Nintendo Switch Brew

Lotus3: Difference between revisions

← Older edit
No edit summary
From SendCardSelfRefresh and SendCardReadRefreshStatus
 
(4 intermediate revisions by the same user not shown)
Line 12: Line 12:
|-
|-
| 60
| 60
| [[#WriteOperation]]
| [[#WriteOperation|WriteOperation]]
|-
|-
| 61
| 61
| [[#FinishOperation]]
| [[#FinishOperation|FinishOperation]]
|-
|-
| 62
| 62
| [[#Sleep]]
| [[#Sleep|Sleep]]
|-
|-
| 63
| 63
| [[#UpdateKey]]
| [[#UpdateKey|UpdateKey]]
|}
|}


Line 57: Line 57:


== OperationId ==
== OperationId ==
The Gamecard ASIC supports a total of 20 operation commands. These commands are passed to the ASIC using the [[#WriteOperation]] MMC command.
The Gamecard ASIC supports a total of 20 operation commands. These commands are passed to the ASIC using the [[#WriteOperation|WriteOperation]] MMC command.


Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Line 67: Line 67:
|-
|-
| 0x01
| 0x01
| [[#SendFirmware]]
| [[#SendFirmware|SendFirmware]]
|-
|-
| 0x02
| 0x02
| [[#ReceiveCertificate]]
| [[#ReceiveCertificate|ReceiveCertificate]]
|-
|-
| 0x03
| 0x03
| [[#SendSocCertificate]]
| [[#SendSocCertificate|SendSocCertificate]]
|-
|-
| 0x04
| 0x04
| [[#ReceiveRandomValue]]
| [[#ReceiveRandomValue|ReceiveRandomValue]]
|-
|-
| 0x05
| 0x05
| [[#SendRandomValue]]
| [[#SendRandomValue|SendRandomValue]]
|-
|-
| 0x06
| 0x06
| [[#ReceiveDeviceChallenge]]
| [[#ReceiveDeviceChallenge|ReceiveDeviceChallenge]]
|-
|-
| 0x07
| 0x07
| [[#RespondDeviceChallenge]]
| [[#RespondDeviceChallenge|RespondDeviceChallenge]]
|-
|-
| 0x08
| 0x08
| [[#SendHostChallenge]]
| [[#SendHostChallenge|SendHostChallenge]]
|-
|-
| 0x09
| 0x09
| [[#ReceiveChallengeResponse]]
| [[#ReceiveChallengeResponse|ReceiveChallengeResponse]]
|-
|-
| 0x0A
| 0x0A
| [[#ChangeModeToSecure]]
| [[#ChangeModeToSecure|ChangeModeToSecure]]
|-
|-
| 0x0B
| 0x0B
| [[#WriteRegister]]
| [[#WriteRegister|WriteRegister]]
|-
|-
| 0x0C
| 0x0C
| [[#ReadRegister]]
| [[#ReadRegister|ReadRegister]]
|-
|-
| 0x0D
| 0x0D
| [[#ChangeGcModeToDebug]]
| [[#ChangeGcModeToDebug|ChangeGcModeToDebug]]
|-
|-
| 0x0E
| 0x0E
| [[#GetCardHeader]]
| [[#GetCardHeader|GetCardHeader]]
|-
|-
| 0x0F
| 0x0F
| [[#ChangeGcModeToSecure]]
| [[#ChangeGcModeToSecure|ChangeGcModeToSecure]]
|-
|-
| 0x10
| 0x10
| [[#SendCardCommand]]
| [[#SendCardCommand|SendCardCommand]]
|-
|-
| 0x11
| 0x11
| [[#EnableCardBus]]
| [[#EnableCardBus|EnableCardBus]]
|-
|-
| 0x12
| 0x12
| [[#ExchangeRandomValuesInSecureMode]]
| [[#ExchangeRandomValuesInSecureMode|ExchangeRandomValuesInSecureMode]]
|-
|-
| 0x13
| 0x13
| [[#ReadRmaInformation]]
| [[#ReadRmaInformation|ReadRmaInformation]]
|-
|-
| 0x14
| 0x14
| [9.0.0+] [[#ChallengeCardExistence]]
| [9.0.0+] [[#ChallengeCardExistence|ChallengeCardExistence]]
|}
|}


Line 386: Line 386:
| 0x10
| 0x10
| 0x40
| 0x40
| CardUid
| [[#CardUid|CardUid]]
|-
|-
| 0x50
| 0x50
Line 430: Line 430:
| 0x10
| 0x10
| 0x40
| 0x40
| CardUid
| [[#CardUid|CardUid]]
|-
|-
| 0x50
| 0x50
Line 444: Line 444:
| [[XCI#InitialData|InitialData]]
| [[XCI#InitialData|InitialData]]
|}
|}
= CardUid =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[#MakerId|MakerId]]
|-
| 0x1
| 0x1
|
|-
| 0x2
| 0x1
|
|-
| 0x3
| 0xD
| [[#UniqueData|UniqueData]]
|-
| 0x10
| 0x1
| Reserved (always 0)
|-
| 0x11
| 0xB
| Reserved (always all 0xFF)
|-
| 0x1C
| 0x4
| [[#CardId1Mirror|CardId1Mirror]]
|-
| 0x20
| 0x20
| Hash
|}
== MakerId ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| MegaChips (Macronix)
|-
| 1
| Lapis
|-
| 2
|
|}
== UniqueData ==
While presumed to be random, this field actually has some degree of determinism depending on the [[#MakerId|MakerId]].
MakerId 0:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Type (4 = [[Filesystem_services#MemoryType|T1RomLate]], 8 = [[Filesystem_services#MemoryType|T1RomFast]])
|-
| 0x1
| 0x1
| Line (0x21 for [[Filesystem_services#MemoryType|T1RomLate]], incrementing value for [[Filesystem_services#MemoryType|T1RomFast]])
|-
| 0x2
| 0x3
| Id
|-
| 0x5
| 0x2
| X (16-bit coordinate?)
|-
| 0x7
| 0x2
| Y (16-bit coordinate?)
|-
| 0x9
| 0x4
| Random
|}
MakerId 1:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Line (incrementing value)
|-
| 0x2
| 0x3
| Id
|-
| 0x5
| 0x1
|
|-
| 0x6
| 0x1
| Version (0 or 1)
|-
| 0x7
| 0x2
|
|-
| 0x9
| 0x4
| Random
|}
MakerId 2:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Random
|-
| 0x4
| 0x1
|
|-
| 0x5
| 0x1
|
|-
| 0x6
| 0x4
| Id (ASCII string)
|-
| 0xA
| 0x1
|
|-
| 0xB
| 0x1
|
|-
| 0xC
| 0x1
|
|}
== CardId1Mirror ==
This field mirrors bit 5 of the [[Filesystem_services#MemoryType|MemoryType]] field from the [[Filesystem_services#CardId1|CardId1]].


= CardCommand =
= CardCommand =
Line 462: Line 624:


== CommandId ==
== CommandId ==
These commands are issued by the Gamecard ASIC to the actual Gamecard using the [[#AsicOperation|OperationData]] passed to [[#SendCardCommand]].
These commands are issued by the Gamecard ASIC to the actual Gamecard using the [[#AsicOperation|OperationData]] passed to [[#SendCardCommand|SendCardCommand]].


Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Line 472: Line 634:
|-
|-
| 0x6
| 0x6
|  
| SelfRefresh
|-
|-
| 0xF
| 0xF
|  
| T1ReadUid
|-
|-
| 0x10
| 0x10
| ReadId1Write
| DebugReadId1
|-
|-
| 0x11
| 0x11
| ReadId2Write
| DebugReadId2
|-
|-
| 0x12
| 0x12
| ReadId3Write
| DebugReadId3
|-
|-
| 0x13
| 0x13
|  
| DebugReadUid
|-
|-
| 0x15
| 0x15
| ReadCrc
| DebugReadCrc
|-
|-
| 0x16
| 0x16
| WritePage
| DebugWritePage
|-
|-
| 0x17
| 0x17
Line 499: Line 661:
|-
|-
| 0x18
| 0x18
| Erase
| DebugErase
|-
|-
| 0x19
| 0x19
| ReadParameter
| DebugReadParameter
|-
|-
| 0x20
| 0x20
| WriteParameter
| DebugWriteParameter
|-
|-
| 0x21
| 0x21
| ReadPageSecure
| T1ReadPage
|-
| 0x22
|
|-
|-
| 0x28
| 0x28
Line 514: Line 679:
|-
|-
| 0x2E
| 0x2E
| ChangeDebugDirect
| ForceErase
|-
|-
| 0x30
| 0x30
| ReadId3Secure
| T1ReadId3
|-
|-
| 0x39
| 0x39
| SetKey
| T1SetKey
|-
|-
| 0x56
| 0x56
Line 527: Line 692:
| 0x59
| 0x59
|  
|  
|-
| 0x67
| ReadId1Secure
|-
|-
| 0x5B
| 0x5B
| ReadPage
| ReadPage
|-
| 0x67
| T1ReadId1
|-
|-
| 0x83
| 0x83
| WritePageSecure
| T1WritePage
|-
|-
| 0x8A
| 0x8A
Line 544: Line 709:
|-
|-
| 0xB8
| 0xB8
| Refresh
| T1Refresh
|-
|-
| 0xC4
| 0xC4
| ReadId2Secure
| T1ReadId2
|-
|-
| 0xE0
| 0xE0
Line 556: Line 721:
|-
|-
| 0xE3
| 0xE3
|  
| T2ReceiveCertificate
|-
|-
| 0xE4
| 0xE4
|  
| T2SendSocCertificate
|-
|-
| 0xE5
| 0xE5
Line 565: Line 730:
|-
|-
| 0xE6
| 0xE6
|  
| T2ReceiveRandomValue
|-
|-
| 0xE7
| 0xE7
|  
| T2SendRandomValue
|-
|-
| 0xE8
| 0xE8
|  
| T2ReceiveDeviceChallenge
|-
|-
| 0xE9
| 0xE9
|  
| T2RespondDeviceChallenge
|-
|-
| 0xEA
| 0xEA
|  
| T2SendHostChallenge
|-
|-
| 0xEB
| 0xEB
|  
| T2ReceiveChallengeResponse
|-
|-
| 0xEC
| 0xEC
Line 598: Line 763:
|-
|-
| 0xFA
| 0xFA
|  
| ReadRefreshStatus
|}
|}


= AsicFirmware =
= AsicFirmware =
This is the Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) uploaded through the [[#SendFirmware]] operation.
This is the Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) uploaded through the [[#SendFirmware|SendFirmware]] operation.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Retrieved from "https://switchbrew.org/wiki/Lotus3"