MemMap

From DeSmuME
(Difference between revisions)
Jump to: navigation, search
 
(10 intermediate revisions by one user not shown)
Line 3: Line 3:
 
!Size
 
!Size
 
!Description
 
!Description
!Default value
+
!Notes
 
|-
 
|-
 
|0x027FF800
 
|0x027FF800
|32
+
|4
 
|Card ID
 
|Card ID
|C2 0F 00 00
+
|00000FC2h
 
|-
 
|-
 
|0x027FF804
 
|0x027FF804
|32
+
|4
|Security Card ID KEY1
+
|Secure Card ID KEY1
 
|
 
|
 
|-
 
|-
 
|0x027FF808
 
|0x027FF808
|16
+
|2
 
|Computed header CRC16
 
|Computed header CRC16
 
|
 
|
 
|-
 
|-
 
|0x027FF80C
 
|0x027FF80C
|16
+
|2
 
|ARM9 copied CRC16
 
|ARM9 copied CRC16
 
|
 
|
 
|-
 
|-
 
|0x027FF816
 
|0x027FF816
|16
+
|2
 
|RTC init failure
 
|RTC init failure
|0 - ok
+
|0 - inited<br />1 - failure
 +
|-
 +
|0x027FF818
 +
|8
 +
|RTC current time
 +
|WWYYMMDDUUHHmmSS<br />
 +
WW - day of week<br />
 +
YY - year<br />
 +
MM - month<br />
 +
DD - day<br />
 +
UU - ???<br />
 +
HH - hour<br />
 +
mm - minutes<br />
 +
SS - seconds
 
|-
 
|-
 
|0x027FF820
 
|0x027FF820
|32
+
|4
 
|ARM9 firmware execute address
 
|ARM9 firmware execute address
 
|
 
|
 
|-
 
|-
 
|0x027FF824
 
|0x027FF824
|32
+
|4
 
|ARM7 firmware execute address
 
|ARM7 firmware execute address
 +
|
 +
|-
 +
|0x027FF830
 +
|
 +
|Firmware header
 +
|
 +
|-
 +
|0x027FF838
 +
|4
 +
|Firmware keycode (copy to 0x037F8014)
 
|
 
|
 
|-
 
|-
 
|0x027FF840
 
|0x027FF840
|16
+
|2
 
|ARM7 BIOS CRC16
 
|ARM7 BIOS CRC16
|A2 0C
+
|0CA2h
 
|-
 
|-
 
|0x027FF848
 
|0x027FF848
|32
+
|4
|source of ARM9 firmware execute address (copy to 0x027FF820)
+
|source of ARM9 firmware execute address
 +
(copy to 0x027FF820)
 
|
 
|
 
|-
 
|-
 
|0x027FF84C
 
|0x027FF84C
|32
+
|4
|source of ARM7 firmware execute address (copy to 0x027FF840)
+
|source of ARM7 firmware execute address
 +
(copy to 0x027FF840)
 
|
 
|
 +
|-
 +
|0x027FFC00
 +
|4
 +
|Secure Chip ID 3rd
 +
|
 +
|-
 +
|0x027FFC80
 +
|
 +
|Firmware user settings
 +
|
 +
|-
 +
|0x027FFE00
 +
|368
 +
|NDS ROM header
 +
|
 +
|-
 +
|0x027FFE60
 +
|4
 +
|Port 40001Ah setting for NORMAL command
 +
|00 58 60 00<br />fixing by BIOS to 00 58 00 00
 +
|-
 +
|0x027FFE64
 +
|4
 +
|Port 40001Ah setting for KEY1 command
 +
|F8081800h
 +
|-
 +
|0x027FFE6C
 +
|2
 +
|Security area CRC16 [20...7FFF]
 +
|
 +
|-
 +
|0x027FFE6E
 +
|2
 +
|Security area timeout
 +
|0051h
 +
|-
 +
|}
 +
<br>
 +
{| border="1" align="center" |
 +
!Address
 +
!Size
 +
!Description
 +
!Notes
 +
|-
 +
|0x037F8000
 +
|8
 +
|RTC timestamp
 +
|
 +
|-
 +
|0x037F802C
 +
|4
 +
|HW encryption seeds0H
 +
|
 +
|-
 +
|0x037F8030
 +
|4
 +
|HW encryption seeds0L
 +
|
 +
|-
 +
|0x037F8034
 +
|4
 +
|HW encryption seeds1H
 +
|
 +
|-
 +
|0x037F8038
 +
|4
 +
|HW encryption seeds1L
 +
|
 +
|-
 +
|0x037F804C
 +
|12
 +
|KEY1 encryption key
 +
|
 +
|-
 +
|0x037F8058
 +
|2
 +
|ARM9 secure length
 +
|always 0x00004000 ??
 +
|-
 +
|0x037F8060
 +
|4
 +
|HW secure bank order
 +
|
 +
|-
 +
|0x037F8074
 +
|8
 +
|RAW cmd buffer
 +
|
 +
|-
 +
|0x037F807C..0x037F90C4
 +
|1048
 +
|Blowfish keybuf
 +
|copied from NDS7 BIOS at [30h]
 +
|-
 +
|0x0380FC00
 +
|4
 +
|Secure src
 +
|
 +
|-
 +
|0x0380FC04
 +
|4
 +
|Secure dst
 +
|
 +
|-
 +
|0x0380FC08
 +
|4
 +
|Secure length
 +
|
 +
|-
 +
|0x0380FC10
 +
|4
 +
|Secure bank size
 +
|
 +
|-
 +
|0x0380FC14
 +
|4
 +
|Game card cnt buffer
 +
|
 +
|-
 +
|0x0380FC18
 +
|8
 +
|Game card cmd buffer
 +
|
 +
|-
 +
|0x0380FC40
 +
|4
 +
|Game card transfer handler
 +
|usually 1C7Fh
 +
|-
 +
|0x0380FC44
 +
|4
 +
|Game card timeout handler
 +
|usually 1DC5h
 
|-
 
|-
 
|}
 
|}

Latest revision as of 09:33, 28 July 2013

Address Size Description Notes
0x027FF800 4 Card ID 00000FC2h
0x027FF804 4 Secure Card ID KEY1
0x027FF808 2 Computed header CRC16
0x027FF80C 2 ARM9 copied CRC16
0x027FF816 2 RTC init failure 0 - inited
1 - failure
0x027FF818 8 RTC current time WWYYMMDDUUHHmmSS

WW - day of week
YY - year
MM - month
DD - day
UU - ???
HH - hour
mm - minutes
SS - seconds

0x027FF820 4 ARM9 firmware execute address
0x027FF824 4 ARM7 firmware execute address
0x027FF830 Firmware header
0x027FF838 4 Firmware keycode (copy to 0x037F8014)
0x027FF840 2 ARM7 BIOS CRC16 0CA2h
0x027FF848 4 source of ARM9 firmware execute address

(copy to 0x027FF820)

0x027FF84C 4 source of ARM7 firmware execute address

(copy to 0x027FF840)

0x027FFC00 4 Secure Chip ID 3rd
0x027FFC80 Firmware user settings
0x027FFE00 368 NDS ROM header
0x027FFE60 4 Port 40001Ah setting for NORMAL command 00 58 60 00
fixing by BIOS to 00 58 00 00
0x027FFE64 4 Port 40001Ah setting for KEY1 command F8081800h
0x027FFE6C 2 Security area CRC16 [20...7FFF]
0x027FFE6E 2 Security area timeout 0051h


Address Size Description Notes
0x037F8000 8 RTC timestamp
0x037F802C 4 HW encryption seeds0H
0x037F8030 4 HW encryption seeds0L
0x037F8034 4 HW encryption seeds1H
0x037F8038 4 HW encryption seeds1L
0x037F804C 12 KEY1 encryption key
0x037F8058 2 ARM9 secure length always 0x00004000 ??
0x037F8060 4 HW secure bank order
0x037F8074 8 RAW cmd buffer
0x037F807C..0x037F90C4 1048 Blowfish keybuf copied from NDS7 BIOS at [30h]
0x0380FC00 4 Secure src
0x0380FC04 4 Secure dst
0x0380FC08 4 Secure length
0x0380FC10 4 Secure bank size
0x0380FC14 4 Game card cnt buffer
0x0380FC18 8 Game card cmd buffer
0x0380FC40 4 Game card transfer handler usually 1C7Fh
0x0380FC44 4 Game card timeout handler usually 1DC5h
Personal tools