Nintendo Switch Brew

Lotus3: Difference between revisions

← Older editNewer edit →
No edit summary
(18 intermediate revisions by the same user not shown)
Line 185: Line 185:


== ReadAsicRegister ==
== ReadAsicRegister ==
Signals the Gamecard ASIC to send a 0x30 byte sized buffer containing the values of all ASIC registers.
Signals the Gamecard ASIC to send a 0x30 byte sized buffer containing the values of all ASIC registers as follows.
 
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Status
|-
| 0x4
| 0x4
| Access Control
|-
| 0x8
| 0x4
|
|-
| 0xC
| 0x4
|
|-
| 0x10
| 0x4
|
|-
| 0x14
| 0x4
|
|-
| 0x18
| 0x4
|
|-
| 0x1C
| 0x4
|
|-
| 0x20
| 0x4
|
|-
| 0x24
| 0x4
|
|-
| 0x28
| 0x4
|
|-
| 0x2C
| 0x4
|
|}


== ChangeDebugMode ==
== ChangeDebugMode ==
Line 200: Line 255:
|-
|-
| 0x0
| 0x0
| 0x8
| 0x4
| Unknown
| [[Gamecard_Format#Gamecard_Info|CUP Version]]
|-
| 0x4
| 0x4
| [[#ReadId1Normal.2C_ReadId1Secure.2C_ReadId1Writer|Gamecard ID1]]
|-
|-
| 0x8
| 0x8
| 0x100
| 0x100
| [[Gamecard_Format#Gamecard_Header|Gamecard header]] (without the signature)
| [[Gamecard_Format#Gamecard_Header|Gamecard Header]] (without the signature)
|}
|}


== GetCardKeyArea ==
== GetCardKeyArea ==
Signals the Gamecard ASIC to send a 0x800 byte sized buffer containing the current Gamecard's key area sectors.
Signals the Gamecard ASIC to send a 0x800 byte sized buffer containing the current Gamecard's key area sectors as follows.
 
{| class="wikitable" border="1"
|-
! Sector
! Size
! Description
|-
| 0
| 0x200
| Gamecard specific data
|-
| 1
| 0x200
| [[Gamecard_Format#Gamecard_Certificate|Gamecard Certificate]]
|-
| 2
| 0x200
| Empty sector (all 0xFF)
|-
| 3
| 0x200
| [[Gamecard_Format#Initial_Data|Gamecard Initial Data]]
|}


== SendCardCommand ==
== SendCardCommand ==
Line 225: Line 307:
|-
|-
| 0x1
| 0x1
| 0x7
| 0x1
| Unknown
| Page size
|-
| 0x2
| 0x1
| Direction (0 = read, 1 = write)
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Page count
|-
|-
| 0x8
| 0x8
Line 310: Line 404:
|-
|-
| 0x2E
| 0x2E
|  
| [[#UnlockForceErase]]
|-
|-
| 0x30
| 0x30
Line 316: Line 410:
|-
|-
| 0x39
| 0x39
|  
| [[#UpdateKey]]
|-
|-
| 0x56
| 0x56
Line 334: Line 428:
|-
|-
| 0xB8
| 0xB8
|  
| [[#Refresh]]
|-
|-
| 0xC4
| 0xC4
Line 340: Line 434:
|-
|-
| 0xE0
| 0xE0
|  
| ReadInitialData
|-
|-
| 0xE2
| 0xE2
|  
| EnterSecureMode
|}
|}


Line 831: Line 925:
| 0x10
| 0x10
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
== UpdateKey ==
Updates the Gamecard's internal key data. This command is only available in [[#Gamecard modes|Secure]] mode.
The [[#OperationBuffer]] is as follows.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Gamecard ASIC operation command (0x10)
|-
| 0x1
| 0x1
| Set to 0
|-
| 0x2
| 0x1
| Set to 0
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Set to 0
|-
| 0x8
| 0x1
| Gamecard command (0x39)
|-
| 0x9
| 0x4
| Set to 0
|-
| 0xD
| 0x2
| Set to 0
|-
| 0xF
| 0x1
| Set to 0
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
== Refresh ==
Resets the Gamecard's internal status. This command is only available in [[#Gamecard modes|Secure]] mode.
The [[#OperationBuffer]] is as follows.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Gamecard ASIC operation command (0x10)
|-
| 0x1
| 0x1
| Set to 2
|-
| 0x2
| 0x1
| Set to 0
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Set to 0
|-
| 0x8
| 0x1
| Gamecard command (0xB8)
|-
| 0x9
| 0x4
| Set to 0
|-
| 0xD
| 0x2
| Set to 0
|-
| 0xF
| 0x1
| Set to 0
|-
| 0x10
| 0x10
| Empty
|-
| 0x20
| 0x20
| Command verification value
|}
== UnlockForceErase ==
Used by [[Filesystem_services#OpenGameCardStorage|OpenGameCardStorage]]. This command is only available in [[#Gamecard modes|Normal]] mode.
The [[#OperationBuffer]] is as follows.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Gamecard ASIC operation command (0x10)
|-
| 0x1
| 0x1
| Set to 1
|-
| 0x2
| 0x1
| Set to 0
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Set to 0
|-
| 0x8
| 0x1
| Gamecard command (0x2E)
|-
| 0x9
| 0xF
| Unlock password
|-
| 0x18
| 0x8
| Empty
| Empty
|-
|-
Line 884: Line 1,138:
| 0x0
| 0x0
| 0x100
| 0x100
| RSA-PKCS#1 signature
| RSA-2048 PKCS #1 signature over the firmware (data from 0x100 to 0x7800)
|-
|-
| 0x100
| 0x100
Line 896: Line 1,150:
| 0x108
| 0x108
| 0x4
| 0x4
|
| Empty
|-
|-
| 0x10C
| 0x10C
| 0x4
| 0x4
|  
| Empty
|-
|-
| 0x110
| 0x110
Line 916: Line 1,170:
| 0x11C
| 0x11C
| 0x4
| 0x4
|  
| Empty
|-
|-
| 0x120
| 0x120
| 0x10
| 0x10
| Data hash
| Encrypted data IV/CTR
|-
|-
| 0x130
| 0x130
Retrieved from "https://switchbrew.org/wiki/Lotus3"