I traced down a routine that does flash chip ID, and does an unlock routine depending on that ID (0x60 to NOR chip). So far my assembly of the function is returning bad data (I haven't figured out exactly what data is sent to the function yet). There is definitely an unlock in there, but why it is not needed on the deluxe (even with the same chip as the others) probably comes down to inital programming at the factory.
Perhaps in the latest version (the Lite Deluxe) they wanted to leave a door open for home upgrades, and so they changed the project a bit.
Quote:
Thanks for testing it on your Deluxe PsychoWood, I'm glad to know that I'm not potentially crazy/the only one it works for
Post subject: EZV OS NOR can be written, PASS patcher and source
Posted: Wed Jan 24, 2007 3:03 pm
Joined: Sat Oct 21, 2006 3:54 pm Posts: 333
why would they do that only on the deluxe? the compact was released at the same time... then again, if the ez4 compact could save a file to it, then it might be able to be dumped.
and @cory, the theory we had about the ez4 compact not being able to write files to sd might not be true because i am able to save goomba color without it being through sram. maybe it can't write that file size of 256kb?
Post subject: Re: EZV OS NOR can be written, PASS patcher and source
Posted: Wed Jan 24, 2007 3:18 pm
Joined: Fri Jan 12, 2007 4:51 pm Posts: 39
yoniwei wrote:
why would they do that only on the deluxe? the compact was released at the same time... then again, if the ez4 compact could save a file to it, then it might be able to be dumped.
I don't know, I was just guessing But the compact has a different ("simplified") design than the Deluxe, or maybe the chip is simply different.. did you have a chance to verify that the used chip is the same?
Post subject: Re: EZV OS NOR can be written, PASS patcher and source
Posted: Wed Jan 24, 2007 7:31 pm
Joined: Fri Jan 12, 2007 4:51 pm Posts: 39
yoniwei wrote:
i would open mine up to check.. but i have no idea what im looking for
You just have to look at the codes written on the chips.
For esample, this is my EZ4 miniSD, and the rightest chip is the one with the code given by cory1492 (M6MGT321S8TP).
Just remember, before opening it up, that it will probably void your warranty. Oh well, you probably knew it already, but better saying once more than not saying.
Joined: Sun Apr 30, 2006 5:39 am Posts: 1560 Location: Canada, eh?
Give this a run on the compact/mini if you will and let me know how it responds. If everything goes right it should give status as 80 three times, and that is it. It wont try to write or erase, it's just trying to determine if the MCU is responding to the commands I am sending it. You know it got to the end of the program when it displays "regF" part way down the page.
ez4test1.zip
In all honesty, to me this is a proof of concept that they could update the bootstrap if they wanted to (which if you recall I previously doubted was even possible), not limited to just the "PASS" header (and with their safer, more usable code for detecting and altering the compact).
yoniwei: The compact is very different from the deluxe. It contains RAM in some form (for ds homebrew and small GBA loading), but the thing is that the RAM it has is not accessible using the code that works for the deluxe and miniSD versions. Something was definitely changed for the compact.
Post subject: Re: EZV OS NOR can be written, PASS patcher and source
Posted: Thu Jan 25, 2007 10:36 am
Joined: Sun Apr 30, 2006 5:39 am Posts: 1560 Location: Canada, eh?
Thanks guys.
ratx: I have been working from disasm of the NDS updater in the bootstrap. There is basically a NDS/GBA detect & key detect routine (which either jumps to the updaters or the appropriate kernels), what looks like a gba multiboot (the gba updater), and a full NDS application (the NDS updater) all in the first 0x40000 of the OS NOR. One PITA is that No$ doesn't have a way to force it to stay in GBA mode to try and get an accurate disasm of the GBA updater.
yoniwei: thanks for the confirmation on the compact.
Basically what this amounts to is: 2e is the first byte of the bootstrap. So they are all basically reading the bootstrap except the deluxe, which is giving an interface to the NOR flash chip. If test2 doesnt provide different results, I'm at a loss as to what to do to make it work with the devices I don't have. The code is identical, NOR is in the correct place on all of them, but I must be missing something since they are not responding to the chip commands
About the only thing new I have discovered in what amounts to about 6 hours of wasted time is that the last block (0x10000 bytes) of the OS NOR needs 5 erase commands to be completely formatted instead of the normal 1.
ez4test2.zip If this doesn't turn up anything new on the non-deluxe versions, maybe windirt can shed some light on it (not holding my breath on that though).
Users browsing this forum: No registered users and 2 guests
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot post attachments in this forum