Cartridge - Revision history

Hexkyz: Redirected page to Gamecard

2018-03-24T21:15:51Z

Redirected page to Gamecard

$andeor at 03:14, 6 August 2017

2017-08-06T01:14:49Z

← Older revision		Revision as of 05:14, 6 August 2017
Line 207:		Line 207:

	Crypto mode2 takes into account the CART-RANDOM seed generated by the cartridge, and possibly the previous HOST-RANDOM.		Crypto mode2 takes into account the CART-RANDOM seed generated by the cartridge, and possibly the previous HOST-RANDOM.
	The game cartridge will send a different ~~random seed~~ even if the exact same command sequence ~~has been~~ replayed and thus with this scheme replay attacks are not possible.		The game cartridge will always send a different CART-RANDOM even if the exact same command sequence is replayed and thus with this scheme replay attacks are not possible.

	== Manufacturers ==		== Manufacturers ==

$andeor at 03:13, 6 August 2017

2017-08-06T01:13:49Z

← Older revision		Revision as of 05:13, 6 August 2017
Line 207:		Line 207:

	Crypto mode2 takes into account the CART-RANDOM seed generated by the cartridge, and possibly the previous HOST-RANDOM.		Crypto mode2 takes into account the CART-RANDOM seed generated by the cartridge, and possibly the previous HOST-RANDOM.
	~~With~~ this scheme replay attacks are not possible ~~when crypto mode2 has been entered~~.		The game cartridge will send a different random seed even if the exact same command sequence has been replayed and thus with this scheme replay attacks are not possible.

	== Manufacturers ==		== Manufacturers ==

$andeor at 03:07, 6 August 2017

2017-08-06T01:07:41Z

← Older revision		Revision as of 05:07, 6 August 2017
Line 172:		Line 172:
	\| <code>200838A25A344F818ABB6456694D4E8D</code>		\| <code>200838A25A344F818ABB6456694D4E8D</code>
	\| 0		\| 0
	\| Enter crypto ~~mode~~ with ~~seed~~ "0838A25A344F818ABB6456694D4E8D"		\| Enter crypto mode1 with HOST-RANDOM "0838A25A344F818ABB6456694D4E8D"
	\|-		\|-
	\| <code>7EE41FDF12C01C157CC899910673A0CF</code>		\| <code>7EE41FDF12C01C157CC899910673A0CF</code>
	\| 0x40		\| 0x40
	\| Encrypted command, ~~possibly read UID?~~		\| Encrypted crypto mode1 command, reads CART-RANDOM
	\|-		\|-
	\| <code>263C8230EC15FAE3CE79365BD850F4BD</code>		\| <code>263C8230EC15FAE3CE79365BD850F4BD</code>
	\| 0x0		\| 0x0
	\| Encrypted command		\| Encrypted mode1 command, enters crypto mode2 with (HOST-RANDOM, CART-RANDOM)
	\|-		\|-
	\| <code>B6FDA6F37FFA29E18831D0B217DFBDBE</code>		\| <code>B6FDA6F37FFA29E18831D0B217DFBDBE</code>
	\| 0x4		\| 0x4
	\| Encrypted command, possibly read card id?		\| Encrypted mode2 command, possibly read card id?
	\|-		\|-
	\| <code>7B97F7DF07240AA9870E1C974336FA8A</code>		\| <code>7B97F7DF07240AA9870E1C974336FA8A</code>
	\| 0x4		\| 0x4
	\| Encrypted command		\| Encrypted mode2 command
	\|-		\|-
	\|}		\|}
Line 201:		Line 201:
	== Encryption ==		== Encryption ==
	After a few initial plaintext commands, the Switch instructs the game cartridge to enter into encrypted mode. From that point on, commands and responses are sent encrypted over the bus. The encryption algorithm used is currently unknown.		After a few initial plaintext commands, the Switch instructs the game cartridge to enter into encrypted mode. From that point on, commands and responses are sent encrypted over the bus. The encryption algorithm used is currently unknown.

			There appear to be 2 kinds of crypto mode.

			Crypto mode1 is initiated solely by the HOST-RANDOM as random session seed. In that mode, the Switch host requests for the game cartridge random seed, and then sends a command to enter crypto mode2.

			Crypto mode2 takes into account the CART-RANDOM seed generated by the cartridge, and possibly the previous HOST-RANDOM.
			With this scheme replay attacks are not possible when crypto mode2 has been entered.

	== Manufacturers ==		== Manufacturers ==

$andeor at 23:12, 5 August 2017

2017-08-05T21:12:46Z

← Older revision		Revision as of 01:12, 6 August 2017
Line 196:		Line 196:

	== Observations ==		== Observations ==
	* The ~~entire game cartridge contents can be dumped using the plaintext 5B commands (including~~ "update" and "normal" partitions~~) except for~~ the "secure" partition ~~which~~ can only be read from encrypted mode.		* The "update" and "normal" partitions can be dumped using the plaintext 5B commands
			* The "secure" partition can only be read from encrypted mode.

	== Encryption ==		== Encryption ==

$andeor at 23:04, 5 August 2017

2017-08-05T21:04:40Z

← Older revision		Revision as of 01:04, 6 August 2017
Line 196:		Line 196:

	== Observations ==		== Observations ==
	* The entire game cartridge can be dumped using the plaintext 5B commands (including "update" and "normal" partitions) except for the "secure" partition which can only be read from encrypted mode.		* The entire game cartridge contents can be dumped using the plaintext 5B commands (including "update" and "normal" partitions) except for the "secure" partition which can only be read from encrypted mode.

	== Encryption ==		== Encryption ==

$andeor at 23:03, 5 August 2017

2017-08-05T21:03:30Z

← Older revision		Revision as of 01:03, 6 August 2017
Line 194:		Line 194:

	The meaning of some these commands are currently unknown.		The meaning of some these commands are currently unknown.

			== Observations ==
			* The entire game cartridge can be dumped using the plaintext 5B commands (including "update" and "normal" partitions) except for the "secure" partition which can only be read from encrypted mode.

	== Encryption ==		== Encryption ==

$andeor at 23:47, 3 August 2017

2017-08-03T21:47:04Z

← Older revision		Revision as of 01:47, 4 August 2017
Line 115:		Line 115:


	Commands are 16 bytes long, and followed immediately by a 4-byte CRC-32 over the command bytes. After this, the Switch stops driving the data bus, and the bus will be 'floating'. Due to the pull-ups on the bus, it will slowly converge to logic HIGH state. The Switch will clock 2 cycles to allow the bus to settle a direction change. The Switch host will then clock ~~2 more cycles~~ and if the game cartridge didn't receive the CRC OK, it will respond with "00 01". Otherwise it will respond with "00 00" and pull DAT0 low on the next cycle to signal it is busy. The Switch host will keep clocking until the cartridge is ready.		Commands are 16 bytes long, and followed immediately by a 4-byte CRC-32 over the command bytes. After this, the Switch stops driving the data bus, and the bus will be 'floating'. Due to the pull-ups on the bus, it will slowly converge to logic HIGH state. The Switch will clock 2 cycles to allow the bus to settle a direction change. The Switch host will then clock another cycle and if the game cartridge didn't receive the CRC OK, it will respond with "01". Otherwise it will respond with "00" and pull DAT0 low on the next cycle to signal it is busy. The Switch host will then keep clocking until the cartridge is ready.

	When the game cartridge is ready to send the actual data response, it will pull the DAT0 pin high for 2 cycles to let the Switch host know. After this, the game cartridge will send the actual response bytes.		When the game cartridge is ready to send the actual data response, it will pull the DAT0 pin high for 2 cycles to let the Switch host know. After this, the game cartridge will send the actual data response bytes.

	The actual response bytes are also followed immediately by a 4-byte CRC-32 over the actual response bytes.		The actual response bytes are also followed immediately by a 4-byte CRC-32 over the actual data response bytes.

	== Commands ==		== Commands ==

$andeor at 23:33, 3 August 2017

2017-08-03T21:33:41Z

← Older revision		Revision as of 01:33, 4 August 2017
Line 115:		Line 115:


	Commands are 16 bytes long, and followed immediately by a 4-byte CRC-32 over the command bytes. After this, the Switch stops driving the data bus, and the bus will be 'floating'. Due to the pull-ups on the bus, it will slowly converge to logic HIGH state. The Switch will clock 2 cycles to allow the bus to settle a direction change. The Switch host will then clock 2 more cycles and if the game cartridge didn't receive the CRC OK, it will respond with "00 01". Otherwise it will respond with "00 00". ~~After this the~~ Switch will keep clocking ~~and~~ the cartridge ~~will respond with a busy signal by pulling DAT0 low~~.		Commands are 16 bytes long, and followed immediately by a 4-byte CRC-32 over the command bytes. After this, the Switch stops driving the data bus, and the bus will be 'floating'. Due to the pull-ups on the bus, it will slowly converge to logic HIGH state. The Switch will clock 2 cycles to allow the bus to settle a direction change. The Switch host will then clock 2 more cycles and if the game cartridge didn't receive the CRC OK, it will respond with "00 01". Otherwise it will respond with "00 00" and pull DAT0 low on the next cycle to signal it is busy. The Switch host will keep clocking until the cartridge is ready.

	When the game cartridge is ready to send the actual data response, it will pull the DAT0 pin high for 2 cycles to let the Switch host know. After this, the game cartridge will send the actual response bytes.		When the game cartridge is ready to send the actual data response, it will pull the DAT0 pin high for 2 cycles to let the Switch host know. After this, the game cartridge will send the actual response bytes.

$andeor at 23:30, 3 August 2017

2017-08-03T21:30:40Z

← Older revision		Revision as of 01:30, 4 August 2017
Line 115:		Line 115:


	Commands are 16 bytes long, and followed immediately by a 4-byte CRC-32 over the command bytes. After this, the bus ~~direction changes~~, and the bus will be 'floating' ~~for~~ a ~~few~~ cycles ('~~'TBD figure out if~~ cartridge ~~can~~ respond with ~~NAK over bad CRC during floating bus'')~~.		Commands are 16 bytes long, and followed immediately by a 4-byte CRC-32 over the command bytes. After this, the Switch stops driving the data bus, and the bus will be 'floating'. Due to the pull-ups on the bus, it will slowly converge to logic HIGH state. The Switch will clock 2 cycles to allow the bus to settle a direction change. The Switch host will then clock 2 more cycles and if the game cartridge didn't receive the CRC OK, it will respond with "00 01". Otherwise it will respond with "00 00". After this the Switch will keep clocking and the cartridge will respond with a busy signal by pulling DAT0 low.

	~~Before~~ the game cartridge ~~responds with the actual response data, it will send busy bytes (LSB will be zero) to the Switch host, until it~~ is ready to send the ~~real~~ response~~. When the game cartridge is ready~~, it will ~~send~~ 2 ~~acknowledgement bytes (LSB will be one)~~ to let the Switch host know. After this, the game cartridge will send the actual response bytes.		When the game cartridge is ready to send the actual data response, it will pull the DAT0 pin high for 2 cycles to let the Switch host know. After this, the game cartridge will send the actual response bytes.

	The actual response bytes are also followed immediately by a 4-byte CRC-32 over the actual response bytes.		The actual response bytes are also followed immediately by a 4-byte CRC-32 over the actual response bytes.