Nintendo Switch Brew

Changes

Lotus3 (view source)

Revision as of 21:01, 10 December 2024

2,451 bytes added ,  21:01, 10 December 2024
From SendCardSelfRefresh and SendCardReadRefreshStatus
Line 12: Line 12:  
|-
 
|-
 
| 60
 
| 60
−
| [[#WriteOperation]]
+
| [[#WriteOperation|WriteOperation]]
 
|-
 
|-
 
| 61
 
| 61
−
| [[#FinishOperation]]
+
| [[#FinishOperation|FinishOperation]]
 
|-
 
|-
 
| 62
 
| 62
−
| [[#Sleep]]
+
| [[#Sleep|Sleep]]
 
|-
 
|-
 
| 63
 
| 63
−
| [[#UpdateKey]]
+
| [[#UpdateKey|UpdateKey]]
 
|}
 
|}
   Line 57: Line 57:     
== OperationId ==
 
== OperationId ==
−
The Gamecard ASIC supports a total of 20 operation commands. These commands are passed to the ASIC using the [[#WriteOperation]] MMC command.
+
The Gamecard ASIC supports a total of 20 operation commands. These commands are passed to the ASIC using the [[#WriteOperation|WriteOperation]] MMC command.
    
Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
 
Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Line 67: Line 67:  
|-
 
|-
 
| 0x01
 
| 0x01
−
| [[#SendFirmware]]
+
| [[#SendFirmware|SendFirmware]]
 
|-
 
|-
 
| 0x02
 
| 0x02
−
| [[#ReceiveCertificate]]
+
| [[#ReceiveCertificate|ReceiveCertificate]]
 
|-
 
|-
 
| 0x03
 
| 0x03
−
| [[#SendSocCertificate]]
+
| [[#SendSocCertificate|SendSocCertificate]]
 
|-
 
|-
 
| 0x04
 
| 0x04
−
| [[#ReceiveRandomValue]]
+
| [[#ReceiveRandomValue|ReceiveRandomValue]]
 
|-
 
|-
 
| 0x05
 
| 0x05
−
| [[#SendRandomValue]]
+
| [[#SendRandomValue|SendRandomValue]]
 
|-
 
|-
 
| 0x06
 
| 0x06
−
| [[#ReceiveDeviceChallenge]]
+
| [[#ReceiveDeviceChallenge|ReceiveDeviceChallenge]]
 
|-
 
|-
 
| 0x07
 
| 0x07
−
| [[#RespondDeviceChallenge]]
+
| [[#RespondDeviceChallenge|RespondDeviceChallenge]]
 
|-
 
|-
 
| 0x08
 
| 0x08
−
| [[#SendHostChallenge]]
+
| [[#SendHostChallenge|SendHostChallenge]]
 
|-
 
|-
 
| 0x09
 
| 0x09
−
| [[#ReceiveChallengeResponse]]
+
| [[#ReceiveChallengeResponse|ReceiveChallengeResponse]]
 
|-
 
|-
 
| 0x0A
 
| 0x0A
−
| [[#ChangeModeToSecure]]
+
| [[#ChangeModeToSecure|ChangeModeToSecure]]
 
|-
 
|-
 
| 0x0B
 
| 0x0B
−
| [[#WriteRegister]]
+
| [[#WriteRegister|WriteRegister]]
 
|-
 
|-
 
| 0x0C
 
| 0x0C
−
| [[#ReadRegister]]
+
| [[#ReadRegister|ReadRegister]]
 
|-
 
|-
 
| 0x0D
 
| 0x0D
−
| [[#ChangeGcModeToDebug]]
+
| [[#ChangeGcModeToDebug|ChangeGcModeToDebug]]
 
|-
 
|-
 
| 0x0E
 
| 0x0E
−
| [[#GetCardHeader]]
+
| [[#GetCardHeader|GetCardHeader]]
 
|-
 
|-
 
| 0x0F
 
| 0x0F
−
| [[#ChangeGcModeToSecure]]
+
| [[#ChangeGcModeToSecure|ChangeGcModeToSecure]]
 
|-
 
|-
 
| 0x10
 
| 0x10
−
| [[#SendCardCommand]]
+
| [[#SendCardCommand|SendCardCommand]]
 
|-
 
|-
 
| 0x11
 
| 0x11
−
| [[#EnableCardBus]]
+
| [[#EnableCardBus|EnableCardBus]]
 
|-
 
|-
 
| 0x12
 
| 0x12
−
| [[#ExchangeRandomValuesInSecureMode]]
+
| [[#ExchangeRandomValuesInSecureMode|ExchangeRandomValuesInSecureMode]]
 
|-
 
|-
 
| 0x13
 
| 0x13
−
| [[#ReadRmaInformation]]
+
| [[#ReadRmaInformation|ReadRmaInformation]]
 
|-
 
|-
 
| 0x14
 
| 0x14
−
| [9.0.0+] [[#ChallengeCardExistence]]
+
| [9.0.0+] [[#ChallengeCardExistence|ChallengeCardExistence]]
 
|}
 
|}
   Line 386: Line 386:  
| 0x10
 
| 0x10
 
| 0x40
 
| 0x40
−
| CardUid
+
| [[#CardUid|CardUid]]
 
|-
 
|-
 
| 0x50
 
| 0x50
Line 430: Line 430:  
| 0x10
 
| 0x10
 
| 0x40
 
| 0x40
−
| CardUid
+
| [[#CardUid|CardUid]]
 
|-
 
|-
 
| 0x50
 
| 0x50
Line 444: Line 444:  
| [[XCI#InitialData|InitialData]]
 
| [[XCI#InitialData|InitialData]]
 
|}
 
|}
 +
 +
= CardUid =
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x1
 +
| [[#MakerId|MakerId]]
 +
|-
 +
| 0x1
 +
| 0x1
 +
|
 +
|-
 +
| 0x2
 +
| 0x1
 +
|
 +
|-
 +
| 0x3
 +
| 0xD
 +
| [[#UniqueData|UniqueData]]
 +
|-
 +
| 0x10
 +
| 0x1
 +
| Reserved (always 0)
 +
|-
 +
| 0x11
 +
| 0xB
 +
| Reserved (always all 0xFF)
 +
|-
 +
| 0x1C
 +
| 0x4
 +
| [[#CardId1Mirror|CardId1Mirror]]
 +
|-
 +
| 0x20
 +
| 0x20
 +
| Hash
 +
|}
 +
 +
== MakerId ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0
 +
| MegaChips (Macronix)
 +
|-
 +
| 1
 +
| Lapis
 +
|-
 +
| 2
 +
|
 +
|}
 +
 +
== UniqueData ==
 +
While presumed to be random, this field actually has some degree of determinism depending on the [[#MakerId|MakerId]].
 +
 +
MakerId 0:
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x1
 +
| Type (4 = [[Filesystem_services#MemoryType|T1RomLate]], 8 = [[Filesystem_services#MemoryType|T1RomFast]])
 +
|-
 +
| 0x1
 +
| 0x1
 +
| Line (0x21 for [[Filesystem_services#MemoryType|T1RomLate]], incrementing value for [[Filesystem_services#MemoryType|T1RomFast]])
 +
|-
 +
| 0x2
 +
| 0x3
 +
| Id
 +
|-
 +
| 0x5
 +
| 0x2
 +
| X (16-bit coordinate?)
 +
|-
 +
| 0x7
 +
| 0x2
 +
| Y (16-bit coordinate?)
 +
|-
 +
| 0x9
 +
| 0x4
 +
| Random
 +
|}
 +
 +
MakerId 1:
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x2
 +
| Line (incrementing value)
 +
|-
 +
| 0x2
 +
| 0x3
 +
| Id
 +
|-
 +
| 0x5
 +
| 0x1
 +
|
 +
|-
 +
| 0x6
 +
| 0x1
 +
| Version (0 or 1)
 +
|-
 +
| 0x7
 +
| 0x2
 +
|
 +
|-
 +
| 0x9
 +
| 0x4
 +
| Random
 +
|}
 +
 +
MakerId 2:
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x4
 +
| Random
 +
|-
 +
| 0x4
 +
| 0x1
 +
|
 +
|-
 +
| 0x5
 +
| 0x1
 +
|
 +
|-
 +
| 0x6
 +
| 0x4
 +
| Id (ASCII string)
 +
|-
 +
| 0xA
 +
| 0x1
 +
|
 +
|-
 +
| 0xB
 +
| 0x1
 +
|
 +
|-
 +
| 0xC
 +
| 0x1
 +
|
 +
|}
 +
 +
== CardId1Mirror ==
 +
This field mirrors bit 5 of the [[Filesystem_services#MemoryType|MemoryType]] field from the [[Filesystem_services#CardId1|CardId1]].
    
= CardCommand =
 
= CardCommand =
Line 462: Line 624:     
== CommandId ==
 
== CommandId ==
−
These commands are issued by the Gamecard ASIC to the actual Gamecard using the [[#AsicOperation|OperationData]] passed to [[#SendCardCommand]].
+
These commands are issued by the Gamecard ASIC to the actual Gamecard using the [[#AsicOperation|OperationData]] passed to [[#SendCardCommand|SendCardCommand]].
    
Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
 
Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Line 472: Line 634:  
|-
 
|-
 
| 0x6
 
| 0x6
−
|  
+
| SelfRefresh
 
|-
 
|-
 
| 0xF
 
| 0xF
−
|  
+
| T1ReadUid
 
|-
 
|-
 
| 0x10
 
| 0x10
−
| ReadId1Write
+
| DebugReadId1
 
|-
 
|-
 
| 0x11
 
| 0x11
−
| ReadId2Write
+
| DebugReadId2
 
|-
 
|-
 
| 0x12
 
| 0x12
−
| ReadId3Write
+
| DebugReadId3
 
|-
 
|-
 
| 0x13
 
| 0x13
−
|  
+
| DebugReadUid
 
|-
 
|-
 
| 0x15
 
| 0x15
−
| ReadCrc
+
| DebugReadCrc
 
|-
 
|-
 
| 0x16
 
| 0x16
−
| WritePage
+
| DebugWritePage
 
|-
 
|-
 
| 0x17
 
| 0x17
Line 499: Line 661:  
|-
 
|-
 
| 0x18
 
| 0x18
−
| Erase
+
| DebugErase
 
|-
 
|-
 
| 0x19
 
| 0x19
−
| ReadParameter
+
| DebugReadParameter
 
|-
 
|-
 
| 0x20
 
| 0x20
−
| WriteParameter
+
| DebugWriteParameter
 
|-
 
|-
 
| 0x21
 
| 0x21
−
| ReadPageSecure
+
| T1ReadPage
 +
|-
 +
| 0x22
 +
|
 
|-
 
|-
 
| 0x28
 
| 0x28
Line 514: Line 679:  
|-
 
|-
 
| 0x2E
 
| 0x2E
−
| ChangeDebugDirect
+
| ForceErase
 
|-
 
|-
 
| 0x30
 
| 0x30
−
| ReadId3Secure
+
| T1ReadId3
 
|-
 
|-
 
| 0x39
 
| 0x39
−
| SetKey
+
| T1SetKey
 
|-
 
|-
 
| 0x56
 
| 0x56
Line 527: Line 692:  
| 0x59
 
| 0x59
 
|  
 
|  
−
|-
  −
| 0x67
  −
| ReadId1Secure
   
|-
 
|-
 
| 0x5B
 
| 0x5B
 
| ReadPage
 
| ReadPage
 +
|-
 +
| 0x67
 +
| T1ReadId1
 
|-
 
|-
 
| 0x83
 
| 0x83
−
| WritePageSecure
+
| T1WritePage
 
|-
 
|-
 
| 0x8A
 
| 0x8A
Line 544: Line 709:  
|-
 
|-
 
| 0xB8
 
| 0xB8
−
| Refresh
+
| T1Refresh
 
|-
 
|-
 
| 0xC4
 
| 0xC4
−
| ReadId2Secure
+
| T1ReadId2
 
|-
 
|-
 
| 0xE0
 
| 0xE0
Line 556: Line 721:  
|-
 
|-
 
| 0xE3
 
| 0xE3
−
|  
+
| T2ReceiveCertificate
 
|-
 
|-
 
| 0xE4
 
| 0xE4
−
|  
+
| T2SendSocCertificate
 
|-
 
|-
 
| 0xE5
 
| 0xE5
Line 565: Line 730:  
|-
 
|-
 
| 0xE6
 
| 0xE6
−
|  
+
| T2ReceiveRandomValue
 
|-
 
|-
 
| 0xE7
 
| 0xE7
−
|  
+
| T2SendRandomValue
 
|-
 
|-
 
| 0xE8
 
| 0xE8
−
|  
+
| T2ReceiveDeviceChallenge
 
|-
 
|-
 
| 0xE9
 
| 0xE9
−
|  
+
| T2RespondDeviceChallenge
 
|-
 
|-
 
| 0xEA
 
| 0xEA
−
|  
+
| T2SendHostChallenge
 
|-
 
|-
 
| 0xEB
 
| 0xEB
−
|  
+
| T2ReceiveChallengeResponse
 
|-
 
|-
 
| 0xEC
 
| 0xEC
Line 598: Line 763:  
|-
 
|-
 
| 0xFA
 
| 0xFA
−
|  
+
| ReadRefreshStatus
 
|}
 
|}
    
= AsicFirmware =
 
= AsicFirmware =
−
This is the Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) uploaded through the [[#SendFirmware]] operation.
+
This is the Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) uploaded through the [[#SendFirmware|SendFirmware]] operation.
    
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
Retrieved from "https://switchbrew.org/wiki/Special:MobileDiff/13074...13081"