From WikiTemp, the GBAtemp wiki
('''DS-Xtreme OpenSource Firmware Project''')
(Undo revision 15644 by 72.161.77.20 (Talk))
 
(46 intermediate revisions by 5 users not shown)
Line 1: Line 1:
== '''DS-Xtreme OpenSource Firmware Project''' ==
+
__NOTOC__
The scope of this project is to open up the DS-Xtreme flash cartridge hardware/firmware for homebrewers to modify. I have asked the DSX for the information prior on embarking on this project. No information was forthcomming.
+
  
I propose the following tasks to achieve that goal.
+
{| width="100%" cellspacing="10" cellpadding="0"
  
  '''01)''' Do Under The Hood research on the DS-X hardware for an insight into what the firmware may be. '''--DONE--'''
+
|colspan="2" style="border: 2px solid black;"|
  '''02)''' Acquire all the files that make up the firmware. '''--DONE--'''
+
<!-- ******************************************************************* -->
 +
<!-- ******************************************************************* -->
 +
{| width="100%" cellspacing="10"
 +
|style="background:#F2F2F2;"|
 +
<div style="font-size:200%;padding:0.4em;">'''DS-Xtreme OpenSource Firmware Project'''</div>
 +
|-
 +
|The '''scope''' of this project is to open up the DS-Xtreme flash cartridge hardware/firmware for homebrewers to modify. I have asked the DS-X for the information prior on embarking on this project. No information was forthcoming.
 +
 
 +
 
 +
Please remember that this wiki is updated and maintained by YOU - '''Please help out where you can!'''
 +
 
 +
 
 +
<div><span style="color:#f4ae08;">Donate your '''DEAD''' DS-X cartridges to this project PM reveng @gbatemp</span></div>
 +
 
 +
There seems little point in continuing the project here. A SVN project needs setting up.
 +
Please watch for further details. In the mean time I have put the Original firmware and new
 +
Versions 113 and unreleased versions 114 on the files page.
 +
There was also some censorship going on with my posts in the Gbatemp DSX forums, so I no longer post.
 +
 
 +
|}
 +
|-
 +
<!-- ******************************************************************* -->
 +
<!-- ******************************************************************* -->
 +
|width="65%" rowspan="2" valign="top" style="border: 2px solid black;"|
 +
 
 +
{| width="100%" height="100%" cellspacing="10"
 +
|style="background:#F2F2F2;"|
 +
<div style="font-size:200%;padding:0.4em;">'''Project Plan'''</div>
 +
|-
 +
|
 +
I propose the following tasks to achieve the "OpenSource" goal.
 +
 
 +
  '''01)''' Do [[DS-Xtreme|Under The Hood]] research on the DS-X hardware for an insight into what the firmware may be. '''--DONE--'''
 +
  '''02)''' Acquire [[DSX_OSFP_FILES|all the files]] that make up the firmware. '''--DONE--'''
  
 
  '''03)''' Disassemble the PC application that updates the firmware. '''--IN PROGRESS--'''
 
  '''03)''' Disassemble the PC application that updates the firmware. '''--IN PROGRESS--'''
  '''04)''' Create a new, "OpenSource" firmware updater based on the knowledge gained.
+
  '''04)''' Create a new, "OpenSource" updater application based on the knowledge gained.
  
  '''05)''' Disassemble the firmware for the USB controller.
+
  '''05)''' Disassemble the core8051 EZ-USB controller firmware.
  '''06)''' Create a new, "OpenSource" firmware from the knowledge gained.
+
  '''06)''' Create a "OpenSource" firmware from the knowledge gained.
  
  '''07)''' Disassemble the firmware for the FPGA.
+
  '''07)''' Disassemble the configuration for the FPGA.
  '''08)''' Create a new, "OpenSource" firmware from the knowledge gained..
+
  '''08)''' Create a "OpenSource" project from the knowledge gained..
  
  '''09)''' Disassemble any native NDS application (the launcher)
+
  '''09)''' Disassemble the native NDS application (the launcher)
 
  '''10)''' Create a new, "OpenSource" launcher from the knowledge gained..
 
  '''10)''' Create a new, "OpenSource" launcher from the knowledge gained..
  
 
  '''11)''' Using the knowledge gained make some schematics of the DS-X cartridge.
 
  '''11)''' Using the knowledge gained make some schematics of the DS-X cartridge.
  
This order was chosen because the firmware "'''update.bin'''" is one large zipped?, binary file. So first we have to decompile the updater application to understand how its zipped and what parts make up the USB, FPGA and NDS launcher....
+
This order was chosen because the firmware "'''[[:image:V112_update.bin| update.bin]]'''" is one large zipped?, binary file. So first we have to decompile the updater application to understand how it's zipped and what parts make up the USB, FPGA and NDS launcher....
 +
 
 +
|}
 +
|}
 +
<!-- ******************************************************************* -->
 +
<!-- ******************************************************************* -->
 +
 
 +
 
 +
== '''How [http://shunyweb.info/forum/ Shuny's] Downgrader Works''' ==
 +
At offset 0x000B79F4 in the [[:media:V112_UpdaterTool.rar| DSX updater application file]] you will find the URL that points to the DS-X server. This is where [[:media:V112_update.txt| update.txt]] can be loaded by the [http://wiki.gbatemp.net/wiki/images/c/cf/V112_UpdaterTool.rar updater application].
 +
 
 +
In the file [[:media:V112_update.txt| update.txt]] there is a URL  which tells the [[:media:V112_UpdaterTool.rar| DSX updater application file]] where it can load [[:media:V112_update.bin| updater.bin]] from.
 +
 
 +
[http://shunyweb.info/forum/ Shuny] patched these URL's to point to another server where the older [[:media:V110_update.txt| update.txt]] and [[:media:V110_update.bin| update.bin]] could be found.
 +
 
 +
Hats of to [http://shunyweb.info/forum/ Shuny] for a very clever and inventive piece of work.
 +
 
 +
 
 +
<!-- ******************************************************************* -->
 +
<!-- ******************************************************************* -->
 +
 
 +
== '''Modifying The [[:image:V112_UpdaterTool.rar| PC Updater]] Application To Load [[:image:V112_update.txt| Update.txt]] and [[:image:V112_update.bin| Update.bin]] Off Your PC''' ==
 +
 
 +
 
 +
Using a [http://www.mirkes.de/blog/uploads/Downloads/mpth_18.exe hex/binary editor] ,alter the URL found in the PC updater at offset '''0x000B79F4'''
  
== '''V1.1.0 Updater Tool Files (Shuny Files)''' ==
 
[[http://wiki.gbatemp.net/images/3/31/V110_Skins.rar]] Launcher skin files.
 
[[http://wiki.gbatemp.net/images/f/f7/V110_update.bin]] USB/FPGA/Launcher firmware.
 
[[http://wiki.gbatemp.net/images/0/09/V110_update.txt]] Updater application info file.
 
[[http://wiki.gbatemp.net/images/3/39/V110_UpdaterTool.rar]] PC Updater application
 
  
== '''V1.1.2 Updater Files (DSX Current Files)''' ==
+
<div><span style="font-family:Courier New;font-size:11pt;">
[[http://wiki.gbatemp.net/images/6/60/V112_Skins.rar]] Launcher skin files.
+
0x0B79F0: 02 29 B9 59 68 74 74 70 3A 2F 2F 75 70 64 61 74 - .)¹Yhttp://updat<BR>
[[http://wiki.gbatemp.net/images/3/30/V112_update.bin]] USB/FPGA/Launcher firmware.
+
0x0B7A00: 65 2E 64 73 2D 78 74 72 65 6D 65 2E 63 6F 6D 2F - e.ds-xtreme.com/<BR>
[[http://wiki.gbatemp.net/images/0/06/V112_update.txt]] Updater application info file
+
0x0B7A10: 75 70 64 61 74 65 6A 2F 75 70 64 61 74 65 2E 74 - updatej/update.t<BR>
[[http://wiki.gbatemp.net/images/c/cf/V112_UpdaterTool.rar]] PC Updater application
+
0x0B7A20: 78 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - xt..............<BR>
 +
0x0B7A30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................<BR>
 +
0x0B7A40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................<BR>
 +
</span></div>
  
== '''Recovery Tool''' ==
 
[[http://wiki.gbatemp.net/images/e/e5/RecoveryDriversXP.rar]] Cypress Windows XP Drivers for the USB Controller.
 
[[http://wiki.gbatemp.net/images/8/8a/RecoveryTool.rar]] The recovery tool (this seems identical to the updater).
 
  
== '''Work In Progress Log''' ==
+
To the following format: '''file://My PC Name or My PC IP/My Path/update.txt''' (you must terminate the string with zero).<BR>
 +
Try not to go to far past the original URL string length as it might cause trouble.
  
  
'''5th January 2008:'''
+
<div><span style="font-family:Courier New;font-size:11pt;">
 +
0x0B79F0: 02 29 B9 59 66 69 6C 65 3A 2F 2F 4D 79 50 43 6F - .)¹Yfile://MyPCo<BR>
 +
0x0B7A00: 72 49 50 2F 4D 79 50 61 74 68 2F 75 70 64 61 74 - rIP/MyPath/updat<BR>
 +
0x0B7A10: 65 2E 74 78 74 00 00 00 00 00 00 00 00 00 00 00 - e.txt...........<BR>
 +
0x0B7A20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................<BR>
 +
0x0B7A30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................<BR>
 +
0x0B7A40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................<BR>
 +
</span></div>
  
Initial viewing of the PC Updater tool yields the following information.
 
  
1) The updater was coded with Borland Delphi development enviroment in C/C++.
+
Next change the URL found in update.txt with '''file://My PC Name Or My PC IP/My Path/update.bin'''<BR>
2) The updater contains ZLIB compression librarys (probabily for the firmware).
+
<BR>
3) The updater contains Altera Jam FPGA communication librarys (maybe for the JTAG connector on the circuit board).
+
4) The updater contains Mozilla/3.0 (compatible; Indy Library).
+
5) The Updater contains Cypress USB communication librarys.
+
  
On running the updater, it uses windows sockets api to download '''update.txt''' and '''update.bin''' from the DSX server. The mozilla api is probabily the wrapper to call the windows sockets api, for platform independancy. Delphi also has wrappers for the application windows. The applications resources can easily be pulled out with XN Resource editor. I've also noticed on some of the disassembly that the updater looks like it can take command line arguments?
+
'''My PC Name''' is what you see the PC called on the network (Host Name)<BR>
 +
'''My PC IP''' is your local machines IP address I.E 192.168.0.100 <BR>
 +
'''My Path''' is whatever path or paths you choose to put the update files in.<BR>
 +
<BR>
 +
Use START->RUN->CMD ipconfig /ALL to find your Host Name and IP Address, if you don't know it<BR>
  
  
ToDo:
 
I'm currently trying out a few disassemblers on the .exe to see which gives me the best results.
 
The hardware investigations need putting on the wiki on a seperate page.
 
The files need moving to a seperate wiki page.
 
  
 +
<!-- ******************************************************************* -->
 +
<!-- ******************************************************************* -->
  
All in all not bad going for a weak lameass like me :)
 
  
 +
Look here for out last chance ^^: http://forums.ds-xtreme.com/showthread.php?p=57612
  
 
[[Category:NDS Slot-1 Carts]]
 
[[Category:NDS Slot-1 Carts]]

Latest revision as of 10:19, 28 October 2008


DS-Xtreme OpenSource Firmware Project
The scope of this project is to open up the DS-Xtreme flash cartridge hardware/firmware for homebrewers to modify. I have asked the DS-X for the information prior on embarking on this project. No information was forthcoming.


Please remember that this wiki is updated and maintained by YOU - Please help out where you can!


Donate your DEAD DS-X cartridges to this project PM reveng @gbatemp
There seems little point in continuing the project here. A SVN project needs setting up.
Please watch for further details. In the mean time I have put the Original firmware and new
Versions 113 and unreleased versions 114 on the files page. 
There was also some censorship going on with my posts in the Gbatemp DSX forums, so I no longer post.
Project Plan

I propose the following tasks to achieve the "OpenSource" goal.

01) Do Under The Hood research on the DS-X hardware for an insight into what the firmware may be. --DONE--
02) Acquire all the files that make up the firmware. --DONE--
03) Disassemble the PC application that updates the firmware. --IN PROGRESS--
04) Create a new, "OpenSource" updater application based on the knowledge gained.
05) Disassemble the core8051 EZ-USB controller firmware.
06) Create a "OpenSource" firmware from the knowledge gained.
07) Disassemble the configuration for the FPGA.
08) Create a "OpenSource" project from the knowledge gained..
09) Disassemble the native NDS application (the launcher)
10) Create a new, "OpenSource" launcher from the knowledge gained..
11) Using the knowledge gained make some schematics of the DS-X cartridge.

This order was chosen because the firmware " update.bin" is one large zipped?, binary file. So first we have to decompile the updater application to understand how it's zipped and what parts make up the USB, FPGA and NDS launcher....


How Shuny's Downgrader Works

At offset 0x000B79F4 in the DSX updater application file you will find the URL that points to the DS-X server. This is where update.txt can be loaded by the updater application.

In the file update.txt there is a URL which tells the DSX updater application file where it can load updater.bin from.

Shuny patched these URL's to point to another server where the older update.txt and update.bin could be found.

Hats of to Shuny for a very clever and inventive piece of work.


Modifying The PC Updater Application To Load Update.txt and Update.bin Off Your PC

Using a hex/binary editor ,alter the URL found in the PC updater at offset 0x000B79F4


0x0B79F0: 02 29 B9 59 68 74 74 70 3A 2F 2F 75 70 64 61 74 - .)¹Yhttp://updat
0x0B7A00: 65 2E 64 73 2D 78 74 72 65 6D 65 2E 63 6F 6D 2F - e.ds-xtreme.com/
0x0B7A10: 75 70 64 61 74 65 6A 2F 75 70 64 61 74 65 2E 74 - updatej/update.t
0x0B7A20: 78 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - xt..............
0x0B7A30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................
0x0B7A40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................


To the following format: file://My PC Name or My PC IP/My Path/update.txt (you must terminate the string with zero).
Try not to go to far past the original URL string length as it might cause trouble.


0x0B79F0: 02 29 B9 59 66 69 6C 65 3A 2F 2F 4D 79 50 43 6F - .)¹Yfile://MyPCo
0x0B7A00: 72 49 50 2F 4D 79 50 61 74 68 2F 75 70 64 61 74 - rIP/MyPath/updat
0x0B7A10: 65 2E 74 78 74 00 00 00 00 00 00 00 00 00 00 00 - e.txt...........
0x0B7A20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................
0x0B7A30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................
0x0B7A40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................


Next change the URL found in update.txt with file://My PC Name Or My PC IP/My Path/update.bin

My PC Name is what you see the PC called on the network (Host Name)
My PC IP is your local machines IP address I.E 192.168.0.100
My Path is whatever path or paths you choose to put the update files in.

Use START->RUN->CMD ipconfig /ALL to find your Host Name and IP Address, if you don't know it



Look here for out last chance ^^: http://forums.ds-xtreme.com/showthread.php?p=57612