wraggster
August 25th, 2010, 22:51
Today sees a massive day in the world of DS Homebrew, the DSI has now been breached for Homebrew in DSI Mode, heres the details from the excellent Wintermute: (http://davejmurphy.com/dsi-mode-homebrew-anyone/)
It was about this time last year when I released open source save game hacks for two DSi hybrid games, Cooking Coach and Classic Word Games. I kind of expected somebody somewhere to pick these up and make them do something a little bit more useful than change the screen colors but it looks like I was a little optimistic on that front. Most people that have done anything at all seem to have been trying to do as much as possible in the 8KiB or so available in each save game. Interestingly not one single DSi hybrid game I’ve been able to find since appears to have no name entry – bit odd considering how easy it is to test for and correct buffer overflows for this specific situation. If anyone knows any different, please let me know.
Since last year I’ve spent a bit of time hunting around DSi hybrid games and playing around with a few ideas I had about how best to utilise the exploits for homebrew. Mostly I’ve been updating devkitARM & libnds with a few things needed to allow normally compiled homebrew to use the extra 12meg when run in DSi mode. I’m still a little undecided on how best to approach the hybrid model – Nintendo seem to be using a system where extra code is loaded in DSi mode from separate binaries in the .nds container format.
So anyway, lest I ramble on for several pages with background and random thoughts, on to the meat of this post. One of the first things that I did on getting into DSi mode was dump the DS mode firmware. As I expected this was identical to the dump made in DS mode – it contains only the wifi module settings and the user data at the end of a 128K flash chip. Most interesting of all was the large block of unwritten space between the two but unfortunately the first 64KiB is protected but that still leaves 61KiB writable – plenty for my nefarious purposes. After some further testing I confirmed that the wifi module flash chip could be written from DS mode and later read when we use the save game exploits to get into DSi mode. This gave me the motivation I needed to revisit a half finished project I had to upload homebrew to a DS over wifi. As an added bonus the wifi uploader also works with a standard DS, everything you need is in the archive.
Nintendo seem to have pre-empted an approach like this in more recent consoles, both the DSiXL and later model DSi units seem to deny write access to the wifi module chip. Even when using other methods to load code via the save exploits there seems to be no access to the wifi hardware at all – that’s probably dependent on a wifi enabled hybrid game. Whether Nintendo can or will update earlier units with similar security remains to be seen. Currently all early consoles I’ve tried this method with have been able to run code with wifi access regardless of updated firmware or not. I bought a DSiXL a few days ago to confirm this but I have another couple of methods which work on that – they’re not yet in a releasable state but hopefully that won’t be the case for long.
In order to use this method you’ll need three things, a DSi compatible flashcard, one of the two exploited games and a means to write to the eeprom on your chosen game. Eepinator will work if you have a standard DS or there are a couple of devices which allow you to do this from a PC. If you’re one of the many homebrewers who likes to play with mcus then you can probably rig up something with a dev board. I have an arduino and a Fletchtronics Bumble-b sitting at the back of my desk, I might have a play around with those over the next few days and post a howto for those. If you’ve already done something like that then please do get in touch, no point in reinventing the wheel.
One word of warning before we get to the all important download link. Nintendo will probably declare your warranty void due to unauthorised software so proceed at your own risk. This method also won’t allow you to run rom dumps and it’s not something I plan to support at any point in the future. Obviously I can’t control what you do when you have the ability to run code but please consider not releasing anything that’s piracy related or has the potential to enable piracy. I believe homebrew can thrive as long as we distance ourselves from the people who want to get their games for free.
The download is here (http://davejmurphy.com/download/dslink.tar.bz2) for those able to try it.
Lets Hope Nintendo leave this alone long enough.
It was about this time last year when I released open source save game hacks for two DSi hybrid games, Cooking Coach and Classic Word Games. I kind of expected somebody somewhere to pick these up and make them do something a little bit more useful than change the screen colors but it looks like I was a little optimistic on that front. Most people that have done anything at all seem to have been trying to do as much as possible in the 8KiB or so available in each save game. Interestingly not one single DSi hybrid game I’ve been able to find since appears to have no name entry – bit odd considering how easy it is to test for and correct buffer overflows for this specific situation. If anyone knows any different, please let me know.
Since last year I’ve spent a bit of time hunting around DSi hybrid games and playing around with a few ideas I had about how best to utilise the exploits for homebrew. Mostly I’ve been updating devkitARM & libnds with a few things needed to allow normally compiled homebrew to use the extra 12meg when run in DSi mode. I’m still a little undecided on how best to approach the hybrid model – Nintendo seem to be using a system where extra code is loaded in DSi mode from separate binaries in the .nds container format.
So anyway, lest I ramble on for several pages with background and random thoughts, on to the meat of this post. One of the first things that I did on getting into DSi mode was dump the DS mode firmware. As I expected this was identical to the dump made in DS mode – it contains only the wifi module settings and the user data at the end of a 128K flash chip. Most interesting of all was the large block of unwritten space between the two but unfortunately the first 64KiB is protected but that still leaves 61KiB writable – plenty for my nefarious purposes. After some further testing I confirmed that the wifi module flash chip could be written from DS mode and later read when we use the save game exploits to get into DSi mode. This gave me the motivation I needed to revisit a half finished project I had to upload homebrew to a DS over wifi. As an added bonus the wifi uploader also works with a standard DS, everything you need is in the archive.
Nintendo seem to have pre-empted an approach like this in more recent consoles, both the DSiXL and later model DSi units seem to deny write access to the wifi module chip. Even when using other methods to load code via the save exploits there seems to be no access to the wifi hardware at all – that’s probably dependent on a wifi enabled hybrid game. Whether Nintendo can or will update earlier units with similar security remains to be seen. Currently all early consoles I’ve tried this method with have been able to run code with wifi access regardless of updated firmware or not. I bought a DSiXL a few days ago to confirm this but I have another couple of methods which work on that – they’re not yet in a releasable state but hopefully that won’t be the case for long.
In order to use this method you’ll need three things, a DSi compatible flashcard, one of the two exploited games and a means to write to the eeprom on your chosen game. Eepinator will work if you have a standard DS or there are a couple of devices which allow you to do this from a PC. If you’re one of the many homebrewers who likes to play with mcus then you can probably rig up something with a dev board. I have an arduino and a Fletchtronics Bumble-b sitting at the back of my desk, I might have a play around with those over the next few days and post a howto for those. If you’ve already done something like that then please do get in touch, no point in reinventing the wheel.
One word of warning before we get to the all important download link. Nintendo will probably declare your warranty void due to unauthorised software so proceed at your own risk. This method also won’t allow you to run rom dumps and it’s not something I plan to support at any point in the future. Obviously I can’t control what you do when you have the ability to run code but please consider not releasing anything that’s piracy related or has the potential to enable piracy. I believe homebrew can thrive as long as we distance ourselves from the people who want to get their games for free.
The download is here (http://davejmurphy.com/download/dslink.tar.bz2) for those able to try it.
Lets Hope Nintendo leave this alone long enough.