MemMap
From DeSmuME
Address | Size | Description | Notes |
---|---|---|---|
0x027FF800 | 4 | Card ID | 00000FC2h |
0x027FF804 | 4 | Secure Card ID KEY1 | |
0x027FF808 | 2 | Computed header CRC16 | |
0x027FF80C | 2 | ARM9 copied CRC16 | |
0x027FF816 | 2 | RTC init failure | 0 - inited 1 - failure |
0x027FF818 | 8 | RTC current time | WWYYMMDDUUHHmmSS WW - day of week |
0x027FF820 | 4 | ARM9 firmware execute address | |
0x027FF824 | 4 | ARM7 firmware execute address | |
0x027FF830 | Firmware header | ||
0x027FF838 | 4 | Firmware keycode (copy to 0x037F8014) | |
0x027FF840 | 2 | ARM7 BIOS CRC16 | 0CA2h |
0x027FF848 | 4 | source of ARM9 firmware execute address
(copy to 0x027FF820) |
|
0x027FF84C | 4 | source of ARM7 firmware execute address
(copy to 0x027FF840) |
|
0x027FFC00 | 4 | Secure Chip ID 3rd | |
0x027FFC80 | Firmware user settings | ||
0x027FFE00 | 368 | NDS ROM header | |
0x027FFE60 | 4 | Port 40001Ah setting for NORMAL command | 00 58 60 00 fixing by BIOS to 00 58 00 00 |
0x027FFE64 | 4 | Port 40001Ah setting for KEY1 command | F8081800h |
0x027FFE6C | 2 | Security area CRC16 [20...7FFF] | |
0x027FFE6E | 2 | Security area timeout | 0051h |
Address | Size | Description | Notes |
---|---|---|---|
0x037F8000 | 8 | RTC timestamp | |
0x037F802C | 4 | HW encryption seeds0H | |
0x037F8030 | 4 | HW encryption seeds0L | |
0x037F8034 | 4 | HW encryption seeds1L | |
0x037F8038 | 4 | HW encryption seeds1L | |
0x037F804C | 12 | KEY1 encryption key | |
0x037F8058 | 2 | ARM9 length | always 0?? |
0x037F8060 | 4 | HW secure bank order | |
0x037F8074 | 8 | RAW cmd buffer | |
0x037F807C..0x037F90C4 | 1048 | Blowfish keybuf | copied from NDS7 BIOS at [30h] |
0x0380FC00 | 4 | Secure src | |
0x0380FC04 | 4 | Secure dst | |
0x0380FC08 | 4 | Secure length | |
0x0380FC10 | 4 | Secure bank size | |
0x0380FC14 | 4 | Game card cnt buffer | |
0x0380FC18 | 8 | Game card cmd buffer | |
0x0380FC40 | 4 | Game card transfer handler | usually 1C7Fh |
0x0380FC44 | 4 | Game card timeout handler | usually 1DC5h |