wraggster
February 1st, 2010, 22:54
News via hackmii:
Recently I was informed that Datel has released a new version of their Action Replay Cheat Cartridge that allows you to cheat in DS games on a DSi console. Knowing that Nintendo put quite some effort in blocking any third party cartridges from working on the DSi I was curious to figure out how they did it.
Before jumping in this article, I’ll give you a small warning that what is written here might be quite “techy” to some people, I advise reading lots of GBAtek (And maybe a bit of dsibrew) when you get lost.
Research™ has shown that getting a DS cart to boot on a DSi requires quite a bit more effort then it did on a (DS)Lite. Cart timings are very important, you cannot eject the cartridge and insert a new one beyond the DSi menu. But most important of all, the DSi menu does additional integrity checking prior to booting the cartridge.
The integrity checking is there to ensure that the cartridge booted is a genuine licensed game cartridge. There is a whitelist stored in the DSi’s NAND, that has an entry for every DS game released, consisting of multiple SHA1 (How these hashes are constructed exactly hasn’t been confirmed) checksums for the cart header, ARM9 binary and ARM7 binary.
I hear you thinking, what about newly released DS games? How will they ever boot on a DSi without an update to the whitelist? Newer DS games come with a RSA signature in the header and so don’t need to be explicitly whitelisted.
So back to the Action Replay DSi cartridge, something that I immediatly noticed is that when the cartridge is inserted into a DSi the icon and title of the game “Game & Watch Collection” show up. That’s a little weird.. but when selecting the icon you are thrown into a AR DSi menu.
Let’s take a step back, if all game binaries and headers are checked against a whitelist or need to have a valid RSA signature, then how does this Datel cart manage to boot?
Full article --> http://hackmii.com/2010/02/lawsuit-coming-in-3-2-1/#more-916
Recently I was informed that Datel has released a new version of their Action Replay Cheat Cartridge that allows you to cheat in DS games on a DSi console. Knowing that Nintendo put quite some effort in blocking any third party cartridges from working on the DSi I was curious to figure out how they did it.
Before jumping in this article, I’ll give you a small warning that what is written here might be quite “techy” to some people, I advise reading lots of GBAtek (And maybe a bit of dsibrew) when you get lost.
Research™ has shown that getting a DS cart to boot on a DSi requires quite a bit more effort then it did on a (DS)Lite. Cart timings are very important, you cannot eject the cartridge and insert a new one beyond the DSi menu. But most important of all, the DSi menu does additional integrity checking prior to booting the cartridge.
The integrity checking is there to ensure that the cartridge booted is a genuine licensed game cartridge. There is a whitelist stored in the DSi’s NAND, that has an entry for every DS game released, consisting of multiple SHA1 (How these hashes are constructed exactly hasn’t been confirmed) checksums for the cart header, ARM9 binary and ARM7 binary.
I hear you thinking, what about newly released DS games? How will they ever boot on a DSi without an update to the whitelist? Newer DS games come with a RSA signature in the header and so don’t need to be explicitly whitelisted.
So back to the Action Replay DSi cartridge, something that I immediatly noticed is that when the cartridge is inserted into a DSi the icon and title of the game “Game & Watch Collection” show up. That’s a little weird.. but when selecting the icon you are thrown into a AR DSi menu.
Let’s take a step back, if all game binaries and headers are checked against a whitelist or need to have a valid RSA signature, then how does this Datel cart manage to boot?
Full article --> http://hackmii.com/2010/02/lawsuit-coming-in-3-2-1/#more-916