Nintendo Switch Brew

Lotus3: Difference between revisions

← Older edit
From SendCardSelfRefresh and SendCardReadRefreshStatus
 
(5 intermediate revisions by the same user not shown)
Line 4: Line 4:


= Protocol =
= Protocol =
All communication is done using the following MMC_SEND_MANUFACTURER commands.
All communication is done using custom MMC_SEND_MANUFACTURER commands.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Command
! Value
! Name
! Description
|-
|-
| 60
| 60
| [[#WriteOperation]]
| [[#WriteOperation|WriteOperation]]
|-
|-
| 61
| 61
| [[#FinishOperation]]
| [[#FinishOperation|FinishOperation]]
|-
|-
| 62
| 62
| [[#Sleep]]
| [[#Sleep|Sleep]]
|-
|-
| 63
| 63
| [[#UpdateKey]]
| [[#UpdateKey|UpdateKey]]
|}
|}


== WriteOperation ==
== WriteOperation ==
Submits a Gamecard ASIC [[#ASIC commands|operation]] using a 0x40 byte sized [[#OperationBuffer|OperationBuffer]].
Sends a Gamecard ASIC [[#AsicOperation|operation]].
 
== FinishOperation ==
Returns the status of a completed Gamecard ASIC operation.
 
== Sleep ==
Puts the Gamecard ASIC in sleep mode.
 
== UpdateKey ==
Tells the Gamecard ASIC to generate new random key data.


=== OperationBuffer ===
= AsicOperation =
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 36: Line 45:
| 0x0
| 0x0
| 0x1
| 0x1
| Gamecard ASIC [[#ASIC commands|operation command]]
| [[#OperationId|OperationId]]
|-
|-
| 0x1
| 0x1
| 0x1F
| 0x1F
| Operation specific data
| OperationData
|-
|-
| 0x20
| 0x20
| 0x20
| 0x20
| Command verification value (secure mode only)
| CvValue (secure mode only)
|}
|}


== FinishOperation ==
== OperationId ==
Returns the status of a completed operation.
The Gamecard ASIC supports a total of 20 operation commands. These commands are passed to the ASIC using the [[#WriteOperation|WriteOperation]] MMC command.


== Sleep ==
Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Puts the Gamecard ASIC in sleep mode.
 
== UpdateKey ==
Tells the Gamecard ASIC to generate new random key data.
 
= ASIC commands =
The Gamecard ASIC supports a total of 20 operation commands. These commands are passed to the ASIC using the [[#WriteOperation]] MMC command.
 
Additional data buffers are then read/written using standard MMC read/write commands.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Command
! Value
! Name
! Description
|-
|-
| 0x01
| 0x01
| [[#SendFirmware]]
| [[#SendFirmware|SendFirmware]]
|-
|-
| 0x02
| 0x02
| [[#ReceiveCertificate]]
| [[#ReceiveCertificate|ReceiveCertificate]]
|-
|-
| 0x03
| 0x03
| [[#SendSocCertificate]]
| [[#SendSocCertificate|SendSocCertificate]]
|-
|-
| 0x04
| 0x04
| [[#ReceiveRandomValue]]
| [[#ReceiveRandomValue|ReceiveRandomValue]]
|-
|-
| 0x05
| 0x05
| [[#SendRandomValue]]
| [[#SendRandomValue|SendRandomValue]]
|-
|-
| 0x06
| 0x06
| [[#ReceiveDeviceChallenge]]
| [[#ReceiveDeviceChallenge|ReceiveDeviceChallenge]]
|-
|-
| 0x07
| 0x07
| [[#RespondDeviceChallenge]]
| [[#RespondDeviceChallenge|RespondDeviceChallenge]]
|-
|-
| 0x08
| 0x08
| [[#SendHostChallenge]]
| [[#SendHostChallenge|SendHostChallenge]]
|-
|-
| 0x09
| 0x09
| [[#ReceiveChallengeResponse]]
| [[#ReceiveChallengeResponse|ReceiveChallengeResponse]]
|-
|-
| 0x0A
| 0x0A
| [[#ChangeModeToSecure]]
| [[#ChangeModeToSecure|ChangeModeToSecure]]
|-
|-
| 0x0B
| 0x0B
| [[#WriteRegister]]
| [[#WriteRegister|WriteRegister]]
|-
|-
| 0x0C
| 0x0C
| [[#ReadRegister]]
| [[#ReadRegister|ReadRegister]]
|-
|-
| 0x0D
| 0x0D
| [[#ChangeGcModeToDebug]]
| [[#ChangeGcModeToDebug|ChangeGcModeToDebug]]
|-
|-
| 0x0E
| 0x0E
| [[#GetCardHeader]]
| [[#GetCardHeader|GetCardHeader]]
|-
|-
| 0x0F
| 0x0F
| [[#ChangeGcModeToSecure]]
| [[#ChangeGcModeToSecure|ChangeGcModeToSecure]]
|-
|-
| 0x10
| 0x10
| [[#SendCardCommand]]
| [[#SendCardCommand|SendCardCommand]]
|-
|-
| 0x11
| 0x11
| [[#EnableCardBus]]
| [[#EnableCardBus|EnableCardBus]]
|-
|-
| 0x12
| 0x12
| [[#ExchangeRandomValuesInSecureMode]]
| [[#ExchangeRandomValuesInSecureMode|ExchangeRandomValuesInSecureMode]]
|-
|-
| 0x13
| 0x13
| [[#ReadRmaInformation]]
| [[#ReadRmaInformation|ReadRmaInformation]]
|-
|-
| 0x14
| 0x14
| [9.0.0+] [[#ChallengeCardExistence]]
| [9.0.0+] [[#ChallengeCardExistence|ChallengeCardExistence]]
|}
|}


== SendFirmware ==
=== SendFirmware ===
Signals the Gamecard ASIC to receive a 0x7800 byte sized buffer containing the [[#User firmware|ASIC's user firmware]].
Signals the Gamecard ASIC to receive the [[#AsicFirmware|firmware]].
 
This is the only operation handled by the Gamecard ASIC's bootrom.
 
=== ReceiveCertificate ===
Signals the Gamecard ASIC to send the ASIC's certificate.
 
=== SendSocCertificate ===
Signals the Gamecard ASIC to receive the certificate from [[Settings_services#GetGameCardCertificate|GetGameCardCertificate]].
 
=== ReceiveRandomValue ===
Signals the Gamecard ASIC to send a RSA-OAEP encrypted message to be decrypted by the host library.
 
The decrypted message will be used to generate a common AES-128 (CBC and CTR) key and IV/CTR shared between the ASIC and the host library.


== ReceiveCertificate ==
=== SendRandomValue ===
Signals the Gamecard ASIC to send a 0x400 byte sized buffer containing the ASIC's certificate.
Signals the Gamecard ASIC to receive a RSA-OAEP encrypted message to be decrypted by the ASIC.


== SendSocCertificate ==
The decrypted message will be used to generate a common AES-128 (CBC and CTR) key and IV/CTR shared between the ASIC and the host library.
Signals the Gamecard ASIC to receive a 0x400 byte sized buffer containing the certificate from [[Settings_services#GetGameCardCertificate|GetGameCardCertificate]].


== ReceiveRandomValue ==
=== ReceiveDeviceChallenge ===
Signals the Gamecard ASIC to send a 0x100 byte sized buffer containing a RSA-OAEP encrypted message to be decrypted by the host library. The decrypted message will be used to generate a common AES-128 (CBC and CTR) key and IV/CTR shared between the ASIC and the host library.
Signals the Gamecard ASIC to send AES-128-CBC encrypted authentication data to be decrypted and hashed by the host library.


== SendRandomValue ==
=== RespondDeviceChallenge ===
Signals the Gamecard ASIC to receive a 0x100 byte sized buffer containing a RSA-OAEP encrypted message to be decrypted by the ASIC. The decrypted message will be used to generate a common AES-128 (CBC and CTR) key and IV/CTR shared between the ASIC and the host library.
Signals the Gamecard ASIC to receive the AES-128-CBC encrypted hash of the ASIC authentication data.


== ReceiveDeviceChallenge ==
=== SendHostChallenge ===
Signals the Gamecard ASIC to send a 0x20 byte sized buffer containing AES-128-CBC encrypted authentication data to be decrypted and hashed by the host library.
Signals the Gamecard ASIC to receive AES-128-CBC encrypted authentication data to be decrypted and hashed by the ASIC.


== RespondDeviceChallenge ==
=== ReceiveChallengeResponse ===
Signals the Gamecard ASIC to receive a 0x20 byte sized buffer containing the AES-128-CBC encrypted hash of the ASIC authentication data.
Signals the Gamecard ASIC to send the AES-128-CBC encrypted hash of the library authentication data.


== SendHostChallenge ==
=== ChangeModeToSecure ===
Signals the Gamecard ASIC to receive a 0x20 byte sized buffer containing AES-128-CBC encrypted authentication data to be decrypted and hashed by the ASIC.
Signals the Gamecard ASIC to enter secure mode.


== ReceiveChallengeResponse ==
In secure mode, all communication with the Gamecard ASIC must be AES-128-CTR encrypted.
Signals the Gamecard ASIC to send a 0x20 byte sized buffer containing the AES-128-CBC encrypted hash of the library authentication data.


== ChangeModeToSecure ==
=== WriteRegister ===
Signals the Gamecard ASIC to enter secure mode. In secure mode, all communication with the Gamecard ASIC must be AES-128-CTR encrypted.
Signals the Gamecard ASIC to write an internal register.


== WriteRegister ==
[[#AsicOperation|OperationData]] becomes:
Signals the Gamecard ASIC to write an internal register. The register value is passed in the first word of a 0x200 byte sized buffer while the register index is passed in the actual [[#OperationBuffer]] as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| Reserved
|-
| 0x3
| 0x4
| RegisterAddress
|-
| 0x7
| 0x18
| Reserved
|}


RegisterValue is passed in a data page.
=== ReadRegister ===
Signals the Gamecard ASIC to send the contents of its [[#AsicRegisters|registers]].
=== ChangeGcModeToDebug ===
Signals the Gamecard ASIC to change into debug mode and send information on the current Gamecard.
=== GetCardHeader ===
Signals the Gamecard ASIC to send the current Gamecard's [[#CardHeader|header]].
=== ChangeGcModeToSecure ===
Signals the Gamecard ASIC to enable secure communication with the Gamecard and return its [[#CardKeyArea|key area]].
=== SendCardCommand ===
Signals the Gamecard ASIC to relay commands to the Gamecard.
[[#AsicOperation|OperationData]] becomes:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 168: Line 214:
| 0x0
| 0x0
| 0x1
| 0x1
| Gamecard ASIC operation command (0x0B)
| PageSize
|-
|-
| 0x1
| 0x1
| 0x1
| Direction (0 = Read, 1 = Write)
|-
| 0x2
| 0x1
| Reserved
|-
| 0x3
| 0x3
| Padding
| 0x4
| PageNumber
|-
|-
| 0x4
| 0x7
| 0x4
| 0x10
| Gamecard ASIC register index
| [[#CardCommand|CardCommand]]
|-
|-
| 0x17
| 0x8
| 0x8
| 0x18
| Reserved
| Empty
|}
 
=== EnableCardBus ===
Signals the Gamecard ASIC to enable the Gamecard's bus line.
 
=== ExchangeRandomValuesInSecureMode ===
Signals the Gamecard ASIC to exchange random authentication values with the current Gamecard.
 
[[#AsicOperation|OperationData]] becomes:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1F
| RandomValues
|}
 
The Gamecard's response is returned in a data page.
 
=== ReadRmaInformation ===
Signals the Gamecard ASIC to send information on the Gamecard ASIC. This is called by [[Filesystem_services#IDeviceOperator|GetGameCardAsicInfo]].
 
=== ChallengeCardExistence ===
Signals the Gamecard ASIC to exchange random values with the current Gamecard.
 
[[#AsicOperation|OperationData]] becomes:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
|-
| 0x20
| 0x0
| 0x20
| 0x1F
| Command verification value
| RandomValues
|}
|}


== ReadRegister ==
The Gamecard's response is returned in a data page.
Signals the Gamecard ASIC to send a 0x30 byte sized buffer containing the values of all ASIC registers as follows:


= AsicRegisters =
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 245: Line 333:
|}
|}


== ChangeGcModeToDebug ==
= CardHeader =
Signals the Gamecard ASIC to change into debug mode and send a 0x200 byte sized buffer containing information on the current Gamecard.
 
== GetCardHeader ==
Signals the Gamecard ASIC to send a 0x200 byte sized buffer containing the current Gamecard's header data as follows:
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 278: Line 361:
|}
|}


== ChangeGcModeToSecure ==
= CardKeyArea =
Signals the Gamecard ASIC to send a 0x800 byte sized buffer containing the current Gamecard's key area sectors as follows:
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 305: Line 386:
| 0x10
| 0x10
| 0x40
| 0x40
| CardUid
| [[#CardUid|CardUid]]
|-
|-
| 0x50
| 0x50
Line 324: Line 405:
|}
|}


[11.0.0+] This now signals the Gamecard ASIC to send a 0x600 byte sized buffer containing the current Gamecard's key area sectors as follows:
[11.0.0+] This is now:
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 350: Line 430:
| 0x10
| 0x10
| 0x40
| 0x40
| CardUid
| [[#CardUid|CardUid]]
|-
|-
| 0x50
| 0x50
Line 365: Line 445:
|}
|}


== SendCardCommand ==
= CardUid =
Signals the Gamecard ASIC to relay a specific [[#Gamecard commands|command]] to the Gamecard. The command is sent to the Gamecard using the [[#OperationBuffer]] as follows:
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 376: Line 454:
| 0x0
| 0x0
| 0x1
| 0x1
| Gamecard ASIC operation command (0x10)
| [[#MakerId|MakerId]]
|-
|-
| 0x1
| 0x1
| 0x1
| 0x1
| Page size
|  
|-
|-
| 0x2
| 0x2
| 0x1
| 0x1
| Direction (0 = read, 1 = write)
|  
|-
|-
| 0x3
| 0x3
| 0x1
| 0xD
| Padding
| [[#UniqueData|UniqueData]]
|-
|-
| 0x4
| 0x10
| 0x4
| Page count
|-
| 0x8
| 0x1
| 0x1
| Gamecard command
| Reserved (always 0)
|-
|-
| 0x9
| 0x11
| 0x17
| 0xB
| Command specific data
| Reserved (always all 0xFF)
|-
|-
| 0x20
| 0x1C
| 0x20
| 0x4
| Command verification value
| [[#CardId1Mirror|CardId1Mirror]]
|}
 
== EnableCardBus ==
Signals the Gamecard ASIC to enable the current Gamecard's bus line.
 
== ExchangeRandomValuesInSecureMode ==
Signals the Gamecard ASIC to exchange random authentication values with the current Gamecard. The Gamecard response values are returned in a 0x20 sized buffer while the host values are passed in the actual [[#OperationBuffer]] as follows:
 
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Gamecard ASIC operation command (0x12)
|-
| 0x1
| 0x1F
| Random value from host
|-
|-
| 0x20
| 0x20
| 0x20
| 0x20
| Command verification value
| Hash
|}
|}


== ReadRmaInformation ==
== MakerId ==
Signals the Gamecard ASIC to send a 0x200 byte sized buffer containing information on the Gamecard ASIC. This is called by [[Filesystem_services#IDeviceOperator|GetGameCardAsicInfo]].
 
== ChallengeCardExistence ==
Signals the Gamecard ASIC to exchange random values with the current Gamecard. The Gamecard response values are returned in a 0x58 sized buffer while the host values are passed in the actual [[#OperationBuffer]] as follows:
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Offset
! Value
! Size
! Description
! Description
|-
|-
| 0x0
| 0
| 0x1
| MegaChips (Macronix)
| Gamecard ASIC operation command (0x14)
|-
| 0x1
| 0x1F
| Random value from host
|-
| 0x20
| 0x20
| Command verification value
|}
 
= Gamecard commands =
These commands are issued by the Gamecard ASIC to the actual Gamecard using the [[#OperationBuffer]] passed to [[#SendCardCommand]].
 
Additional data buffers are then read/written using standard MMC read/write commands.
 
{| class="wikitable" border="1"
|-
! Command
! Name
|-
| 0x6
|
|-
| 0xF
|
|-
| 0x10
| [[#ReadId1|ReadId1Write]]
|-
| 0x11
| [[#ReadId2|ReadId2Write]]
|-
| 0x12
| [[#ReadId3|ReadId3Write]]
|-
| 0x13
|
|-
| 0x15
| [[#ReadCrc|ReadCrc]]
|-
| 0x16
| [[#WritePage|WritePage]]
|-
| 0x17
|
|-
| 0x18
| [[#Erase|Erase]]
|-
| 0x19
| [[#ReadParameter|ReadParameter]]
|-
| 0x20
| [[#WriteParameter|WriteParameter]]
|-
| 0x21
| [[#ReadPage|ReadPageSecure]]
|-
| 0x28
| [[#ReadId2|ReadId2]]
|-
| 0x2E
| [[#ChangeDebugDirect|ChangeDebugDirect]]
|-
| 0x30
| [[#ReadId3|ReadId3Secure]]
|-
| 0x39
| [[#SetKey|SetKey]]
|-
| 0x56
| [[#ReadId1|ReadId1]]
|-
| 0x59
|
|-
| 0x67
| [[#ReadId1|ReadId1Secure]]
|-
| 0x5B
| [[#ReadPage|ReadPage]]
|-
| 0x83
| [[#WritePage|WritePageSecure]]
|-
| 0x8A
|
|-
| 0xA5
| [[#ReadId3|ReadId3]]
|-
| 0xB8
| [[#Refresh|Refresh]]
|-
| 0xC4
| [[#ReadId2|ReadId2Secure]]
|-
| 0xE0
| ReadInitialData
|-
| 0xE2
| ChangeInitialData
|-
| 0xE3
|
|-
| 0xE4
|
|-
| 0xE5
|
|-
|-
| 0xE6
| 1
|  
| Lapis
|-
|-
| 0xE7
| 2
|
|-
| 0xE8
|
|-
| 0xE9
|
|-
| 0xEA
|
|-
| 0xEB
|
|-
| 0xEC
|
|-
| 0xED
|
|-
| 0xEE
|
|-
| 0xEF
|
|-
| 0xF1
|
|-
| 0xFA
|  
|  
|}
|}


== ReadId1 ==
== UniqueData ==
Returns the Gamecard ID1 under one of the valid [[#Gamecard modes|Gamecard modes]].
While presumed to be random, this field actually has some degree of determinism depending on the [[#MakerId|MakerId]].
 
The [[#OperationBuffer]] is as follows:


MakerId 0:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 610: Line 513:
| 0x0
| 0x0
| 0x1
| 0x1
| Gamecard ASIC operation command (0x10)
| Type (4 = [[Filesystem_services#MemoryType|T1RomLate]], 8 = [[Filesystem_services#MemoryType|T1RomFast]])
|-
|-
| 0x1
| 0x1
| 0x1
| 0x1
| Set to 1
| Line (0x21 for [[Filesystem_services#MemoryType|T1RomLate]], incrementing value for [[Filesystem_services#MemoryType|T1RomFast]])
|-
|-
| 0x2
| 0x2
| 0x1
| Set to 0
|-
| 0x3
| 0x3
| 0x1
| Id
| Padding
|-
|-
| 0x4
| 0x5
| 0x4
| Set to 0
|-
| 0x8
| 0x1
| Gamecard command (0x10, 0x56 or 0x67)
|-
| 0x9
| 0x4
| Set to 0
|-
| 0xD
| 0x2
| 0x2
| Set to 0
| X (16-bit coordinate?)
|-
| 0xF
| 0x1
| Set to 0
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
 
== ReadId2 ==
Returns the Gamecard ID2 under one of the valid [[#Gamecard modes|Gamecard modes]].
 
The [[#OperationBuffer]] is as follows:
 
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Gamecard ASIC operation command (0x10)
|-
| 0x1
| 0x1
| Set to 1
|-
|-
| 0x7
| 0x2
| 0x2
| 0x1
| Y (16-bit coordinate?)
| Set to 0
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Set to 0
|-
| 0x8
| 0x1
| Gamecard command (0x11, 0x28 or 0xC4)
|-
|-
| 0x9
| 0x9
| 0x4
| 0x4
| Set to 0
| Random
|-
| 0xD
| 0x2
| Set to 0
|-
| 0xF
| 0x1
| Set to 0
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
|}


== ReadId3 ==
MakerId 1:
Returns the Gamecard ID3 under one of the valid [[#Gamecard modes|Gamecard modes]].
 
The [[#OperationBuffer]] is as follows:
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 721: Line 544:
|-
|-
| 0x0
| 0x0
| 0x1
| 0x2
| Gamecard ASIC operation command (0x10)
| Line (incrementing value)
|-
| 0x1
| 0x1
| Set to 1
|-
|-
| 0x2
| 0x2
| 0x1
| Set to 0
|-
| 0x3
| 0x3
| 0x1
| Id
| Padding
|-
| 0x4
| 0x4
| Set to 0
|-
|-
| 0x8
| 0x5
| 0x1
| 0x1
| Gamecard command (0x12, 0x30 or 0xA5)
|  
|-
|-
| 0x9
| 0x6
| 0x4
| Set to 0
|-
| 0xD
| 0x2
| Set to 0
|-
| 0xF
| 0x1
| 0x1
| Set to 0
| Version (0 or 1)
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
 
== ReadCrc ==
Reads pages from the Gamecard, calculates their CRC and returns it. This command is only available in [[#Gamecard modes|Write]] mode.
 
The [[#OperationBuffer]] is as follows:
 
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Gamecard ASIC operation command (0x10)
|-
| 0x1
| 0x1
| Set to 1
|-
|-
| 0x7
| 0x2
| 0x2
| 0x1
|  
| Set to 0
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Set to 0
|-
| 0x8
| 0x1
| Gamecard command (0x15)
|-
|-
| 0x9
| 0x9
| 0x4
| 0x4
| Gamecard page offset
| Random
|-
| 0xD
| 0x3
| Gamecard page count
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
|}


== WritePage ==
MakerId 2:
Writes Gamecard pages. This command is only available in [[#Gamecard modes|Write]] and [[#Gamecard modes|Secure]] modes.
 
The [[#OperationBuffer]] is as follows:
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 829: Line 576:
|-
|-
| 0x0
| 0x0
| 0x1
| Gamecard ASIC operation command (0x10)
|-
| 0x1
| 0x1
| Set to 3
|-
| 0x2
| 0x1
| Set to 1
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| 0x4
| Random
| Gamecard page count (duplicate)
|-
| 0x8
| 0x1
| Gamecard command (0x16 or 0x83)
|-
|-
| 0x9
| 0x4
| 0x4
| Gamecard page offset
|-
| 0xD
| 0x3
| Gamecard page count
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
== ReadPage ==
Reads Gamecard pages. This command is only available in [[#Gamecard modes|Normal]] and [[#Gamecard modes|Secure]] modes.
The [[#OperationBuffer]] is as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| 0x1
| Gamecard ASIC operation command (0x10)
|  
|-
|-
| 0x5
| 0x1
| 0x1
| 0x1
|  
| Set to 3
|-
|-
| 0x2
| 0x6
| 0x1
| Set to 0
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| 0x4
| Gamecard page count (duplicate)
| Id (ASCII string)
|-
|-
| 0x8
| 0xA
| 0x1
| 0x1
| Gamecard command (0x21 or 0x5B)
|  
|-
|-
| 0x9
| 0xB
| 0x4
| Gamecard page offset
|-
| 0xD
| 0x3
| Gamecard page count
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
 
== Erase ==
Fully erases a Gamecard's contents. This command is only available in [[#Gamecard modes|Write]] mode.
 
The [[#OperationBuffer]] is as follows:
 
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| 0x1
| Gamecard ASIC operation command (0x10)
|  
|-
|-
| 0xC
| 0x1
| 0x1
| 0x1
|  
| Set to 1
|-
| 0x2
| 0x1
| Set to 0
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Set to 0
|-
| 0x8
| 0x1
| Gamecard command (0x18)
|-
| 0x9
| 0x4
| Set to 0
|-
| 0xD
| 0x2
| Set to 0
|-
| 0xF
| 0x1
| Set to 0
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
|}


== ReadParameter ==
== CardId1Mirror ==
Reads a development Gamecard's parameters. This command is only available in [[#Gamecard modes|Write]] mode.
This field mirrors bit 5 of the [[Filesystem_services#MemoryType|MemoryType]] field from the [[Filesystem_services#CardId1|CardId1]].
 
The [[#OperationBuffer]] is as follows:


= CardCommand =
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 990: Line 616:
| 0x0
| 0x0
| 0x1
| 0x1
| Gamecard ASIC operation command (0x10)
| [[#CommandId|CommandId]]
|-
|-
| 0x1
| 0x1
| 0x1
| Set to 3
|-
| 0x2
| 0x1
| Set to 0
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Set to 1
|-
| 0x8
| 0x1
| Gamecard command (0x19)
|-
| 0x9
| 0x4
| Set to 0
|-
| 0xD
| 0x2
| Set to 0
|-
| 0xF
| 0xF
| 0x1
| CommandData
| Set to 0
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
|}


== WriteParameter ==
== CommandId ==
Writes a development Gamecard's parameters. This command is only available in [[#Gamecard modes|Write]] mode.
These commands are issued by the Gamecard ASIC to the actual Gamecard using the [[#AsicOperation|OperationData]] passed to [[#SendCardCommand|SendCardCommand]].


The [[#OperationBuffer]] is as follows:
Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Offset
! Value
! Size
! Description
! Description
|-
|-
| 0x0
| 0x6
| 0x1
| SelfRefresh
| Gamecard ASIC operation command (0x10)
|-
| 0x1
| 0x1
| Set to 3
|-
| 0x2
| 0x1
| Set to 1
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Set to 1
|-
| 0x8
| 0x1
| Gamecard command (0x20)
|-
| 0x9
| 0x4
| Set to 0
|-
| 0xD
| 0x2
| Set to 0
|-
|-
| 0xF
| 0xF
| 0x1
| T1ReadUid
| Set to 0
|-
|-
| 0x10
| 0x10
| 0x10
| DebugReadId1
| Empty
|-
|-
| 0x20
| 0x11
| 0x20
| DebugReadId2
| Command verification value
|}
 
== SetKey ==
Sets the Gamecard's internal key data. This command is only available in [[#Gamecard modes|Secure]] mode.
 
The [[#OperationBuffer]] is as follows:
 
{| class="wikitable" border="1"
|-
|-
! Offset
| 0x12
! Size
| DebugReadId3
! Description
|-
|-
| 0x0
| 0x13
| 0x1
| DebugReadUid
| Gamecard ASIC operation command (0x10)
|-
|-
| 0x1
| 0x15
| 0x1
| DebugReadCrc
| Set to 0
|-
|-
| 0x2
| 0x16
| 0x1
| DebugWritePage
| Set to 0
|-
|-
| 0x3
| 0x17
| 0x1
|  
| Padding
|-
|-
| 0x4
| 0x18
| 0x4
| DebugErase
| Set to 0
|-
|-
| 0x8
| 0x19
| 0x1
| DebugReadParameter
| Gamecard command (0x39)
|-
|-
| 0x9
| 0x20
| 0x4
| DebugWriteParameter
| Set to 0
|-
|-
| 0xD
| 0x21
| 0x2
| T1ReadPage
| Set to 0
|-
|-
| 0xF
| 0x22
| 0x1
|  
| Set to 0
|-
|-
| 0x10
| 0x28
| 0x10
| ReadId2
| Empty
|-
|-
| 0x20
| 0x2E
| 0x20
| ForceErase
| Command verification value
|}
 
== Refresh ==
Resets the Gamecard's internal status. This command is only available in [[#Gamecard modes|Secure]] mode.
 
The [[#OperationBuffer]] is as follows:
 
{| class="wikitable" border="1"
|-
|-
! Offset
| 0x30
! Size
| T1ReadId3
! Description
|-
|-
| 0x0
| 0x39
| 0x1
| T1SetKey
| Gamecard ASIC operation command (0x10)
|-
|-
| 0x1
| 0x56
| 0x1
| ReadId1
| Set to 2
|-
|-
| 0x2
| 0x59
| 0x1
|  
| Set to 0
|-
|-
| 0x3
| 0x5B
| 0x1
| ReadPage
| Padding
|-
|-
| 0x4
| 0x67
| 0x4
| T1ReadId1
| Set to 0
|-
|-
| 0x8
| 0x83
| 0x1
| T1WritePage
| Gamecard command (0xB8)
|-
|-
| 0x9
| 0x8A
| 0x4
|  
| Set to 0
|-
|-
| 0xD
| 0xA5
| 0x2
| ReadId3
| Set to 0
|-
|-
| 0xF
| 0xB8
| 0x1
| T1Refresh
| Set to 0
|-
|-
| 0x10
| 0xC4
| 0x10
| T1ReadId2
| Empty
|-
|-
| 0x20
| 0xE0
| 0x20
| ReadInitialData
| Command verification value
|}
 
== ChangeDebugDirect ==
Used by [[Filesystem_services#OpenGameCardStorage|OpenGameCardStorage]]. This command is only available in [[#Gamecard modes|Normal]] mode.
 
The [[#OperationBuffer]] is as follows:
 
{| class="wikitable" border="1"
|-
|-
! Offset
| 0xE2
! Size
| ChangeInitialData
! Description
|-
|-
| 0x0
| 0xE3
| 0x1
| T2ReceiveCertificate
| Gamecard ASIC operation command (0x10)
|-
|-
| 0x1
| 0xE4
| 0x1
| T2SendSocCertificate
| Set to 1
|-
|-
| 0x2
| 0xE5
| 0x1
|  
| Set to 0
|-
|-
| 0x3
| 0xE6
| 0x1
| T2ReceiveRandomValue
| Padding
|-
|-
| 0x4
| 0xE7
| 0x4
| T2SendRandomValue
| Set to 0
|-
|-
| 0x8
| 0xE8
| 0x1
| T2ReceiveDeviceChallenge
| Gamecard command (0x2E)
|-
|-
| 0x9
| 0xE9
| 0xF
| T2RespondDeviceChallenge
| Unlock password
|-
|-
| 0x18
| 0xEA
| 0x8
| T2SendHostChallenge
| Empty
|-
|-
| 0x20
| 0xEB
| 0x20
| T2ReceiveChallengeResponse
| Command verification value
|}
 
= Modes =
Both the Gamecard ASIC and the actual Gamecard can operate in different modes.
 
== ASIC modes ==
{| class="wikitable" border="1"
|-
|-
! Mode
| 0xEC
! Name
|
|-
|-
| 0x00
| 0xED
| Initial
|  
|-
|-
| 0x01
| 0xEE
| Secure
|  
|}
 
== Gamecard modes ==
{| class="wikitable" border="1"
|-
|-
! Mode
| 0xEF
! Name
|
|-
|-
| 0x00
| 0xF1
| Initial
|  
|-
|-
| 0x01
| 0xFA
| Normal
| ReadRefreshStatus
|-
| 0x02
| Secure
|-
| 0x03
| Write
|}
|}


= User firmware =
= AsicFirmware =
[[Filesystem_services|FS]] provides the appropriate Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) which is encrypted, signed and follows the format below:
This is the Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) uploaded through the [[#SendFirmware|SendFirmware]] operation.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,302: Line 784:
|-
|-
| 0x104
| 0x104
| 0x4
| 0x1
| Unknown (0xFF000000, 0xFFFF0000 or 0xFFFFFF00)
| ProductionFirmwareFlag
|-
| 0x105
| 0x1
| DevelopmentFirmwareFlag
|-
|-
| 0x108
| 0x106
| 0x4
| 0x1
| Empty
| WriterFirmwareFlag
|-
|-
| 0x10C
| 0x107
| 0x4
| 0x9
| Empty
| Reserved
|-
|-
| 0x110
| 0x110
| 0x4
| 0x8
| Version (0, 0x1, [4.0.0+] 0x3, [9.0.0+] 0x7, [11.0.0+] 0xF, [12.0.0+] 0x1F)
| [[#FirmwareVersion|FirmwareVersion]]
|-
| 0x114
| 0x4
| Unknown (0x80000000)
|-
|-
| 0x118
| 0x118
| 0x4
| 0x4
| Data size
| FirmwareSize
|-
|-
| 0x11C
| 0x11C
| 0x4
| 0x4
| Empty
| Reserved
|-
|-
| 0x120
| 0x120
| 0x10
| 0x10
| Encrypted data IV/CTR
| Iv
|-
|-
| 0x130
| 0x130
| 0x10
| 0x10
| Placeholder string ("IDIDIDIDIDIDIDID")
| Lotus3DeviceId
|-
|-
| 0x140
| 0x140
| 0x40
| 0x40
| Empty
| Reserved
|-
|-
| 0x180
| 0x180
| 0x7680
| 0x7680
| Encrypted data
| FirmwareData
|}
|}


== Types ==
== FirmwareVersion ==
Depending on it's purpose, multiple user firmware blobs exist.
{| class="wikitable" border="1"
 
|-
=== ReadFw ===
! Bits
Code for reading retail Gamecards. Only the normal and secure [[#Gamecard modes|Gamecard modes]] are supported.
! Description
 
|-
Found inside [[Filesystem_services|FS]].
| 0-61
 
| Version (0, 0x1, [4.0.0+] 0x3, [9.0.0+] 0x7, [11.0.0+] 0xF, [12.0.0+] 0x1F)
[4.0.0+] This firmware blob was updated to provide support for new Gamecards.
|-
 
| 62
[9.0.0+] This firmware blob was updated.
| IsDevelopment
 
|-
[11.0.0+] This firmware blob was updated.
| 63
 
| IsProduction
[12.0.0+] This firmware blob was updated.
|}
 
[14.0.0+] This firmware blob was updated.
 
=== WriterFw ===
Code for writing development Gamecards. Only the normal and write [[#Gamecard modes|Gamecard modes]] are supported.
 
Found inside [[Filesystem_services|FS]].
 
=== ReadDevFw ===
Code for reading development Gamecards. Development Gamecards use common [[Gamecard_Format#Initial_Data|initial data]] which justifies the need for a specialized read firmware.
 
Found inside [[Filesystem_services|FS]].
 
[9.0.0+] This firmware blob was updated.
 
[11.0.0+] This firmware blob was updated.
 
[14.0.0+] This firmware blob was updated.
 
=== RmaFw ===
Code for calling [[#ReadRmaInformation]]. Must be passed as an argument for [[Filesystem_services#IDeviceOperator|GetGameCardAsicInfo]].
 
Never observed (possibly factory only).


== Anti-downgrade ==
== Anti-downgrade ==
Loading an user firmware blob with a certain version field will lock the Gamecard ASIC to only allow running firmware blobs with the same or higher version number. Therefore, it is speculated that the Gamecard ASIC contains some sort of non-volatile memory bank which could be used for this purpose (among others).
Loading a firmware blob will burn as many OTP fuses as those specified by the [[#FirmwareVersion|Version]] field. This will lock the Gamecard ASIC to only allow running firmware blobs with the same or higher version number.
Retrieved from "https://switchbrew.org/wiki/Lotus3"