This entry was posted in DSi, Portfolio and tagged ds, fpga, hacks, microscope, nintendo, reverse engineering, soldering on September 16, 2009 by Micah.

Well, Ive been meaning to write a detailed blog post explaining it all- but I keep running out of time.

The executive summary is that Ive been working on making it possible to run homebrew games on the DSi.

If youve used The Homebrew Channel on the Wii, you know what Im talking about- wed basically like to have the same thing for the DSi.

And as it turns out, the DSi has a lot in common with the Wii.

Nintendo Dsi Hack Software And Hardware

Ive been collaborating with the excellent software and hardware engineers in Team Twiizers, the group responsible for The Homebrew Channel.

Bushing has written a couple blog posts about our DSi efforts so far: one on the RAM tracing effort in general, and one with a sample trace.

My role in this project lately has been building hardware and software for a tool which is effectively a low-level CPU debugger for the DSi.

It attaches to the RAM bus between the RAM and CPU, its capable of tracing all traffic in real-time (after slowing down the system clock so the required bandwidth fits in USB 2.0), and just this week I got RAM injection working.

The hardware interposes on one of the chip select signals between the CPU and RAM.

If an address floats by that we want to patch, the hardware can quickly disable the real RAM chip and drive new data onto the bus as the CPU continues to read.

Nintendo Dsi Hack Code From Within

So why is all the complex hardware needed Well, we hit two big dead-ends: Several of us managed to run code from within a DSi-enhanced game using modified save files, but most of the interesting hardware on the DSi (like the SD card slot, and the internal flash memory) is disabled when these games are running.

The earlier Team Twiizers Classic Word Games hack, WinterMutes cookhack, and my own cookinject all suffer from this problem.

This isnt as interesting as it may sound, since nearly all of the flash is encrypted.

However, by running a lot of tests where we modified or compared the encrypted data, we were still able to gain a lot of knowledge about the layout of the flash memory, and some information about how the system boots.

What wed really like to do is understand more about how the consoles main menu works, and how software is installed and loaded on the DSi.

It required an FPGA and a lot of crazy soldering under a microscope, but now its working and were well on our way to unlocking the secrets of DSi homebrew.

If youre interested in following our efforts to make homebrew possible on the DSi, definitely subscribe to Bushings blog at hackmii.com.

He understands the Wii (and by extension, the DSi) better than I ever will, and hes great at writing about it.

I have a Flickr set with lots more photos, but these are two of my favorite.

The first is a photo of the entire setup as its currently configured.

The second is a picture of the craziest of the microscopic solder joints in this project.

This is where I separated the chip-select signal I mentioned above, giving the FPGA the ability to sit between the CPU and RAM.

The trace Im tapping into is buried under four other PCB layers.

For a sense of scale, the orange enameled wire is 32 AWG, or about 0.2mm in diameter.

Normal 30 AWG wire-wrapping wire is actually only the third smallest size of wire Ive been using in this project If youre interested in the C and Verilog source code, its in Subversion as usual.