From DeSmuME
Jump to: navigation, search
Address Size Description Notes
0x027FF800 4 Card ID 00000FC2h
0x027FF804 4 Secure Card ID KEY1
0x027FF808 2 Computed header CRC16
0x027FF80C 2 ARM9 copied CRC16
0x027FF816 2 RTC init failure 0 - inited
1 - failure
0x027FF818 8 RTC current time WWYYMMDDUUHHmmSS

WW - day of week
YY - year
MM - month
DD - day
UU - ???
HH - hour
mm - minutes
SS - seconds

0x027FF820 4 ARM9 firmware execute address
0x027FF824 4 ARM7 firmware execute address
0x027FF830 Firmware header
0x027FF838 4 Firmware keycode (copy to 0x037F8014)
0x027FF840 2 ARM7 BIOS CRC16 0CA2h
0x027FF848 4 source of ARM9 firmware execute address

(copy to 0x027FF820)

0x027FF84C 4 source of ARM7 firmware execute address

(copy to 0x027FF840)

0x027FFC00 4 Secure Chip ID 3rd
0x027FFC80 Firmware user settings
0x027FFE00 368 NDS ROM header
0x027FFE60 4 Port 40001Ah setting for NORMAL command 00 58 60 00
fixing by BIOS to 00 58 00 00
0x027FFE64 4 Port 40001Ah setting for KEY1 command F8081800h
0x027FFE6C 2 Security area CRC16 [20...7FFF]
0x027FFE6E 2 Security area timeout 0051h

Address Size Description Notes
0x037F8000 8 RTC timestamp
0x037F802C 4 HW encryption seeds0H
0x037F8030 4 HW encryption seeds0L
0x037F8034 4 HW encryption seeds1H
0x037F8038 4 HW encryption seeds1L
0x037F804C 12 KEY1 encryption key
0x037F8058 2 ARM9 secure length always 0x00004000 ??
0x037F8060 4 HW secure bank order
0x037F8074 8 RAW cmd buffer
0x037F807C..0x037F90C4 1048 Blowfish keybuf copied from NDS7 BIOS at [30h]
0x0380FC00 4 Secure src
0x0380FC04 4 Secure dst
0x0380FC08 4 Secure length
0x0380FC10 4 Secure bank size
0x0380FC14 4 Game card cnt buffer
0x0380FC18 8 Game card cmd buffer
0x0380FC40 4 Game card transfer handler usually 1C7Fh
0x0380FC44 4 Game card timeout handler usually 1DC5h
Personal tools