From ab04f98396c829c128b19b107041e1d986f08bf4 Mon Sep 17 00:00:00 2001 From: RocketRobz Date: Tue, 26 Mar 2024 18:32:09 -0600 Subject: [PATCH 1/3] Only detect GBA cart ejection when running from Slot-1 --- arm9/source/main.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arm9/source/main.cpp b/arm9/source/main.cpp index 14dbe77..527ff7b 100644 --- a/arm9/source/main.cpp +++ b/arm9/source/main.cpp @@ -60,7 +60,7 @@ void vblankHandler (void) { } // Check if GBA cart ejected - if(isRegularDS && *(u8*)(0x080000B2) != 0x96 && romTitle[1][0] != '\0') { + if(isRegularDS && (io_dldi_data->ioInterface.features & FEATURE_SLOT_NDS) && *(u8*)(0x080000B2) != 0x96 && romTitle[1][0] != '\0') { romTitle[1][0] = '\0'; romSize[1] = 0; } From e5d85dd5cdb84e8a62dfd7ddfbf12028af77700e Mon Sep 17 00:00:00 2001 From: RocketRobz Date: Thu, 25 Apr 2024 12:44:03 -0600 Subject: [PATCH 2/3] Read ConsoleID register, if available --- arm7/source/main.c | 47 +++++++++++++++++++++++++------------------- arm9/source/nandio.c | 9 +++++++++ 2 files changed, 36 insertions(+), 20 deletions(-) diff --git a/arm7/source/main.c b/arm7/source/main.c index 43fb069..c17215e 100644 --- a/arm7/source/main.c +++ b/arm7/source/main.c @@ -145,31 +145,38 @@ int main() { } if (isDSiMode() || ((REG_SCFG_EXT & BIT(17)) && (REG_SCFG_EXT & BIT(18)))) { - /*for (int i = 0; i < 8; i++) { - *(u8*)(0x2FFFD00+i) = *(u8*)(0x4004D07-i); // Get ConsoleID - }*/ // For getting ConsoleID without reading from 0x4004D00... - u8 base[16]={0}; - u8 in[16]={0}; - u8 iv[16]={0}; - u8 *scratch=(u8*)0x02F00200; u8 *out=(u8*)0x02F00000; - u8 *key3=(u8*)0x40044D0; - - aes(in, base, iv, 2); + memset(out, 0, 16); - //write consecutive 0-255 values to any byte in key3 until we get the same aes output as "base" above - this reveals the hidden byte. this way we can uncover all 16 bytes of the key3 normalkey pretty easily. - //greets to Martin Korth for this trick https://problemkaputt.de/gbatek.htm#dsiaesioports (Reading Write-Only Values) - for(int i=0;i<16;i++){ - for(int j=0;j<256;j++){ - *(key3+i)=j & 0xFF; - aes(in, scratch, iv, 2); - if(!memcmp(scratch, base, 16)){ - out[i]=j; - //hit++; - break; + // first check whether we can read the console ID directly and it was not hidden by SCFG + if (((*(vu16*)0x04004000) & (1u << 10)) == 0 && ((*(vu8*)0x04004D08) & 0x1) == 0) + { + // The console id registers are readable, so use them! + memcpy(out, (u8*)0x04004D00, 8); + } + if(out[0] == 0 || out[1] == 0) { + u8 base[16]={0}; + u8 in[16]={0}; + u8 iv[16]={0}; + u8 *scratch=(u8*)0x02F00200; + u8 *key3=(u8*)0x40044D0; + + aes(in, base, iv, 2); + + //write consecutive 0-255 values to any byte in key3 until we get the same aes output as "base" above - this reveals the hidden byte. this way we can uncover all 16 bytes of the key3 normalkey pretty easily. + //greets to Martin Korth for this trick https://problemkaputt.de/gbatek.htm#dsiaesioports (Reading Write-Only Values) + for(int i=0;i<16;i++){ + for(int j=0;j<256;j++){ + *(key3+i)=j & 0xFF; + aes(in, scratch, iv, 2); + if(!memcmp(scratch, base, 16)){ + out[i]=j; + //hit++; + break; + } } } } diff --git a/arm9/source/nandio.c b/arm9/source/nandio.c index 3e952a8..43f5a0f 100644 --- a/arm9/source/nandio.c +++ b/arm9/source/nandio.c @@ -31,8 +31,17 @@ void getConsoleID(u8 *consoleID){ u8 key_x[16];////key3_x - contains a DSi console id (which just happens to be the LFCS on 3ds) u8 key_y[16] = {0x76, 0xDC, 0xB9, 0x0A, 0xD3, 0xC4, 0x4D, 0xBD, 0x1D, 0xDD, 0x2D, 0x20, 0x05, 0x00, 0xA0, 0xE1}; //key3_y NAND constant + u8 empty_buff[8] = {0}; + tonccpy(key, fifo, 16); //receive the goods from arm7 + if(memcmp(key + 8, empty_buff, 8) == 0) + { + //we got the consoleid directly or nothing at all, don't treat this as key3 output + tonccpy(consoleID, key, 8); + return; + } + F_XY_reverse((uint32_t*)key, (uint32_t*)key_xy); //work backwards from the normalkey to get key_x that has the consoleID for(int i=0;i<16;i++){ From 0ba733cdb78978b4a6205ee07010cb244988d5c3 Mon Sep 17 00:00:00 2001 From: RocketRobz Date: Fri, 26 Apr 2024 17:10:49 -0600 Subject: [PATCH 3/3] Update main.c --- arm7/source/main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arm7/source/main.c b/arm7/source/main.c index c17215e..8cd6547 100644 --- a/arm7/source/main.c +++ b/arm7/source/main.c @@ -145,9 +145,6 @@ int main() { } if (isDSiMode() || ((REG_SCFG_EXT & BIT(17)) && (REG_SCFG_EXT & BIT(18)))) { - - // For getting ConsoleID without reading from 0x4004D00... - u8 *out=(u8*)0x02F00000; memset(out, 0, 16); @@ -158,6 +155,7 @@ int main() { memcpy(out, (u8*)0x04004D00, 8); } if(out[0] == 0 || out[1] == 0) { + // For getting ConsoleID without reading from 0x4004D00... u8 base[16]={0}; u8 in[16]={0}; u8 iv[16]={0};