General ARM7TDMI Information ARM CPU Overview ARM CPU Register Set ARM CPU Flags & Condition Field (cond) ARM CPU 26bit Memory Interface ARM CPU Exceptions ARM CPU Memory Alignments Further Information ARM Pseudo Instructions and Directives ARM CP15 System Control Coprocessor ARM CPU Instruction Cycle Times ARM CPU Versions ARM CPU Data Sheet |
ARM 32bit Opcodes (ARM Code) ARM Instruction Summary ARM Branch and Branch with Link (B, BL, BX, BLX, SWI, BKPT) ARM Data Processing (ALU) ARM Multiply and Multiply-Accumulate (MUL, MLA) ARM Special ARM9 Instructions (CLZ, QADD/QSUB) ARM PSR Transfer (MRS, MSR) ARM Memory: Single Data Transfer (LDR, STR, PLD) ARM Memory: Halfword, Doubleword, and Signed Data Transfer ARM Memory: Block Data Transfer (LDM, STM) ARM Memory: Single Data Swap (SWP) ARM Coprocessor (MRC/MCR, LDC/STC, CDP, MCRR/MRRC) |
ARM 16bit Opcodes (THUMB Code) When operating in THUMB state, cut-down 16bit opcodes are used. THUMB is supported on T-variants of ARMv4 and up, ie. ARMv4T, ARMv5T, etc. THUMB Instruction Summary THUMB Register Operations (ALU, BX) THUMB Memory Load/Store (LDR/STR) THUMB Memory Addressing (ADD PC/SP) THUMB Memory Multiple Load/Store (PUSH/POP and LDM/STM) THUMB Jumps and Calls |
GBA Reference |
GBA Technical Data |
ARM Mode ARM7TDMI 32bit RISC CPU, 16.78MHz, 32bit opcodes (GBA) THUMB Mode ARM7TDMI 32bit RISC CPU, 16.78MHz, 16bit opcodes (GBA) CGB Mode Z80/8080-style 8bit CPU, 4.2MHz or 8.4MHz (CGB compatibility) DMG Mode Z80/8080-style 8bit CPU, 4.2MHz (monochrome gameboy compatib.) |
BIOS ROM 16 KBytes Work RAM 288 KBytes (Fast 32K on-chip, plus Slow 256K on-board) VRAM 96 KBytes OAM 1 KByte (128 OBJs 3x16bit, 32 OBJ-Rotation/Scalings 4x16bit) Palette RAM 1 KByte (256 BG colors, 256 OBJ colors) |
Display 240x160 pixels (2.9 inch TFT color LCD display) BG layers 4 background layers BG types Tile/map based, or Bitmap based BG colors 256 colors, or 16 colors/16 palettes, or 32768 colors OBJ colors 256 colors, or 16 colors/16 palettes OBJ size 12 types (in range 8x8 up to 64x64 dots) OBJs/Screen max. 128 OBJs of any size (up to 64x64 dots each) OBJs/Line max. 128 OBJs of 8x8 dots size (under best circumstances) Priorities OBJ/OBJ: 0-127, OBJ/BG: 0-3, BG/BG: 0-3 Effects Rotation/Scaling, alpha blending, fade-in/out, mosaic, window Backlight GBA SP only (optionally by light on/off toggle button) |
Analogue 4 channel CGB compatible (3x square wave, 1x noise) Digital 2 DMA sound channels Output Built-in speaker (mono), or headphones socket (stereo) |
Gamepad 4 Direction Keys, 6 Buttons |
Serial Port Various transfer modes, 4-Player Link, Single Game Pak play |
GBA Game Pak max. 32MB ROM or flash ROM + max 64K SRAM CGB Game Pak max. 32KB ROM + 8KB SRAM (more memory requires banking) |
Size (mm) GBA: 145x81x25 - GBA SP: 82x82x24 (closed), 155x82x24 (stretch) |
Battery GBA GBA: 2x1.5V DC (AA), Life-time approx. 15 hours Battery SP GBA SP: Built-in rechargeable Lithium ion battery, 3.7V 600mAh External GBA: 3.3V DC 350mA - GBA SP: 5.2V DC 320mA |
---------------------------------------------------------------------------- |
____._____________...___.____ ____/ : CARTRIDGE SIO : \____ | L _____________________ LED R | | | | | | _||_ | 2.9" TFT SCREEN | (A) | | |_ _| | 240x160pix 61x40mm | (B) | | || | NO BACKLIGHT | :::: | | | | SPEAKR | | STRT() |_____________________| :::: | | SLCT() GAME BOY ADVANCE VOLUME | |____ OFF-ON BATTERY 2xAA PHONES _==_| \__.##.__________________,,___/ |
_______________________ _ | _____________________ | / / || || / / || 2.9" TFT SCREEN || / / || 240x160pix 61x40mm || / / || WITH BACKLIGHT || / / || || GBA SP SIDE VIEWS / / ||_____________________|| / / | GAME BOY ADVANCE SP | _____________________(_) |_______________________| |. . . . . . . .'.'. _| |_|________|________|_|_| |_CARTRIDGE_:_BATT._:_|_| <-- EXT1/EXT2 |L EXT1 EXT2 R| | (*) LEDSo _____________________ _ (VOL_||_ (A) o |_____________________(_) | |_ _| ,,,,,(B) | |. . . . . . . .'.'. _| | || ;SPK; | |_CARTRIDGE_:_BATT._:_|_| <-- EXT1/EXT2 | ''''' ON # _ _____________________ | SLCT STRT OFF# _____________________(_)_____________________| | CART. () () | |. . . . . . . .'.'. _| |_:___________________:_| |_CARTRIDGE_:_BATT._:_|_| <-- EXT1/EXT2 |
________________SIO_______________ | L __________________ R | | | GBA-MICRO | | | _||_ | 2.0" TFT SCREEN | (A)| + ||_ _| |240x160pix 42x28mm| (B) |VOL | || | BACKLIGHT | | - | |__________________| ... | |___________SELECT__START__________| PWR <--- CARTRIDGE SLOT ---> PHONES |
_____________________________________ | _____________________ | | | | | | | 3" TFT SCREEN | | | | 256x192pix 61x46mm | | | | BACKLIGHT | | | ::::: | Original NDS | ::::: | | ::::: |_____________________| ::::: | _| _ ______ _ |_ <-- gap between screens: 22mm |L|_______| |________| |_| |_______|R| (equivalent to 90 pixels) |_______ _____________________ _______| | PWR | | | |SEL STA| | _ | | 3" TFT SCREEN | | | | _| |_ | | 256x192pix 61x46mm | | X | ||_ _|| | BACKLIGHT | | Y A | | |_| | | TOUCH SCREEN | | B | | | |_____________________| | | |_______| NintendoDS |_______| | MIC LEDS | |_________________________________________| VOL SLOT2(GBA) MIC/PHONES |
_____________________________________ | _____________________ | | | | | | | 3" TFT SCREEN | | | ... | 256x192pix 61x46mm | ... | | ... | BACKLIGHT | ... | | | NDS-LITE | | | |_____________________| | |___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ____| <-- gap between screens: 23mm L| _ |_____________MIC____________|LEDS|R | _ _____________________ | | _| |_ | | X | ||_ _|| 3" TFT SCREEN | Y A |PWR | |_| | 256x192pix 61x46mm | B | | | BACKLIGHT | | | | TOUCH SCREEN |oSTART | | |_____________________|oSELECT| |_____________________________________| VOL SLOT2(GBA) MIC/PHONES |
_____________________________________ | _____________________ | | | | O o | <-- CAM (O) and LED (o) | | 3.25" TFT SCREEN | | (on backside) | | 256x192pix 66x50mm | | | | BACKLIGHT | | | __ | DSi | __ | | (__) |_____________________| (__) | |___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ____| <-- gap between screens: 23mm L|LEDS|__________CAM__MIC_________| __ |R (88 pixels) + | _ _____________________ | VOL| _| |_ | | X | <-- SD Card Slot - ||_ _|| 3.25" TFT SCREEN | Y A | | |_| | 256x192pix 66x50mm | B | | | BACKLIGHT | | | | TOUCH SCREEN |oSTART | | POWERo|_____________________|oSELECT| |_____________________________________| MIC/PHONES |
As DSi, but bigger case, and bigger 4.2" screens |
_________ L____------- -------____R / ___ \ / (Y) \Z / / O \ | (START) | (X)\ Z = Gameboy Player Menu | \___/ \_______/ (A) | X or Y = Select button |\ _ \ / (B) /| | \___ _| |_ \ / ___ ___/ | optionally X/Y can be | |\ |_ _| / \ / C \ /| | swapped with L/R (?) | | \ |_| / \ \___/ / | | | | \_____/ \_____/ | | analogue sticks = ? \__/ \__/ |
_______ _______ / Y \ / X \ Y/B = left bongo rear/front side | . . . . |_| . . . . | X/A = right bongo rear/front side | B |R| A | S = start/pause button |\_______/|_|\_______/| R = microphone (triggers R button) |\_______/|S|\_______/| | |_| | (the X/Y inputs can be assigned to |\_______/| |\_______/| GBA R/L inputs in GBA player setup) \_______/ \_______/ |
GBA Memory Map |
00000000-00003FFF BIOS - System ROM (16 KBytes) 00004000-01FFFFFF Not used 02000000-0203FFFF WRAM - On-board Work RAM (256 KBytes) 2 Wait 02040000-02FFFFFF Not used 03000000-03007FFF WRAM - On-chip Work RAM (32 KBytes) 03008000-03FFFFFF Not used 04000000-040003FE I/O Registers 04000400-04FFFFFF Not used |
05000000-050003FF BG/OBJ Palette RAM (1 Kbyte) 05000400-05FFFFFF Not used 06000000-06017FFF VRAM - Video RAM (96 KBytes) 06018000-06FFFFFF Not used 07000000-070003FF OAM - OBJ Attributes (1 Kbyte) 07000400-07FFFFFF Not used |
08000000-09FFFFFF Game Pak ROM/FlashROM (max 32MB) - Wait State 0 0A000000-0BFFFFFF Game Pak ROM/FlashROM (max 32MB) - Wait State 1 0C000000-0DFFFFFF Game Pak ROM/FlashROM (max 32MB) - Wait State 2 0E000000-0E00FFFF Game Pak SRAM (max 64 KBytes) - 8bit Bus width 0E010000-0FFFFFFF Not used |
10000000-FFFFFFFF Not used (upper 4bits of address bus unused) |
Region Bus Read Write Cycles BIOS ROM 32 8/16/32 - 1/1/1 Work RAM 32K 32 8/16/32 8/16/32 1/1/1 I/O 32 8/16/32 8/16/32 1/1/1 OAM 32 8/16/32 16/32 1/1/1 * Work RAM 256K 16 8/16/32 8/16/32 3/3/6 ** Palette RAM 16 8/16/32 16/32 1/1/2 * VRAM 16 8/16/32 16/32 1/1/2 * GamePak ROM 16 8/16/32 - 5/5/8 **/*** GamePak Flash 16 8/16/32 16/32 5/5/8 **/*** GamePak SRAM 8 8 8 5 ** |
* Plus 1 cycle if GBA accesses video memory at the same time. ** Default waitstate settings, see System Control chapter. *** Separate timings for sequential, and non-sequential accesses. One cycle equals approx. 59.59ns (ie. 16.78MHz clock). |
GBA I/O Map |
4000000h 2 R/W DISPCNT LCD Control 4000002h 2 R/W - Undocumented - Green Swap 4000004h 2 R/W DISPSTAT General LCD Status (STAT,LYC) 4000006h 2 R VCOUNT Vertical Counter (LY) 4000008h 2 R/W BG0CNT BG0 Control 400000Ah 2 R/W BG1CNT BG1 Control 400000Ch 2 R/W BG2CNT BG2 Control 400000Eh 2 R/W BG3CNT BG3 Control 4000010h 2 W BG0HOFS BG0 X-Offset 4000012h 2 W BG0VOFS BG0 Y-Offset 4000014h 2 W BG1HOFS BG1 X-Offset 4000016h 2 W BG1VOFS BG1 Y-Offset 4000018h 2 W BG2HOFS BG2 X-Offset 400001Ah 2 W BG2VOFS BG2 Y-Offset 400001Ch 2 W BG3HOFS BG3 X-Offset 400001Eh 2 W BG3VOFS BG3 Y-Offset 4000020h 2 W BG2PA BG2 Rotation/Scaling Parameter A (dx) 4000022h 2 W BG2PB BG2 Rotation/Scaling Parameter B (dmx) 4000024h 2 W BG2PC BG2 Rotation/Scaling Parameter C (dy) 4000026h 2 W BG2PD BG2 Rotation/Scaling Parameter D (dmy) 4000028h 4 W BG2X BG2 Reference Point X-Coordinate 400002Ch 4 W BG2Y BG2 Reference Point Y-Coordinate 4000030h 2 W BG3PA BG3 Rotation/Scaling Parameter A (dx) 4000032h 2 W BG3PB BG3 Rotation/Scaling Parameter B (dmx) 4000034h 2 W BG3PC BG3 Rotation/Scaling Parameter C (dy) 4000036h 2 W BG3PD BG3 Rotation/Scaling Parameter D (dmy) 4000038h 4 W BG3X BG3 Reference Point X-Coordinate 400003Ch 4 W BG3Y BG3 Reference Point Y-Coordinate 4000040h 2 W WIN0H Window 0 Horizontal Dimensions 4000042h 2 W WIN1H Window 1 Horizontal Dimensions 4000044h 2 W WIN0V Window 0 Vertical Dimensions 4000046h 2 W WIN1V Window 1 Vertical Dimensions 4000048h 2 R/W WININ Inside of Window 0 and 1 400004Ah 2 R/W WINOUT Inside of OBJ Window & Outside of Windows 400004Ch 2 W MOSAIC Mosaic Size 400004Eh - - Not used 4000050h 2 R/W BLDCNT Color Special Effects Selection 4000052h 2 R/W BLDALPHA Alpha Blending Coefficients 4000054h 2 W BLDY Brightness (Fade-In/Out) Coefficient 4000056h - - Not used |
4000060h 2 R/W SOUND1CNT_L Channel 1 Sweep register (NR10) 4000062h 2 R/W SOUND1CNT_H Channel 1 Duty/Length/Envelope (NR11, NR12) 4000064h 2 R/W SOUND1CNT_X Channel 1 Frequency/Control (NR13, NR14) 4000066h - - Not used 4000068h 2 R/W SOUND2CNT_L Channel 2 Duty/Length/Envelope (NR21, NR22) 400006Ah - - Not used 400006Ch 2 R/W SOUND2CNT_H Channel 2 Frequency/Control (NR23, NR24) 400006Eh - - Not used 4000070h 2 R/W SOUND3CNT_L Channel 3 Stop/Wave RAM select (NR30) 4000072h 2 R/W SOUND3CNT_H Channel 3 Length/Volume (NR31, NR32) 4000074h 2 R/W SOUND3CNT_X Channel 3 Frequency/Control (NR33, NR34) 4000076h - - Not used 4000078h 2 R/W SOUND4CNT_L Channel 4 Length/Envelope (NR41, NR42) 400007Ah - - Not used 400007Ch 2 R/W SOUND4CNT_H Channel 4 Frequency/Control (NR43, NR44) 400007Eh - - Not used 4000080h 2 R/W SOUNDCNT_L Control Stereo/Volume/Enable (NR50, NR51) 4000082h 2 R/W SOUNDCNT_H Control Mixing/DMA Control 4000084h 2 R/W SOUNDCNT_X Control Sound on/off (NR52) 4000086h - - Not used 4000088h 2 BIOS SOUNDBIAS Sound PWM Control 400008Ah .. - - Not used 4000090h 2x10h R/W WAVE_RAM Channel 3 Wave Pattern RAM (2 banks!!) 40000A0h 4 W FIFO_A Channel A FIFO, Data 0-3 40000A4h 4 W FIFO_B Channel B FIFO, Data 0-3 40000A8h - - Not used |
40000B0h 4 W DMA0SAD DMA 0 Source Address 40000B4h 4 W DMA0DAD DMA 0 Destination Address 40000B8h 2 W DMA0CNT_L DMA 0 Word Count 40000BAh 2 R/W DMA0CNT_H DMA 0 Control 40000BCh 4 W DMA1SAD DMA 1 Source Address 40000C0h 4 W DMA1DAD DMA 1 Destination Address 40000C4h 2 W DMA1CNT_L DMA 1 Word Count 40000C6h 2 R/W DMA1CNT_H DMA 1 Control 40000C8h 4 W DMA2SAD DMA 2 Source Address 40000CCh 4 W DMA2DAD DMA 2 Destination Address 40000D0h 2 W DMA2CNT_L DMA 2 Word Count 40000D2h 2 R/W DMA2CNT_H DMA 2 Control 40000D4h 4 W DMA3SAD DMA 3 Source Address 40000D8h 4 W DMA3DAD DMA 3 Destination Address 40000DCh 2 W DMA3CNT_L DMA 3 Word Count 40000DEh 2 R/W DMA3CNT_H DMA 3 Control 40000E0h - - Not used |
4000100h 2 R/W TM0CNT_L Timer 0 Counter/Reload 4000102h 2 R/W TM0CNT_H Timer 0 Control 4000104h 2 R/W TM1CNT_L Timer 1 Counter/Reload 4000106h 2 R/W TM1CNT_H Timer 1 Control 4000108h 2 R/W TM2CNT_L Timer 2 Counter/Reload 400010Ah 2 R/W TM2CNT_H Timer 2 Control 400010Ch 2 R/W TM3CNT_L Timer 3 Counter/Reload 400010Eh 2 R/W TM3CNT_H Timer 3 Control 4000110h - - Not used |
4000120h 4 R/W SIODATA32 SIO Data (Normal-32bit Mode; shared with below) 4000120h 2 R/W SIOMULTI0 SIO Data 0 (Parent) (Multi-Player Mode) 4000122h 2 R/W SIOMULTI1 SIO Data 1 (1st Child) (Multi-Player Mode) 4000124h 2 R/W SIOMULTI2 SIO Data 2 (2nd Child) (Multi-Player Mode) 4000126h 2 R/W SIOMULTI3 SIO Data 3 (3rd Child) (Multi-Player Mode) 4000128h 2 R/W SIOCNT SIO Control Register 400012Ah 2 R/W SIOMLT_SEND SIO Data (Local of MultiPlayer; shared below) 400012Ah 2 R/W SIODATA8 SIO Data (Normal-8bit and UART Mode) 400012Ch - - Not used |
4000130h 2 R KEYINPUT Key Status 4000132h 2 R/W KEYCNT Key Interrupt Control |
4000134h 2 R/W RCNT SIO Mode Select/General Purpose Data 4000136h - - IR Ancient - Infrared Register (Prototypes only) 4000138h - - Not used 4000140h 2 R/W JOYCNT SIO JOY Bus Control 4000142h - - Not used 4000150h 4 R/W JOY_RECV SIO JOY Bus Receive Data 4000154h 4 R/W JOY_TRANS SIO JOY Bus Transmit Data 4000158h 2 R/? JOYSTAT SIO JOY Bus Receive Status 400015Ah - - Not used |
4000200h 2 R/W IE Interrupt Enable Register 4000202h 2 R/W IF Interrupt Request Flags / IRQ Acknowledge 4000204h 2 R/W WAITCNT Game Pak Waitstate Control 4000206h - - Not used 4000208h 2 R/W IME Interrupt Master Enable Register 400020Ah - - Not used 4000300h 1 R/W POSTFLG Undocumented - Post Boot Flag 4000301h 1 W HALTCNT Undocumented - Power Down Control 4000302h - - Not used 4000410h ? ? ? Undocumented - Purpose Unknown / Bug ??? 0FFh 4000411h - - Not used 4000800h 4 R/W ? Undocumented - Internal Memory Control (R/W) 4000804h - - Not used 4xx0800h 4 R/W ? Mirrors of 4000800h (repeated each 64K) |
GBA LCD Video Controller |
LCD I/O Display Control |
Bit Expl. 0-2 BG Mode (0-5=Video Mode 0-5, 6-7=Prohibited) 3 Reserved / CGB Mode (0=GBA, 1=CGB; can be set only by BIOS opcodes) 4 Display Frame Select (0-1=Frame 0-1) (for BG Modes 4,5 only) 5 H-Blank Interval Free (1=Allow access to OAM during H-Blank) 6 OBJ Character VRAM Mapping (0=Two dimensional, 1=One dimensional) 7 Forced Blank (1=Allow FAST access to VRAM,Palette,OAM) 8 Screen Display BG0 (0=Off, 1=On) 9 Screen Display BG1 (0=Off, 1=On) 10 Screen Display BG2 (0=Off, 1=On) 11 Screen Display BG3 (0=Off, 1=On) 12 Screen Display OBJ (0=Off, 1=On) 13 Window 0 Display Flag (0=Off, 1=On) 14 Window 1 Display Flag (0=Off, 1=On) 15 OBJ Window Display Flag (0=Off, 1=On) |
Mode Rot/Scal Layers Size Tiles Colors Features 0 No 0123 256x256..512x515 1024 16/16..256/1 SFMABP 1 Mixed 012- (BG0,BG1 as above Mode 0, BG2 as below Mode 2) 2 Yes --23 128x128..1024x1024 256 256/1 S-MABP 3 Yes --2- 240x160 1 32768 --MABP 4 Yes --2- 240x160 2 256/1 --MABP 5 Yes --2- 160x128 2 32768 --MABP |
Bit Expl. 0 Green Swap (0=Normal, 1=Swap) 1-15 Not used |
LCD I/O Interrupts and Status |
Bit Expl. 0 V-Blank flag (Read only) (1=VBlank) (set in line 160..226; not 227) 1 H-Blank flag (Read only) (1=HBlank) (toggled in all lines, 0..227) 2 V-Counter flag (Read only) (1=Match) (set in selected line) (R) 3 V-Blank IRQ Enable (1=Enable) (R/W) 4 H-Blank IRQ Enable (1=Enable) (R/W) 5 V-Counter IRQ Enable (1=Enable) (R/W) 6 Not used (0) / DSi: LCD Initialization Ready (0=Busy, 1=Ready) (R) 7 Not used (0) / NDS: MSB of V-Vcount Setting (LYC.Bit8) (0..262)(R/W) 8-15 V-Count Setting (LYC) (0..227) (R/W) |
Bit Expl. 0-7 Current Scanline (LY) (0..227) (R) 8 Not used (0) / NDS: MSB of Current Scanline (LY.Bit8) (0..262) (R) 9-15 Not Used (0) |
LCD I/O BG Control |
Bit Expl. 0-1 BG Priority (0-3, 0=Highest) 2-3 Character Base Block (0-3, in units of 16 KBytes) (=BG Tile Data) 4-5 Not used (must be zero) (except in NDS mode: MSBs of char base) 6 Mosaic (0=Disable, 1=Enable) 7 Colors/Palettes (0=16/16, 1=256/1) 8-12 Screen Base Block (0-31, in units of 2 KBytes) (=BG Map Data) 13 BG0/BG1: Not used (except in NDS mode: Ext Palette Slot for BG0/BG1) 13 BG2/BG3: Display Area Overflow (0=Transparent, 1=Wraparound) 14-15 Screen Size (0-3) |
Value Text Mode Rotation/Scaling Mode 0 256x256 (2K) 128x128 (256 bytes) 1 512x256 (4K) 256x256 (1K) 2 256x512 (4K) 512x512 (4K) 3 512x512 (8K) 1024x1024 (16K) |
LCD I/O BG Scrolling |
Bit Expl. 0-8 Offset (0-511) 9-15 Not used |
LCD I/O BG Rotation/Scaling |
Bit Expl. 0-7 Fractional portion (8 bits) 8-26 Integer portion (19 bits) 27 Sign (1 bit) 28-31 Not used |
Bit Expl. 0-7 Fractional portion (8 bits) 8-14 Integer portion (7 bits) 15 Sign (1 bit) |
Rotation Center X and Y Coordinates (x0,y0) Rotation Angle (alpha) Magnification X and Y Values (xMag,yMag) |
A = Cos (alpha) / xMag ;distance moved in direction x, same line B = Sin (alpha) / xMag ;distance moved in direction x, next line C = Sin (alpha) / yMag ;distance moved in direction y, same line D = Cos (alpha) / yMag ;distance moved in direction y, next line |
x0,y0 Rotation Center x1,y1 Old Position of a pixel (before rotation/scaling) x2,y2 New position of above pixel (after rotation scaling) A,B,C,D BG2PA-BG2PD Parameters (as calculated above) |
x2 = A(x1-x0) + B(y1-y0) + x0 y2 = C(x1-x0) + D(y1-y0) + y0 |
LCD I/O Window Feature |
Bit Expl. 0-7 X2, Rightmost coordinate of window, plus 1 8-15 X1, Leftmost coordinate of window |
Bit Expl. 0-7 Y2, Bottom-most coordinate of window, plus 1 8-15 Y1, Top-most coordinate of window |
Bit Expl. 0-3 Window 0 BG0-BG3 Enable Bits (0=No Display, 1=Display) 4 Window 0 OBJ Enable Bit (0=No Display, 1=Display) 5 Window 0 Color Special Effect (0=Disable, 1=Enable) 6-7 Not used 8-11 Window 1 BG0-BG3 Enable Bits (0=No Display, 1=Display) 12 Window 1 OBJ Enable Bit (0=No Display, 1=Display) 13 Window 1 Color Special Effect (0=Disable, 1=Enable) 14-15 Not used |
Bit Expl. 0-3 Outside BG0-BG3 Enable Bits (0=No Display, 1=Display) 4 Outside OBJ Enable Bit (0=No Display, 1=Display) 5 Outside Color Special Effect (0=Disable, 1=Enable) 6-7 Not used 8-11 OBJ Window BG0-BG3 Enable Bits (0=No Display, 1=Display) 12 OBJ Window OBJ Enable Bit (0=No Display, 1=Display) 13 OBJ Window Color Special Effect (0=Disable, 1=Enable) 14-15 Not used |
LCD I/O Mosaic Function |
Bit Expl. 0-3 BG Mosaic H-Size (minus 1) 4-7 BG Mosaic V-Size (minus 1) 8-11 OBJ Mosaic H-Size (minus 1) 12-15 OBJ Mosaic V-Size (minus 1) 16-31 Not used |
LCD I/O Color Special Effects |
Bit Expl. 0 BG0 1st Target Pixel (Background 0) 1 BG1 1st Target Pixel (Background 1) 2 BG2 1st Target Pixel (Background 2) 3 BG3 1st Target Pixel (Background 3) 4 OBJ 1st Target Pixel (Top-most OBJ pixel) 5 BD 1st Target Pixel (Backdrop) 6-7 Color Special Effect (0-3, see below) 0 = None (Special effects disabled) 1 = Alpha Blending (1st+2nd Target mixed) 2 = Brightness Increase (1st Target becomes whiter) 3 = Brightness Decrease (1st Target becomes blacker) 8 BG0 2nd Target Pixel (Background 0) 9 BG1 2nd Target Pixel (Background 1) 10 BG2 2nd Target Pixel (Background 2) 11 BG3 2nd Target Pixel (Background 3) 12 OBJ 2nd Target Pixel (Top-most OBJ pixel) 13 BD 2nd Target Pixel (Backdrop) 14-15 Not used |
Bit Expl. 0-4 EVA Coefficient (1st Target) (0..16 = 0/16..16/16, 17..31=16/16) 5-7 Not used 8-12 EVB Coefficient (2nd Target) (0..16 = 0/16..16/16, 17..31=16/16) 13-15 Not used |
I = MIN ( 31, I1st*EVA + I2nd*EVB ) |
Bit Expl. 0-4 EVY Coefficient (Brightness) (0..16 = 0/16..16/16, 17..31=16/16) 5-31 Not used |
I = I1st + (31-I1st)*EVY ;For Brightness Increase I = I1st - (I1st)*EVY ;For Brightness Decrease |
LCD VRAM Overview |
06000000-0600FFFF 64 KBytes shared for BG Map and Tiles 06010000-06017FFF 32 KBytes OBJ Tiles |
Item Depth Required Memory One Tile 4bit 20h bytes One Tile 8bit 40h bytes 1024 Tiles 4bit 8000h (32K) 1024 Tiles 8bit 10000h (64K) - excluding some bytes for BG map BG Map 32x32 800h (2K) BG Map 64x64 2000h (8K) |
Item Depth Required Memory One Tile 8bit 40h bytes 256 Tiles 8bit 4000h (16K) BG Map 16x16 100h bytes BG Map 128x128 4000h (16K) |
06000000-06013FFF 80 KBytes Frame 0 buffer (only 75K actually used) 06014000-06017FFF 16 KBytes OBJ Tiles |
06000000-06009FFF 40 KBytes Frame 0 buffer (only 37.5K used in Mode 4) 0600A000-06013FFF 40 KBytes Frame 1 buffer (only 37.5K used in Mode 4) 06014000-06017FFF 16 KBytes OBJ Tiles |
LCD VRAM Character Data |
LCD VRAM BG Screen Data Format (BG Map) |
Bit Expl. 0-9 Tile Number (0-1023) (a bit less in 256 color mode, because there'd be otherwise no room for the bg map) 10 Horizontal Flip (0=Normal, 1=Mirrored) 11 Vertical Flip (0=Normal, 1=Mirrored) 12-15 Palette Number (0-15) (Not used in 256 color/1 palette mode) |
Bit Expl. 0-7 Tile Number (0-255) |
LCD VRAM Bitmap BG Modes |
Bit Expl. 0-4 Red Intensity (0-31) 5-9 Green Intensity (0-31) 10-14 Blue Intensity (0-31) 15 Not used in GBA Mode (in NDS Mode: Alpha=0=Transparent, Alpha=1=Normal) |
LCD OBJ - Overview |
1210 (=304*4-6) If "H-Blank Interval Free" bit in DISPCNT register is 0 954 (=240*4-6) If "H-Blank Interval Free" bit in DISPCNT register is 1 |
Cycles per <n> Pixels OBJ Type OBJ Type Screen Pixel Range n*1 cycles Normal OBJs 8..64 pixels 10+n*2 cycles Rotation/Scaling OBJs 8..64 pixels (area clipped) 10+n*2 cycles Rotation/Scaling OBJs 16..128 pixels (double size) |
LCD OBJ - OAM Attributes |
Bit Expl. 0-7 Y-Coordinate (0-255) 8 Rotation/Scaling Flag (0=Off, 1=On) When Rotation/Scaling used (Attribute 0, bit 8 set): 9 Double-Size Flag (0=Normal, 1=Double) When Rotation/Scaling not used (Attribute 0, bit 8 cleared): 9 OBJ Disable (0=Normal, 1=Not displayed) 10-11 OBJ Mode (0=Normal, 1=Semi-Transparent, 2=OBJ Window, 3=Prohibited) 12 OBJ Mosaic (0=Off, 1=On) 13 Colors/Palettes (0=16/16, 1=256/1) 14-15 OBJ Shape (0=Square,1=Horizontal,2=Vertical,3=Prohibited) |
Bit Expl. 0-8 X-Coordinate (0-511) When Rotation/Scaling used (Attribute 0, bit 8 set): 9-13 Rotation/Scaling Parameter Selection (0-31) (Selects one of the 32 Rotation/Scaling Parameters that can be defined in OAM, for details read next chapter.) When Rotation/Scaling not used (Attribute 0, bit 8 cleared): 9-11 Not used 12 Horizontal Flip (0=Normal, 1=Mirrored) 13 Vertical Flip (0=Normal, 1=Mirrored) 14-15 OBJ Size (0..3, depends on OBJ Shape, see Attr 0) Size Square Horizontal Vertical 0 8x8 16x8 8x16 1 16x16 32x8 8x32 2 32x32 32x16 16x32 3 64x64 64x32 32x64 |
Bit Expl. 0-9 Character Name (0-1023=Tile Number) 10-11 Priority relative to BG (0-3; 0=Highest) 12-15 Palette Number (0-15) (Not used in 256 color/1 palette mode) |
OBJ No. 0 with Priority relative to BG=1 ;hi OBJ prio, lo BG prio OBJ No. 1 with Priority relative to BG=0 ;lo OBJ prio, hi BG prio |
LCD OBJ - OAM Rotation/Scaling Parameters |
1st Group - PA=07000006, PB=0700000E, PC=07000016, PD=0700001E 2nd Group - PA=07000026, PB=0700002E, PC=07000036, PD=0700003E etc. |
LCD OBJ - VRAM Character (Tile) Mapping |
LCD Color Palettes |
05000000-050001FF - BG Palette RAM (512 bytes, 256 colors) 05000200-050003FF - OBJ Palette RAM (512 bytes, 256 colors) |
Bit Expl. 0-4 Red Intensity (0-31) 5-9 Green Intensity (0-31) 10-14 Blue Intensity (0-31) 15 Not used |
LCD Dimensions and Timings |
Visible 240 dots, 57.221 us, 960 cycles - 78% of h-time H-Blanking 68 dots, 16.212 us, 272 cycles - 22% of h-time Total 308 dots, 73.433 us, 1232 cycles - ca. 13.620 kHz |
Visible (*) 160 lines, 11.749 ms, 197120 cycles - 70% of v-time V-Blanking 68 lines, 4.994 ms, 83776 cycles - 30% of v-time Total 228 lines, 16.743 ms, 280896 cycles - ca. 59.737 Hz |
GBA Sound Controller |
GBA Sound Channel 1 - Tone & Sweep |
Bit Expl. 0-2 R/W Number of sweep shift (n=0-7) 3 R/W Sweep Frequency Direction (0=Increase, 1=Decrease) 4-6 R/W Sweep Time; units of 7.8ms (0-7, min=7.8ms, max=54.7ms) 7-15 - Not used |
X(t) = X(t-1) +/- X(t-1)/2^n |
Bit Expl. 0-5 W Sound length; units of (64-n)/256s (0-63) 6-7 R/W Wave Pattern Duty (0-3, see below) 8-10 R/W Envelope Step-Time; units of n/64s (1-7, 0=No Envelope) 11 R/W Envelope Direction (0=Decrease, 1=Increase) 12-15 R/W Initial Volume of envelope (1-15, 0=No Sound) |
0: 12.5% ( -_______-_______-_______ ) 1: 25% ( --______--______--______ ) 2: 50% ( ----____----____----____ ) (normal) 3: 75% ( ------__------__------__ ) |
Bit Expl. 0-10 W Frequency; 131072/(2048-n)Hz (0-2047) 11-13 - Not used 14 R/W Length Flag (1=Stop output when length in NR11 expires) 15 W Initial (1=Restart Sound) 16-31 - Not used |
GBA Sound Channel 2 - Tone |
GBA Sound Channel 3 - Wave Output |
Bit Expl. 0-4 - Not used 5 R/W Wave RAM Dimension (0=One bank/32 digits, 1=Two banks/64 digits) 6 R/W Wave RAM Bank Number (0-1, see below) 7 R/W Sound Channel 3 Off (0=Stop, 1=Playback) 8-15 - Not used |
Bit Expl. 0-7 W Sound length; units of (256-n)/256s (0-255) 8-12 - Not used. 13-14 R/W Sound Volume (0=Mute/Zero, 1=100%, 2=50%, 3=25%) 15 R/W Force Volume (0=Use above, 1=Force 75% regardless of above) |
Bit Expl. 0-10 W Sample Rate; 2097152/(2048-n) Hz (0-2047) 11-13 - Not used 14 R/W Length Flag (1=Stop output when length in NR31 expires) 15 W Initial (1=Restart Sound) 16-31 - Not used |
Wave RAM, single bank 32 digits Tone Frequency FFFFFFFFFFFFFFFF0000000000000000 65536/(2048-n) Hz FFFFFFFF00000000FFFFFFFF00000000 131072/(2048-n) Hz FFFF0000FFFF0000FFFF0000FFFF0000 262144/(2048-n) Hz FF00FF00FF00FF00FF00FF00FF00FF00 524288/(2048-n) Hz F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0 1048576/(2048-n) Hz |
GBA Sound Channel 4 - Noise |
Bit Expl. 0-5 W Sound length; units of (64-n)/256s (0-63) 6-7 - Not used 8-10 R/W Envelope Step-Time; units of n/64s (1-7, 0=No Envelope) 11 R/W Envelope Direction (0=Decrease, 1=Increase) 12-15 R/W Initial Volume of envelope (1-15, 0=No Sound) 16-31 - Not used |
Bit Expl. 0-2 R/W Dividing Ratio of Frequencies (r) 3 R/W Counter Step/Width (0=15 bits, 1=7 bits) 4-7 R/W Shift Clock Frequency (s) 8-13 - Not used 14 R/W Length Flag (1=Stop output when length in NR41 expires) 15 W Initial (1=Restart Sound) 16-31 - Not used |
7bit: X=X SHR 1, IF carry THEN Out=HIGH, X=X XOR 60h ELSE Out=LOW 15bit: X=X SHR 1, IF carry THEN Out=HIGH, X=X XOR 6000h ELSE Out=LOW |
GBA Sound Channel A and B - DMA Sound |
If Timer overflows then Move 8bit data from FIFO to sound circuit. If FIFO contains only 4 x 32bits (16 bytes) then Request more data per DMA Receive 4 x 32bit (16 bytes) per DMA Endif Endif |
GBA Sound Control Registers |
Bit Expl. 0-2 R/W Sound 1-4 Master Volume RIGHT (0-7) 3 - Not used 4-6 R/W Sound 1-4 Master Volume LEFT (0-7) 7 - Not used 8-11 R/W Sound 1-4 Enable Flags RIGHT (each Bit 8-11, 0=Disable, 1=Enable) 12-15 R/W Sound 1-4 Enable Flags LEFT (each Bit 12-15, 0=Disable, 1=Enable) |
Bit Expl. 0-1 R/W Sound # 1-4 Volume (0=25%, 1=50%, 2=100%, 3=Prohibited) 2 R/W DMA Sound A Volume (0=50%, 1=100%) 3 R/W DMA Sound B Volume (0=50%, 1=100%) 4-7 - Not used 8 R/W DMA Sound A Enable RIGHT (0=Disable, 1=Enable) 9 R/W DMA Sound A Enable LEFT (0=Disable, 1=Enable) 10 R/W DMA Sound A Timer Select (0=Timer 0, 1=Timer 1) 11 W? DMA Sound A Reset FIFO (1=Reset) 12 R/W DMA Sound B Enable RIGHT (0=Disable, 1=Enable) 13 R/W DMA Sound B Enable LEFT (0=Disable, 1=Enable) 14 R/W DMA Sound B Timer Select (0=Timer 0, 1=Timer 1) 15 W? DMA Sound B Reset FIFO (1=Reset) |
Bit Expl. 0 R Sound 1 ON flag (Read Only) 1 R Sound 2 ON flag (Read Only) 2 R Sound 3 ON flag (Read Only) 3 R Sound 4 ON flag (Read Only) 4-6 - Not used 7 R/W PSG/FIFO Master Enable (0=Disable, 1=Enable) (Read/Write) 8-31 - Not used |
Bit Expl. 0 - Not used 1-9 R/W Bias Level (Default=100h, converting signed samples into unsigned) 10-13 - Not used 14-15 R/W Amplitude Resolution/Sampling Cycle (Default=0, see below) 16-31 - Not used |
0 9bit / 32.768kHz (Default, best for DMA channels A,B) 1 8bit / 65.536kHz 2 7bit / 131.072kHz 3 6bit / 262.144kHz (Best for PSG channels 1-4) |
GBA Comparison of CGB and GBA Sound |
GBA Timers |
Bit Expl. 0-1 Prescaler Selection (0=F/1, 1=F/64, 2=F/256, 3=F/1024) 2 Count-up Timing (0=Normal, 1=See below) ;Not used in TM0CNT_H 3-5 Not used 6 Timer IRQ Enable (0=Disable, 1=IRQ on Timer overflow) 7 Timer Start/Stop (0=Stop, 1=Operate) 8-15 Not used |
GBA DMA Transfers |
Bit Expl. 0-4 Not used 5-6 Dest Addr Control (0=Increment,1=Decrement,2=Fixed,3=Increment/Reload) 7-8 Source Adr Control (0=Increment,1=Decrement,2=Fixed,3=Prohibited) 9 DMA Repeat (0=Off, 1=On) (Must be zero if Bit 11 set) 10 DMA Transfer Type (0=16bit, 1=32bit) 11 Game Pak DRQ - DMA3 only - (0=Normal, 1=DRQ <from> Game Pak, DMA3) 12-13 DMA Start Timing (0=Immediately, 1=VBlank, 2=HBlank, 3=Special) The 'Special' setting (Start Timing=3) depends on the DMA channel: DMA0=Prohibited, DMA1/DMA2=Sound FIFO, DMA3=Video Capture 14 IRQ upon end of Word Count (0=Disable, 1=Enable) 15 DMA Enable (0=Off, 1=On) |
2N+2(n-1)S+xI |
GBA Communication Ports |
SIO Normal Mode |
Bit Expl. 0-3 Undocumented (current SC,SD,SI,SO state, as for General Purpose mode) 4-8 Not used (Should be 0, bits are read/write-able though) 9-13 Not used (Always 0, read only) 14 Not used (Should be 0, bit is read/write-able though) 15 Must be zero (0) for Normal/Multiplayer/UART modes |
Bit Expl. 0 Shift Clock (SC) (0=External, 1=Internal) 1 Internal Shift Clock (0=256KHz, 1=2MHz) 2 SI State (opponents SO) (0=Low, 1=High/None) --- (Read Only) 3 SO during inactivity (0=Low, 1=High) (applied ONLY when Bit7=0) 4-6 Not used (Read only, always 0 ?) 7 Start Bit (0=Inactive/Ready, 1=Start/Active) 8-11 Not used (R/W, should be 0) 12 Transfer Length (0=8bit, 1=32bit) 13 Must be "0" for Normal Mode 14 IRQ Enable (0=Disable, 1=Want IRQ upon completion) 15 Not used (Read only, always 0) |
(Expl. Old SO=LOW kept output until 1st clock bit received). (Expl. New SO=HIGH is automatically output at transfer completion). |
Step Sender 1st Recipient 2nd Recipient Transfer 1: DATA #0 --> UNDEF --> UNDEF --> Transfer 2: DATA #1 --> DATA #0 --> UNDEF --> Transfer 3: DATA #2 --> DATA #1 --> DATA #0 --> Transfer 4: DATA #3 --> DATA #2 --> DATA #1 --> |
SIO Multi-Player Mode |
Bit Expl. 0-3 Undocumented (current SC,SD,SI,SO state, as for General Purpose mode) 4-8 Not used (Should be 0, bits are read/write-able though) 9-13 Not used (Always 0, read only) 14 Not used (Should be 0, bit is read/write-able though) 15 Must be zero (0) for Normal/Multiplayer/UART modes |
Bit Expl. 0-1 Baud Rate (0-3: 9600,38400,57600,115200 bps) 2 SI-Terminal (0=Parent, 1=Child) (Read Only) 3 SD-Terminal (0=Bad connection, 1=All GBAs Ready) (Read Only) 4-5 Multi-Player ID (0=Parent, 1-3=1st-3rd child) (Read Only) 6 Multi-Player Error (0=Normal, 1=Error) (Read Only) 7 Start/Busy Bit (0=Inactive, 1=Start/Busy) (Read Only for Slaves) 8-11 Not used (R/W, should be 0) 12 Must be "0" for Multi-Player mode 13 Must be "1" for Multi-Player mode 14 IRQ Enable (0=Disable, 1=Want IRQ upon completion) 15 Not used (Read only, always 0) |
GBAs Bits Delays Timeout 1 18 None Yes 2 36 1 Yes 3 54 2 Yes 4 72 3 None |
SIO UART Mode |
Bit Expl. 0-3 Undocumented (current SC,SD,SI,SO state, as for General Purpose mode) 4-8 Not used (Should be 0, bits are read/write-able though) 9-13 Not used (Always 0, read only) 14 Not used (Should be 0, bit is read/write-able though) 15 Must be zero (0) for Normal/Multiplayer/UART modes |
Bit Expl. 0-1 Baud Rate (0-3: 9600,38400,57600,115200 bps) 2 CTS Flag (0=Send always/blindly, 1=Send only when SC=LOW) 3 Parity Control (0=Even, 1=Odd) 4 Send Data Flag (0=Not Full, 1=Full) (Read Only) 5 Receive Data Flag (0=Not Empty, 1=Empty) (Read Only) 6 Error Flag (0=No Error, 1=Error) (Read Only) 7 Data Length (0=7bits, 1=8bits) 8 FIFO Enable Flag (0=Disable, 1=Enable) 9 Parity Enable Flag (0=Disable, 1=Enable) 10 Send Enable Flag (0=Disable, 1=Enable) 11 Receive Enable Flag (0=Disable, 1=Enable) 12 Must be "1" for UART mode 13 Must be "1" for UART mode 14 IRQ Enable (0=Disable, 1=IRQ when any Bit 4/5/6 become set) 15 Not used (Read only, always 0) |
SIO JOY BUS Mode |
Bit Expl. 0-3 Undocumented (current SC,SD,SI,SO state, as for General Purpose mode) 4-8 Not used (Should be 0, bits are read/write-able though) 9-13 Not used (Always 0, read only) 14 Must be "1" for JOY BUS Mode 15 Must be "1" for JOY BUS Mode |
Bit Expl. 0 Device Reset Flag (Command FFh) (Read/Acknowledge) 1 Receive Complete Flag (Command 14h or 15h?) (Read/Acknowledge) 2 Send Complete Flag (Command 15h or 14h?) (Read/Acknowledge) 3-5 Not used 6 IRQ when receiving a Device Reset Command (0=Disable, 1=Enable) 7-31 Not used |
Bit Expl. 0 Not used 1 Receive Status Flag (0=Remote GBA is/was receiving) (Read Only?) 2 Not used 3 Send Status Flag (1=Remote GBA is/was sending) (Read Only?) 4-5 General Purpose Flag (Not assigned, may be used for whatever purpose) 6-31 Not used |
Receive FFh (Command) Send 00h (GBA Type number LSB (or MSB?)) Send 04h (GBA Type number MSB (or LSB?)) Send XXh (lower 8bits of SIOSTAT register) |
Receive 00h (Command) Send 00h (GBA Type number LSB (or MSB?)) Send 04h (GBA Type number MSB (or LSB?)) Send XXh (lower 8bits of SIOSTAT register) |
Receive 15h (Command) Receive XXh (Lower 8bits of JOY_RECV_L) Receive XXh (Upper 8bits of JOY_RECV_L) Receive XXh (Lower 8bits of JOY_RECV_H) Receive XXh (Upper 8bits of JOY_RECV_H) Send XXh (lower 8bits of SIOSTAT register) |
Receive 14h (Command) Send XXh (Lower 8bits of JOY_TRANS_L) Send XXh (Upper 8bits of JOY_TRANS_L) Send XXh (Lower 8bits of JOY_TRANS_H) Send XXh (Upper 8bits of JOY_TRANS_H) Send XXh (lower 8bits of SIOSTAT register) |
SIO General-Purpose Mode |
Bit Expl. 0 SC Data Bit (0=Low, 1=High) 1 SD Data Bit (0=Low, 1=High) 2 SI Data Bit (0=Low, 1=High) 3 SO Data Bit (0=Low, 1=High) 4 SC Direction (0=Input, 1=Output) 5 SD Direction (0=Input, 1=Output) 6 SI Direction (0=Input, 1=Output, but see below) 7 SO Direction (0=Input, 1=Output) 8 SI Interrupt Enable (0=Disable, 1=Enable) 9-13 Not used 14 Must be "0" for General-Purpose Mode 15 Must be "1" for General-Purpose or JOYBUS Mode |
SIO Control Registers Summary |
R.15 R.14 S.13 S.12 Mode 0 x 0 0 Normal 8bit 0 x 0 1 Normal 32bit 0 x 1 0 Multiplay 16bit 0 x 1 1 UART (RS232) 1 0 x x General Purpose 1 1 x x JOY BUS |
Bit 0 1 2 3 4 5 6 7 8 9 10 11 Normal Master Rate SI/In SO/Out - - - Start - - - - Multi Baud Baud SI/In SD/In ID# Err Start - - - - UART Baud Baud CTS Parity S R Err Bits FIFO Parity Send Recv |
GBA Wireless Adapter |
GBA Wireless Adapter Games |
bit Generations series (Japan only) Boktai 2: Solar Boy Django (Konami) Boktai 3: Sabata's Counterattack Classic NES Series: Donkey Kong Classic NES Series: Dr. Mario Classic NES Series: Ice Climber Classic NES Series: Pac-Man Classic NES Series: Super Mario Bros. Classic NES Series: Xevious Digimon Racing (Bandai) (No Wireless Adapter support in European release) Dragon Ball Z: Buu's Fury (Atari) Famicom Mini Series: #13 Balloon Fight Famicom Mini Series: #12 Clu Clu Land Famicom Mini Series: #16 Dig Dug Famicom Mini Series: #02 Donkey Kong Famicom Mini Series: #15 Dr. Mario Famicom Mini Series: #03 Ice Climber Famicom Mini Series: #18 Makaimura Famicom Mini Series: #08 Mappy Famicom Mini Series: #11 Mario Bros. Famicom Mini Series: #06 Pac-Man Famicom Mini Series: #30 SD Gundam World Scramble Wars Famicom Mini Series: #01 Super Mario Bros. Famicom Mini Series: #21 Super Mario Bros. Famicom Mini Series: #19 Twin Bee Famicom Mini Series: #14 Wrecking Crew Famicom Mini Series: #07 Xevious Hamtaro: Ham-Ham Games (Nintendo) Lord of the Rings: The Third Age, The (EA Games) Mario Golf: Advance Tour (Nintendo) Mario Tennis: Power Tour (Nintendo) Mega Man Battle Network 5: Team Protoman (Capcom) Mega Man Battle Network 5: Team Colonel (Capcom) Mega Man Battle Network 6: Cybeast Falzar Mega Man Battle Network 6: Cybeast Gregar Momotaro Dentetsu G: Make a Gold Deck! (Japan only) Pokemon Emerald (Nintendo) Pokemon FireRed (Nintendo) Pokemon LeafGreen (Nintendo) Sennen Kazoku (Japan only) Shrek SuperSlam Sonic Advance 3 |
GBA Wireless Adapter Login |
rcnt=8000h ;\ rcnt=80A0h ; rcnt=80A2h ; reset adapter or so wait ; rcnt=80A0h ;/ siocnt=5003h ;\set 32bit normal mode, 2MHz internal clock rcnt=0000h ;/ passes=0, index=0 @@lop: passes=passes+1, if passes>32 then ERROR ;give up (usually only 10 passses) recv.lo=siodata AND FFFFh ;response from adapter recv.hi=siodata/10000h ;adapter's own "NI" data if send.hi<>recv.lo then index=0, goto @@stuck ;<-- fallback to index=0 if (send.lo XOR FFFFh)<>recv.lo then goto @@stuck if (send.hi XOR FFFFh)<>recv.hi then goto @@stuck index=index+1 @@stuck: send.lo=halfword[@@key_string+index*2] send.hi=recv.hi XOR FFFFh siodata=send.lo+(send.hi*10000h) siocnt.bit7=1 ;<-- start transmission if index<4 then goto @@lop ret @@key_string db 'NINTENDO',01h,80h ;10 bytes (5 halfwords; index=0..4) |
GBA ADAPTER xxxx494E ;\ <--> xxxxxxxx xxxx494E ; "NI" <--> "NI"/; 494EB6B1 ;\ NOT("NI") /; B6B1494E ;/ <--> \; 494EB6B1 ; NOT("NI") \; B6B1544E ;\"NT" <--> "NT"/; 544EB6B1 ;/ NOT("NT") /; ABB1544E ;/ <--> \; 544EABB1 ;\NOT("NT") \; ABB14E45 ;\"EN" <--> "EN"/; 4E45ABB1 ;/ NOT("EN") /; B1BA4E45 ;/ <--> \; 4E45B1BA ;\NOT("EN") \; B1BA4F44 ;\"DO" <--> "DO"/; 4F44B1BA ;/ NOT("DO") /; B0BB4F44 ;/ <--> \; 4F44B0BB ;\NOT("DO") \; B0BB8001 ;-fin <--> fin-; 8001B0BB ;/ \ \ \ \ \ LSBs=Own \ LSBs=Inverse of \ Data.From.Gba \ Prev.Data.From.Gba \ \ MSBs=Inverse of MSBs=Own Prev.Data.From.Adapter Data.From.Adapter |
GBA Wireless Adapter Commands |
GBA Adapter 9966ppcch 80000000h ;-send command (cc), and num param_words (pp) <param01> 80000000h ;\ <param02> 80000000h ; send "pp" parameter word(s), if any ... ... ;/ 80000000h 9966rraah ;-recv ack (aa=cc+80h), and num response_words (rr) 80000000? <reply01> ;\ 80000000? <reply02> ; recv "rr" response word(s), if any ... ... ;/ |
wait until [4000128h].Bit2=0 ;want SI=0 set [4000128h].Bit3=1 ;set SO=1 wait until [4000128h].Bit2=1 ;want SI=1 set [4000128h].Bit3=0,Bit7=1 ;set SO=0 and start 32bit transfer |
Cmd Para Reply Name 10h - - Hello (send immediately after login) 11h - 1 Good/Bad response to cmd 16h ? 12h 13h - 1 14h 15h 16h 6 - Introduce (send game/user name) 17h 1 - Config (send after Hello) (eg. param=003C0420h or 003C043Ch) 18h 19h 1Ah 1Bh 1Ch - - 1Dh - NN Get Directory? (receive list of game/user names?) 1Eh - NN Get Directory? (receive list of game/user names?) 1Fh 1 - Select Game for Download (send 16bit Game_ID) |
20h - 1 21h - 1 Good/Bad response to cmd 1Fh ? 22h 23h 24h - - 25h ;use EXT clock! 26h - - 27h - - Begin Download ? ;use EXT clock! 28h 29h 2Ah 2Bh 2Ch 2Dh 2Eh 2Fh |
30h 1 - 31h 32h 33h 34h 35h ;use EXT clock! 36h 37h ;use EXT clock! 38h 39h 3Ah 3Bh 3Ch 3Dh - - Bye (return to language select) 3Eh 3Fh |
GBA Wireless Adapter Component Lists |
U1 32pin Freescale MC13190 (2.4 GHz ISM band transceiver) U2 48pin Freescale CT3000 or CT3001 (depending on adapter version) X3 2pin 9.5MHz crystal |
Sticker on Case: "GAME BOY advance, WIRELESS ADAPTER" "Pat.Pend.Made in Philipines, CE0125(!)B" "MODEL NO./MODELE NO.AGB-015 D-63760 Grossosteim P/AGB-A-WA-EUR-2 E3" PCB: "19-C046-04, A-7" (top side) and "B-7" and Microchip ",\\" (bottom side) PCB: white stamp "3104, 94V-0, RU, TW-15" PCB: black stamp "22FDE" U1 32pin "Freescale 13190, 4WFQ" (MC13190) (2.4 GHz ISM band transceiver) U2 48pin "Freescale CT3001, XAC0445" (bottom side) X3 2pin "D959L4I" (9.5MHz) (top side) (ca. 19 clks per 2us) |
D1 5pin "D6F, 44" (top side, below X3) U71 6pin ".., () 2" (top side, right of X3, tiny black chip) B71 6pin "[]" (top side, right of X3, small white chip) ANT 2pin on-board copper wings Q? 3pin (top side, above CN1) Q? 3pin (top side, above CN1) D? 2pin "72" (top side, above CN1) D3 2pin "F2" (top side, above CN1) U200 4pin "MSV" (top side, above CN1) U202 5pin "LXKA" (top side, right of CN1) U203 4pin "M6H" (top side, right of CN1) CN1 6pin connector to GBA link port (top side) |
U201 5pin "LXVB" (bottom side, near CN1) U72 4pin "BMs" (bottom side, near ANT, tiny black chip) FL70 ?pin "[] o26" (bottom side, near ANT, bigger white chip) B70 6pin "[]" (bottom side, near ANT, small white chip) |
Sticker on Case: N/A PCB: "19-C046-03, A-1" (top side) and "B-1" and Microchip ",\\" (bottom side) PCB: white stamp "3204, TW-15, RU, 94V-0" PCB: black stamp "23MN" or "23NH" or so (smeared) U1 32pin "Freescale 13190, 4FGD" (top side) U2 48pin "Freescale CT3000, XAB0425" (bottom side) ;CT3000 (not CT3001) X3 2pin "9.5SKSS4GT" (top side) |
D1 5pin "D6F, 31" (top side, below X3) U71 6pin "P3, () 2" (top side, right of X3, tiny black chip) B71 6pin "[]" (top side, right of X3, small white chip) ANT 2pin on-board copper wings Q70 3pin (top side, above CN1) D? 2pin "72" (top side, above CN1) D3 2pin "F2" (top side, above CN1) U200 4pin "MSV" (top side, above CN1) U202 5pin "LXKH" (top side, right of CN1) U203 4pin "M6H" (top side, right of CN1) CN1 6pin connector to GBA link port (top side) |
U201 5pin "LXV2" (bottom side, near CN1) U70 6pin "AAG" (bottom side, near ANT, tiny black chip) FL70 ?pin "[] o26" (bottom side, near ANT, bigger white chip) B70 6pin "[]" (bottom side, near ANT, small white chip) |
Sticker "N/A" vs "Grossosteim P/AGB-A-WA-EUR-2 E3" PCB-markings "19-C046-03, A-1, 3204" vs "19-C046-04, A-7, 3104" U1 "CT3000, XAB0425" vs "CT3001, XAC0445" Transistors One transistor (Q70) vs Two transistors (both nameless) U70/U72 U70 "AAG" (6pin) vs U72 "BMs" (4pin) |
GBA Infrared Communication |
Bit Expl. 0 Transmission Data (0=LED Off, 1=LED On) 1 READ Enable (0=Disable, 1=Enable) 2 Reception Data (0=None, 1=Signal received) (Read only) 3 AMP Operation (0=Off, 1=On) 4 IRQ Enable Flag (0=Disable, 1=Enable) 5-15 Not used |
GBA Keypad Input |
Bit Expl. 0 Button A (0=Pressed, 1=Released) 1 Button B (etc.) 2 Select (etc.) 3 Start (etc.) 4 Right (etc.) 5 Left (etc.) 6 Up (etc.) 7 Down (etc.) 8 Button R (etc.) 9 Button L (etc.) 10-15 Not used |
Bit Expl. 0 Button A (0=Ignore, 1=Select) 1 Button B (etc.) 2 Select (etc.) 3 Start (etc.) 4 Right (etc.) 5 Left (etc.) 6 Up (etc.) 7 Down (etc.) 8 Button R (etc.) 9 Button L (etc.) 10-13 Not used 14 IRQ Enable Flag (0=Disable, 1=Enable) 15 IRQ Condition (0=Logical OR, 1=Logical AND) |
GBA Interrupt Control |
Bit Expl. 0 Disable all interrupts (0=Disable All, 1=See IE register) 1-31 Not used |
Bit Expl. 0 LCD V-Blank (0=Disable) 1 LCD H-Blank (etc.) 2 LCD V-Counter Match (etc.) 3 Timer 0 Overflow (etc.) 4 Timer 1 Overflow (etc.) 5 Timer 2 Overflow (etc.) 6 Timer 3 Overflow (etc.) 7 Serial Communication (etc.) 8 DMA 0 (etc.) 9 DMA 1 (etc.) 10 DMA 2 (etc.) 11 DMA 3 (etc.) 12 Keypad (etc.) 13 Game Pak (external IRQ source) (etc.) 14-15 Not used |
Bit Expl. 0 LCD V-Blank (1=Request Interrupt) 1 LCD H-Blank (etc.) 2 LCD V-Counter Match (etc.) 3 Timer 0 Overflow (etc.) 4 Timer 1 Overflow (etc.) 5 Timer 2 Overflow (etc.) 6 Timer 3 Overflow (etc.) 7 Serial Communication (etc.) 8 DMA 0 (etc.) 9 DMA 1 (etc.) 10 DMA 2 (etc.) 11 DMA 3 (etc.) 12 Keypad (etc.) 13 Game Pak (external IRQ source) (etc.) 14-15 Not used |
00000018 b 128h ;IRQ vector: jump to actual BIOS handler 00000128 stmfd r13!,r0-r3,r12,r14 ;save registers to SP_irq 0000012C mov r0,4000000h ;ptr+4 to 03FFFFFC (mirror of 03007FFC) 00000130 add r14,r15,0h ;retadr for USER handler $+8=138h 00000134 ldr r15,[r0,-4h] ;jump to [03FFFFFC] USER handler 00000138 ldmfd r13!,r0-r3,r12,r14 ;restore registers from SP_irq 0000013C subs r15,r14,4h ;return from IRQ (PC=LR-4, CPSR=SPSR) |
Addr. Size Expl. 3007FFCh 4 Pointer to user IRQ handler (32bit ARM code) 3007FF8h 2 Interrupt Check Flag (for IntrWait/VBlankIntrWait functions) 3007FF4h 4 Allocated Area 3007FF0h 4 Pointer to Sound Buffer 3007FE0h 16 Allocated Area 3007FA0h 64 Default area for SP_svc Supervisor Stack (4 words/time) 3007F00h 160 Default area for SP_irq Interrupt Stack (6 words/time) |
SP_svc=03007FE0h SP_irq=03007FA0h SP_usr=03007F00h |
GBA System Control |
Bit Expl. 0-1 SRAM Wait Control (0..3 = 4,3,2,8 cycles) 2-3 Wait State 0 First Access (0..3 = 4,3,2,8 cycles) 4 Wait State 0 Second Access (0..1 = 2,1 cycles) 5-6 Wait State 1 First Access (0..3 = 4,3,2,8 cycles) 7 Wait State 1 Second Access (0..1 = 4,1 cycles; unlike above WS0) 8-9 Wait State 2 First Access (0..3 = 4,3,2,8 cycles) 10 Wait State 2 Second Access (0..1 = 8,1 cycles; unlike above WS0,WS1) 11-12 PHI Terminal Output (0..3 = Disable, 4.19MHz, 8.38MHz, 16.78MHz) 13 Not used 14 Game Pak Prefetch Buffer (Pipe) (0=Disable, 1=Enable) 15 Game Pak Type Flag (Read Only) (0=GBA, 1=CGB) (IN35 signal) 16-31 Not used |
Bit Expl. 0 Undocumented. First Boot Flag (0=First, 1=Further) 1-7 Undocumented. Not used. |
Bit Expl. 0-6 Undocumented. Not used. 7 Undocumented. Power Down Mode (0=Halt, 1=Stop) |
Bit Expl. 0 Disable 32K+256K WRAM (0=Normal, 1=Disable) (when off: empty/prefetch) 1-3 Unknown (Read/Write-able) 4 Unknown (Always zero, not used or write only) 5 Enable 256K WRAM (0=Disable, 1=Normal) (when off: mirror of 32K WRAM) 6-23 Unknown (Always zero, not used or write only) 24-27 Wait Control WRAM 256K (0-14 = 15..1 Waitstates, 15=Lockup) 28-31 Unknown (Read/Write-able) |
GBA GamePak Prefetch |
1) opcodes with internal cycles (I) which do not change R15, shift/rotate register-by-register, load opcodes (ldr,ldm,pop,swp), multiply opcodes 2) opcodes that load/store memory (ldr,str,ldm,stm,etc.) |
"Opcodes in GamePak ROM with Internal Cycles which do not change R15" |
GBA Cartridges |
GBA Cartridge Header |
Address Bytes Expl. 000h 4 ROM Entry Point (32bit ARM branch opcode, eg. "B rom_start") 004h 156 Nintendo Logo (compressed bitmap, required!) 0A0h 12 Game Title (uppercase ascii, max 12 characters) 0ACh 4 Game Code (uppercase ascii, 4 characters) 0B0h 2 Maker Code (uppercase ascii, 2 characters) 0B2h 1 Fixed value (must be 96h, required!) 0B3h 1 Main unit code (00h for current GBA models) 0B4h 1 Device type (usually 00h) (bit7=DACS/debug related) 0B5h 7 Reserved Area (should be zero filled) 0BCh 1 Software version (usually 00h) 0BDh 1 Complement check (header checksum, required!) 0BEh 2 Reserved Area (should be zero filled) --- Additional Multiboot Header Entries --- 0C0h 4 RAM Entry Point (32bit ARM branch opcode, eg. "B ram_start") 0C4h 1 Boot mode (init as 00h - BIOS overwrites this value!) 0C5h 1 Slave ID Number (init as 00h - BIOS overwrites this value!) 0C6h 26 Not used (seems to be unused) 0E0h 4 JOYBUS Entry Pt. (32bit ARM branch opcode, eg. "B joy_start") |
U Unique Code (usually "A" or "B" or special meaning) TT Short Title (eg. "PM" for Pac Man) D Destination/Language (usually "J" or "E" or "P" or specific language) |
A Normal game; Older titles (mainly 2001..2003) B Normal game; Newer titles (2003..) C Normal game; Not used yet, but might be used for even newer titles F Famicom/Classic NES Series (software emulated NES games) K Yoshi and Koro Koro Puzzle (acceleration sensor) P e-Reader (dot-code scanner) R Warioware Twisted (cartridge with rumble and z-axis gyro sensor) U Boktai 1 and 2 (cartridge with RTC and solar sensor) V Drill Dozer (cartridge with rumble) |
Usually an abbreviation of the game title (eg. "PM" for "Pac Man") (unless that gamecode was already used for another game, then TT is just random) |
J Japan P Europe/Elsewhere F French S Spanish E USA/English D German I Italian |
Value Expl. 01h Joybus mode 02h Normal mode 03h Multiplay mode |
Value Expl. 01h Slave #1 02h Slave #2 03h Slave #3 |
GBA Cartridge ROM |
GBA Cart Backup IDs |
EEPROM_Vnnn EEPROM 512 bytes or 8 Kbytes (4Kbit or 64Kbit) SRAM_Vnnn SRAM 32 Kbytes (256Kbit) FLASH_Vnnn FLASH 64 Kbytes (512Kbit) (ID used in older files) FLASH512_Vnnn FLASH 64 Kbytes (512Kbit) (ID used in newer files) FLASH1M_Vnnn FLASH 128 Kbytes (1Mbit) |
GBA Cart Backup SRAM/FRAM |
GBA Cart Backup EEPROM |
2 bits "11" (Read Request) n bits eeprom address (MSB first, 6 or 14 bits, depending on EEPROM) 1 bit "0" |
4 bits - ignore these 64 bits - data (conventionally MSB first) |
2 bits "10" (Write Request) n bits eeprom address (MSB first, 6 or 14 bits, depending on EEPROM) 64 bits data (conventionally MSB first) 1 bit "0" |
GBA Cart Backup Flash ROM |
[E005555h]=AAh, [E002AAAh]=55h, [E005555h]=90h (enter ID mode) dev=[E000001h], man=[E000000h] (get device & manufacturer) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=F0h (terminate ID mode) |
dat=[E00xxxxh] (read byte from address xxxx) |
[E005555h]=AAh, [E002AAAh]=55h, [E005555h]=80h (erase command) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=10h (erase entire chip) wait until [E000000h]=FFh (or timeout) |
[E005555h]=AAh, [E002AAAh]=55h, [E005555h]=80h (erase command) [E005555h]=AAh, [E002AAAh]=55h, [E00n000h]=30h (erase sector n) wait until [E00n000h]=FFh (or timeout) |
old=IME, IME=0 (disable interrupts) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=A0h (erase/write sector command) [E00xxxxh+00h..7Fh]=dat[00h..7Fh] (write 128 bytes) IME=old (restore old IME state) wait until [E00xxxxh+7Fh]=dat[7Fh] (or timeout) |
[E005555h]=AAh, [E002AAAh]=55h, [E005555h]=A0h (write byte command) [E00xxxxh]=dat (write byte to address xxxx) wait until [E00xxxxh]=dat (or timeout) |
[E005555h]=F0h (force end of write/erase command) |
[E005555h]=AAh, [E002AAAh]=55h, [E005555h]=B0h (select bank command) [E000000h]=bnk (write bank number 0..1) |
ID Name Size Sectors AverageTimings Timeouts/ms Waits D4BFh SST 64K 16x4K 20us?,?,? 10, 40, 200 3,2 1CC2h Macronix 64K 16x4K ?,?,? 10,2000,2000 8,3 1B32h Panasonic 64K 16x4K ?,?,? 10, 500, 500 4,2 3D1Fh Atmel 64K 512x128 ?,?,? ...40.., 40 8,8 1362h Sanyo 128K ? ?,?,? ? ? ? ? 09C2h Macronix 128K ? ?,?,? ? ? ? ? |
GBA Cart Backup DACS |
GBA Cart I/O Port (GPIO) |
bit0-3 Data Bits 0..3 (0=Low, 1=High) bit4-15 not used (0) |
bit0-3 Direction for Data Port Bits 0..3 (0=In, 1=Out) bit4-15 not used (0) |
bit0 Register 80000C4h..80000C8h Control (0=Write-Only, 1=Read/Write) bit1-15 not used (0) |
GPIO | Boktai | Wario Bit Pin | RTC SOL | GYR RBL -----------+---------+--------- 0 ROM.1 | SCK CLK | RES - 1 ROM.2 | SIO RST | CLK - 2 ROM.21 | CS - | DTA - 3 ROM.22 | - FLG | - MOT -----------+---------+--------- IRQ ROM.43 | IRQ - | - - |
GBA Cart Real-Time Clock (RTC) |
NDS_________GBA_________GBA/Params___ stat2 control (1-byte) datetime datetime (7-byte) time time (3-byte) stat1 force reset (0-byte) clkadjust force irq (0-byte) alarm1/int1 always FFh (boktai contains code for writing 1-byte to it) alarm2 always FFh (unused) free always FFh (unused) |
Bit Dir Expl. 0 - Not used 1 R/W IRQ duty/hold related? 2 - Not used 3 R/W Per Minute IRQ (30s duty) (0=Disable, 1=Enable) 4 - Not used 5 R/W Unknown? 6 R/W 12/24-hour Mode (0=12h, 1=24h) (usually 1) 7 R Power-Off (auto cleared on read) (0=Normal, 1=Failure) |
GBA Cart Solar Sensor |
strh 0001h,[80000c8h] ;-enable R/W mode strh 0007h,[80000c6h] ;-init I/O direction strh 0002h,[80000c4h] ;-reset counter to zero (high=reset) (I/O bit0) strh 0000h,[80000c4h] ;-clear reset (low=normal) mov r0,0 ;-initial level @@lop: strh 0001h,[80000c4h] ;-clock high ;\increase counter (I/O bit1) strh 0000h,[80000c4h] ;-clock low ;/ ldrh r1,[80000c4h] ;-read port (I/O bit3) tst r1,08h ;\ addeq r0,1 ; loop until voltage match (exit with r0=00h..FFh), tsteq r0,100h ; or until failure/timeout (exit with r0=100h) beq @@lop ;/ |
E8h total darkness (including daylight on rainy days) Dxh close to a 100 Watt Bulb 5xh reaches max level in boktai's solar gauge 00h close to a tactical nuclear bomb dropped on your city |
GBA Cart Tilt Sensor |
E008000h (W) Write 55h to start sampling E008100h (W) Write AAh to start sampling E008200h (R) Lower 8 bits of X axis E008300h (R) Upper 4 bits of X axis, and Bit7: ADC Status (0=Busy, 1=Ready) E008400h (R) Lower 8 bits of Y axis E008500h (R) Upper 4 bits of Y axis |
wait until [E008300h].Bit7=1 or until timeout ;wait ready x = ([E008300h] AND 0Fh)*100h + [E008200h] ;get x y = ([E008500h] AND 0Fh)*100h + [E008400h] ;get y [E008000h]=55h, [E008100h]=AAh ;start next conversion |
X ranged between 0x2AF to 0x477, center at 0x392. Huh? Y ranged between 0x2C3 to 0x480, center at 0x3A0. Huh? |
GBA Cart Gyro Sensor |
GPIO.Bit0 (W) Start Conversion GPIO.Bit1 (W) Serial Clock GPIO.Bit2 (R) Serial Data GPIO.Bit3 (W) Used for Rumble (not gyro related) |
read_gyro: mov r1,8000000h ;-cartridge base address mov r0,01h ;\enable R/W access strh r0,[r1,0c8h] ;/ mov r0,0bh ;\init direction (gpio2=input, others=output) strh r0,[r1,0c6h] ;/ ldrh r2,[r1,0c4h] ;-get current state (for keeping gpio3=rumble) orr r2,3 ;\ strh r2,[r1,0c4h] ;gpio0=1 ; start ADC conversion bic r2,1 ; strh r2,[r1,0c4h] ;gpio0=0 ;/ mov r0,00010000h ;stop-bit ;\ bic r2,2 ; @@lop: ; ldrh r3,[r1,0c4h] ;get gpio2=data ; read 16 bits strh r2,[r1,0c4h] ;gpio1=0=clk=low ; (4 dummy bits, plus 12 data bits) movs r3,r3,lsr 3 ;gpio2 to cy=data ; adcs r0,r0,r0 ;merge data, cy=done; orr r3,r2,2 ;set bit1 and delay ; strh r3,[r1,0c4h] ;gpio1=1=clk=high ; bcc @@lop ;/ bic r0,0f000h ;-strip upper 4 dummy bits (isolate 12bit adc) bx lr |
354h rotated in anti-clockwise direction (shock-speed) 64Dh rotated in anti-clockwise direction (normal fast) 6A3h rotated in anti-clockwise direction (slow) 6C0h no rotation (stopped) 6DAh rotation in clockwise direction (slow) 73Ah rotation in clockwise direction (normal fast) 9E3h rotation in clockwise direction (shock-speed) |
GBA Cart Rumble |
GBA Cart e-Reader |
________________ | ShortStrip | |L L| |o Center o| |n Region n| |g g| | may contain | |S pictures, S| |t instructions t| |r etc. r| |i i| |p p| |___ShortStrip___| |
GBA Cart e-Reader Overview |
GBA Cart e-Reader I/O Ports |
0 Output to PGA.Pin93 (which seems to be not connected to anything) 1-3 Unknown, read/write-able (not used by e-Reader BIOS) 4-15 Always zero (0) |
0 Always zero (0) 1 Reset Something? (0=Normal, 1=Reset) 2 Unknown, always set (1) 3 Unknown, read/write-able (not used by e-Reader BIOS) 4-7 Always zero (0) 8 Unknown, read/write-able (not used by e-Reader BIOS) 9-15 Always zero (0) |
0-6 Max Brightness (00h..7Fh; 00h=All black, 7Fh=One or more white) 7-15 Always zero |
0-7 Max Darkness (00h..7Fh; 00h=One or more black, 7Fh=All white) 8-15 Always zero |
0-6 Block Intensity Boundaries (0..7Fh; 7Fh=Whole block gets black) 7 Always zero |
0 Serial Data (Low/High) 1 Serial Clock (Low/High) 2 Serial Direction (0=Input, 1=Output) 3 Led/Irq Enable (0=Off, 1=On; Enable LED and Gamepak IRQ) 4 Start Scan (0=Off, 1=Start) (0-to-1 --> Resync line 0) 5 Phi 16MHz Output (0=Off, 1=On; Enable Clock for Camera, and for LED) 6 Power 3V Enable (0=Off, 1=On; Enable 3V Supply for Camera) 7 Not used (always 0) (sometimes 1) (Read only) |
0 Not used (always 0) 1 Scanline Flag (1=Scanline Received, 0=Acknowledge) 2-3 Not used (always 0) 4 Strange Bit (0=Normal, 1=Force Resync/Line0 on certain interval?) 5 LED Anode Voltage (0=3.0V, 1=5.1V; requires E00FFB0h.Bit3+5 to be set) 6 Not used (always 0) 7 Input from PGA.Pin22, always high (not used by e-Reader) (Read Only) |
Port Expl. (e-Reader Setting) 00h Maybe Chip ID (12h) (not used by e-Reader BIOS) (Read Only) 01h (05h) ;-Bit0: 1=auto-repeat scanning? 02h (0Eh) 10h-11h Vertical Scroll (calib_data[30h]+7) 12h-13h Horizontal Scroll (0030h) 14h-15h Vertical Size (00F6h=246) 16h-17h Horizontal Size (0140h=320) 20h-21h H-Blank Duration (00C4h) 22h-23h (0400h) ;-Upper-Blanking in dot-clock units? 25h (var) ;-bit1: 0=enable [57h..5Ah] ? 26h (var) ;\maybe a 16bit value 27h (var) ;/ 28h (00h) 30h Brightness/contrast (calib_data[31h]+/-nn) 31h-33h (014h,014h,014h) 34h Brightness/contrast (02h) 50h-52h 8bit Read/Write (not used by e-Reader BIOS) 53h-55h 2bit Read/Write (not used by e-Reader BIOS) 56h 8bit Read/Write (not used by e-Reader BIOS) 57h-58h 16bit value, used to autodetect/adjust register[30h] (Read Only) 59h-5Ah 16bit value, used to autodetect/adjust register[30h] (Read Only) 80h-FFh Mirrors of 00h..7Fh (not used by e-Reader BIOS) |
Port Expl. (e-Reader Setting) 00h (22h) 01h (50h) 02h-03h Vertical Scroll (calib_data[30h]+28h) 04h-05h Horizontal Scroll (001Eh) 06h-07h Vertical Size (00F6h) ;=246 08h-09h Horizontal Size (0140h) ;=320 0Ah-0Ch (not used by e-Reader BIOS) 0Dh (01h) 0Eh-0Fh (01EAh) ;=245*2 10h-11h (00F5h) ;=245 12h-13h (20h,F0h) ;maybe min/max values? 14h-15h (31h,C0h) ;maybe min/max values? 16h (00h) 17h-18h (77h,77h) 19h-1Ch (30h,30h,30h,30h) 1Dh-20h (80h,80h,80h,80h) 21h-FFh (not used by e-Reader BIOS) |
E00D000 14h ID String ('Card-E Reader 2001',0,0) E00D014 2 Sector Checksum (NOT(x+x/10000h); x=sum of all other halfwords) |
E00D016 8x6 [00h] Intensity Boundaries for 8x6 blocks ;see E00FF80h..AFh E00D046 1 [30h] Vertical scroll (0..36h) ;see type1.reg10h/type2.reg02h E00D047 1 [31h] Brightness or contrast ;see type1.reg30h E00D048 2 [32h] LED Duration ;see E00FFB2h..B3h E00D04A 2 [34h] Not used? (0000h) E00D04C 2 [36h] Signed value, related to adjusting the 8x6 blocks E00D04E 4 [38h] Not used? (00000077h) E00D052 4 [3Ch] Camera Type (0=none,1=DV488800,2=Whatever?) |
E00D056 FAAh Not used (zerofilled) (included in above checksum) |
call ereader_power_on call ereader_initialize for z=1 to number_of_frames for y=0 to 245 Wait until E00FFB1h.Bit1 gets set by hardware (can be handled by IRQ) Copy 14h halfwords from DFC0000h to buf+y*28h via DMA3 Reset E00FFB1h.Bit1 by software next y ;(could now check DFC0028h..DFC0086h/DFC0088h for adjusting E00FF00h..2Fh) ;(could now show image on screen, that may require to stop/pause scanning) next z call ereader_power_off Ret |
[4000204h]=5803h ;Init waitstates, and enable Phi 16MHz [DFA0000h].Bit1=1 Wait(10ms) [E00FFB0h]=40h ;Enable Power3V and reset other bits [DFA0000h].Bit1=0 [E00FFB1h]=20h ;Enable Power5V and reset other bits Wait(40ms) [E00FFB1h].Bit4=0 ;...should be already 0 ? [E00FFB0h]=40h+27h ;Phi16MHz=On, SioDtaClkDir=HighHighOut Ret |
[E00FFB0h]=04h ;Power3V=Off, Disable Everything, SioDtaClkDir=LowLowOut [DFA0000h].Bit1=0 ;...should be already 0 [E00FFB1h].Bit5=0 ;Power5V=Off Ret |
IF calib_data[3Ch] AND 03h = 1 THEN init_camera_type1 [E00FFB0h].Bit4=1 ;ScanStart IF calib_data[3Ch] AND 03h = 2 THEN init_camera_type2 Copy calib_data[00h..2Fh] to [E00FF80h+00h..2Fh] ;Intensity Boundaries Copy calib_data[32h..33h] to [E00FFB2h+00h..01h] ;LED Duration LSB,MSB [E00FFB0h].Bit3=1 ;LedIrqOn Ret |
x=MIN(0,calib_data[31h]-0Bh) Set Sio Registers (as shown for Camera Type 1, except below values...) Set Sio Registers [30h]=x [25h]=04h, [26h]=58h, [27h]=6Ch ;(could now detect/adjust <x> based on Sio Registers [57h..5Ah]) Set Sio Registers [30h]=x [25h]=06h, [26h]=E8h, [27h]=6Ch Ret |
Wait(0.5ms) Set Sio Registers (as shown for Camera Type 2) Ret |
Begin Write(A) Write(B) Read(C) Read(D) End Idle PwrOff Dir ooooooo ooooooo ooooooo iiiiiii iiiiiii ooooooo ooooooo ooooooo Dta ---____ AAAAAAA BBBBBBB xxxxxCx xxxxxDx ______- ------- _______ Clk ------_ ___---_ ___---_ ___---_ ___---_ ___---- ------- _______ |
Delay: Wait circa 2.5us, Ret SioBegin: SioDta=1, SioDir=Out, SioClk=1, Delay, SioDta=0, Delay, SioClk=0, Ret SioEnd: SioDta=0, SioDir=Out, Delay, SioClk=1, Delay, SioDta=1, Ret SioRead1bit: ;out: databit SioDir=In, Delay, SioClk=1, Delay, databit=SioDta, SioClk=0, Ret SioWrite1bit: ;in: databit SioDta=databit, SioDir=Out, Delay, SioClk=1, Delay, SioClk=0, Ret SioReadByte: ;in: endflag - out: data for i=7 to 0, data.bit<i>=SioRead1bit, next i, SioWrite1bit(endflag), Ret SioWriteByte: ;in: data - out: errorflag for i=7 to 0, Delay(huh/why?), SioWrite1bit(data.bit<i>), next i errorflag=SioRead1bit, SioDir=Out(huh/why?), Ret SioWriteRegisters: ;in: index, len, buffer SioBegin SioWriteByte(22h) ;command (set_index) (and write_data) SioWriteByte(index) ;index for i=0 to len-1 SioWriteByte(buffer[i]) ;write data (and auto-increment index) next SioEnd ret SioReadRegisters: ;in: index, len - out: buffer SioBegin SioWriteByte(22h) ;command (set_index) (without any write_data here) SioWriteByte(index) ;index SioBegin SioWriteByte(23h) ;command (read_data) (using above index) for i=0 to len-1 if i=len-1 then endflag=1 else endflag=0 buffer[i]=SioReadByte(endflag) ;read data (and auto-increment index) next SioEnd Ret |
C000000h-C7FFFFFh ROM (8MB) C800000h-DF7FFFFh Open Bus DF80000h-DF80001h Useless Register (R/W) DF80002h-DF9FFFFh Mirrors of DF80000h-DF80001h DFA0000h-DFA0001h Reset Register (R/W) DFA0002h-DFBFFFFh Mirrors of DFA0000h-DFA0001h DFC0000h-DFC0027h Scanline Data (320 Pixels) (R) DFC0028h-DFC0087h Brightest Pixels of 8x6 Blocks (R) DFC0088h Darkest Pixel of whole Image (R) DFC0089h-DFC00FFh Always zero DFC0100h-DFDFFFFh Mirrors of DFC0000h-DFC00FFh DFE0000h-DFFFFFFh Open Bus E000000h-E00CFFFh FLASH Bank 0 - Data E00D000h-E00DFFFh FLASH Bank 0 - Calibration Data E00E000h-E00EFFFh FLASH Bank 0 - Copy of Calibration Data E00F000h-E00FF7Fh FLASH Bank 0 - Unused region E000000h-E00EFFFh FLASH Bank 1 - Data E00F000h-E00FF7Fh FLASH Bank 1 - Unused region E00FF80h-E00FFAFh Intensity Boundaries for 8x6 Blocks (R/W) E00FFB0h Control Register 0 (R/W) E00FFB1h Control Register 1 (R/W) E00FFB2h-E00FFB3h LED Duration (16bit) (R/W) E00FFB4h-E00FFBFh Always zero E00FFC0h-E00FFFFh Mirror of E00FF80h-E00FFBFh |
Actual Shape Scanned Shape XXXXX X X XXXXXXX X X X XXXXXXXXX X X X XX XXXXXXXXX X X X XX XXXXXXX XXXXXXX XXXXX XXXXX |
GBA Cart e-Reader Dotcode Format |
XXX BLOCK 1 XXX BLOCK 2 XXX XXXXX XXXXX XXXXX XXXXX X X X X X X X X X X X X XXXXX X X X X X X X X X X X X XXXXX XXXXX XXXXX XXXXX XXX HHHHHHHHHHHHHHHHHHHH...... XXX HHHHHHHHHHHHHHHHHHHH...... XXX .......................... .......................... ...... 3 short lines ..... .......................... A..................................A..................................A.. A.... 26 long lines ....A........ X = Sync Marks ........A.. A.... (each 34 data dots) ....A........ H = Block Header ........A.. A....(not all lines shown here)....A........ . = Data Bits ........A.. A..................................A........ A = Address Bits ........A.. ...... 3 short lines ..... .......................... ...(each 26 data dots).... .......................... XXX .......................... XXX .......................... XXX XXXXX XXXXX XXXXX XXXXX X X X X X X X X X X X X XXXXX X X X X X X X X X X X X XXXXX XXXXX XXXXX XXXXX XXX XXX XXX <ca. 35 blank lines> ___Snip____________________________________________________________________ |
addr[0] = 03FFh for i = 1 to 53 addr[i] = addr[i-1] xor ((i and (-i)) * 769h) if (i and 07h)=0 then addr[i] = addr[i] xor (769h) if (i and 0Fh)=0 then addr[i] = addr[i] xor (769h*2) if (i and 1Fh)=0 then addr[i] = addr[i] xor (769h*4) xor (769h) next i |
00h Unknown (00h) 01h Dotcode type (02h=Short, 03h=Long) 02h Unknown (00h) 03h Address of 1st Block (01h=Short, 19h=Long) 04h Total Fragment Size (40h) ;64 bytes per fragment, of which, ;48 bytes are actual data, the remaining 05h Error-Info Size (10h) ;16 bytes are error-info 06h Unknown (00h) 07h Interleave Value (1Ch=Short, 2Ch=Long) 08h..17h 16 bytes Reed-solomon error correction info for Block Header |
4bit 00h 01h 02h 03h 04h 05h 06h 07h 08h 09h 0Ah 0Bh 0Ch 0Dh 0Eh 0Fh 5bit 00h 01h 02h 12h 04h 05h 06h 16h 08h 09h 0Ah 14h 0Ch 0Dh 11h 10h |
RAW Offset Content 000h..001h 1st 2 bytes of RAW Header 002h 1st byte of 1st fragment 003h 1st byte of 2nd fragment ... ... 002h+I-1 1st byte of last fragment 002h+I 2nd byte of 1st fragment 003h+I 2nd byte of 2nd fragment ... ... 002h+I*2-1 2nd byte of last fragment ... ... |
GBA Cart e-Reader Data Format |
Data Header (48 bytes) Main-Title (17 bytes, or 33 bytes) Sub-Title(s) (3+18 bytes, or 33 bytes) (for each strip) (optional) VPK Size (2 byte value, total length of VPK Data in ALL strips) NULL Value (4 bytes, contained ONLY in 1st strip of GBA strips) VPK Data (length as defined in VPK Size entry, see above) |
Data Header (48 bytes) Main-Title (17 bytes, or 33 bytes) Sub-Title(s) (3+18 bytes, or 33 bytes) (for each strip) (optional) VPK Data (continued from previous strip) |
00h-01h Fixed (00h,30h) 02h Fixed (01h) ;01h="Do not calculate Global Checksum" ? 03h Primary Type (see below) 04h-05h Fixed (00h,01h) (don't care) 06h-07h Strip Size (0510h=Short, 0810h=Long Strip) ((I-1)*30h) (MSB,LSB) 08h-0Bh Fixed (00h,00h,10h,12h) 0Ch-0Dh Region/Type (see below) 0Eh Strip Type (02h=Short Strip, 01h=Long Strip) (don't care) 0Fh Fixed (00h) (don't care) 10h-11h Unknown (whatever) (don't care) 12h Fixed (10h) ;10h="Do calculate Data Checksum" ? 13h-14h Data Checksum (see below) (MSB,LSB) 15h-19h Fixed (19h,00h,00h,00h,08h) 1Ah-21h ID String ('NINTENDO') 22h-25h Fixed (00h,22h,00h,09h) 26h-29h Size Info (see below) 2Ah-2Dh Flags (see below) 2Eh Header Checksum (entries [0Ch-0Dh,10h-11h,26h-2Dh] XORed together) 2Fh Global Checksum (see below) |
0 Card Type (upper bit) (see below) 1 Unknown (usually opposite of Bit0) (don't care) 2-7 Unknown (usually zero) |
0-3 Unknown (don't care) 4-7 Card Type (lower bits) (see below) 8-11 Region/Version (0=Japan/Original, 1=Non-japan, 2=Japan/Plus) 12-15 Unknown (don't care) |
0 Unknown (don't care) 1-4 Strip Number (01h..Number of strips) 5-8 Number of Strips (01h..0Ch) (01h..08h for Japan/Original version) 9-23 Size of all Strips (excluding Headers and Main/Sub-Titles) (same as "VPK Size", but also including the 2-byte "VPK Size" value, plus the 4-byte NULL value; if it is present) 24-31 Fixed (02h) (don't care) |
0 Permission to save (0=Start Immediately, 1=Prompt for FLASH Saving) 1 Sub-Title Flag (0=Yes, 1=None) (Japan/Original: always 0=Yes) 2 Application Type (0=GBA/Z80, 1=NES) (Japan/Original: always 0=Z80) 3-31 Zero (0) (don't care) |
Bit Expl. 0-3 h1, values 1..15 shown as "10..150", value 0 is not displayed 4-6 i3, values 0..7 shown as "A..G,#" 7-13 i2, values 0..98 shown as "01..99" values 99..127 as "A0..C8" 14-18 i1, values 0..31 shown as "A..Z,-,_,{HP},.,{ID?},:" 19-22 Unknown 23 Disable stats (0=Show as "HP: h1 ID: i1-i2-i3", 1=Don't show it) |
00h --> end-byte 81h,40h --> SPC 81h,43h..97h --> punctuation marks 82h,4Fh..58h --> "0..9" 82h,60h..79h --> "A..Z" 82h,81h..9Ah --> "a..z" |
00 = end-byte 01 = spc 02..0B = 0..9 0C..AF = japanese B0..B4 = dash, male, female, comma, round-dot B5..C0 = !"%&~?/+-:.' C1..DA = A..Z DB..DF = unused (blank) E0..E5 = japanese E6..FF = a..z N/A = #$()*;<=>@[\]^_`{|} |
00h..01h Blank Screen (?) 02h..03h Dotcode Application with 17byte-title, with stats, load music A 04h..05h Dotcode Application with 17byte-title, with stats, load music B 06h..07h P-Letter Attacks 08h..09h Construction Escape 0Ah..0Bh Construction Action 0Ch..0Dh Construction Melody Box 0Eh Dotcode Application with 33byte-title, without stats, load music A 0Fh Game specific cards 10h..1Dh P-Letter Viewer 1Eh..1Fh Same as 0Eh and 0Fh (see above) |
GBA Cart e-Reader Program Code |
IF e-Reader is Non-Japanese, AND [2000008h] is outside of range of 2000000h..20000E3h, AND only if booted from camera (not when booted from FLASH?), THEN [2000008h]=[2000008h]-0001610Ch ELSE [2000008h] kept intact |
Store "B 20000C0h" at 2000000h ;redirect to RAM-entrypoint Zerofill 2000004h..20000BFh ;erase header (for better compression rate) Store 01h,01h at 20000C4h ;indicate RAM boot |
http://problemkaputt.de/everynes.htm |
for i=17h to 0 for j=07h to 0, nmi = nmi shr 1, if carry then nmi = nmi xor 8646h, next j nmi = nmi xor (byte[dmca_data+i] shl 8) next i dmca_data: db 0,0,'DMCA NINTENDO E-READER' |
Bit0-14 Lower bits of Entrypoint (0..7FFFh = Address 8000h..FFFFh) Bit15 Nametable Mode (0=Vertical Mirroring, 1=Horizontal Mirroring) |
(NES limitations, 1 16K program rom + 1-2 8K CHR rom, mapper 0 and 1) ines mapper 1 would be MMC1, rather than CNROM (ines mapper 3)? but, there are more or less NONE games that have 16K PRG ROM + 16K VROM? |
CB [Prefix] E0 RET PO E2 JP PO,nn E4 CALL PO,nn 27 DAA 76 HALT ED [Prefix] E8 RET PE EA JP PE,nn EC CALL PE,nn D3 OUT (n),A DD [IX Prefix] F3 DI 08 EX AF,AF' F4 CALL P,nn DB IN A,(n) FD [IY Prefix] FB EI D9 EXX FC CALL M,nn xx RST 00h..38h |
76 WAIT A frames, D3 WAIT n frames, and C7/CF RST 0/8 used for API calls. |
retry: ld bc,data // ld hl,00c8h ;src/dst lop: ld a,[bc] // inc bc // ld e,a ;lsb ld a,[bc] // inc bc // ld d,a ;msb dw 0bcfh ;aka rst 8 // db 0bh ;[4000000h+hl]=de (DMA registers) inc hl // inc hl // ld a,l cp a,0dch // jr nz,lop mod1 equ $+1 dw 37cfh ;aka rst 8 // db 37h ;bx 3E700F0h ;below executed only on jap/plus... on jap/plus, above 37cfh is hl=[400010Ch] ld a,3Ah // ld [mod1],a ;bx 3E700F0h (3Ah instead 37h) ld hl,1 // ld [mod2],hl // ld [mod3],hl ;base (0200010Ch instead 0201610Ch) jr retry data: mod2 equ $+1 dd loader ;40000C8h dma2sad (loader) ;\ dd 030000F0h ;40000CCh dma2dad (mirrored 3E700F0h) ; relocate loader dd 8000000ah ;40000D0h dma2cnt (copy 0Ah x 16bit) ;/ mod3 equ $+1 dd main ;40000D4h dma3sad (main) ;\prepare main reloc dd 02000000h ;40000D8h dma3dad (2000000h) ;/dma3cnt see loader .align 2 ;alignment for 16bit-halfword org $+201600ch ;jap/plus: adjusted to org $+200000ch loader: mov r0,80000000h ;(dma3cnt, copy 10000h x 16bit) mov r1,04000000h ;i/o base strb r1,[r1,208h] ;ime=0 (better disable ime before moving ram) str r0,[r1,0DCh] ;dma3cnt (relocate to 2000000h) mov r15,2000000h ;start relocated code at 2000000h in ARM state main: ;...insert/append whatever ARM code here... end |
GBA Cart e-Reader API Functions |
db 76h ;Wait8bit A db D3h,xxh ;Wait8bit xxh db C7h,xxh ;RST0_xxh db CFh,xxh ;RST8_xxh ld r,[00xxh] ;get system values (addresses differ on jap/ori) ld r,[00C2h..C3h] ;GetKeyStateSticky (jap/ori: 9F02h..9F03h) ld r,[00C4h..C5h] ;GetKeyStateRaw (jap/ori: 9F04h..9F05h) ld r,[00C0h..C1h] ;see Exit and ExitRestart ld r,[00D0h..D3h] ;see Mul16bit |
bx [30075FCh] ;ApiVector ;in: r0=func_no,r1,r2,r3,[sp+0],[sp+4],[sp+8]=params bx lr ;Exit ;in: r0 (0=Restart, 2=To_Menu) |
RST0_00h FadeIn, A speed, number of frames (0..x) RST0_01h FadeOut RST0_02h BlinkWhite RST0_03h (?) RST0_04h (?) blend_func_unk1 RST0_05h (?) RST0_06h (?) RST0_07h (?) RST0_08h (?) RST0_09h (?) _020264CC_check RST0_0Ah (?) _020264CC_free RST0_0Bh N/A (bx 0) RST0_0Ch N/A (bx 0) RST0_0Dh N/A (bx 0) RST0_0Eh N/A (bx 0) RST0_0Fh N/A (bx 0) RST0_10h LoadSystemBackground, A number of background (1..101), E bg# (0..3) RST0_11h SetBackgroundOffset, A=bg# (0..3), DE=X, BC=Y RST0_12h SetBackgroundAutoScroll RST0_13h SetBackgroundMirrorToggle RST0_14h (?) RST0_15h (?) RST0_16h (?) write_000000FF_to_02029494_ RST0_17h (?) RST0_18h (?) RST0_19h SetBackgroundMode, A=mode (0..2) RST0_1Ah (?) RST0_1Bh (?) RST0_1Ch (?) RST0_1Dh (?) RST0_1Eh (?) RST0_1Fh (?) RST0_20h LayerShow RST0_21h LayerHide RST0_22h (?) RST0_23h (?) RST0_24h ... [20264DCh+A*20h+1Ah]=DE, [20264DCh+A*20h+1Ch]=BC RST0_25h (?) RST0_26h (?) RST0_27h (?) RST0_28h (?) RST0_29h (?) RST0_2Ah (?) RST0_2Bh (?) RST0_2Ch (?) RST0_2Dh LoadCustomBackground, A bg# (0..3), DE pointer to struct_background, max. tile data size = 3000h bytes, max. map data size = 1000h bytes RST0_2Eh GBA: N/A - Z80: (?) RST0_2Fh (?) RST0_30h CreateSystemSprite, - - (what "- -" ???) RST0_31h SpriteFree, HL sprite handle RST0_32h SetSpritePos, HL=sprite handle, DE=X, BC=Y RST0_33h (?) sprite_unk2 RST0_34h SpriteFrameNext RST0_35h SpriteFramePrev RST0_36h SetSpriteFrame, HL=sprite handle, E=frame number (0..x) RST0_37h (?) sprite_unk3 RST0_38h (?) sprite_unk4 RST0_39h SetSpriteAutoMove, HL=sprite handle, DE=X, BC=Y RST0_3Ah (?) sprite_unk5 RST0_3Bh (?) sprite_unk6 RST0_3Ch SpriteAutoAnimate RST0_3Dh (?) sprite_unk7 RST0_3Eh SpriteAutoRotateUntilAngle RST0_3Fh SpriteAutoRotateByAngle RST0_40h SpriteAutoRotateByTime RST0_41h (?) sprite_unk8 RST0_42h SetSpriteAutoMoveHorizontal RST0_43h SetSpriteAutoMoveVertical RST0_44h (?) sprite_unk9 RST0_45h SpriteDrawOnBackground RST0_46h SpriteShow, HL=sprite handle RST0_47h SpriteHide, HL=sprite handle RST0_48h SpriteMirrorToggle RST0_49h (?) sprite_unk10 RST0_4Ah (?) sprite_unk11 RST0_4Bh (?) sprite_unk12 RST0_4Ch GetSpritePos RST0_4Dh CreateCustomSprite RST0_4Eh (?) RST0_4Fh (?) sprite_unk14 RST0_50h (?) sprite_unk15 RST0_51h (?) sprite_unk16 RST0_52h (?) sprite_unk17 RST0_53h (?) sprite_unk18 RST0_54h (?) RST0_55h (?) sprite_unk20 RST0_56h (?) RST0_57h SpriteMove RST0_58h (?) sprite_unk22 RST0_59h (?) sprite_unk23 RST0_5Ah (?) sprite_unk24 RST0_5Bh SpriteAutoScaleUntilSize, C=speed (higher value is slower), HL=sprite handle, DE=size (0100h = normal size, lower value = larger, higher value = smaller) RST0_5Ch SpriteAutoScaleBySize RST0_5Dh SpriteAutoScaleWidthUntilSize RST0_5Eh SpriteAutoScaleHeightBySize RST0_5Fh (?) RST0_60h (?) RST0_61h (?) RST0_62h (?) RST0_63h (?) RST0_64h hl=[[2024D28h+a*4]+12h] RST0_65h (?) sprite_unk25 RST0_66h SetSpriteVisible, HL=sprite handle, E=(0=not visible, 1=visible) RST0_67h (?) sprite_unk26 RST0_68h (?) set_sprite_unk27 RST0_69h (?) get_sprite_unk27 RST0_6Ah (?) RST0_6Bh (?) RST0_6Ch (?) RST0_6Dh (?) RST0_6Eh hl=[hl+000Ah] ;r0=[r1+0Ah] RST0_6Fh (?) RST0_70h (?) RST0_71h (?) RST0_72h (?) RST0_73h (?) RST0_74h (?) RST0_75h (?) RST0_76h (?) RST0_77h (?) RST0_78h (?) RST0_79h (?) RST0_7Ah (?) RST0_7Bh (?) RST0_7Ch (?) _0202FD2C_unk12 RST0_7Dh Wait16bit ;HL=num_frames (16bit variant of Wait8bit opcode/function) RST0_7Eh SetBackgroundPalette, HL=src_addr, DE=offset, C=num_colors (1..x) RST0_7Fh GetBackgroundPalette(a,b,c) RST0_80h SetSpritePalette, HL=src_addr, DE=offset, C=num_colors (1..x) RST0_81h GetSpritePalette(a,b,c) RST0_82h ClearPalette RST0_83h (?) _0202FD2C_unk11 RST0_84h (?) RST0_85h (?) RST0_86h (?) RST0_87h (?) _0202FD2C_unk8 RST0_88h (?) _0202FD2C_unk7 RST0_89h (?) RST0_8Ah (?) _0202FD2C_unk6 RST0_8Bh (?) _0202FD2C_unk5 RST0_8Ch GBA: N/A - Z80: (?) RST0_8Dh GBA: N/A - Z80: (?) RST0_8Eh (?) RST0_8Fh WindowHide RST0_90h CreateRegion, H=bg# (0..3), L=palbank# (0..15), D,E,B,C=x1,y1,cx,cy (in tiles), return: n/a (no$note: n/a ???) RST0_91h SetRegionColor RST0_92h ClearRegion RST0_93h SetPixel RST0_94h GetPixel RST0_95h DrawLine RST0_96h DrawRect RST0_97h (?) _0202FD2C_unk4 RST0_98h SetTextColor, A=region handle, D=color foreground (0..15), E=color background (0..15) RST0_99h DrawText, A=region handle, BC=pointer to text, D=X, E=Y (non-japan uses ASCII text, but japanese e-reader's use STH ELSE?) RST0_9Ah SetTextSize RST0_9Bh (?) RegionUnk7 RST0_9Ch (?) _0202FD2C_unk3 RST0_9Dh (?) _0202FD2C_unk2 RST0_9Eh (?) _0202FD2C_unk1 RST0_9Fh Z80: (?) - GBA: SetBackgroundModeRaw RST0_A0h (?) RST0_A1h (?) RST0_A2h (?) RegionUnk6 RST0_A3h GBA: N/A - Z80: (?) RST0_A4h GBA: N/A - Z80: (?) RST0_A5h (?) RST0_A6h (?) RST0_A7h (?) RST0_A8h (?) RST0_A9h (?) RST0_AAh (?) RST0_ABh (?) RST0_ACh (?) RST0_ADh (?) RegionUnk5 RST0_AEh [202FD2Ch+122h]=A RST0_AFh [202FD2Ch+123h]=A RST0_B0h [202FD2Ch+124h]=A RST0_B1h (?) RST0_B2h (?) RST0_B3h GBA: N/A - Z80: Sqrt ;hl=sqrt(hl) RST0_B4h GBA: N/A - Z80: ArcTan ;hl=ArcTan2(hl,de) RST0_B5h Sine ;hl=sin(a)*de RST0_B6h Cosine ;hl=cos(a)*de RST0_B7h (?) RST0_B8h (?) RST0_B9h N/A (bx 0) RST0_BAh N/A (bx 0) RST0_BBh N/A (bx 0) RST0_BCh N/A (bx 0) RST0_BDh N/A (bx 0) RST0_BEh N/A (bx 0) RST0_BFh N/A (bx 0) Below Non-Japan and Japan/Plus only (not Japan/Ori) RST0_C0h GetTextWidth(a,b) RST0_C1h GetTextWidthEx(a,b,c) RST0_C2h (?) RST0_C3h Z80: N/A (bx 0) - GBA: (?) RST0_C4h (?) RST0_C5h (?) RST0_C6h (?) RST0_C7h (?) RST0_C8h (?) RST0_C9h (?) RST0_CAh (?) RST0_CBh (?) RST0_CCh (?) RST0_CDh N/A (bx lr) RST0_CEh ;same as RST0_3Bh, but with 16bit mask RST0_CFh ;same as RST0_3Eh, but with 16bit de RST0_D0h ;same as RST0_3Fh, but with 16bit de RST0_D1h ;same as RST0_5Bh, but with 16bit de RST0_D2h ;same as RST0_5Ch, but with 16bit de RST0_D3h ;same as RST0_5Dh, but with 16bit de RST0_D4h ;same as RST0_5Eh, but with 16bit de RST0_D5h (?) RST0_D6h (?) RST0_D7h ;[202FD2Ch+125h]=A RST0_D8h (?) RST0_D9h (?) RST0_DAh (?) RST0_DBh ;A=[3003E51h] RST0_DCh ;[3004658h]=01h RST0_DDh DecompressVPKorNonVPK RST0_DEh FlashWriteSectorSingle(a,b) RST0_DFh FlashReadSectorSingle(a,b) RST0_E0h SoftReset RST0_E1h GetCartridgeHeader ;[hl+0..BFh]=[8000000h..80000BFh] RST0_E2h GBA: N/A - Z80: bx hl ;in: hl=addr, af,bc,de,sp=param, out: a RST0_E3h Z80: N/A (bx 0) - GBA: (?) RST0_E4h (?) RST0_E5h (?) RST0_E6h (?) RST0_E7h (?) RST0_E8h (?) RST0_E9h ;[2029498h]=0000h RST0_EAh Z80: N/A (bx 0) - GBA: InitMemory(a) RST0_EBh (?) BL_irq_sio_dma3 RST0_ECh ;hl = [3003E30h]*100h + [3003E34h] RST0_EDh FlashWriteSectorMulti(a,b,c) RST0_EEh FlashReadPart(a,b,c) RST0_EFh ;A=((-([2029416h] xor 1)) OR (+([2029416h] xor 1))) SHR 31 RST0_F0h (?) _unk1 RST0_F1h RandomInit ;in: hl=random_seed RST0_F2h (?) Below Japan/Plus only RST0_F3h (?) RST0_F4h (?) RST0_F5h (?) RST0_F6h (?) RST0_F7h GBA: N/A - Z80: (?) Below is undefined/garbage (values as so in Z80 mode) Jap/Ori: RST0_C0h N/A (bx 0) Jap/Ori: RST0_C1h..FFh Overlaps RST8 jump list Non-Jap: RST0_F3h..FFh Overlaps RST8 jump list Jap/Pls: RST0_F8h..FFh Overlaps RST8 jump list |
RST8_00h GBA: N/A - Z80: Exit ;[00C0h]=a ;(1=restart, 2=exit) RST8_01h GBA: N/A - Z80: Mul8bit ;hl=a*e RST8_02h GBA: N/A - Z80: Mul16bit ;hl=hl*de, s32[00D0h]=hl*de RST8_03h Div ;hl=hl/de RST8_04h DivRem ;hl=hl mod de RST8_05h PlaySystemSound ;in: hl=sound_number RST8_06h (?) sound_unk1 RST8_07h Random8bit ;a=random(0..FFh) RST8_08h SetSoundVolume RST8_09h BcdTime ;[de+0..5]=hhmmss(hl*bc) RST8_0Ah BcdNumber ;[de+0..4]=BCD(hl), [de+5]=00h RST8_0Bh IoWrite ;[4000000h+hl]=de RST8_0Ch IoRead ;de=[4000000h+hl] RST8_0Dh GBA: N/A - Z80: (?) RST8_0Eh GBA: N/A - Z80: (?) RST8_0Fh GBA: N/A - Z80: (?) RST8_10h GBA: N/A - Z80: (?) RST8_11h DivSigned ;hl=hl/de, signed RST8_12h RandomMax ;a=random(0..a-1) RST8_13h SetSoundSpeed RST8_14h hl=[202FD20h]=[2024CACh] RST8_15h hl=[2024CACh]-[202FD20h] RST8_16h SoundPause RST8_17h SoundResume RST8_18h PlaySystemSoundEx RST8_19h IsSoundPlaying RST8_1Ah (?) RST8_1Bh (?) RST8_1Ch (?) RST8_1Dh GetExitCount ;a=[2032D34h] RST8_1Eh Permille ;hl=de*1000/hl RST8_1Fh GBA: N/A - Z80: ExitRestart;[2032D38h]=a, [00C0h]=0001h ;a=? RST8_20h GBA: N/A - Z80: WaitJoypad ;wait until joypad<>0, set hl=joypad RST8_21h GBA: N/A - Z80: (?) RST8_22h (?) _sound_unk7 RST8_23h (?) _sound_unk8 RST8_24h (?) _sound_unk9 RST8_25h (?) _sound_unk10 RST8_26h Mosaic ;bg<n>cnt.bit6=a.bit<n>, [400004Ch]=de RST8_27h (?) RST8_28h (?) RST8_29h (?) RST8_2Ah (?) get_8bit_from_2030110h RST8_2Bh (?) RST8_2Ch (?) get_16bit_from_2030112h ;jap/ori: hl=[20077B2h] RST8_2Dh (?) get_16bit_from_2030114h ;jap/ori: hl=[20077B4h] RST8_2Eh (?) RST8_2Fh PlayCustomSound(a,b) Below not for Japanese/Original (the renumbered functions can be theoretically used on japanese/original) (but, doing so would blow forwards compatibility with japanese/plus) RST8_30h (ori: none) GBA: N/A - Z80: (?) RST8_31h (ori: none) PlayCustomSoundEx(a,b,c) RST8_32h (ori: RST8_30h) BrightnessHalf ;[4000050h]=00FFh,[4000054h]=0008h RST8_33h (ori: RST8_31h) BrightnessNormal ;[4000050h]=0000h RST8_34h (ori: RST8_32h) N/A (bx lr) RST8_35h (ori: RST8_33h) (?) RST8_36h (ori: RST8_34h) ResetTimer ;[400010Ch]=00000000h, [400010Eh]=A+80h RST8_37h (ori: RST8_35h) GetTimer ;hl=[400010Ch] RST8_38h (ori: none) GBA: N/A - Z80: (?) Below is undefined/reserved/garbage (values as so in Z80 mode) (can be used to tweak jap/ori to start GBA-code from inside of Z80-code) (that, after relocating code to 3000xxxh via DMA via IoWrite function) RST8_39h (ori: RST8_36h) bx 0140014h RST8_3Ah (ori: RST8_37h) bx 3E700F0h RST8_3Bh (ori: RST8_38h) bx 3E70000h+1 RST8_3Ch (ori: RST8_39h) bx 3E703E6h+1 RST8_3Dh (ori: RST8_3Ah) bx 3E703E6h+1 RST8_3Eh (ori: RST8_3Bh) bx 3E703E6h+1 RST8_3Fh (ori: RST8_3Ch) bx 3E703E6h+1 40h-FFh (ori: 3Dh-FFh) bx ... |
RSTX_00h Wait8bit ;for 16bit: RST0_7Dh RSTX_01h GetKeyStateSticky() RSTX_02h GetKeyStateRaw() RSTX_03h (?) RSTX_04h (?) |
GBA Cart e-Reader VPK Decompression |
collected32bit=80000000h ;initially empty (endflag in bit31) for i=0 to 3, id[i]=read_bits(8), next i, if id[0..3]<>'vpk0' then error dest_end=dest+read_bits(32) ;size of decompressed data (of all strips) method=read_bits(8), if method>1 then error tree_index=0, read_huffman_tree, disproot=tree_index tree_index=tree_index+1, read_huffman_tree, lenroot=tree_index ;above stuff is contained only in the first strip. below loop starts at ;current location in first strip, and does then continue in further strips. decompress_loop: if read_bits(1)=0 then ;copy one uncompressed data byte, [dest]=read_bits(8), dest=dest+1 ;does work without huffman trees else if disproot=-1 or lenroot=-1 then error ;compression does require trees disp=read_tree(disproot) if method=1 ;disp*4 is good for 32bit ARM opcodes if disp>2 then disp=disp*4-8 else disp=disp+4*read_tree(disproot)-7 len=read_tree(lenroot) if len=0 or disp<=0 or dest+len-1>dest_end then error ;whoops for j=1 to len, [dest]=[dest-disp], dest=dest+1, next j if dest<dest_end then decompress_loop ret |
mov data=0 for i=1 to num shl collected32bit,1 ;move next bit to carry, or set zeroflag if empty if zeroflag collected32bit=[src+0]*1000000h+[src+1]*10000h+[src+2]*100h+[src+3] src=src+4 ;read data in 32bit units, in reversed byte-order carryflag=1 ;endbit rcl collected32bit,1 ;move bit31 to carry (and endbit to bit0) rcl data,1 ;move carry to data next i ret(data) |
i=root_index while node[i].right<>-1 ;loop until reaching data node if read_bits(1)=1 then i=node[i].right else i=node[i].left i=node[i].left ;get number of bits i=read_bits(i) ;read that number of bits ret(i) ;return that value |
stacktop=sp if read_bits(1)=1 then tree_index=-1, ret ;exit (empty) node[tree_index].right=-1 ;indicate data node node[tree_index].left=read_bits(8) ;store data value if read_bits(1)=1 then ret ;exit (only 1 data node at root) push tree_index ;save previous (child) node tree_index=tree_index+1 jmp data_injump load_loop: push tree_index ;save previous (child) node tree_index=tree_index+1 if read_bits(1)=1 then parent_node data_injump: node[tree_index].right=-1 ;indicate data node node[tree_index].left=read_bits(8) ;store data value jmp load_loop parent_node: pop node[tree_index].right ;store 1st child pop node[tree_index].left ;store 2nd child if sp<>stacktop then jmp load_loop if read_bits(1)=0 then error ;end bit (must be 1) ret |
GBA Cart e-Reader Error Correction |
reverse_byte_order(data,dtalen) zerofill_error_bytes(data,errlen) for i=dtalen-1 to errlen ;loop across data portion z = rev[ data[i] xor data[errlen-1] ] ; for j=errlen-1 to 0 ;loop across error-info portion if j=0 then x=00h else x=data[j-1] if z<>FFh then y=gg[j], if y<>FFh then y=y+z, if y>=FFh then y=y-FFh x=x xor pow[y] data[j]=x next j next i invert_error_bytes(data,errlen) reverse_byte_order(data,dtalen) |
reverse_byte_order(data,dtalen) invert_error_bytes(data,errlen) make_rev(data,dtalen) for i=78h to 78h+errlen-1 x=0, z=0 for j=0 to dtalen-1 y=data[j] if y<>FFh then y=y+z, if y>=FFh then y=y-FFh x=x xor pow[y] z=z+i, if z>=FFh then z=z-FFh next j if x<>0 then error next i ;(if errors occured, could correct them now) make_pow(data,dtalen) invert_error_bytes(data,errlen) reverse_byte_order(data,dtalen) |
for i=0 to len-1, data[i]=rev[data[i]], next i |
for i=0 to len-1, data[i]=pow[data[i]], next i |
for i=0 to len-1, data[i]=data[i] xor FFh, next i |
for i=0 to len-1, data[i]=00h, next i |
for i=0 to (len-1)/2, x=data[i], data[i]=data[len-i], data[len-i]=x, next i |
x=01h, pow[FFh]=00h, rev[00h]=FFh for i=00h to FEh pow[i]=x, rev[x]=i, x=x*2, if x>=100h then x=x xor 187h next i |
gg[0]=pow[78h] for i=1 to errlen-1 gg[i]=01h for j=i downto 0 if j=0 then y=00h else y=gg[j-1] x=gg[j], if x<>00h then x=rev[x]+78h+i, if x>=FFh then x=x-FFh y=y xor pow[x] gg[j]=y next j next i make_rev(gg,errlen) |
00h,4Bh,EBh,D5h,EFh,4Ch,71h,00h,F4h,00h,71h,4Ch,EFh,D5h,EBh,4Bh |
pow = alpha_to, but generated as shown above rev = index_of, dito b0 = 78h nn = dtalen kk = dtalen-errlen %nn = MOD FFh (for the ereader that isn't MOD dtalen) -1 = FFh |
GBA Cart e-Reader File Formats |
GBA Cart Unknown Devices |
GBA Cart Protections |
GBA Flashcards |
configure_flashcard(9E2468Ah,9413h) ;unlock flash advance cards turbo=1, send_command(8000000h,90h) ;enter ID mode (both chips, if any) maker=[8000000h], device=[8000000h+2] IF maker=device THEN device=[8000000h+4] ELSE turbo=0 flashcard_read_mode ;exit ID mode search (maker+device*10000h) in device_list total/erase/write_block_size = list_entry SHL turbo |
FOR x=1 to len/erase_block_size send_command(dest,20h) ;erase sector command send_command(dest,D0h) ;confirm erase sector dest=dest+erase_block_size IF wait_busy=okay THEN NEXT x enter_read_mode ;exit erase/status mode |
siz=write_block_size FOR x=1 to len/siz IF siz=2 THEN send_command(dest,10h) ;write halfword command IF siz>2 THEN send_command(dest,E8h) ;write to buffer command IF siz>2 THEN send_command(dest,16-1) ;buffer size 16 halfwords (per chip) FOR y=1 TO siz/2 [dest]=[src], dest=dest+2, src=src+2 ;write data to buffer NEXT y IF siz>2 THEN send_command(dest,D0h) ;confirm write to buffer IF wait_busy=okay THEN NEXT x enter_read_mode ;exit write/status mode |
[adr]=val IF turbo THEN [adr+2]=val |
send_command(8000000h,FFh) ;exit status mode send_command(8000000h,FFh) ;again maybe more stable (as in jeff's source) |
start=time REPEAT stat=[8000000h] XOR 80h IF turbo THEN stat=stat OR ([8000000h+2] XOR 80h) IF (stat AND 7Fh)>0 THEN error IF (stat AND 80h)=0 THEN ready IF time-start>5secs THEN timeout UNTIL ready OR error OR timeout IF error OR timeout THEN send_command(8000000h,50h) ;clear status |
[930ECA8h]=5354h [802468Ah]=1234h, repeated 500 times [800ECA8h]=5354h [802468Ah]=5354h [802468Ah]=5678h, repeated 500 times [930ECA8h]=5354h [802468Ah]=5354h [8ECA800h]=5678h [80268A0h]=1234h [802468Ah]=ABCDh, repeated 500 times [930ECA8h]=5354h [adr]=val |
configure_flashcard(942468Ah,???) |
ID Code Total Erase Write Name -??-00DCh ? ? ? Hudson Cart (???) 00160089h 4M 128K 32 Intel i28F320J3A (Flash Advance) 00170089h 8M 128K 32 Intel i28F640J3A (Flash Advance) 00180089h 16M 128K 32 Intel i28F128J3A (Flash Advance) 00E200B0h ? 64K 2 Sharp LH28F320BJE ? (Nintendo) |
GBA Cheat Devices |
GBA Cheat Codes - General Info |
GBA Cheat Codes - Codebreaker/Xploder |
0000xxxx 000y Enable Code 1 - Game ID 1aaaaaaa 000z Enable Code 2 - Hook Address 2aaaaaaa yyyy [aaaaaaa]=[aaaaaaa] OR yyyy 3aaaaaaa 00yy [aaaaaaa]=yy 4aaaaaaa yyyy [aaaaaaa+0..(cccc-1)*ssss]=yyyy+0..(cccc-1)*ssss iiiicccc ssss parameters for above code 5aaaaaaa cccc [aaaaaaa+0..(cccc-1)]=11,22,33,44,etc. 11223344 5566 parameter bytes 1..6 for above code (example) 77880000 0000 parameter bytes 7..8 for above code (padded with zero) 6aaaaaaa yyyy [aaaaaaa]=[aaaaaaa] AND yyyy 7aaaaaaa yyyy IF [aaaaaaa]=yyyy THEN (next code) 8aaaaaaa yyyy [aaaaaaa]=yyyy 9xyyxxxx xxxx Enable Code 0 - Encrypt all following codes (optional) Aaaaaaaa yyyy IF [aaaaaaa]<>yyyy THEN (next code) Baaaaaaa yyyy IF [aaaaaaa]>yyyy THEN (next code) (signed comparison) Caaaaaaa yyyy IF [aaaaaaa]<yyyy THEN (next code) (signed comparison) D0000020 yyyy IF [joypad] AND yyyy = 0 THEN (next code) Eaaaaaaa yyyy [aaaaaaa]=[aaaaaaa]+yyyy Faaaaaaa yyyy IF [aaaaaaa] AND yyyy THEN (next code) |
crc=FFFFh for i=0 to FFFFh x=byte[i] xor (crc/100h) x=x xor (x/10h) crc=(crc*100h) xor (x*1001h) xor (x*20h) next i |
for i=0 to 2Fh, swaplist[i]=i, next i randomizer = 1111h xor byte[code+4] ;LSB value for i=0 to 4Fh exchange swaplist[random MOD 30h] with swaplist[random MOD 30h] next i halfword[seedlist+0] = halfword[code+0] ;LSW address randomizer = 4EFAD1C3h for i=0 to byte[code+3]-91h, randomizer=random, next i ;MSB address word[seedlist+2]=random, halfword[seedlist+6]=random randomizer = F254h xor byte[code+5] ;MSB value for i=0 to byte[code+5]-01h, randomizer=random, next i ;MSB value word[seedlist+8]=random, halfword[seedlist+12]=random ;note: byte[code+2] = don't care ret |
randomizer=randomizer*41C64E6Dh+3039h, x=(randomizer SHL 14 AND C0000000h) randomizer=randomizer*41C64E6Dh+3039h, x=(randomizer SHR 1 AND 3FFF8000h)+x randomizer=randomizer*41C64E6Dh+3039h, x=(randomizer SHR 16 AND 00007FFFh)+x return(x) |
for i=2Fh to 0 j=swaplist[i] bitno1=(i AND 7), index1=xlatlist[i/8] bitno2=(j AND 7), index2=xlatlist[j/8] exchange [code+index1].bitno1 with [code+index2].bitno2 next i word[code+0] = word[code+0] xor word[seedlist+8] i = (byte[code+3]*1010000h + byte[code+0]*100h + byte[code+5]) i = (halfword[code+1]*10001h) xor (word[seedlist+2]) xor i i = (byte[seedlist+0]*1010101h) xor (byte[seedlist+1]*1000000h) xor i j = (byte[code+5] + (byte[code+0] xor byte[code+4])*100h) j = (byte[seedlist+0]*101h) xor halfword[seedlist+6] xor j word[code+0] = i, halfword[code+4] = j |
GBA Cheat Codes - Gameshark/Action Replay V1/V2 |
0aaaaaaa 000000xx [aaaaaaa]=xx 1aaaaaaa 0000xxxx [aaaaaaa]=xxxx 2aaaaaaa xxxxxxxx [aaaaaaa]=xxxxxxxx 3000cccc xxxxxxxx write xxxxxxxx to (cccc-1) addresses (list in next codes) aaaaaaaa aaaaaaaa parameter for above code, containing two addresses each aaaaaaaa 00000000 last parameter for above, zero-padded if only one address 60aaaaaa y000xxxx [8000000h+aaaaaa*2]=xxxx (ROM Patch) 8a1aaaaa 000000xx IF GS_Button_Down THEN [a0aaaaa]=xx 8a2aaaaa 0000xxxx IF GS_Button_Down THEN [a0aaaaa]=xxxx 80F00000 0000xxxx IF GS_Button_Down THEN slowdown xxxx * ? cycles per hook Daaaaaaa 0000xxxx IF [aaaaaaa]=xxxx THEN (next code) E0zzxxxx 0aaaaaaa IF [aaaaaaa]=xxxx THEN (next 'zz' codes) Faaaaaaa 00000x0y Enable Code - Hook Routine xxxxxxxx 001DC0DE Enable Code - Game Code ID (value at [0ACh] in cartridge) DEADFACE 0000xxyy Change Encryption Seeds |
y=1 - Executes code handler without backing up the LR register. y=2 - Executes code handler and backs up the LR register. y=3 - Replaces a 32-bit pointer used for long-branches. x=0 - Must turn GSA off before loading game. x=1 - Must not do that. |
y=0 wait for the code handler to enable the patch y=1 patch is enabled before the game starts y=2 unknown ? |
FOR I=1 TO 32 A=A + (V*16+S0) XOR (V+I*9E3779B9h) XOR (V/32+S1) V=V + (A*16+S2) XOR (A+I*9E3779B9h) XOR (A/32+S3) NEXT I |
S0=09F4FBBDh S1=9681884Ah S2=352027E9h S3=F3DEE5A7h |
FOR y=0 TO 3 FOR x=0 TO 3 z = T1[(xx+x) AND FFh] + T2[(yy+y) AND FFh] Sy = Sy*100h + (z AND FFh) NEXT x NEXT y |
GBA Cheat Codes - Pro Action Replay V3 |
C4aaaaaa 0000yyyy Enable Code - Hook Routine at [8aaaaaa] xxxxxxxx 001DC0DE Enable Code - ID Code [080000AC] DEADFACE 0000xxxx Enable Code - Change Encryption Seeds 00aaaaaa xxxxxxyy [a0aaaaa..a0aaaaa+xxxxxx]=yy 02aaaaaa xxxxyyyy [a0aaaaa..a0aaaaa+xxxx*2]=yyyy 04aaaaaa yyyyyyyy [a0aaaaa]=yyyyyyyy 40aaaaaa xxxxxxyy [ [a0aaaaa] + xxxxxx ]=yy (Indirect) 42aaaaaa xxxxyyyy [ [a0aaaaa] + xxxx*2 ]=yyyy (Indirect) 44aaaaaa yyyyyyyy [ [a0aaaaa] ]=yyyyyyyy (Indirect) 80aaaaaa 000000yy [a0aaaaa]=[a0aaaaa]+yy 82aaaaaa 0000yyyy [a0aaaaa]=[a0aaaaa]+yyyy 84aaaaaa yyyyyyyy [a0aaaaa]=[a0aaaaa]+yyyyyyyy C6aaaaaa 0000yyyy [4aaaaaa]=yyyy (I/O Area) C7aaaaaa yyyyyyyy [4aaaaaa]=yyyyyyyy (I/O Area) iiaaaaaa yyyyyyyy IF [a0aaaaa] <cond> <value> THEN <action> 00000000 60000000 ELSE (?) 00000000 40000000 ENDIF (?) 00000000 0800xx00 AR Slowdown : loops the AR xx times 00000000 00000000 End of the code list 00000000 10aaaaaa 000000zz 00000000 IF AR_BUTTON THEN [a0aaaaa]=zz 00000000 12aaaaaa 0000zzzz 00000000 IF AR_BUTTON THEN [a0aaaaa]=zzzz 00000000 14aaaaaa zzzzzzzz 00000000 IF AR_BUTTON THEN [a0aaaaa]=zzzzzzzz 00000000 18aaaaaa 0000zzzz 00000000 [8000000+aaaaaa*2]=zzzz (ROM Patch 1) 00000000 1Aaaaaaa 0000zzzz 00000000 [8000000+aaaaaa*2]=zzzz (ROM Patch 2) 00000000 1Caaaaaa 0000zzzz 00000000 [8000000+aaaaaa*2]=zzzz (ROM Patch 3) 00000000 1Eaaaaaa 0000zzzz 00000000 [8000000+aaaaaa*2]=zzzz (ROM Patch 4) |
00000000 80aaaaaa 000000yy ssccssss repeat cc times [a0aaaaa]=yy (with yy=yy+ss, a0aaaaa=a0aaaaa+ssss after each step) |
00000000 82aaaaaa 0000yyyy ssccssss repeat cc times [a0aaaaa]=yyyy (with yyyy=yyyy+ss, a0aaaaa=a0aaaaa+ssss*2 after each step) |
00000000 84aaaaaa yyyyyyyy ssccssss repeat cc times [a0aaaaa]=yyyyyyyy (with yyyy=yyyy+ss, a0aaaaa=a0aaaaa+ssss*4 after each step) |
<cond> <value> <action> 08 Equal = 00 8bit zz 00 execute next code 10 Not equal <> 02 16bit zzzz 40 execute next two codes 18 Signed < 04 32bit zzzzzzzz 80 execute all following 20 Signed > 06 (always false) codes until ELSE or ENDIF 28 Unsigned < C0 normal ELSE turn off all codes 30 Unsigned > 38 Logical AND |
For the "Always..." codes: - XXXXXXXX can be any authorised address except 00000000 (eg. use 02000000). - ZZZZZZZZ can be anything. - The "y" in the code data must be in the [1-7] range (which means not 0). typ=y,sub=0,siz=3 Always skip next line. typ=y,sub=1,siz=3 Always skip next 2 lines. typ=y,sub=2,siz=3 Always Stops executing all the codes below. typ=y,sub=3,siz=3 Always turn off all codes. |
adr mask = 003FFFFF n/a mask = 00C00000 ;not used xtr mask = 01000000 ;used only by I/O write, and MSB of Hook siz mask = 06000000 typ mask = 38000000 ;0=normal, other=conditional sub mask = C0000000 |
S0=7AA9648Fh S1=7FAE6994h S2=C0EFAAD5h S3=42712C57h |
GBA Gameboy Player |
Drill Dozer (supports BOTH handheld-rumble and GBP-rumble?) Mario & Luigi: Superstar Saga Pokemon Pinball: Ruby & Sapphire Shikakui Atama wo Marukusuru Advance: Kokugo Sansu Rika Shakai Shikakui Atama wo Marukusuru Advance: Kanji Keisan Summon Night Craft Sword Monogatari: Hajimari no Ishi Super Mario Advance 4: Super Mario Bros. 3 |
Remudvance (FluBBA) (homebrew) Goomba (FluBBA) (8bit Gameboy Color Emulator for 32bit GBA) (homebrew) and, supposedly in "Tetanus on Drugs" (Tepples) (homebrew) |
Receive Response 0000494E 494EB6B1 xxxx494E 494EB6B1 B6B1494E 544EB6B1 B6B1544E 544EABB1 ABB1544E 4E45ABB1 ABB14E45 4E45B1BA B1BA4E45 4F44B1BA B1BA4F44 4F44B0BB B0BB4F44 8000B0BB B0BB8002 10000010 10000010 20000013 20000013 40000004 30000003 40000004 30000003 40000004 30000003 40000004 30000003 400000yy 30000003 40000004 |
GBA Unpredictable Things |
WORD = [$+8] |
LSW = [$+4], MSW = [$+4] |
LSW = [$+4], MSW = [$+6] ;for opcodes at 4-byte aligned locations LSW = [$+2], MSW = [$+4] ;for opcodes at non-4-byte aligned locations |
LSW = [$+4], MSW = OldHI ;for opcodes at 4-byte aligned locations LSW = OldLO, MSW = [$+4] ;for opcodes at non-4-byte aligned locations |
OldLO=[$+2], OldHI=[$+2] |
OldLO=LSW(data), OldHI=MSW(data) Theoretically, this might also change if a DMA transfer occurs. |
NDS Reference |
DS Technical Data |
1x ARM946E-S 32bit RISC CPU, 66MHz (NDS9 video) (not used in GBA mode) 1x ARM7TDMI 32bit RISC CPU, 33MHz (NDS7 sound) (16MHz in GBA mode) |
4096KB Main RAM (8192KB in debug version) 96KB WRAM (64K mapped to NDS7, plus 32K mappable to NDS7 or NDS9) 60KB TCM/Cache (TCM: 16K Data, 32K Code) (Cache: 4K Data, 8K Code) 656KB VRAM (allocateable as BG/OBJ/2D/3D/Palette/Texture/WRAM memory) 4KB OAM/PAL (2K OBJ Attribute Memory, 2K Standard Palette RAM) 248KB Internal 3D Memory (104K Polygon RAM, 144K Vertex RAM) ?KB Matrix Stack, 48 scanline cache 8KB Wifi RAM 256KB Firmware FLASH (512KB in iQue variant, with chinese charset) 36KB BIOS ROM (4K NDS9, 16K NDS7, 16K GBA) |
2x LCD screens (each 256x192 pixel, 3 inch, 18bit color depth, backlight) 2x 2D video engines (extended variants of the GBA's video controller) 1x 3D video engine (can be assigned to upper or lower screen) 1x video capture (for effects, or for forwarding 3D to the 2nd 2D engine) |
16 sound channels (16x PCM8/PCM16/IMA-ADPCM, 6x PSG-Wave, 2x PSG-Noise) 2 sound capture units (for echo effects, etc.) Output: Two built-in stereo speakers, and headphones socket Input: One built-in microphone, and microphone socket |
Gamepad 4 Direction Keys, 8 Buttons Touchscreen (on lower LCD screen) |
Wifi IEEE802.11b |
Built-in Real Time Clock Power Managment Device Hardware divide and square root functions CP15 System Control Coprocessor (cache, tcm, pu, bist, etc.) |
NDS Slot (for NDS games) (encrypted 8bit data bus, and serial 1bit bus) GBA Slot (for NDS expansions, or for GBA games) (but not for DMG/CGB games) |
ROM: 16MB, 32MB, or 64MB EEPROM/FLASH/FRAM: 0.5KB, 8KB, 64KB, 256KB, or 512KB |
NDS Cartridge (NDS mode) Firmware FLASH (NDS mode) (eg. by patching firmware via ds-xboo cable) Wifi (NDS mode) GBA Cartridge (GBA mode) (without DMG/CGB support) (without SIO support) |
Built-in rechargeable Lithium ion battery, 3.7V 1000mAh (DS-Lite) External Supply: 5.2V DC |
DS I/O Maps |
4000000h 4 2D Engine A - DISPCNT - LCD Control (Read/Write) 4000004h 2 2D Engine A+B - DISPSTAT - General LCD Status (Read/Write) 4000006h 2 2D Engine A+B - VCOUNT - Vertical Counter (Read only) 4000008h 50h 2D Engine A (same registers as GBA, some changed bits) 4000060h 2 DISP3DCNT - 3D Display Control Register (R/W) 4000064h 4 DISPCAPCNT - Display Capture Control Register (R/W) 4000068h 4 DISP_MMEM_FIFO - Main Memory Display FIFO (R?/W) 400006Ch 2 2D Engine A - MASTER_BRIGHT - Master Brightness Up/Down |
40000B0h 30h DMA Channel 0..3 40000E0h 10h DMA FILL Registers for Channel 0..3 4000100h 10h Timers 0..3 4000130h 2 KEYINPUT 4000132h 2 KEYCNT |
4000180h 2 IPCSYNC - IPC Synchronize Register (R/W) 4000184h 2 IPCFIFOCNT - IPC Fifo Control Register (R/W) 4000188h 4 IPCFIFOSEND - IPC Send Fifo (W) 40001A0h 2 AUXSPICNT - Gamecard ROM and SPI Control 40001A2h 2 AUXSPIDATA - Gamecard SPI Bus Data/Strobe 40001A4h 4 Gamecard bus timing/control 40001A8h 8 Gamecard bus 8-byte command out 40001B0h 4 Gamecard Encryption Seed 0 Lower 32bit 40001B4h 4 Gamecard Encryption Seed 1 Lower 32bit 40001B8h 2 Gamecard Encryption Seed 0 Upper 7bit (bit7-15 unused) 40001BAh 2 Gamecard Encryption Seed 1 Upper 7bit (bit7-15 unused) |
4000204h 2 EXMEMCNT - External Memory Control (R/W) 4000208h 2 IME - Interrupt Master Enable (R/W) 4000210h 4 IE - Interrupt Enable (R/W) 4000214h 4 IF - Interrupt Request Flags (R/W) 4000240h 1 VRAMCNT_A - VRAM-A (128K) Bank Control (W) 4000241h 1 VRAMCNT_B - VRAM-B (128K) Bank Control (W) 4000242h 1 VRAMCNT_C - VRAM-C (128K) Bank Control (W) 4000243h 1 VRAMCNT_D - VRAM-D (128K) Bank Control (W) 4000244h 1 VRAMCNT_E - VRAM-E (64K) Bank Control (W) 4000245h 1 VRAMCNT_F - VRAM-F (16K) Bank Control (W) 4000246h 1 VRAMCNT_G - VRAM-G (16K) Bank Control (W) 4000247h 1 WRAMCNT - WRAM Bank Control (W) 4000248h 1 VRAMCNT_H - VRAM-H (32K) Bank Control (W) 4000249h 1 VRAMCNT_I - VRAM-I (16K) Bank Control (W) |
4000280h 2 DIVCNT - Division Control (R/W) 4000290h 8 DIV_NUMER - Division Numerator (R/W) 4000298h 8 DIV_DENOM - Division Denominator (R/W) 40002A0h 8 DIV_RESULT - Division Quotient (=Numer/Denom) (R) 40002A8h 8 DIVREM_RESULT - Division Remainder (=Numer MOD Denom) (R) 40002B0h 2 SQRTCNT - Square Root Control (R/W) 40002B4h 4 SQRT_RESULT - Square Root Result (R) 40002B8h 8 SQRT_PARAM - Square Root Parameter Input (R/W) 4000300h 4 POSTFLG - Undoc 4000304h 2 POWCNT1 - Graphics Power Control Register (R/W) |
4000320h..6A3h |
4001000h 4 2D Engine B - DISPCNT - LCD Control (Read/Write) 4001008h 50h 2D Engine B (same registers as GBA, some changed bits) 400106Ch 2 2D Engine B - MASTER_BRIGHT - 16bit - Brightness Up/Down |
40021Axh .. DSi Registers 4004xxxh .. DSi Registers |
4100000h 4 IPCFIFORECV - IPC Receive Fifo (R) 4100010h 4 Gamecard bus 4-byte data in, for manual or dma read |
4FFF0xxh .. Ensata Emulator Debug Registers 4FFFAxxh .. No$gba Emulator Debug Registers |
27FFD9Ch .. NDS9 Debug Stacktop / Debug Vector (0=None) DTCM+3FF8h 4 NDS9 IRQ Check Bits (hardcoded RAM address) DTCM+3FFCh 4 NDS9 IRQ Handler (hardcoded RAM address) |
27FFFFEh 2 Main Memory Control |
4000004h 2 DISPSTAT 4000006h 2 VCOUNT 40000B0h 30h DMA Channels 0..3 4000100h 10h Timers 0..3 4000120h 4 Debug SIODATA32 4000128h 4 Debug SIOCNT 4000130h 2 keyinput 4000132h 2 keycnt 4000134h 2 Debug RCNT 4000136h 2 EXTKEYIN 4000138h 1 RTC Realtime Clock Bus 4000180h 2 IPCSYNC - IPC Synchronize Register (R/W) 4000184h 2 IPCFIFOCNT - IPC Fifo Control Register (R/W) 4000188h 4 IPCFIFOSEND - IPC Send Fifo (W) 40001A0h 2 AUXSPICNT - Gamecard ROM and SPI Control 40001A2h 2 AUXSPIDATA - Gamecard SPI Bus Data/Strobe 40001A4h 4 Gamecard bus timing/control 40001A8h 8 Gamecard bus 8-byte command out 40001B0h 4 Gamecard Encryption Seed 0 Lower 32bit 40001B4h 4 Gamecard Encryption Seed 1 Lower 32bit 40001B8h 2 Gamecard Encryption Seed 0 Upper 7bit (bit7-15 unused) 40001BAh 2 Gamecard Encryption Seed 1 Upper 7bit (bit7-15 unused) 40001C0h 2 SPI bus Control (Firmware, Touchscreen, Powerman) 40001C2h 2 SPI bus Data |
4000204h 2 EXMEMSTAT - External Memory Status 4000206h 2 WIFIWAITCNT 4000208h 4 IME - Interrupt Master Enable (R/W) 4000210h 4 IE - Interrupt Enable (R/W) 4000214h 4 IF - Interrupt Request Flags (R/W) 4000218h - IE2 ;\DSi only (additional ARM7 interrupt sources) 400021Ch - IF2 ;/ 4000240h 1 VRAMSTAT - VRAM-C,D Bank Status (R) 4000241h 1 WRAMSTAT - WRAM Bank Status (R) 4000300h 1 POSTFLG 4000301h 1 HALTCNT (different bits than on GBA) (plus NOP delay) 4000304h 2 POWCNT2 Sound/Wifi Power Control Register (R/W) 4000308h 4 BIOSPROT - Bios-data-read-protection address |
4000400h 100h Sound Channel 0..15 (10h bytes each) 40004x0h 4 SOUNDxCNT - Sound Channel X Control Register (R/W) 40004x4h 4 SOUNDxSAD - Sound Channel X Data Source Register (W) 40004x8h 2 SOUNDxTMR - Sound Channel X Timer Register (W) 40004xAh 2 SOUNDxPNT - Sound Channel X Loopstart Register (W) 40004xCh 4 SOUNDxLEN - Sound Channel X Length Register (W) 4000500h 2 SOUNDCNT - Sound Control Register (R/W) 4000504h 2 SOUNDBIAS - Sound Bias Register (R/W) 4000508h 1 SNDCAP0CNT - Sound Capture 0 Control Register (R/W) 4000509h 1 SNDCAP1CNT - Sound Capture 1 Control Register (R/W) 4000510h 4 SNDCAP0DAD - Sound Capture 0 Destination Address (R/W) 4000514h 2 SNDCAP0LEN - Sound Capture 0 Length (W) 4000518h 4 SNDCAP1DAD - Sound Capture 1 Destination Address (R/W) 400051Ch 2 SNDCAP1LEN - Sound Capture 1 Length (W) |
40021Axh .. DSi Registers 4004xxxh .. DSi Registers 4004700h 2 DSi SNDEXCNT Register ;\mapped even in DS mode 4004C0xh .. DSi GPIO Registers ;/ |
4100000h 4 IPCFIFORECV - IPC Receive Fifo (R) 4100010h 4 Gamecard bus 4-byte data in, for manual or dma read |
4800000h .. Wifi WS0 Region (32K) (Wifi Ports, and 8K Wifi RAM) 4808000h .. Wifi WS1 Region (32K) (mirror of above, other waitstates) |
380FFC0h 4 DSi7 IRQ IF2 Check Bits (hardcoded RAM address) (DSi only) 380FFDCh .. NDS7 Debug Stacktop / Debug Vector (0=None) 380FFF8h 4 NDS7 IRQ IF Check Bits (hardcoded RAM address) 380FFFCh 4 NDS7 IRQ Handler (hardcoded RAM address) |
DS Memory Maps |
00000000h Instruction TCM (32KB) (not moveable) (mirror-able to 1000000h) 0xxxx000h Data TCM (16KB) (moveable) 02000000h Main Memory (4MB) 03000000h Shared WRAM (0KB, 16KB, or 32KB can be allocated to ARM9) 04000000h ARM9-I/O Ports 05000000h Standard Palettes (2KB) (Engine A BG/OBJ, Engine B BG/OBJ) 06000000h VRAM - Engine A, BG VRAM (max 512KB) 06200000h VRAM - Engine B, BG VRAM (max 128KB) 06400000h VRAM - Engine A, OBJ VRAM (max 256KB) 06600000h VRAM - Engine B, OBJ VRAM (max 128KB) 06800000h VRAM - "LCDC"-allocated (max 656KB) 07000000h OAM (2KB) (Engine A, Engine B) 08000000h GBA Slot ROM (max 32MB) 0A000000h GBA Slot RAM (max 64KB) FFFF0000h ARM9-BIOS (32KB) (only 3K used) |
00000000h ARM7-BIOS (16KB) 02000000h Main Memory (4MB) 03000000h Shared WRAM (0KB, 16KB, or 32KB can be allocated to ARM7) 03800000h ARM7-WRAM (64KB) 04000000h ARM7-I/O Ports 04800000h Wireless Communications Wait State 0 (8KB RAM at 4804000h) 04808000h Wireless Communications Wait State 1 (I/O Ports at 4808000h) 06000000h VRAM allocated as Work RAM to ARM7 (max 256K) 08000000h GBA Slot ROM (max 32MB) 0A000000h GBA Slot RAM (max 64KB) |
3D Engine Polygon RAM (52KBx2) 3D Engine Vertex RAM (72KBx2) Firmware (256KB) (built-in serial flash memory) GBA-BIOS (16KB) (not used in NDS mode) NDS Slot ROM (serial 8bit-bus, max 4GB with default protocol) NDS Slot FLASH/EEPROM/FRAM (serial 1bit-bus) |
DS Memory Control |
DS Memory Control - Cache and TCM |
ITCM 32K, base=00000000h (fixed, not move-able) DTCM 16K, base=moveable (default base=27C0000h) |
Data Cache 4KB, Instruction Cache 8KB 4-way set associative method Cache line 8 words (32 bytes) Read-allocate method (ie. writes are not allocating cache lines) Round-robin and Pseudo-random replacement algorithms selectable Cache Lockdown, Instruction Prefetch, Data Preload Data write-through and write-back modes selectable |
Region Name Address Size Cache WBuf Code Data - Background 00000000h 4GB - - - - 0 I/O and VRAM 04000000h 64MB - - R/W R/W 1 Main Memory 02000000h 4MB On On R/W R/W 2 ARM7-dedicated 027C0000h 256KB - - - - 3 GBA Slot 08000000h 128MB - - - R/W 4 DTCM 027C0000h 16KB - - - R/W 5 ITCM 01000000h 32KB - - R/W R/W 6 BIOS FFFF0000h 32KB On - R R 7 Shared Work 027FF000h 4KB - - - R/W |
DS Memory Control - Cartridges and Main RAM |
0-1 32-pin GBA Slot SRAM Access Time (0-3 = 10, 8, 6, 18 cycles) 2-3 32-pin GBA Slot ROM 1st Access Time (0-3 = 10, 8, 6, 18 cycles) 4 32-pin GBA Slot ROM 2nd Access Time (0-1 = 6, 4 cycles) 5-6 32-pin GBA Slot PHI-pin out (0-3 = Low, 4.19MHz, 8.38MHz, 16.76MHz) 7 32-pin GBA Slot Access Rights (0=ARM9, 1=ARM7) 8-10 Not used (always zero) 11 17-pin NDS Slot Access Rights (0=ARM9, 1=ARM7) 12 Not used (always zero) 13 NDS:Always set? ;set/tested by DSi bootcode: Main RAM enable, CE2 pin? 14 Main Memory Interface Mode Switch (0=Async/GBA/Reserved, 1=Synchronous) 15 Main Memory Access Priority (0=ARM9 Priority, 1=ARM7 Priority) |
6 clks --> returns "Addr/2" 8 clks --> returns "Addr/2" 10 clks --> returns "Addr/2 OR FE08h" (or similar garbage) 18 clks --> returns "FFFFh" (High-Z) |
DS Memory Control - WRAM |
0-1 ARM9/ARM7 (0-3 = 32K/0K, 2nd 16K/1st 16K, 1st 16K/2nd 16K, 0K/32K) 2-7 Not used |
DS Memory Control - VRAM |
0 VRAM C enabled and allocated to NDS7 (0=No, 1=Yes) 1 VRAM D enabled and allocated to NDS7 (0=No, 1=Yes) 2-7 Not used (always zero) |
0-2 VRAM MST ;Bit2 not used by VRAM-A,B,H,I 3-4 VRAM Offset (0-3) ;Offset not used by VRAM-E,H,I 5-6 Not used 7 VRAM Enable (0=Disable, 1=Enable) |
VRAM SIZE MST OFS ARM9, Plain ARM9-CPU Access (so-called LCDC mode) A 128K 0 - 6800000h-681FFFFh B 128K 0 - 6820000h-683FFFFh C 128K 0 - 6840000h-685FFFFh D 128K 0 - 6860000h-687FFFFh E 64K 0 - 6880000h-688FFFFh F 16K 0 - 6890000h-6893FFFh G 16K 0 - 6894000h-6897FFFh H 32K 0 - 6898000h-689FFFFh I 16K 0 - 68A0000h-68A3FFFh VRAM SIZE MST OFS ARM9, 2D Graphics Engine A, BG-VRAM (max 512K) A,B,C,D 128K 1 0..3 6000000h+(20000h*OFS) E 64K 1 - 6000000h F,G 16K 1 0..3 6000000h+(4000h*OFS.0)+(10000h*OFS.1) VRAM SIZE MST OFS ARM9, 2D Graphics Engine A, OBJ-VRAM (max 256K) A,B 128K 2 0..1 6400000h+(20000h*OFS.0) ;(OFS.1 must be zero) E 64K 2 - 6400000h F,G 16K 2 0..3 6400000h+(4000h*OFS.0)+(10000h*OFS.1) VRAM SIZE MST OFS 2D Graphics Engine A, BG Extended Palette E 64K 4 - Slot 0-3 ;only lower 32K used F,G 16K 4 0..1 Slot 0-1 (OFS=0), Slot 2-3 (OFS=1) VRAM SIZE MST OFS 2D Graphics Engine A, OBJ Extended Palette F,G 16K 5 - Slot 0 ;16K each (only lower 8K used) VRAM SIZE MST OFS Texture/Rear-plane Image A,B,C,D 128K 3 0..3 Slot OFS(0-3) ;(Slot2-3: Texture, or Rear-plane) VRAM SIZE MST OFS Texture Palette E 64K 3 - Slots 0-3 ;OFS=don't care F,G 16K 3 0..3 Slot (OFS.0*1)+(OFS.1*4) ;ie. Slot 0, 1, 4, or 5 VRAM SIZE MST OFS ARM9, 2D Graphics Engine B, BG-VRAM (max 128K) C 128K 4 - 6200000h H 32K 1 - 6200000h I 16K 1 - 6208000h VRAM SIZE MST OFS ARM9, 2D Graphics Engine B, OBJ-VRAM (max 128K) D 128K 4 - 6600000h I 16K 2 - 6600000h VRAM SIZE MST OFS 2D Graphics Engine B, BG Extended Palette H 32K 2 - Slot 0-3 VRAM SIZE MST OFS 2D Graphics Engine B, OBJ Extended Palette I 16K 3 - Slot 0 ;(only lower 8K used) VRAM SIZE MST OFS <ARM7>, Plain <ARM7>-CPU Access C,D 128K 2 0..1 6000000h+(20000h*OFS.0) ;OFS.1 must be zero |
5000000h Engine A Standard BG Palette (512 bytes) 5000200h Engine A Standard OBJ Palette (512 bytes) 5000400h Engine B Standard BG Palette (512 bytes) 5000600h Engine B Standard OBJ Palette (512 bytes) 7000000h Engine A OAM (1024 bytes) 7000400h Engine B OAM (1024 bytes) |
DS Memory Control - BIOS |
Opcodes at... Can read from Expl. 0..[BIOSPROT]-1 0..3FFFh Double-protected (when BIOSPROT is set) [BIOSPROT]..3FFFh [BIOSPROT]..3FFFh Normal-protected (always active) |
05ECh ldrb r3,[r3,12h] ;requires incoming r3=src-12h 05EEh pop r2,r4,r6,r7,r15 ;requires dummy values & THUMB retadr on stack |
DS Memory Timings |
Bus clock = 33MHz (33.513982 MHz) (1FF61FEh Hertz) NDS7 clock = 33MHz (same as bus clock) NDS9 clock = 66MHz (internally twice bus clock; for cache/tcm) |
NDS7/CODE NDS9/CODE N32 S32 N16 S16 Bus N32 S32 N16 S16 Bus 9 2 8 1 16 9 9 4.5 4.5 16 Main RAM (read) (cache off) 1 1 1 1 32 4 4 2 2 32 WRAM,BIOS,I/O,OAM 2 2 1 1 16 5 5 2.5 2.5 16 VRAM,Palette RAM 16 12 10 6 16 19 19 9.5 9.5 16 GBA ROM (example 10,6 access) - - - - - 0.5 0.5 0.5 0.5 32 TCM, Cache_Hit - - - - - (--Load 8 words--) Cache_Miss |
NDS7/DATA NDS9/DATA N32 S32 N16 S16 Bus N32 S32 N16 S16 Bus 10 2 9 1 16 10 2 9 1 16 Main RAM (read) (cache off) 1 1 1 1 32 4 1 4 1 32 WRAM,BIOS,I/O,OAM 1? 2 1 1 16 5 2 4 1 16 VRAM,Palette RAM 15 12 9 6 16 19 12 13 6 16 GBA ROM (example 10,6 access) 9 10 9 10 8 13 10 13 10 8 GBA RAM (example 10 access) - - - - - 0.5 0.5 0.5 - 32 TCM, Cache_Hit - - - - - (--Load 8 words--) Cache_Miss - - - - - 11 11 11 - 32 Cache_Miss (BIOS) - - - - - 23 23 23 - 16 Cache_Miss (Main RAM) |
S16 and N16 do not exist (because thumb-double-fetching) (see there). S32 becomes N32 (ie. the ARM9 does NOT support fast sequential timing). |
Eg. an ARM9 N32 or S32 to 16bit bus will take: N16 + S16 + 3 waits. Eg. an ARM9 N32 or S32 to 32bit bus will take: N32 + 3 waits. |
Eg. LDRH on 16bit-data-bus is N16+3waits. Eg. LDR on 16bit-data-bus is N16+S16+3waits. Eg. LDM on 16bit-data-bus is N16+(n*2-1)*S16+3waits. |
That is NOT true for LDM (works only for LDR/LDRB/LDRH). That is NOT true for DATA in SAME memory region than CODE. That is NOT true for DATA in ITCM (no matter if CODE is in ITCM). |
DS Video |
DS Video Stuff |
0-4 Factor used for 6bit R,G,B Intensities (0-16, values >16 same as 16) Brightness up: New = Old + (63-Old) * Factor/16 Brightness down: New = Old - Old * Factor/16 5-13 Not used 14-15 Mode (0=Disable, 1=Up, 2=Down, 3=Reserved) 16-31 Not used |
write new LY values only in range of 202..212 write only while old LY values are in range of 202..212 |
Region______Engine A______________Engine B___________ I/O Ports 4000000h 4001000h Palette 5000000h (1K) 5000400h (1K) BG VRAM 6000000h (max 512K) 6200000h (max 128K) OBJ VRAM 6400000h (max 256K) 6600000h (max 128K) OAM 7000000h (1K) 7000400h (1K) |
Bit0-3 "COMMAND" (?) Bit4-7 "COMMAND2" (?) Bit8-11 "COMMAND3" (?) |
DS Video BG Modes / Control |
Bit Engine Expl. 0-2 A+B BG Mode 3 A BG0 2D/3D Selection (instead CGB Mode) (0=2D, 1=3D) 4 A+B Tile OBJ Mapping (0=2D; max 32KB, 1=1D; max 32KB..256KB) 5 A+B Bitmap OBJ 2D-Dimension (0=128x512 dots, 1=256x256 dots) 6 A+B Bitmap OBJ Mapping (0=2D; max 128KB, 1=1D; max 128KB..256KB) 7-15 A+B Same as GBA 16-17 A+B Display Mode (Engine A: 0..3, Engine B: 0..1, GBA: Green Swap) 18-19 A VRAM block (0..3=VRAM A..D) (For Capture & above Display Mode=2) 20-21 A+B Tile OBJ 1D-Boundary (see Bit4) 22 A Bitmap OBJ 1D-Boundary (see Bit5-6) 23 A+B OBJ Processing during H-Blank (was located in Bit5 on GBA) 24-26 A Character Base (in 64K steps) (merged with 16K step in BGxCNT) 27-29 A Screen Base (in 64K steps) (merged with 2K step in BGxCNT) 30 A+B BG Extended Palettes (0=Disable, 1=Enable) 31 A+B OBJ Extended Palettes (0=Disable, 1=Enable) |
Mode BG0 BG1 BG2 BG3 0 Text/3D Text Text Text 1 Text/3D Text Text Affine 2 Text/3D Text Affine Affine 3 Text/3D Text Text Extended 4 Text/3D Text Affine Extended 5 Text/3D Text Extended Extended 6 3D - Large - |
BGxCNT.Bit7 BGxCNT.Bit2 Extended Affine Mode Selection 0 CharBaseLsb rot/scal with 16bit bgmap entries (Text+Affine mixup) 1 0 rot/scal 256 color bitmap 1 1 rot/scal direct color bitmap |
0 Display off (screen becomes white) 1 Graphics Display (normal BG and OBJ layers) 2 Engine A only: VRAM Display (Bitmap from block selected in DISPCNT.18-19) 3 Engine A only: Main Memory Display (Bitmap DMA transfer from Main RAM) |
engine A screen base: BGxCNT.bits*2K + DISPCNT.bits*64K engine B screen base: BGxCNT.bits*2K + 0 engine A char base: BGxCNT.bits*16K + DISPCNT.bits*64K engine B char base: BGxCNT.bits*16K + 0 |
bgcnt size text rotscal bitmap large bmp 0 256x256 128x128 128x128 512x1024 1 512x256 256x256 256x256 1024x512 2 256x512 512x512 512x256 - 3 512x512 1024x1024 512x512 - |
for BG0CNT, BG1CNT only: bit13 selects extended palette slot (BG0: 0=Slot0, 1=Slot2, BG1: 0=Slot1, 1=Slot3) |
DS Video OBJs |
Bit4 Bit20-21 Dimension Boundary Total ;Notes 0 x 2D 32 32K ;Same as GBA 2D Mapping 1 0 1D 32 32K ;Same as GBA 1D Mapping 1 1 1D 64 64K 1 2 1D 128 128K 1 3 1D 256 256K ;Engine B: 128K max |
Bit6 Bit5 Bit22 Dimension Boundary Total ;Notes 0 0 x 2D/128 dots 8x8 dots 128K ;Source Bitmap width 128 dots 0 1 x 2D/256 dots 8x8 dots 128K ;Source Bitmap width 256 dots 1 0 0 1D 128 bytes 128K ;Source Width = Target Width 1 0 1 1D 256 bytes 256K ;Engine A only 1 1 x Reserved |
1D_BitmapVramAddress = TileNumber(0..3FFh) * BoundaryValue(128..256) 2D_BitmapVramAddress = (TileNo AND MaskX)*10h + (TileNo AND NOT MaskX)*80h |
DS Video Extended Palettes |
standard palette --> 16-color tiles (with 16bit bgmap entries) (text) 256-color tiles (with 8bit bgmap entries) (rot/scal) 256-color bitmaps backdrop-color (color 0) extended palette --> 256-color tiles (with 16bit bgmap entries)(text,rot/scal) |
16 colors x 16 palettes --> standard palette memory (=256 colors) 256 colors x 16 palettes --> extended palette memory (=4096 colors) |
DS Video Capture and Main Memory Display Mode |
0-4 EVA (0..16 = Blending Factor for Source A) 5-7 Not used 8-12 EVB (0..16 = Blending Factor for Source B) 13-15 Not used 16-17 VRAM Write Block (0..3 = VRAM A..D) (VRAM must be allocated to LCDC) 18-19 VRAM Write Offset (0=00000h, 0=08000h, 0=10000h, 0=18000h) 20-21 Capture Size (0=128x128, 1=256x64, 2=256x128, 3=256x192 dots) 22-23 Not used 24 Source A (0=Graphics Screen BG+3D+OBJ, 1=3D Screen) 25 Source B (0=VRAM, 1=Main Memory Display FIFO) 26-27 VRAM Read Offset (0=00000h, 0=08000h, 0=10000h, 0=18000h) 28 Not used 29-30 Capture Source (0=Source A, 1=Source B, 2/3=Sources A+B blended) 31 Capture Enable (0=Disable/Ready, 1=Enable/Busy) |
Dest_Intensity = ( (SrcA_Intensitity * SrcA_Alpha * EVA) + (SrcB_Intensitity * SrcB_Alpha * EVB) ) / 16 Dest_Alpha = (SrcA_Alpha AND (EVA>0)) OR (SrcB_Alpha AND EVB>0)) |
- to Screen A (set DISPCNT to Main Memory Display mode), or - to Display Capture unit (set DISPCAPCNT to Main Memory Source). |
DS Video Display System Block Diagram |
_____________ __________ VRAM A -->| 2D Graphics |--------OBJ->| | VRAM B -->| Engine A |--------BG3->| Layering | VRAM C -->| |--------BG2->| and | VRAM D -->| |--------BG1->| Special | VRAM E -->| | ___ | Effects | VRAM F -->| |->|SEL| | | ______ VRAM G -->| - - - - - - | |BG0|-BG0->| |----+--->| | | 3D Graphics |->|___| |__________| | |Select| | Engine | | |Video | |_____________|--------3D----------------+ | |Input | _______ _______ ___ | | | | | | | |<-----------|SEL|<-+ | |and |--> | | | | _____ |A | | | | VRAM A <--|Select | |Select | | |<-|___|<----+ |Master| VRAM B <--|Capture|<---|Capture|<--|Blend| ___ |Bright| VRAM C <--|Dest. | |Source | |_____|<-|SEL|<----+ |A | VRAM D <--| | | | |B | | | | |_______| |_______|<-----------|___|<-+ | | | _______ | | | | VRAM A -->|Select | | | | | VRAM B -->|Display|--------------------------------+------>| | VRAM C -->|VRAM | | | | VRAM D -->|_______| _____________ | | | |Main Memory | | | | Main ------DMA---->|Display FIFO |------------------+--->|______| Memory |_____________| _____________ __________ ______ VRAM C -->| 2D Graphics |--------OBJ->| Layering | | | VRAM D -->| Engine B |--------BG3->| and | |Master| VRAM H -->| |--------BG2->| Special |-------->|Bright|--> VRAM I -->| |--------BG1->| Effects | |B | |_____________|--------BG0->|__________| |______| |
DS 3D Video |
DS 3D Overview |
DS 3D I/O Map |
Address Siz Name Expl. Rendering Engine (per Frame settings) 4000060h 2 DISP3DCNT 3D Display Control Register (R/W) 4000320h 1 RDLINES_COUNT Rendered Line Count Register (R) 4000330h 10h EDGE_COLOR Edge Colors 0..7 (W) 4000340h 1 ALPHA_TEST_REF Alpha-Test Comparision Value (W) 4000350h 4 CLEAR_COLOR Clear Color Attribute Register (W) 4000354h 2 CLEAR_DEPTH Clear Depth Register (W) 4000356h 2 CLRIMAGE_OFFSET Rear-plane Bitmap Scroll Offsets (W) 4000358h 4 FOG_COLOR Fog Color (W) 400035Ch 2 FOG_OFFSET Fog Depth Offset (W) 4000360h 20h FOG_TABLE Fog Density Table, 32 entries (W) 4000380h 40h TOON_TABLE Toon Table, 32 colors (W) Geometry Engine (per Polygon/Vertex settings) 4000400h 40h GXFIFO Geometry Command FIFO (W) 4000440h ... ... Geometry Command Ports (see below) 4000600h 4 GXSTAT Geometry Engine Status Register (R and R/W) 4000604h 4 RAM_COUNT Polygon List & Vertex RAM Count Register (R) 4000610h 2 DISP_1DOT_DEPTH 1-Dot Polygon Display Boundary Depth (W) 4000620h 10h POS_RESULT Position Test Results (R) 4000630h 6 VEC_RESULT Vector Test Results (R) 4000640h 40h CLIPMTX_RESULT Read Current Clip Coordinates Matrix (R) 4000680h 24h VECMTX_RESULT Read Current Directional Vector Matrix (R) |
Address Cmd Pa.Cy. N/A 00h - - NOP - No Operation (for padding packed GXFIFO commands) 4000440h 10h 1 1 MTX_MODE - Set Matrix Mode (W) 4000444h 11h - 17 MTX_PUSH - Push Current Matrix on Stack (W) 4000448h 12h 1 36 MTX_POP - Pop Current Matrix from Stack (W) 400044Ch 13h 1 17 MTX_STORE - Store Current Matrix on Stack (W) 4000450h 14h 1 36 MTX_RESTORE - Restore Current Matrix from Stack (W) 4000454h 15h - 19 MTX_IDENTITY - Load Unit Matrix to Current Matrix (W) 4000458h 16h 16 34 MTX_LOAD_4x4 - Load 4x4 Matrix to Current Matrix (W) 400045Ch 17h 12 30 MTX_LOAD_4x3 - Load 4x3 Matrix to Current Matrix (W) 4000460h 18h 16 35* MTX_MULT_4x4 - Multiply Current Matrix by 4x4 Matrix (W) 4000464h 19h 12 31* MTX_MULT_4x3 - Multiply Current Matrix by 4x3 Matrix (W) 4000468h 1Ah 9 28* MTX_MULT_3x3 - Multiply Current Matrix by 3x3 Matrix (W) 400046Ch 1Bh 3 22 MTX_SCALE - Multiply Current Matrix by Scale Matrix (W) 4000470h 1Ch 3 22* MTX_TRANS - Mult. Curr. Matrix by Translation Matrix (W) 4000480h 20h 1 1 COLOR - Directly Set Vertex Color (W) 4000484h 21h 1 9* NORMAL - Set Normal Vector (W) 4000488h 22h 1 1 TEXCOORD - Set Texture Coordinates (W) 400048Ch 23h 2 9 VTX_16 - Set Vertex XYZ Coordinates (W) 4000490h 24h 1 8 VTX_10 - Set Vertex XYZ Coordinates (W) 4000494h 25h 1 8 VTX_XY - Set Vertex XY Coordinates (W) 4000498h 26h 1 8 VTX_XZ - Set Vertex XZ Coordinates (W) 400049Ch 27h 1 8 VTX_YZ - Set Vertex YZ Coordinates (W) 40004A0h 28h 1 8 VTX_DIFF - Set Relative Vertex Coordinates (W) 40004A4h 29h 1 1 POLYGON_ATTR - Set Polygon Attributes (W) 40004A8h 2Ah 1 1 TEXIMAGE_PARAM - Set Texture Parameters (W) 40004ACh 2Bh 1 1 PLTT_BASE - Set Texture Palette Base Address (W) 40004C0h 30h 1 4 DIF_AMB - MaterialColor0 - Diffuse/Ambient Reflect. (W) 40004C4h 31h 1 4 SPE_EMI - MaterialColor1 - Specular Ref. & Emission (W) 40004C8h 32h 1 6 LIGHT_VECTOR - Set Light's Directional Vector (W) 40004CCh 33h 1 1 LIGHT_COLOR - Set Light Color (W) 40004D0h 34h 32 32 SHININESS - Specular Reflection Shininess Table (W) 4000500h 40h 1 1 BEGIN_VTXS - Start of Vertex List (W) 4000504h 41h - 1 END_VTXS - End of Vertex List (W) 4000540h 50h 1 392 SWAP_BUFFERS - Swap Rendering Engine Buffer (W) 4000580h 60h 1 1 VIEWPORT - Set Viewport (W) 40005C0h 70h 3 103 BOX_TEST - Test if Cuboid Sits inside View Volume (W) 40005C4h 71h 2 9 POS_TEST - Set Position Coordinates for Test (W) 40005C8h 72h 1 5 VEC_TEST - Set Directional Vector for Test (W) |
DS 3D Display Control |
0 Texture Mapping (0=Disable, 1=Enable) 1 PolygonAttr Shading (0=Toon Shading, 1=Highlight Shading) 2 Alpha-Test (0=Disable, 1=Enable) (see ALPHA_TEST_REF) 3 Alpha-Blending (0=Disable, 1=Enable) (see various Alpha values) 4 Anti-Aliasing (0=Disable, 1=Enable) 5 Edge-Marking (0=Disable, 1=Enable) (see EDGE_COLOR) 6 Fog Color/Alpha Mode (0=Alpha and Color, 1=Only Alpha) (see FOG_COLOR) 7 Fog Master Enable (0=Disable, 1=Enable) 8-11 Fog Depth Shift (FOG_STEP=400h shr FOG_SHIFT) (see FOG_OFFSET) 12 Color Buffer RDLINES Underflow (0=None, 1=Underflow/Acknowledge) 13 Polygon/Vertex RAM Overflow (0=None, 1=Overflow/Acknowledge) 14 Rear-Plane Mode (0=Blank, 1=Bitmap) 15-31 Not used |
0 Translucent polygon Y-sorting (0=Auto-sort, 1=Manual-sort) 1 Depth Buffering (0=With Z-value, 1=With W-value) (mode 1 does not function properly with orthogonal projections) 2-31 Not used |
0-7 Screen/BG0 Coordinate X1 (0..255) (For Fullscreen: 0=Left-most) 8-15 Screen/BG0 Coordinate Y1 (0..191) (For Fullscreen: 0=Bottom-most) 16-23 Screen/BG0 Coordinate X2 (0..255) (For Fullscreen: 255=Right-most) 24-31 Screen/BG0 Coordinate Y2 (0..191) (For Fullscreen: 191=Top-most) |
0-14 W-Coordinate (Unsigned, 12bit integer, 3bit fractional part) 15-31 Not used (0000h=Closest, 7FFFh=Most Distant) |
0-4 Alpha-Test Comparision Value (0..31) (Draw pixels if Alpha>AlphaRef) 5-31 Not used |
DS 3D Geometry Commands |
0-7 First Packed Command (or Unpacked Command) 8-15 Second Packed Command (or 00h=None) 16-23 Third Packed Command (or 00h=None) 24-31 Fourth Packed Command (or 00h=None) |
0-31 Parameter data for the previously sent (packed) command(s) |
- command1 (upper 24bit zero) - parameter(s) for command1 (if any) - command2 (upper 24bit zero) - parameter(s) for command2 (if any) - command3 (upper 24bit zero) - parameter(s) for command3 (if any) |
- command1,2,3,4 packed into one 32bit value (all bits used) - parameter(s) for command1 (if any) - parameter(s) for command2 (if any) - parameter(s) for command3 (if any) - parameter(s) for command4 (top-most packed command MUST have parameters) - command5,6 packed into one 32bit value (upper 16bit zero) - parameter(s) for command5 (if any) - parameter(s) for command6 (top-most packed command MUST have parameters) - command7,8,9 packed into one 32bit value (upper 8bit zero) - parameter(s) for command7 (if any) - parameter(s) for command8 (if any) - parameter(s) for command9 (top-most packed command MUST have parameters) |
DS 3D Matrix Load/Multiply |
0-1 Matrix Mode (0..3) 0 Projection Matrix 1 Position Matrix (aka Modelview Matrix) 2 Position & Vector Simultaneous Set mode (used for Light+VEC_TEST) 3 Texture Matrix (see DS 3D Texture Coordinates chapter) 2-31 Not used |
MTX_SCALE in Mode 2: uses ONLY Position Matrix MTX_PUSH/POP/STORE/RESTORE in Mode 1: uses BOTH Position AND Vector Matrices |
vice-versa for the scale command. |
ClipMatrix = PositionMatrix * ProjectionMatrix |
DS 3D Matrix Types |
_ 4x4 Matrix _ _ Identity Matrix _ | m[0] m[1] m[2] m[3] | | 1.0 0 0 0 | | m[4] m[5] m[6] m[7] | | 0 1.0 0 0 | | m[8] m[9] m[10] m[11] | | 0 0 1.0 0 | |_m[12] m[13] m[14] m[15]_| |_ 0 0 0 1.0 _| |
_ 4x3 Matrix _ _ Translation Matrix _ | m[0] m[1] m[2] 0 | | 1.0 0 0 0 | | m[3] m[4] m[5] 0 | | 0 1.0 0 0 | | m[6] m[7] m[8] 0 | | 0 0 1.0 0 | |_m[9] m[10] m[11] 1.0 _| |_m[0] m[1] m[2] 1.0 _| |
_ 3x3 Matrix _ _ Scale Matrix _ | m[0] m[1] m[2] 0 | | m[0] 0 0 0 | | m[3] m[4] m[5] 0 | | 0 m[1] 0 0 | | m[6] m[7] m[8] 0 | | 0 0 m[2] 0 | |_ 0 0 0 1.0 _| |_ 0 0 0 1.0 _| |
DS 3D Matrix Stack |
Matrix Stack________Valid Stack Area____Stack Pointer___________________ Projection Stack 0..0 (1 entry) 0..1 (1bit) (GXSTAT: 1bit) Coordinate Stack 0..30 (31 entries) 0..63 (6bit) (GXSTAT: 5bit only) Directional Stack 0..30 (31 entries) (uses Coordinate Stack Pointer) Texture Stack One..None? 0..1 (1bit) (GXSTAT: N/A) |
MTX_MODE = 0 --> Projection Stack MTX_MODE = 1 or 2 --> BOTH Coordinate AND Directional Stack MTX_MODE = 3 --> Texture Stack |
Parameter Bit0-5: Stack Offset (signed value, -30..+31) (usually +1) Parameter Bit6-31: Not used |
Parameter Bit0-4: Stack Address (0..30) (31 causes overflow in GXSTAT.15) Parameter Bit5-31: Not used |
Parameter Bit0-4: Stack Address (0..30) (31 causes overflow in GXSTAT.15) Parameter Bit5-31: Not used |
DS 3D Matrix Examples (Projection) |
Perspective Projection Orthogonal Projection __ __________ top __..--'' | top | | | view | | view | Eye ----|--------->| Eye ----|--------->| |__volume | | volume | bottom ''--..__| bottom|__________| near far near far |
| (2.0)/(r-l) 0 0 0 | | 0 (2.0)/(t-b) 0 0 | | 0 0 (2.0)/(n-f) 0 | | (l+r)/(l-r) (b+t)/(b-t) (n+f)/(n-f) 1.0 | |
| (2*n)/(r-l) 0 0 0 | | 0 (2*n)/(t-b) 0 0 | | (r+l)/(r-l) (t+b)/(t-b) (n+f)/(n-f) -1.0 | | 0 0 (2*n*f)/(n-f) 0 | |
| cos/(asp*sin) 0 0 0 | | 0 cos/sin 0 0 | | 0 0 (n+f)/(n-f) -1.0 | | 0 0 (2*n*f)/(n-f) 0 | |
DS 3D Matrix Examples (Rotate/Scale/Translate) |
Load(Identity) ;no rotation/scaling used Load(Identity), Mul(Rotate), Mul(Scale) ;rotation/scaling (not so efficient) Load(Rotate), Mul(Scale) ;rotation/scaling (more efficient) |
Around X-Axis Around Y-Axis Around Z-Axis | 1.0 0 0 | | cos 0 sin | | cos sin 0 | | 0 cos sin | | 0 1.0 0 | | -sin cos 0 | | 0 -sin cos | | -sin 0 cos | | 0 0 1.0 | |
DS 3D Matrix Examples (Maths Basics) |
| c11 c12 c13 c14 | | a11 a12 a13 a14 | | b11 b12 b13 b14 | | c21 c22 c23 c24 | = | a21 a22 a23 a24 | * | b21 b22 b23 b24 | | c31 c32 c33 c34 | | a31 a32 a33 a34 | | b31 b32 b33 b34 | | c41 c42 c43 c44 | | a41 a42 a43 a44 | | b41 b42 b43 b44 | |
cyx = ay1*b1x + ay2*b2x + ay3*b3x + ay4*b4x |
| b11 b12 b13 b14 | | c11 c12 c13 c14 | = | a11 a12 a13 a14 | * | b21 b22 b23 b24 | | b31 b32 b33 b34 | | b41 b42 b43 b44 | |
cyx = ay1*b1x + ay2*b2x + ay3*b3x + ay4*b4x |
cyx = ayx*n |
cyx = ayx +/- byx |
cyx = ay1*b1x + ay2*b2x + ay3*b3x + ay4*b4x |
DS 3D Polygon Attributes |
0-3 Light 0..3 Enable Flags (each bit: 0=Disable, 1=Enable) 4-5 Polygon Mode (0=Modulation,1=Decal,2=Toon/Highlight Shading,3=Shadow) 6 Polygon Back Surface (0=Hide, 1=Render) ;Line-segments are always 7 Polygon Front Surface (0=Hide, 1=Render) ;rendered (no front/back) 8-10 Not used 11 Depth-value for Translucent Pixels (0=Keep Old, 1=Set New Depth) 12 Far-plane intersecting polygons (0=Hide, 1=Render/clipped) 13 1-Dot polygons behind DISP_1DOT_DEPTH (0=Hide, 1=Render) 14 Depth Test, Draw Pixels with Depth (0=Less, 1=Equal) (usually 0) 15 Fog Enable (0=Disable, 1=Enable) 16-20 Alpha (0=Wire-Frame, 1..30=Translucent, 31=Solid) 21-23 Not used 24-29 Polygon ID (00h..3Fh, used for translucent, shadow, and edge-marking) 30-31 Not used |
Parameter 1, Bit 0-4 Red Parameter 1, Bit 5-9 Green Parameter 1, Bit 10-14 Blue Parameter 1, Bit 15-31 Not used |
DS 3D Polygon Definitions by Vertices |
Separate Tri. Triangle Strips Line Segment v0 v2___v4____v6 |\ v3 /|\ |\ /\ v0 v1 | \ /\ v0( | \ | \ / \ ------ |__\ /__\ \|__\|__\/____\ v2 v1 v2 v4 v5 v1 v3 v5 v7 |
Separate Quads Quadliteral Strips Prohibited Quads v0__v3 v0__v2____v4 v10__ v0__v3 v4 / \ v4____v7 / \ |\ _____ / /v11 \/ |\ / \ | \ / \ | |v6 v8| / /\ v5| \ /______\ |_____\ /______\___|_|_____|/ /__\ /___\ v1 v2 v5 v6 v1 v3 v5 v7 v9 v2 v1 v6 v7 |
Parameter 1, Bit 0-1 Primitive Type (0..3, see below) Parameter 1, Bit 2-31 Not used |
0 Separate Triangle(s) ;3*N vertices per N triangles 1 Separate Quadliteral(s) ;4*N vertices per N quads 2 Triangle Strips ;3+(N-1) vertices per N triangles 3 Quadliteral Strips ;4+(N-1)*2 vertices per N quads |
Parameter 1, Bit 0-15 X-Coordinate (signed, with 12bit fractional part) Parameter 1, Bit 16-31 Y-Coordinate (signed, with 12bit fractional part) Parameter 2, Bit 0-15 Z-Coordinate (signed, with 12bit fractional part) Parameter 2, Bit 16-31 Not used |
Parameter 1, Bit 0-9 X-Coordinate (signed, with 6bit fractional part) Parameter 1, Bit 10-19 Y-Coordinate (signed, with 6bit fractional part) Parameter 1, Bit 20-29 Z-Coordinate (signed, with 6bit fractional part) Parameter 1, Bit 30-31 Not used |
Parameter 1, Bit 0-15 X-Coordinate (signed, with 12bit fractional part) Parameter 1, Bit 16-31 Y-Coordinate (signed, with 12bit fractional part) |
Parameter 1, Bit 0-15 X-Coordinate (signed, with 12bit fractional part) Parameter 1, Bit 16-31 Z-Coordinate (signed, with 12bit fractional part) |
Parameter 1, Bit 0-15 Y-Coordinate (signed, with 12bit fractional part) Parameter 1, Bit 16-31 Z-Coordinate (signed, with 12bit fractional part) |
Parameter 1, Bit 0-9 X-Difference (signed, with 9/12bit fractional part) Parameter 1, Bit 10-19 Y-Difference (signed, with 9/12bit fractional part) Parameter 1, Bit 20-29 Z-Difference (signed, with 9/12bit fractional part) Parameter 1, Bit 30-31 Not used |
( xx, yy, zz, ww ) = ( x, y, z, 1.0 ) * ClipMatrix |
screen_x = (xx+ww)*viewport_width / (2*ww) + viewport_x1 screen_y = (yy+ww)*viewport_height / (2*ww) + viewport_y1 |
DS 3D Polygon Light Parameters |
0-9 Directional Vector's X component (1bit sign + 9bit fractional part) 10-19 Directional Vector's Y component (1bit sign + 9bit fractional part) 20-29 Directional Vector's Z component (1bit sign + 9bit fractional part) 30-31 Light Number (0..3) |
0-4 Red (0..1Fh) ;\light color this will be combined with 5-9 Green (0..1Fh) ; diffuse, specular, and ambient colors 10-14 Blue (0..1Fh) ;/upon execution of the normal command 15-29 Not used 30-31 Light Number (0..3) |
0-4 Diffuse Reflection Red ;\light(s) that directly hits the polygon, 5-9 Diffuse Reflection Green ; ie. max when NormalVector has opposite 10-14 Diffuse Reflection Blue ;/direction of LightVector 15 Set Vertex Color (0=No, 1=Set Diffuse Reflection Color as Vertex Color) 16-20 Ambient Reflection Red ;\light(s) that indirectly hits the polygon, 21-25 Ambient Reflection Green ; ie. assuming that light is reflected by 26-30 Ambient Reflection Blue ;/walls/floor, regardless of LightVector 31 Not used |
0-4 Specular Reflection Red ;\light(s) reflected towards the camera, 5-9 Specular Reflection Green ; ie. max when NormalVector is in middle of 10-14 Specular Reflection Blue ;/LightVector and ViewDirection 15 Specular Reflection Shininess Table (0=Disable, 1=Enable) 16-20 Emission Red ;\light emitted by the polygon itself, 21-25 Emission Green ; ie. regardless of light colors/vectors, 26-30 Emission Blue ;/and no matter if any lights are enabled 31 Not used |
0-7 Shininess 0 (unsigned fixed-point, 0bit integer, 8bit fractional part) 8-15 Shininess 1 ("") 16-23 Shininess 2 ("") 24-31 Shininess 3 ("") |
0-9 X-Component of Normal Vector (1bit sign + 9bit fractional part) 10-19 Y-Component of Normal Vector (1bit sign + 9bit fractional part) 20-29 Z-Component of Normal Vector (1bit sign + 9bit fractional part) 30-31 Not used |
IF TexCoordTransformMode=2 THEN TexCoord=NormalVector*Matrix (see TexCoord) NormalVector=NormalVector*DirectionalMatrix VertexColor = EmissionColor FOR i=0 to 3 IF PolygonAttrLight[i]=enabled THEN DiffuseLevel = max(0,-(LightVector[i]*NormalVector)) ShininessLevel = max(0,(-HalfVector[i])*(NormalVector))^2 IF TableEnabled THEN ShininessLevel = ShininessTable[ShininessLevel] ;note: below processed separately for the R,G,B color components... VertexColor = VertexColor + SpecularColor*LightColor[i]*ShininessLevel VertexColor = VertexColor + DiffuseColor*LightColor[i]*DiffuseLevel VertexColor = VertexColor + AmbientColor*LightColor[i] ENDIF NEXT i |
LightVector[i] = (LightVector*DirectionalMatrix) HalfVector[i] = (LightVector[i]+LineOfSightVector)/2 |
LineOfSightVector = (0,0,-1.0) |
Specular Reflection WON'T WORK when the ProjectionMatrix is rotated (!) |
DS 3D Shadow Polygons |
DS 3D Texture Attributes |
Parameter 1, Bit 0-15 S-Coordinate (X-Coordinate in Texture Source) Parameter 1, Bit 16-31 T-Coordinate (Y-Coordinate in Texture Source) Both values are 1bit sign + 11bit integer + 4bit fractional part. A value of 1.0 (=1 SHL 4) equals to one Texel. |
0-15 Texture VRAM Offset div 8 (0..FFFFh -> 512K RAM in Slot 0,1,2,3) (VRAM must be allocated as Texture data, see Memory Control chapter) 16 Repeat in S Direction (0=Clamp Texture, 1=Repeat Texture) 17 Repeat in T Direction (0=Clamp Texture, 1=Repeat Texture) 18 Flip in S Direction (0=No, 1=Flip each 2nd Texture) (requires Repeat) 19 Flip in T Direction (0=No, 1=Flip each 2nd Texture) (requires Repeat) 20-22 Texture S-Size (for N=0..7: Size=(8 SHL N); ie. 8..1024 texels) 23-25 Texture T-Size (for N=0..7: Size=(8 SHL N); ie. 8..1024 texels) 26-28 Texture Format (0..7, see below) 29 Color 0 of 4/16/256-Color Palettes (0=Displayed, 1=Made Transparent) 30-31 Texture Coordinates Transformation Mode (0..3, see below) |
0 No Texture 1 A3I5 Translucent Texture 2 4-Color Palette Texture 3 16-Color Palette Texture 4 256-Color Palette Texture 5 4x4-Texel Compressed Texture 6 A5I3 Translucent Texture 7 Direct Texture |
0 Do not Transform texture coordinates 1 TexCoord source 2 Normal source 3 Vertex source |
Clamp _____ Repeat Repeat+Flip _____/ /////////// /\/\/\/\/\/ |
0-12 Palette Base Address (div8 or div10h, see below) (Not used for Texture Format 7: Direct Color Texture) (0..FFF8h/8 for Texture Format 2: ie. 4-color-palette Texture) (0..17FF0h/10h for all other Texture formats) 13-31 Not used |
DS 3D Texture Formats |
Bit0-4: Color Index (0..31) of a 32-color Palette Bit5-7: Alpha (0..7; 0=Transparent, 7=Solid) |
Bit0-2: Color Index (0..7) of a 8-color Palette Bit3-7: Alpha (0..31; 0=Transparent, 31=Solid) |
Bit0-7 Upper 4-Texel row (LSB=first/left-most Texel) Bit8-15 Next 4-Texel row ("") Bit16-23 Next 4-Texel row ("") Bit24-31 Lower 4-Texel row ("") |
Bit0-13 Palette Offset in 4-byte steps; Addr=(PLTT_BASE*10h)+(Offset*4) Bit14-15 Transparent/Interpolation Mode (0..3, see below) |
slot1_addr = slot0_addr / 2 ;lower 64K of Slot1 assoc to Slot0 slot1_addr = slot2_addr / 2 + 10000h ;upper 64K of Slot1 assoc to Slot2 |
Texel Mode 0 Mode 1 Mode 2 Mode 3 0 Color 0 Color0 Color 0 Color 0 1 Color 1 Color1 Color 1 Color 1 2 Color 2 (Color0+Color1)/2 Color 2 (Color0*5+Color1*3)/8 3 Transparent Transparent Color 3 (Color0*3+Color1*5)/8 |
DS 3D Texture Coordinates |
( S' T' ) = ( S T ) |
| m[0] m[1] | ( S' T' ) = ( S T 1/16 1/16 ) * | m[4] m[5] | | m[8] m[9] | | m[12] m[13] | |
| m[0] m[1] | ( S' T' ) = ( Nx Ny Nz 1.0 ) * | m[4] m[5] | | m[8] m[9] | | S T | |
| m[0] m[1] | ( S' T' ) = ( Vx Vy Vz 1.0 ) * | m[4] m[5] | | m[8] m[9] | | S T | |
Matrix m[..] 1+19+12 (32bit) Vertex Vx,Vy,Vz 1+3+12 (16bit) Normal Nx,Ny,Nz 1+0+9 (10bit) Constant 1.0 0+1+0 (1bit) Constant 1/16 0+0+4 (4bit) TexCoord S,T 1+11+4 (16bit) Result S',T' 1+11+4 (16bit) <-------- clipped to that size ! |
DS 3D Texture Blending |
R = ((Rt+1)*(Rv+1)-1)/64 G = ((Gt+1)*(Gv+1)-1)/64 B = ((Bt+1)*(Bv+1)-1)/64 A = ((At+1)*(Av+1)-1)/64 |
R = (Rt*At + Rv*(63-At))/64 ;except, when At=0: R=Rv, when At=31: R=Rt G = (Gt*At + Gv*(63-At))/64 ;except, when At=0: G=Gv, when At=31: G=Gt B = (Bt*At + Bv*(63-At))/64 ;except, when At=0: B=Bv, when At=31: B=Bt A = Av |
R = ((Rt+1)*(Rs+1)-1)/64 ;Rs=ToonTableRed[Rv] G = ((Gt+1)*(Gs+1)-1)/64 ;Gs=ToonTableGreen[Rv] B = ((Bt+1)*(Bs+1)-1)/64 ;Bs=ToonTableBlue[Rv] A = ((At+1)*(Av+1)-1)/64 |
R = ((Rt+1)*(Rs+1)-1)/64+Rs ;truncated to MAX=63 G = ((Gt+1)*(Gs+1)-1)/64+Gs ;truncated to MAX=63 B = ((Bt+1)*(Bs+1)-1)/64+Bs ;truncated to MAX=63 A = ((At+1)*(Av+1)-1)/64 |
DS 3D Toon, Edge, Fog, Alpha-Blending, Anti-Aliasing |
Bit0-4: Red, Bit5-9: Green, Bit10-14: Blue, Bit15: Not Used |
Bit0-4: Red, Bit5-9: Green, Bit10-14: Blue, Bit15: Not Used |
0-4 Fog Color, Red ;\ 5-9 Fog Color, Green ; used only when DISP3DCNT.Bit6 is zero 10-14 Fog Color, Blue ;/ 15 Not used 16-20 Fog Alpha ;-used no matter of DISP3DCNT.Bit6 21-31 Not used |
0-14 Fog Offset (Unsigned) (0..7FFFh) 15-31 Not used |
FogDepthBoundary[n] = FOG_OFFSET + FOG_STEP*(n+1) ;with n = 0..31 |
0-6 Fog Density (00h..7Fh = None..Full) (usually increasing values) 7 Not used |
FrameBuffer[R] = (FogColor[R]*Density + FrameBuffer[R]*(128-Density)) / 128 FrameBuffer[G] = (FogColor[G]*Density + FrameBuffer[G]*(128-Density)) / 128 FrameBuffer[B] = (FogColor[B]*Density + FrameBuffer[B]*(128-Density)) / 128 FrameBuffer[A] = (FogColor[A]*Density + FrameBuffer[A]*(128-Density)) / 128 |
FrameBuf[R] = (Poly[R]*(Poly[A]+1) + FrameBuf[R]*(31-(Poly[A])) / 32 FrameBuf[G] = (Poly[G]*(Poly[A]+1) + FrameBuf[G]*(31-(Poly[A])) / 32 FrameBuf[B] = (Poly[B]*(Poly[A]+1) + FrameBuf[B]*(31-(Poly[A])) / 32 FrameBuf[A] = max(Poly[A],FrameBuf[A]) |
1) Alpha-Blending is disabled (DISP3DCNT.Bit3=0) 2) The polygon pixel is opaque (Poly[A]=31) 3) The old framebuffer value is totally transparent (FrameBuf[A]=0) |
Opaque polygons (except wire-frames) without Edge-Marking and Anti-Aliasing, and, all polygons with vertical right-edges (except line-segments). Plus, Translucent Polys when Alpha-Blending is disabled in DISP3DCNT.Bit3. |
DS 3D Status |
0 BoxTest,PositionTest,VectorTest Busy (0=Ready, 1=Busy) 1 BoxTest Result (0=All Outside View, 1=Parts or Fully Inside View) 2-7 Not used 8-12 Position & Vector Matrix Stack Level (0..31) (lower 5bit of 6bit value) 13 Projection Matrix Stack Level (0..1) 14 Matrix Stack Busy (0=No, 1=Yes; Currently executing a Push/Pop command) 15 Matrix Stack Overflow/Underflow Error (0=No, 1=Error/Acknowledge/Reset) 16-24 Number of 40bit-entries in Command FIFO (0..256) (24) Command FIFO Full (MSB of above) (0=No, 1=Yes; Full) 25 Command FIFO Less Than Half Full (0=No, 1=Yes; Less than Half-full) 26 Command FIFO Empty (0=No, 1=Yes; Empty) 27 Geometry Engine Busy (0=No, 1=Yes; Busy; Commands are executing) 28-29 Not used 30-31 Command FIFO IRQ (0=Never, 1=Less than half full, 2=Empty, 3=Reserved) |
0-11 Number of Polygons currently stored in Polygon List RAM (0..2048) 12-15 Not used 16-28 Number of Vertices currently stored in Vertex RAM (0..6144) 13-15 Not used |
0-5 Minimum Number (minus 2) of buffered lines in previous frame (0..46) 6-31 Not used |
DS 3D Tests |
Parameter 1, Bit 0-15 X-Coordinate Parameter 1, Bit 16-31 Y-Coordinate Parameter 2, Bit 0-15 Z-Coordinate Parameter 2, Bit 16-31 Width (presumably: X-Offset?) Parameter 3, Bit 0-15 Height (presumably: Y-Offset?) Parameter 3, Bit 16-31 Depth (presumably: Z-Offset?) All values are 1bit sign, 3bit integer, 12bit fractional part |
Parameter 1, Bit 0-15 X-Coordinate Parameter 1, Bit 16-31 Y-Coordinate Parameter 2, Bit 0-15 Z-Coordinate Parameter 2, Bit 16-31 Not used All values are 1bit sign, 3bit integer, 12bit fractional part. |
Parameter 1, Bit 0-9 X-Component Parameter 1, Bit 10-19 Y-Component Parameter 1, Bit 20-29 Z-Component Parameter 1, Bit 30-31 Not used All values are 1bit sign, 9bit fractional part. |
DS 3D Rear-Plane |
--> 2D Layers --> 3D Polygons --> 3D Rear-plane --> 2D Layers --> 2D Backdrop |
0-4 Clear Color, Red 5-9 Clear Color, Green 10-14 Clear Color, Blue 15 Fog (enables Fog to the rear-plane) (doesn't affect Fog of polygons) 16-20 Alpha 21-23 Not used 24-29 Clear Polygon ID (affects edge-marking, at the screen-edges?) 30-31 Not used |
0-14 Clear Depth (0..7FFFh) (usually 7FFFh = most distant) 15 Not used 16-31 See Port 4000356h, CLRIMAGE_OFFSET |
Rear Color Bitmap (located in Texture Slot 2) 0-4 Clear Color, Red 5-9 Clear Color, Green 10-14 Clear Color, Blue 15 Alpha (0=Transparent, 1=Solid) (equivalent to 5bit-alpha 0 and 31) Rear Depth Bitmap (located in Texture Slot 3) 0-14 Clear Depth, expanded to 24bit as X=(X*200h)+((X+1)/8000h)*1FFh 15 Clear Fog (Initial fog enable value) |
Bit0-7 X-Offset (0..255; 0=upper row of bitmap) Bit8-14 Y-Offset (0..255; 0=left column of bitmap) |
DS 3D Final 2D Output |
Brightness up/down with BG0 as 1st Target via EVY (as for 2D) Blending with BG0 as 2nd Target via EVA/EVB (as for 2D) Blending with BG0 as 1st Target via 3D Alpha-values (unlike as for 2D) |
DS Sound |
DS Sound Channels 0..15 |
Bit0-6 Volume Mul (0..127=silent..loud) Bit7 Not used (always zero) Bit8-9 Volume Div (0=Normal, 1=Div2, 2=Div4, 3=Div16) Bit10-14 Not used (always zero) Bit15 Hold (0=Normal, 1=Hold last sample after one-shot sound) Bit16-22 Panning (0..127=left..right) (64=half volume on both speakers) Bit23 Not used (always zero) Bit24-26 Wave Duty (0..7) ;HIGH=(N+1)*12.5%, LOW=(7-N)*12.5% (PSG only) Bit27-28 Repeat Mode (0=Manual, 1=Loop Infinite, 2=One-Shot, 3=Prohibited) Bit29-30 Format (0=PCM8, 1=PCM16, 2=IMA-ADPCM, 3=PSG/Noise) Bit31 Start/Status (0=Stop, 1=Start/Busy) |
Bit0-26 Source Address (must be word aligned, bit0-1 are always zero) Bit27-31 Not used |
Bit0-15 Timer Value, Sample frequency, timerval=-(33513982Hz/2)/freq |
Bit0-15 Loop Start, Sample loop start position (counted in words, ie. N*4 bytes) |
Bit0-21 Sound length (counted in words, ie. N*4 bytes) Bit22-31 Not used |
DS Sound Control Registers |
Bit0-6 Master Volume (0..127=silent..loud) Bit7 Not used (always zero) Bit8-9 Left Output from (0=Left Mixer, 1=Ch1, 2=Ch3, 3=Ch1+Ch3) Bit10-11 Right Output from (0=Right Mixer, 1=Ch1, 2=Ch3, 3=Ch1+Ch3) Bit12 Output Ch1 to Mixer (0=Yes, 1=No) (both Left/Right) Bit13 Output Ch3 to Mixer (0=Yes, 1=No) (both Left/Right) Bit14 Not used (always zero) Bit15 Master Enable (0=Disable, 1=Enable) Bit16-31 Not used (always zero) |
Bit0-9 Sound Bias (0..3FFh, usually 200h) Bit10-31 Not used (always zero) |
DS Sound Capture |
Bit0 Control of Associated Sound Channels (ANDed with Bit7) SNDCAP0CNT: Output Sound Channel 1 (0=As such, 1=Add to Channel 0) SNDCAP1CNT: Output Sound Channel 3 (0=As such, 1=Add to Channel 2) Caution: Addition mode works only if BOTH Bit0 and Bit7 are set. Bit1 Capture Source Selection SNDCAP0CNT: Capture 0 Source (0=Left Mixer, 1=Channel 0/Bugged) SNDCAP1CNT: Capture 1 Source (0=Right Mixer, 1=Channel 2/Bugged) Bit2 Capture Repeat (0=Loop, 1=One-shot) Bit3 Capture Format (0=PCM16, 1=PCM8) Bit4-6 Not used (always zero) Bit7 Capture Start/Status (0=Stop, 1=Start/Busy) |
Bit0-26 Destination address (word aligned, bit0-1 are always zero) Bit27-31 Not used (always zero) |
Bit0-15 Buffer length (1..FFFFh words) (ie. N*4 bytes) Bit16-31 Not used |
1) Both Negative Bug - SNDCAPxCNT Bit1=1, Bit0=0 (addition disabled) Capture data is accidently set to -8000h if ch(a) and ch(b) are both <0. Otherwise the correct capture result is returned, ie. plain ch(a) data, not being affected by ch(b) (since addition is disabled). Workaround: Ensure that ch(a) and/or ch(b) are >=0 (or disabled). 2) Overflow Bug - SNDCAPxCNT Bit1=1, Bit0=1 (addition enabled) In this mode, Capture data isn't clipped to MinMax(-8000h,+7FFFh), instead, it is ANDed with FFFFh, so the sign bit is lost if the addition result ch(a)+ch(b) is less/greater than -8000h/+7FFFh. Workaround: Reduce ch(a)/ch(b) volume or data to avoid overflows. |
1) Addition Result for Capture(x) when using capture source=ch(a): Addition is performed always, no matter of SOUNDCNT.Bit12/13. And, no matter of ch(a) enable, result is plain ch(b) if ch(a) is disabled. Result is 16bit (plus fraction) with overflow error (see Capture Bugs). 2) Addition Result for Mixer (towards speakers, and capture source=mixer): Ch(b) is muted if ch(a) is disabled. Ch(b) is muted if ch(b) SOUNDCNT.Bit12/13 is set to "Ch(b) not to mixer". Result is 17bit (plus fraction) without overflow error. |
DS Sound Block Diagrams |
_____ Ch0.L ------------->| | +------------------------------> to Capture 0 ___ | | | ___ Ch1.L ---+->|Sel|-->| | | Ch0..Ch15 | | | |___| |Left |--+---------------->| | Ch2.L ---|--------->|Mixer| |Sel| ______ ____ | ___ | | Ch1 | | |Master| |Add | Ch3.L -+-|->|Sel|-->| | +----------------->| |->|Volume|->|Bias|-> L | | |___| | | | | | |______| |____| Ch4.L -|-|--------->| | | Ch3 | | ... -|-|--------->| | | +--------------->| | Ch15.L-|-|--------->|_____| | | ___ | | | +------------------+-|->|Add| Ch1+Ch3 | | +----------------------+->|___|-------->|___| |
____ _________ ___ ___ ___ |FIFO|-->|Channel 0|-->|Vol|-->|Add|-+->|Pan|--> Ch0.L |____| |_________| |___| |___| | |___|--> Ch0.R ____ _________ ___ ^ | |FIFO|<--|Capture 0|<--|Sel|<----|---+ |____| |_ _____ _| |___|<----|-------------- Left Mixer ____ _:Timer:_ ___ _|_ ___ |FIFO|-->|Channel 1|-->|Vol|-->|Sel|--->|Pan|--> Ch1.L |____| |_________| |___| |___| |___|--> Ch1.R |
____ _________ ___ ___ |FIFO|-->|Channel 4|-->|Vol|----------->|Pan|--> Ch4.L |____| |_________| |___| |___|--> Ch4.R |
DS Sound Notes |
data.vol = data*N/128 pan.left = data*(128-N)/128 pan.right = data*N/128 master.vol = data*N/128/64 |
Step Bits Min Max 0 Incoming PCM16 Data 16.0 -8000h +7FFFh 1 Volume Divider (div 1..16) 16.4 -8000h +7FFFh 2 Volume Factor (mul N/128) 16.11 -8000h +7FFFh 3 Panning (mul N/128) 16.18 -8000h +7FFFh 4 Rounding Down (strip 10bit) 16.8 -8000h +7FFFh 5 Mixer (add channel 0..15) 20.8 -80000h +7FFF0h 6 Master Volume (mul N/128/64) 14.21 -2000h +1FF0h 7 Strip fraction 14.0 -2000h +1FF0h 8 Add Bias (0..3FFh, def=200h) 15.0 -2000h+0 +1FF0h+3FFh 9 Clip (min/max 0h..3FFh) 10.0 0 +3FFh |
0 12.5% "_______-_______-_______-" 1 25.0% "______--______--______--" 2 37.5% "_____---_____---_____---" 3 50.0% "____----____----____----" 4 62.5% "___-----___-----___-----" 5 75.0% "__------__------__------" 6 87.5% "_-------_-------_-------" 7 0.0% "________________________" |
X=X SHR 1, IF carry THEN Out=LOW, X=X XOR 6000h ELSE Out=HIGH |
Bit0-15 Initial PCM16 Value (Pcm16bit = -7FFFh..+7FFF) (not -8000h) Bit16-22 Initial Table Index Value (Index = 0..88) Bit23-31 Not used (zero) |
Diff = ((Data4bit AND 7)*2+1)*AdpcmTable[Index]/8 ;see rounding-error IF (Data4bit AND 8)=0 THEN Pcm16bit = Max(Pcm16bit+Diff,+7FFFh) IF (Data4bit AND 8)=8 THEN Pcm16bit = Min(Pcm16bit-Diff,-7FFFh) Index = MinMax (Index+IndexTable[Data4bit AND 7],0,88) |
Diff = AdpcmTable[Index]/8 IF (data4bit AND 1) THEN Diff = Diff + AdpcmTable[Index]/4 IF (data4bit AND 2) THEN Diff = Diff + AdpcmTable[Index]/2 IF (data4bit AND 4) THEN Diff = Diff + AdpcmTable[Index]/1 |
Max(+7FFFh) leaves -8000h unclipped (can happen if initial PCM16 was -8000h) Min(-7FFFh) clips -8000h to -7FFFh (possibly unlike windows .WAV files?) |
0007h,0008h,0009h,000Ah,000Bh,000Ch,000Dh,000Eh,0010h,0011h,0013h,0015h 0017h,0019h,001Ch,001Fh,0022h,0025h,0029h,002Dh,0032h,0037h,003Ch,0042h 0049h,0050h,0058h,0061h,006Bh,0076h,0082h,008Fh,009Dh,00ADh,00BEh,00D1h 00E6h,00FDh,0117h,0133h,0151h,0173h,0198h,01C1h,01EEh,0220h,0256h,0292h 02D4h,031Ch,036Ch,03C3h,0424h,048Eh,0502h,0583h,0610h,06ABh,0756h,0812h 08E0h,09C3h,0ABDh,0BD0h,0CFFh,0E4Ch,0FBAh,114Ch,1307h,14EEh,1706h,1954h 1BDCh,1EA5h,21B6h,2515h,28CAh,2CDFh,315Bh,364Bh,3BB9h,41B2h,4844h,4F7Eh 5771h,602Fh,69CEh,7462h,7FFFh |
X=000776d2h, FOR I=0 TO 88, Table[I]=X SHR 16, X=X+(X/10), NEXT I Table[3]=000Ah, Table[4]=000Bh, Table[88]=7FFFh, Table[89..127]=0000h |
DS System and Built-in Peripherals |
DS DMA Transfers |
0 Start Immediately 1 Start at V-Blank 2 Start at H-Blank (paused during V-Blank) 3 Synchronize to start of display 4 Main memory display 5 DS Cartridge Slot 6 GBA Cartridge Slot 7 Geometry Command FIFO |
0 Start Immediately 1 Start at V-Blank 2 DS Cartridge Slot 3 DMA0/DMA2: Wireless interrupt, DMA1/DMA3: GBA Cartridge Slot |
Bit0-31 Filldata |
DS Timers |
DS Interrupts |
0 Disable all interrupts (0=Disable All, 1=See IE register) 1-31 Not used |
0 LCD V-Blank 1 LCD H-Blank 2 LCD V-Counter Match 3 Timer 0 Overflow 4 Timer 1 Overflow 5 Timer 2 Overflow 6 Timer 3 Overflow 7 NDS7 only: SIO/RCNT/RTC (Real Time Clock) 8 DMA 0 9 DMA 1 10 DMA 2 11 DMA 3 12 Keypad 13 GBA-Slot (external IRQ source) / DSi: None such 14 Not used / DSi9: NDS-Slot Card change? 15 Not used / DSi: dito for 2nd NDS-Slot? 16 IPC Sync 17 IPC Send FIFO Empty 18 IPC Recv FIFO Not Empty 19 NDS-Slot Game Card Data Transfer Completion 20 NDS-Slot Game Card IREQ_MC 21 NDS9 only: Geometry Command FIFO 22 NDS7 only: Screens unfolding 23 NDS7 only: SPI bus 24 NDS7 only: Wifi / DSi9: XpertTeak DSP 25 Not used / DSi9: Camera 26 Not used / DSi9: Undoc, IF.26 set on FFh-filling 40021Axh 27 Not used / DSi: Maybe IREQ_MC for 2nd gamecard? 28 Not used / DSi: NewDMA0 29 Not used / DSi: NewDMA1 30 Not used / DSi: NewDMA2 31 Not used / DSi: NewDMA3 ? DSi7: any further new IRQs on ARM7 side...? |
0 DSi7: GPIO18[0] ;\ 1 DSi7: GPIO18[1] ; maybe 1.8V signals? 2 DSi7: GPIO18[2] ;/ 3 DSi7: Unused (0) 4 DSi7: GPIO33[0] unknown (related to "GPIO330" testpoint on mainboard?) 5 DSi7: GPIO33[1] Headphone connect (HP#SP) (static state) 6 DSi7: GPIO33[2] Powerbutton interrupt (short pulse upon key-down) 7 DSi7: GPIO33[3] sound enable output (ie. not a useful irq-input) 8 DSi7: SD/MMC Controller ;-Onboard eMMC and External SD Slot 9 DSi7: SD Slot Data1 pin ;-For SDIO hardware in External SD Slot 10 DSi7: SDIO Controller ;\Atheros Wifi Unit 11 DSi7: SDIO Data1 pin ;/ 12 DSi7: AES interrupt 13 DSi7: I2C interrupt 14 DSi7: Microphone Extended interrupt 15-31 DSi7: Unused (0) |
Bit 0-31 Pointer to IRQ Handler |
Bit 0-31 IRQ Flags (same format as IE/IF registers) |
DS Maths |
0-1 Division Mode (0-2=See below) (3=Reserved; same as Mode 1) 2-13 Not used 14 Division by zero (0=Okay, 1=Division by zero error; 64bit Denom=0) 15 Busy (0=Ready, 1=Busy) (Execution time see below) 16-31 Not used |
Mode Numer / Denom = Result, Remainder ; Cycles 0 32bit / 32bit = 32bit , 32bit ; 18 clks 1 64bit / 32bit = 64bit , 32bit ; 34 clks 2 64bit / 64bit = 64bit , 64bit ; 34 clks |
DIV0 --> REMAIN=NUMER, RESULT=+/-1 (with sign opposite of NUMER) -MAX/-1 --> RESULT=-MAX (instead +MAX) |
0 Mode (0=32bit input, 1=64bit input) 1-14 Not used 15 Busy (0=Ready, 1=Busy) (Execution time is 13 clks, in either Mode) 16-31 Not used |
DS Inter Process Communication (IPC) |
Bit Dir Expl. 0-3 R Data input from IPCSYNC Bit8-11 of remote CPU (00h..0Fh) 4-7 - Not used 8-11 R/W Data output to IPCSYNC Bit0-3 of remote CPU (00h..0Fh) 12 - Not used 13 W Send IRQ to remote CPU (0=None, 1=Send IRQ) 14 R/W Enable IRQ from remote CPU (0=Disable, 1=Enable) 15-31 - Not used |
Bit Dir Expl. 0 R Send Fifo Empty Status (0=Not Empty, 1=Empty) 1 R Send Fifo Full Status (0=Not Full, 1=Full) 2 R/W Send Fifo Empty IRQ (0=Disable, 1=Enable) 3 W Send Fifo Clear (0=Nothing, 1=Flush Send Fifo) 4-7 - Not used 8 R Receive Fifo Empty (0=Not Empty, 1=Empty) 9 R Receive Fifo Full (0=Not Full, 1=Full) 10 R/W Receive Fifo Not Empty IRQ (0=Disable, 1=Enable) 11-13 - Not used 14 R/W Error, Read Empty/Send Full (0=No Error, 1=Error/Acknowledge) 15 R/W Enable Send/Receive Fifo (0=Disable, 1=Enable) 16-31 - Not used |
Bit0-31 Send Fifo Data (max 16 words; 64bytes) |
Bit0-31 Receive Fifo Data (max 16 words; 64bytes) |
DS Keypad |
0 Button X (0=Pressed, 1=Released) 1 Button Y (0=Pressed, 1=Released) 3 DEBUG button (0=Pressed, 1=Released/None such) 6 Pen down (0=Pressed, 1=Released/Disabled) (always 0 in DSi mode) 7 Hinge/folded (0=Open, 1=Closed) 2,4,5 Unknown / set 8..15 Unknown / zero |
DS Absent Link Port |
NDS7 4000128h SIOCNT Bit15 "CKUP" New Bit in NORMAL/MULTI/UART mode (R/W) NDS7 4000128h SIOCNT Bit14 "N/A" Removed IRQ Bit in UART mode (?) NDS7 400012Ah SIOCNT_H Bit14 "TFEMP" New Bit (R/W) NDS7 400012Ah SIOCNT_H Bit15 "RFFUL" New Bit (always zero?) NDS7 400012Ch SIOSEL Bit0 "SEL" New Bit (always zero?) NDS7 4000140h JOYCNT Bit7 "MOD" New Bit (R/W) |
NDS9 4000120h SIODATA32 Bit0-31 Data (always zero?) NDS9 4000128h SIOCNT Bit2 "TRECV" New Bit (always zero?) NDS9 4000128h SIOCNT Bit3 "TSEND" New Bit (always zero?) NDS9 400012Ch SIOSEL Bit0 "SEL" New Bit (always zero?) |
DS Real-Time Clock (RTC) |
Bit Expl. 0 Data I/O (0=Low, 1=High) 1 Clock Out (0=Low, 1=High) 2 Select Out (0=Low, 1=High/Select) 4 Data Direction (0=Read, 1=Write) 5 Clock Direction (should be 1=Write) 6 Select Direction (should be 1=Write) 3,8-11 Unused I/O Lines 7,12-15 Direction for Bit3,8-11 (usually 0) 16-31 Not used |
Init CS=LOW and /SCK=HIGH, and wait at least 1us Switch CS=HIGH, and wait at least 1us Send the Command byte (see bit-transfer below) Send/receive Parameter byte(s) associated with the command (see below) Switch CS to LOW |
Output /SCK=LOW and SIO=databit (when writing), then wait at least 5us Output /SCK=HIGH, wait at least 5us, then read SIO=databit (when reading) In either direction, data is output on (or immediately after) falling edge. |
Command Register Fwd Rev 0 7 Fixed Code (must be 0) 1 6 Fixed Code (must be 1) 2 5 Fixed Code (must be 1) 3 4 Fixed Code (must be 0, or, DSi only: 1=Extended Command) 4-6 3-1 Command Fwd Rev Parameter bytes (read/write access) 0 0 1 byte, status register 1 4 1 1 byte, status register 2 2 2 7 bytes, date & time (year,month,day,day_of_week,hh,mm,ss) 6 3 3 bytes, time (hh,mm,ss) 1* 4* 1 byte, int1, frequency duty setting 1* 4* 3 bytes, int1, alarm time 1 (day_of_week, hour, minute) 5 5 3 bytes, int2, alarm time 2 (day_of_week, hour, minute) 3 6 1 byte, clock adjustment register 7 7 1 byte, free register Extended command (when above "fourth bit" was set, DSi only) Fwd Rev Parameter bytes (read/write access) 0 0 3 byte, up counter (msw,mid,lsw) (read only) 4 1 1 byte, FOUT register setting 1 2 2 1 byte, FOUT register setting 2 6 3 reserved 1 4 3 bytes, alarm date 1 (year,month,day) 5 5 3 bytes, alarm date 2 (year,month,day) 3 6 reserved 7 7 reserved 7 0 Parameter Read/Write Access (0=Write, 1=Read) |
Status Register 1 0 W Reset (0=Normal, 1=Reset) 1 R/W 12/24 hour mode (0=12 hour, 1=24 hour) 2-3 R/W General purpose bits 4 R Interrupt 1 Flag (1=Yes) ;auto-cleared on read 5 R Interrupt 2 Flag (1=Yes) ;auto-cleared on read 6 R Power Low Flag (0=Normal, 1=Power is/was low) ;auto-cleared on read 7 R Power Off Flag (0=Normal, 1=Power was off) ;auto-cleared on read Power off indicates that the battery was removed or fully discharged, all registers are reset to 00h (or 01h), and must be re-initialized. Status Register 2 0-3 R/W INT1 Mode/Enable 0000b Disable 0x01b Selected Frequency steady interrupt 0x10b Per-minute edge interrupt 0011b Per-minute steady interrupt 1 (duty 30.0 seconds) 0100b Alarm 1 interrupt 0111b Per-minute steady interrupt 2 (duty 0.0079 seconds) 1xxxb 32kHz output 4-5 R/W General purpose bits 6 R/W INT2 Enable 0b Disable 1b Alarm 2 interrupt 7 R/W Test Mode (0=Normal, 1=Test, don't use) (cleared on Reset) Clock Adjustment Register (to compensate oscillator inaccuracy) 0-7 R/W Adjustment (00h=Normal, no adjustment) Free Register 0-7 R/W General purpose bits |
Year Register 0-7 R/W Year (BCD 00h..99h = 2000..2099) Month Register 0-4 R/W Month (BCD 01h..12h = January..December) 5-7 - Not used (always zero) Day Register 0-5 R/W Day (BCD 01h..28h,29h,30h,31h, range depending on month/year) 6-7 - Not used (always zero) Day of Week Register (septenary counter) 0-2 R/W Day of Week (00h..06h, custom assignment, usually 0=Monday?) 3-7 - Not used (always zero) |
Hour Register 0-5 R/W Hour (BCD 00h..23h in 24h mode, or 00h..11h in 12h mode) 6 * AM/PM (0=AM before noon, 1=PM after noon) * 24h mode: AM/PM flag is read only (PM=1 if hour = 12h..23h) * 12h mode: AM/PM flag is read/write-able * 12h mode: Observe that 12 o'clock is defined as 00h (not 12h) 7 - Not used (always zero) Minute Register 0-6 R/W Minute (BCD 00h..59h) 7 - Not used (always zero) Second Register 0-6 R/W Minute (BCD 00h..59h) 7 - Not used (always zero) |
Alarm1 and Alarm2 Day of Week Registers (INT1 and INT2 each) 0-2 R/W Day of Week (00h..06h) 3-6 - Not used (always zero) 7 R/W Compare Enable (0=Alarm every day, 1=Alarm only at specified day) Alarm1 and Alarm2 Hour Registers (INT1 and INT2 each) 0-5 R/W Hour (BCD 00h..23h in 24h mode, or 00h..11h in 12h mode) 6 R/W AM/PM (0=AM, 1=PM) (must be correct even in 24h mode?) 7 R/W Compare Enable (0=Alarm every hour, 1=Alarm only at specified hour) Alarm1 and Alarm2 Minute Registers (INT1 and INT2 each) 0-6 R/W Minute (BCD 00h..59h) 7 R/W Compare Enable (0=Alarm every min, 1=Alarm only at specified min) Selected Frequency Steady Interrupt Register (INT1 only) (when Stat2/Bit2=0) 0 R/W Enable 1Hz Frequency (0=Disable, 1=Enable) 1 R/W Enable 2Hz Frequency (0=Disable, 1=Enable) 2 R/W Enable 4Hz Frequency (0=Disable, 1=Enable) 3 R/W Enable 8Hz Frequency (0=Disable, 1=Enable) 4 R/W Enable 16Hz Frequency (0=Disable, 1=Enable) The signals are ANDed when two or more frequencies are enabled, ie. the /INT signal gets LOW when either of the signals is LOW. 5-7 R/W General purpose bits |
Up Counter Msw 0-7 R Up Counter bit16-23 (non-BCD, 00h..FFh) Up Counter Mid 0-7 R Up Counter bit8-15 (non-BCD, 00h..FFh) Up Counter Lsw 0-7 R Up Counter bit0-7 (non-BCD, 00h..FFh) |
Alarm 1 and Alarm 2 Year Register 0-7 R/W Year (BCD 00h..99h = 2000..2099) Alarm 1 and Alarm 2 Month Register 0-4 R/W Month (BCD 01h..12h = January..December) 5 - Not used (always zero) 6 R/W Year Compare Enable (0=Ignore, 1=Enable) 7 R/W Month Compare Enable (0=Ignore, 1=Enable) Alarm 1 and Alarm 2 Day Register 0-5 R/W Day (BCD 01h..28h,29h,30h,31h, range depending on month/year) 6 - Not used (always zero) 7 R/W Day Compare Enable (0=Ignore, 1=Enable) |
FOUT Register Setting 1 0-7 R/W Enable bits (bit0=256Hz, bit1=512Hz, ..., bit7=32768Hz) FOUT Register Setting 2 0-7 R/W Enable bits (bit0=1Hz, bit1=2Hz, ..., bit7=128Hz) The above sixteen FOUT signals are ANDed when two or more frequencies are enabled, ie. the FOUT signal gets LOW when either of the signals is LOW. |
1 /INT 8 VDD 2 XOUT 7 SIO 3 XIN 6 /SCK 4 GND 5 CS |
DS Serial Peripheral Interface Bus (SPI) |
0-1 Baudrate (0=4MHz/Firmware, 1=2MHz/Touchscr, 2=1MHz/Powerman., 3=512KHz) 2-6 Not used (Zero) 7 Busy Flag (0=Ready, 1=Busy) (presumably Read-only) 8-9 Device Select (0=Powerman., 1=Firmware, 2=Touchscr, 3=Reserved) 10 Transfer Size (0=8bit/Normal, 1=16bit/Bugged) 11 Chipselect Hold (0=Deselect after transfer, 1=Keep selected) 12-13 Not used (Zero) 14 Interrupt Request (0=Disable, 1=Enable) 15 SPI Bus Enable (0=Disable, 1=Enable) |
0-7 Data 8-15 Not used (always zero, even in bugged-16bit mode) |
DS Touch Screen Controller (TSC) |
0-1 Power Down Mode Select 2 Reference Select (0=Differential, 1=Single-Ended) 3 Conversion Mode (0=12bit, max CLK=2MHz, 1=8bit, max CLK=3MHz) 4-6 Channel Select (0-7, see below) 7 Start Bit (Must be set to access Control Byte) |
0 Temperature 0 (requires calibration, step 2.1mV per 1'C accuracy) 1 Touchscreen Y-Position (somewhat 0B0h..F20h, or FFFh=released) 2 Battery Voltage (not used, connected to GND in NDS, always 000h) 3 Touchscreen Z1-Position (diagonal position for pressure measurement) 4 Touchscreen Z2-Position (diagonal position for pressure measurement) 5 Touchscreen X-Position (somewhat 100h..ED0h, or 000h=released) 6 AUX Input (connected to Microphone in the NDS) 7 Temperature 1 (difference to Temp 0, without calibration, 2'C accuracy) |
Mode /PENIRQ VREF ADC Recommended use 0 Enabled Auto Auto Differential Mode (Touchscreen, Penirq) 1 Disabled Off On Single-Ended Mode (Temperature, Microphone) 2 Enabled On Off Don't use 3 Disabled On On Don't use |
scr.x = (adc.x-adc.x1) * (scr.x2-scr.x1) / (adc.x2-adc.x1) + (scr.x1-1) scr.y = (adc.y-adc.y1) * (scr.y2-scr.y1) / (adc.y2-adc.y1) + (scr.y1-1) |
Rtouch = (Rx_plate*Xpos*(Z2pos/Z1pos-1))/4096 Rtouch = (Rx_plate*Xpos*(4096/Z1pos-1)-Ry_plate*(1-Ypos))/4096 |
touchval = Xpos*(Z2pos/Z1pos-1) |
K = (CAL.TP0-ADC.TP0) * 0.4 + CAL.KELVIN |
K = (ADC.TP1-ADC.TP0) * 8568 / 4096 |
Celsius: C = (K-273.15) Fahrenheit: F = (K-273.15)*9/5+32 Reaumur: R = (K-273.15)*4/5 Rankine: X = (K)*9/5 |
________ VCC 1|o |16 DCLK X+ 2| |15 /CS Y+ 3| TSC |14 DIN X- 4| 2046 |13 BUSY Y- 5| |12 DOUT GND 6| |11 /PENIRQ VBAT 7| |10 IOVDD AUX 8|________|9 VREF |
DS Power Management |
0 Enable Flag for both LCDs (0=Disable) (Prohibited, see notes) 1 2D Graphics Engine A (0=Disable) (Ports 008h-05Fh, Pal 5000000h) 2 3D Rendering Engine (0=Disable) (Ports 320h-3FFh) 3 3D Geometry Engine (0=Disable) (Ports 400h-6FFh) 4-8 Not used 9 2D Graphics Engine B (0=Disable) (Ports 1008h-105Fh, Pal 5000400h) 10-14 Not used 15 Display Swap (0=Send Display A to Lower Screen, 1=To Upper Screen) 16-31 Not used |
Bit Expl. 0 Sound Speakers (0=Disable, 1=Enable) (Initial setting = 1) 1 Wifi (0=Disable, 1=Enable) (Initial setting = 0) 2-31 Not used |
Bit Expl. 0-2 Wifi WS0 Control (0-7) (Ports 4800000h-4807FFFh) 3-5 Wifi WS1 Control (0-7) (Ports 4808000h-480FFFFh) 4-15 Not used (zero) |
Bit Expl. 0-5 Not used (zero) 6-7 Power Down Mode (0=No function, 1=Enter GBA Mode, 2=Halt, 3=Sleep) |
Bit Expl. 0 Post Boot Flag (0=Boot in progress, 1=Boot completed) 1 NDS7: Not used (always zero), NDS9: Bit1 is read-writeable 2-7 Not used (always zero) |
Index Register Bit0-6 Register Select (0..3) (0..4 for DS-Lite) (0..7Fh for DSi) Bit7 Register Direction (0=Write, 1=Read) Register 0 - Powermanagement Control (R/W) Bit0 Sound Amplifier Enable (0=Disable, 1=Enable) (Old-DS: Disabled: Sound is very silent, but still audible) (DS-Lite: Disabled: Sound is NOT audible) (DSi in NDS Mode: R/W, but effect is unknown yet) (DSi in DSi Mode: Not used, Bit0 is always 1) Bit1 Sound Amplifier Mute (0=Normal, 1=Mute) (Old-DS Only, not DS-Lite) (Old-DS: Muted: Sound is NOT audible, that works only if Bit0=1) (DS-Lite: Not used, Bit1 is always zero) (DSi in NDS Mode: R/W, but effect is unknown yet) (DSi in DSi Mode: R/W, but effect is unknown yet) Bit2 Lower Backlight (0=Disable, 1=Enable) Bit3 Upper Backlight (0=Disable, 1=Enable) Bit4 Power LED Blink Enable (0=Always ON, 1=Blinking OFF/ON) Bit5 Power LED Blink Speed (0=Slow, 1=Fast) (only if Blink enabled) (DSi: Power LED Blinking isn't supported, neither in NDS nor DSi mode) Bit6 DS System Power (0=Normal, 1=Shut Down) Bit7 Not used (always 0) Register 1 - Battery Status (R) Bit0 Battery Power LED Status (0=Power Good/Green, 1=Power Low/Red) (DSi: Usually 0, not tested if it changes upon Power=Low) Bit1-7 Not used Register 2 - Microphone Amplifier Control (R/W) Bit0 Amplifier (0=Disable, 1=Enable) Bit1-7 Not used (always 0) (DSi in NDS Mode: looks same as NDS, ie. only bit0 is R/W) (DSi in DSi Mode: Not used, always FFh) Register 3 - Microphone Amplifier Gain Control (R/W) Bit0-1 Gain (0..3=Gain 20, 40, 80, 160) Bit2-7 Not used (always 0) (DSi in NDS Mode: looks same as NDS, ie. only bit0-1 are R/W) (DSi in DSi Mode: Not used, always FFh) Register 4 - DS-Lite and DSi Only - Backlight Levels/Power Source (R/W) Bit0-1 Backlight Brightness (0..3=Low,Med,High,Max) (R/W) (when bit2+3 are both set, then reading bit0-1 always returns 3) Bit2 Force Max Brightness when Bit3=1 (0=No, 1=Yes) (R/W) Bit3 External Power Present (0=No, 1=Yes) (Read-Only) Bit4-7 Unknown (Always 4) (Read-Only) (DSi in NDS Mode: looks same as in DSi mode) (DSi in DSi Mode: Bit0-1 are R/W, but ignored, bit2-3 are always 0) Register 10h - DSi Only - Backlight Mirrors & Reset (R/W) Bit0 Reset (0=No, 1=Reboot DSi) (same/similar as BPTWL reset feature?) Bit1 Unknown (R/W) (note: whatever it is, it isn't warmboot flag) Bit2-3 Mirror of Register 0, bit2-3 (backlight enable bits) (R/W) Bit4-7 Not used (always 0) (This register works in NDS mode and DSi mode, though it's mainly intended for NDS mode, eg. DS Download Play uses the Reset bit to return to DSi menu) (note: writing bit2 seems to affect BOTH bit1 and bit2 in register 0) |
DS Main Memory Control |
LDRH R0,[27FFFFEh] ;read one value STRH R0,[27FFFFEh] ;write should be same value as above STRH R0,[27FFFFEh] ;write should be same value as above STRH R0,[27FFFFEh] ;write any value STRH R0,[27FFFFEh] ;write any value LDRH R0,[2400000h+CR*2] ;read, address-bits are defining new CR value |
Bit Expl. 0-6 Reserved (Must be 7Fh) 7 Write Control 0=WE Single Clock Pulse Control without Write Suspend Function 1=WE Level Control with Write Suspend Function) Burst Read/Single Write is not supported at WE Single Clock Mode. 8 Reserved (Must be 1) 9 Valid Clock Edge (0=Falling Edge, 1=Rising Edge) 10 Single Write (0=Burst Read/Burst Write, 1=Burst Read/Single Write) 11 Burst Sequence (0=Reserved, 1=Sequential) 12-14 Read Latency (1=3 clocks, 2=4 clocks, 3=5 clocks, other=Reserved) 15 Mode 0=Synchronous: Burst Read, Burst Write 1=Asynchronous: Page Read, Normal Write In Mode 1 (Async), only the Partial Size bits are used, all other bits, CR bits 0..18, must be "1". 16-18 Burst Length (2=8 Words, 3=16Words, 7=Continous, other=Reserved) 19-20 Partial Size (0=1MB, 1=512KB, 2=Reserved, 3=Deep/0 bytes) |
STRH 2000h,[4000204h] LDRH R0,[27FFFFEh] STRH R0,[27FFFFEh] STRH R0,[27FFFFEh] STRH FFDFh,[27FFFFEh] STRH E732h,[27FFFFEh] LDRH R0,[27E57FEh] STRH 6000h,[4000204h] |
DS Backwards-compatible GBA-Mode |
--- NDS9: --- ZEROFILL VRAM A,B ;init black screen border (or other color/image) POWCNT=8003h ;enable 2D engine A on upper screen (0003h=lower) EXMEMCNT=... ;set Async Main Memory mode (clear bit14) IME=0 ;disable interrupts SWI 06h ;halt with interrupts disabled (lockdown) --- NDS7: --- POWERMAN.REG0=09h ;enable sound amplifier & upper backlight (05h=lower) IME=0 ;disable interrupts wait for VCOUNT=200 ;wait until VBlank SWI 1Fh with R2=40h ;enter GBA mode, by CustomHalt(40h) |
DS Debug Registers (Emulator/Devkits) |
4FFFA00h..A0Fh R Emulation ID (16 bytes, eg. "no$gba v2.7", padded with 20h) 4FFFA10h W String Out (raw) 4FFFA14h W String Out (with %param's) 4FFFA18h W String Out (with %param's, plus linefeed) 4FFFA1Ch W Char Out (nocash) 4FFFA20h..A27h R Clock Cycles (64bit) 4FFFA28h..A3Fh - N/A |
4000640h (32bit) ;aka CLIPMTX_RESULT (mis-used to invoke detection) 4000006h (16bit) ;aka VCOUNT (mis-used to get detection result) 4FFF010h (32bit) ;use to initialize/unlock/reset something 4FFF000h (8bit) ;debug message character output (used when Ensata detected) |
[4000640h]=2468ACE0h ;CLIPMTX_RESULT (on real hardware it's read-only) if ([4000006h] AND 1FFh)=10Eh ;VCOUNT (on real hardware it's 000h..106h) [4FFF010h]=13579BDFh ;\initialize/reset something [4FFF010h]=FDB97531h ;/ Ensata=true else Ensata=false endif |
DS Cartridges, Encryption, Firmware |
DS Cartridge Header |
Address Bytes Expl. 000h 12 Game Title (Uppercase ASCII, padded with 00h) 00Ch 4 Gamecode (Uppercase ASCII, NTR-<code>) (0=homebrew) 010h 2 Makercode (Uppercase ASCII, eg. "01"=Nintendo) (0=homebrew) 012h 1 Unitcode (00h=NDS, 02h=NDS+DSi, 03h=DSi) (bit1=DSi) 013h 1 Encryption Seed Select (00..07h, usually 00h) 014h 1 Devicecapacity (Chipsize = 128KB SHL nn) (eg. 7 = 16MB) 015h 7 Reserved (zero filled) 01Ch 1 Reserved (zero) (except, used on DSi) 01Dh 1 NDS Region (00h=Normal, 80h=China, 40h=Korea) (other on DSi) 01Eh 1 ROM Version (usually 00h) 01Fh 1 Autostart (Bit2: Skip "Press Button" after Health and Safety) (Also skips bootmenu, even in Manual mode & even Start pressed) 020h 4 ARM9 rom_offset (4000h and up, align 1000h) 024h 4 ARM9 entry_address (2000000h..23BFE00h) 028h 4 ARM9 ram_address (2000000h..23BFE00h) 02Ch 4 ARM9 size (max 3BFE00h) (3839.5KB) 030h 4 ARM7 rom_offset (8000h and up) 034h 4 ARM7 entry_address (2000000h..23BFE00h, or 37F8000h..3807E00h) 038h 4 ARM7 ram_address (2000000h..23BFE00h, or 37F8000h..3807E00h) 03Ch 4 ARM7 size (max 3BFE00h, or FE00h) (3839.5KB, 63.5KB) 040h 4 File Name Table (FNT) offset 044h 4 File Name Table (FNT) size 048h 4 File Allocation Table (FAT) offset 04Ch 4 File Allocation Table (FAT) size 050h 4 File ARM9 overlay_offset 054h 4 File ARM9 overlay_size 058h 4 File ARM7 overlay_offset 05Ch 4 File ARM7 overlay_size 060h 4 Port 40001A4h setting for normal commands (usually 00586000h) 064h 4 Port 40001A4h setting for KEY1 commands (usually 001808F8h) 068h 4 Icon/Title offset (0=None) (8000h and up) 06Ch 2 Secure Area Checksum, CRC-16 of [[020h]..00007FFFh] 06Eh 2 Secure Area Delay (in 131kHz units) (051Eh=10ms or 0D7Eh=26ms) 070h 4 ARM9 Auto Load List Hook RAM Address (?) ;\endaddr of auto-load 074h 4 ARM7 Auto Load List Hook RAM Address (?) ;/functions 078h 8 Secure Area Disable (by encrypted "NmMdOnly") (usually zero) 080h 4 Total Used ROM size (remaining/unused bytes usually FFh-padded) 084h 4 ROM Header Size (4000h) 088h 28h Reserved (zero filled; except, [88h..93h] used on DSi) 0B0h 10h Reserved (zero filled; or "DoNotZeroFillMem"=unlaunch fastboot) 0C0h 9Ch Nintendo Logo (compressed bitmap, same as in GBA Headers) 15Ch 2 Nintendo Logo Checksum, CRC-16 of [0C0h-15Bh], fixed CF56h 15Eh 2 Header Checksum, CRC-16 of [000h-15Dh] 160h 4 Debug rom_offset (0=none) (8000h and up) ;only if debug 164h 4 Debug size (0=none) (max 3BFE00h) ;version with 168h 4 Debug ram_address (0=none) (2400000h..27BFE00h) ;SIO and 8MB 16Ch 4 Reserved (zero filled) (transferred, and stored, but not used) 170h 90h Reserved (zero filled) (transferred, but not stored in RAM) |
Delay,Cmd |
Cmd,Delay,Cmd ;for 2x repeat Cmd,Delay,Cmd,Cmd,Cmd,Cmd,Cmd,Cmd,Cmd,Cmd ;for 9x repeat |
U Unique Code (usually "A", "B", "C", or special meaning) TT Short Title (eg. "PM" for Pac Man) D Destination/Language (usually "J" or "E" or "P" or specific language) |
A NDS common games B NDS common games C NDS common games D DSi-exclusive games H DSiWare (system utilities and browser) (eg. HNGP=browser) I NDS and DSi-enhanced games with built-in Infrared port K DSiWare (dsiware games and flipnote) (eg. KGUV=flipnote) N NDS nintendo channel demo's japan (NTR-NTRJ-JPN) T NDS many games U NDS utilities, educational games, or uncommon extra hardware? V DSi-enhanced games Y NDS many games |
Usually an abbreviation of the game title (eg. "PM" for "Pac Man") (unless that gamecode was already used for another game, then TT is just random) |
A Asian E English/USA I Italian M Swedish Q Danish U Australian B N/A F French J Japanese N Nor R Russian V EUR+AUS C Chinese G N/A K Korean O Int S Spanish W..Z Europe #3..5 D German H Dutch L USA #2 P Europe T USA+AUS |
DS Cartridge Secure Area |
Value Expl. "encryObj" raw ID before encryption (raw ROM-image) (encrypted) encrypted ID after encryption (encrypted ROM-image) "encryObj" raw ID after decryption (verified by BIOS boot code) E7FFDEFFh,E7FFDEFFh destroyed ID (overwritten by BIOS after verify) |
000h..007h Secure Area ID (see above) 008h..00Dh Fixed (FFh,DEh,FFh,E7h,FFh,DEh) 00Eh..00Fh CRC16 across following 7E0h bytes, ie. [010h..7FFh] 010h..7FDh Unknown/random values, mixed with some THUMB SWI calls 7FEh..7FFh Fixed (00h,00h) |
DS Cartridge Icon/Title |
0000h 2 Version (0001h, 0002h, 0003h, or 0103h) 0002h 2 CRC16 across entries 0020h..083Fh (all versions) 0004h 2 CRC16 across entries 0020h..093Fh (Version 0002h and up) 0006h 2 CRC16 across entries 0020h..0A3Fh (Version 0003h and up) 0008h 2 CRC16 across entries 1240h..23BFh (Version 0103h and up) 000Ah 16h Reserved (zero-filled) 0020h 200h Icon Bitmap (32x32 pix) (4x4 tiles, 4bit depth) (4x8 bytes/tile) 0220h 20h Icon Palette (16 colors, 16bit, range 0000h-7FFFh) (Color 0 is transparent, so the 1st palette entry is ignored) 0240h 100h Title 0 Japanese (128 characters, 16bit Unicode) 0340h 100h Title 1 English ("") 0440h 100h Title 2 French ("") 0540h 100h Title 3 German ("") 0640h 100h Title 4 Italian ("") 0740h 100h Title 5 Spanish ("") 0840h 100h Title 6 Chinese ("") (Version 0002h and up) 0940h 100h Title 7 Korean ("") (Version 0003h and up) 0A40h 800h Zerofilled (probably reserved for Title 8..15) |
1240h 1000h Icon Animation Bitmap 0..7 (200h bytes each, format as above) 2240h 100h Icon Animation Palette 0..7 (20h bytes each, format as above) 2340h 80h Icon Animation Sequence (16bit tokens) |
0840h 1C0h Unused/padding (FFh-filled) in Version 0001h 0940h C0h Unused/padding (FFh-filled) in Version 0002h 23C0h 40h Unused/padding (FFh-filled) in Version 0103h |
0001h = Original 0002h = With Chinese Title 0003h = With Chinese+Korean Titles 0103h = With Chinese+Korean Titles and animated DSi icon |
15 Flip Vertically (0=No, 1=Yes) 14 Flip Horizontally (0=No, 1=Yes) 13-11 Palette Index (0..7) 10-8 Bitmap Index (0..7) 7-0 Frame Duration (01h..FFh) (in 60Hz units) |
0000h 2 Version (0103h) 0002h 6 Reserved (zero-filled) 0008h 2 CRC16 across entries 0020h..119Fh (with initial value FFFFh) 000Ah 16h Reserved (zero-filled) 0020h 1000h Icon Animation Bitmap 0..7 (200h bytes each) ;\same format as 1020h 100h Icon Animation Palette 0..7 (20h bytes each) ; in Icon/Title 1120h 80h Icon Animation Sequence (16bit tokens) ;/ 11A0h 2E60h Garbage (random values, maybe due to eMMC decryption) |
DS Cartridge Protocol |
0000000h-0000FFFh Header (unencrypted) 0001000h-0003FFFh Not read-able (zero filled in ROM-images) 0004000h-0007FFFh Secure Area, 16KBytes (first 2Kbytes with extra encryption) 0008000h-... Main Data Area |
XX00000h XX02FFFh DSi Not read-able (XX00000h=first megabyte after NDS area) XX03000h-XX06FFFh DSi ARM9i Secure Area (usually with modcrypt encryption) XX07000h-... DSi Main Data Area |
Command/Params Expl. Cmd Reply Len -- Unencrypted Load -- 9F00000000000000h Dummy (read HIGH-Z bytes) RAW RAW 2000h 0000000000000000h Get Cartridge Header RAW RAW 200h DSi:1000h 9000000000000000h 1st Get ROM Chip ID RAW RAW 4 00aaaaaaaa000000h Unencrypted Data (debug ver only) RAW RAW 200h 3Ciiijjjxkkkkkxxh Activate KEY1 Encryption Mode RAW RAW 0 -- Secure Area Load -- 4llllmmmnnnkkkkkh Activate KEY2 Encryption Mode KEY1 FIX 910h+0 1lllliiijjjkkkkkh 2nd Get ROM Chip ID KEY1 KEY2 910h+4 xxxxxxxxxxxxxxxxh Invalid - Get KEY2 Stream XOR 00h KEY1 KEY2 910h+... 2bbbbiiijjjkkkkkh Get Secure Area Block (4Kbytes) KEY1 KEY2 910h+10A8h 6lllliiijjjkkkkkh Optional KEY2 Disable KEY1 KEY2 910h+? Alllliiijjjkkkkkh Enter Main Data Mode KEY1 KEY2 910h+0 -- Main Data Load -- B7aaaaaaaa000000h Encrypted Data Read KEY2 KEY2 200h B800000000000000h 3rd Get ROM Chip ID KEY2 KEY2 4 xxxxxxxxxxxxxxxxh Invalid - Get KEY2 Stream XOR 00h KEY2 KEY2 ... B500000000000000h Whatever NAND related? KEY2 KEY2 0 D600000000000000h Whatever NAND related? KEY2 KEY2 4 |
aaaaaaaa 32bit ROM address (command B7 can access only 8000h and up) bbbb Secure Area Block number (0004h..0007h for addr 4000h..7000h) x,xx Random, not used in further commands (DSi: always zero) iii,jjj,llll Random, must be SAME value in further commands kkkkk Random, must be INCREMENTED after FURTHER commands mmm,nnn Random, used as KEY2-encryption seed |
1st byte - Manufacturer (eg. C2h=Macronix) (roughly based on JEDEC IDs) 2nd byte - Chip size (00h..7Fh: (N+1)Mbytes, F0h..FFh: (100h-N)*256Mbytes?) 3rd byte - Flags (see below) 4th byte - Flags (see below) |
0 Maybe Infrared flag? (in case ROM does contain on-chip infrared stuff) 1 Unknown (set in some 3DS carts) 2-7 Zero |
0-2 Zero 3 Seems to be NAND flag (0=ROM, 1=NAND) (observed in only ONE cartridge) 4 3DS Flag (0=NDS/DSi, 1=3DS) 5 Zero ... set in ... DSi-exclusive games? 6 DSi flag (0=NDS/3DS, 1=DSi) 7 Cart Protocol Variant (0=older/smaller carts, 1=newer/bigger carts) |
C2h,07h,00h,00h NDS Macronix 8MB ROM (eg. DS Vision) AEh,0Fh,00h,00h NDS Noname 16MB ROM (eg. Meine Tierarztpraxis) C2h,0Fh,00h,00h NDS Macronix 16MB ROM (eg. Metroid Demo) C2h,1Fh,00h,00h NDS Macronix 32MB ROM (eg. Over the Hedge) C2h,1Fh,00h,40h DSi Macronix 32MB ROM (eg. Art Academy, TWL-VAAV, SystemFlaw) 80h,3Fh,01h,E0h ? 64MB ROM+Infrared (eg. Walk with Me, NTR-IMWP) AEh,3Fh,00h,E0h DSi Noname 64MB ROM (eg. de Blob 2, TWL-VD2V) C2h,3Fh,00h,00h NDS Macronix 64MB ROM (eg. Ultimate Spiderman) C2h,3Fh,00h,40h DSi Macronix 64MB ROM (eg. Crime Lab, NTR-VAOP) 80h,7Fh,00h,80h NDS SanDisk 128MB ROM (DS Zelda, NTR-AZEP-0) 80h,7Fh,01h,E0h ? 128MB ROM+Infrared? (P-letter Soul Silver, IPGE) C2h,7Fh,00h,80h NDS Macronix 128MB ROM (eg. Spirit Tracks, NTR-BKIP) C2h,7Fh,00h,C0h DSi Macronix 128MB ROM (eg. Cooking Coach/TWL-VCKE) ECh,7Fh,00h,88h NDS Samsung 128MB NAND (eg. Warioware D.I.Y.) ECh,7Fh,01h,88h NDS Samsung? 128MB NAND+What? (eg. Jam with the Band, UXBP) ECh,7Fh,00h,E8h DSi Samsung? 128MB NAND (eg. Face Training, USKV) 80h,FFh,80h,E0h NDS 256MB ROM (Kingdom Hearts - Re-Coded, NTR-BK9P) C2h,FFh,01h,C0h DSi Macronix 256MB ROM+Infrared? (eg. P-Letter White) C2h,FFh,00h,80h NDS Macronix 256MB ROM (eg. Band Hero, NTR-BGHP) C2h,FEh,01h,C0h DSi Macronix 512MB ROM+Infrared? (eg. P-Letter White 2) C2h,FEh,00h,90h 3DS Macronix probably 512MB? ROM (eg. Sims 3) 45h,FAh,00h,90h 3DS SunDisk? maybe... 1.5GB? ROM (eg. Starfox) C2h,F8h,00h,90h 3DS Macronix maybe... 2GB? ROM (eg. Kid Icarus) C2h,7Fh,00h,90h 3DS Macronix 128MB ROM CTR-P-AENJ MMinna no Ennichi C2h,FFh,00h,90h 3DS Macronix 256MB ROM CTR-P-AFSJ Pro Yakyuu Famista 2011 C2h,FEh,00h,90h 3DS Macronix 512MB ROM CTR-P-AFAJ Real 3D Bass FishingFishOn C2h,FAh,00h,90h 3DS Macronix 1GB ROM CTR-P-ASUJ Hana to Ikimono Rittai Zukan C2h,FAh,02h,90h 3DS Macronix 1GB ROM CTR-P-AGGW Luigis Mansion 2 ASiA CHT C2h,F8h,00h,90h 3DS Macronix 2GB ROM CTR-P-ACFJ Castlevania - Lords of Shadow C2h,F8h,02h,90h 3DS Macronix 2GB ROM CTR-P-AH4J Monster Hunter 4 AEh,FAh,00h,90h 3DS 1GB ROM CTR-P-AGKJ Gyakuten Saiban 5 AEh,FAh,00h,98h 3DS 1GB NAND CTR-P-EGDJ Tobidase Doubutsu no Mori 45h,FAh,00h,90h 3DS 1GB ROM CTR-P-AFLJ Fantasy Life 45h,F8h,00h,90h 3DS 2GB ROM CTR-P-AVHJ Senran Kagura Burst - Guren C2h,F0h,00h,90h 3DS Macronix 4GB ROM CTR-P-ABRJ Biohazard Revelations FFh,FFh,FFh,FFh None (no cartridge inserted) |
1) Command 2bbbbiiijjjkkkkkh loads ARM9i secure area (instead of ARM9 area) 2) Command B7aaaaaaaa000000h allows to read the 'whole' cartridge space |
1) Chip ID.Bit31=0 Used by older/smaller carts with up to 64MB ROM 2) Chip ID.Bit31=1 Used by newer/bigger carts with 64MB or more ROM |
DS Cartridge Backup |
Type Total Size Page Size Chip/Example Game/Example EEPROM 0.5K bytes 16 bytes ST M95040-W (eg. Metroid Demo) EEPROM 8K bytes 32 bytes ST M95640-W (eg. Super Mario DS) EEPROM 64K bytes 128 bytes ST M95512-W (eg. Downhill Jam) FLASH 256K bytes 256 bytes ST M45PE20 (eg. Skateland) FLASH 256K bytes Sanyo LE25FW203T (eg. Mariokart) FLASH 512K bytes 256 bytes ST M25PE40? (eg. which/any games?) FLASH 512K bytes ST 45PE40V6 (eg. DS Zelda, NTR-AZEP-0) FLASH 1024K bytes ST 45PE80V6 (eg. Spirit Tracks, NTR-BKIP) FLASH 8192K bytes MX25L6445EZNI-10G (Art Academy only, TWL-VAAV) FRAM 8K bytes No limit ? (eg. which/any games?) FRAM 32K bytes No limit Ramtron FM25L256? (eg. which/any games?) |
Type Max Writes per Page Data Retention EEPROM 100,000 40 years FLASH 100,000 20 years FRAM No limit 10 years |
06h WREN Write Enable Cmd, no parameters 04h WRDI Write Disable Cmd, no parameters 05h RDSR Read Status Register Cmd, read repeated status value(s) 01h WRSR Write Status Register Cmd, write one-byte value 9Fh RDID Read JEDEC ID (not supported on EEPROM/FLASH, returns FFh-bytes) |
03h RDLO Read from Memory 000h-0FFh Cmd, addr lsb, read byte(s) 0Bh RDHI Read from Memory 100h-1FFh Cmd, addr lsb, read byte(s) 02h WRLO Write to Memory 000h-0FFh Cmd, addr lsb, write 1..MAX byte(s) 0Ah WRHI Write to Memory 100h-1FFh Cmd, addr lsb, write 1..MAX byte(s) |
03h RD Read from Memory Cmd, addr msb,lsb, read byte(s) 02h WR Write to Memory Cmd, addr msb,lsb, write 1..MAX byte(s) |
0 WIP Write in Progress (1=Busy) (Read only) (always 0 for FRAM chips) 1 WEL Write Enable Latch (1=Enable) (Read only, except by WREN,WRDI) 2-3 WP Write Protect (0=None, 1=Upper quarter, 2=Upper Half, 3=All memory) |
4-7 ONEs Not used (all four bits are always set to "1" each) |
4-6 ZERO Not used (all three bits are always set to "0" each) 7 SRWD Status Register Write Disable (0=Normal, 1=Lock) (Only if /W=LOW) |
RDSR RDID Type (bus-width) FFh, FFh,FFh,FFh None (none) F0h, FFh,FFh,FFh EEPROM (with 8+1bit address bus) 00h, FFh,FFh,FFh EEPROM/FRAM (with 16bit address bus) 00h, xxh,xxh,xxh FLASH (usually with 24bit address bus) |
Pin Name Expl. 1 /S Chip Select 2 Q Data Out 3 /W Write-Protect (not used in NDS, wired to VCC) 4 VSS Ground 5 D Data In 6 C Clock 7 /HOLD Transfer-pause (not used in NDS, wired to VCC) 8 VCC Supply 2.5 to 5.5V for M95xx0-W |
DS Vision (NDS cart with microSD slot... and maybe ALSO with EEPROM?) Warioware D.I.Y. (uses a single NAND FLASH chip for both 'ROM' and 'SAVE') (the warioware chip is marked "SAMSUNG 004, KLC2811ANB-P204, NTR-UORE-0") (the warioware PCB is marked "DI X-7 C17-01") and, a few games are said to have "Flash - 64 Mbit" save memory? |
DS Cartridge I/O Ports |
0-1 SPI Baudrate (0=4MHz/Default, 1=2MHz, 2=1MHz, 3=512KHz) 2-5 Not used (always zero) 6 SPI Hold Chipselect (0=Deselect after transfer, 1=Keep selected) 7 SPI Busy (0=Ready, 1=Busy) (presumably Read-only) 8-12 Not used (always zero) 13 NDS Slot Mode (0=Parallel/ROM, 1=Serial/SPI-Backup) 14 Transfer Ready IRQ (0=Disable, 1=Enable) (for ROM, not for AUXSPI) 15 NDS Slot Enable (0=Disable, 1=Enable) (for both ROM and AUXSPI) |
0-7 Data 8-15 Not used (always zero) |
Bit Expl. 0-12 KEY1 gap1 length (0-1FFFh) (forced min 08F8h by BIOS) (leading gap) 13 KEY2 encrypt data (0=Disable, 1=Enable KEY2 Encryption for Data) 14 "SE" Unknown? (usually same as Bit13) (does NOT affect timing?) 15 KEY2 Apply Seed (0=No change, 1=Apply Encryption Seed) (Write only) 16-21 KEY1 gap2 length (0-3Fh) (forced min 18h by BIOS) (200h-byte gap) 22 KEY2 encrypt cmd (0=Disable, 1=Enable KEY2 Encryption for Commands) 23 Data-Word Status (0=Busy, 1=Ready/DRQ) (Read-only) 24-26 Data Block size (0=None, 1..6=100h SHL (1..6) bytes, 7=4 bytes) 27 Transfer CLK rate (0=6.7MHz=33.51MHz/5, 1=4.2MHz=33.51MHz/8) 28 KEY1 Gap CLKs (0=Hold CLK High during gaps, 1=Output Dummy CLK Pulses) 29 RESB Release Reset (0=Reset, 1=Release) (cannot be cleared once set) 30 "WR" Unknown, maybe data-write? (usually 0) (read/write-able) 31 Block Start/Status (0=Ready, 1=Start/Busy) (IRQ See 40001A0h/Bit14) |
hdr[60h] hdr[64h] hdr[6Eh] 00586000h 001808F8h 051Eh ;older/faster MROM 00416657h 081808F8h 0D7Eh ;newer/slower 1T-ROM ? ? ? ;whatever NAND |
0-7 1st Command Byte (at 40001A8h) (eg. B7h) (MSB) 8-15 2nd Command Byte (at 40001A9h) (eg. addr bit 24-31) 16-23 3rd Command Byte (at 40001AAh) (eg. addr bit 16-23) 24-31 4th Command Byte (at 40001ABh) (eg. addr bit 8-15) (when aligned=even) 32-39 5th Command Byte (at 40001ACh) (eg. addr bit 0-7) (when aligned=00h) 40-47 6th Command Byte (at 40001ADh) (eg. 00h) 48-57 7th Command Byte (at 40001AEh) (eg. 00h) 56-63 8th Command Byte (at 40001AFh) (eg. 00h) (LSB) |
0-7 1st received Data Byte (at 4100010h) 8-15 2nd received Data Byte (at 4100011h) 16-23 3rd received Data Byte (at 4100012h) 24-31 4th received Data Byte (at 4100013h) |
For more info: |
DS Cartridge NitroROM and NitroARC File Systems |
FNT = cart_hdr[040h] ;\origin as defined in ROM cartridge header FAT = cart_hdr[048h] ;/ IMG = 00000000h ;-origin at begin of ROM |
... ... Optional Header (eg. compression header, or RSA signature) 000h 4 Chunk Name "NARC" (Nitro Archive) ;\ 004h 2 Byte Order (FFFEh) ; 006h 2 Version (0100h) ; NARC 008h 4 File Size (from "NARC" ID to end of file) ; Header 00Ch 2 Chunk Size (0010h) ; 00Eh 2 Number of following chunks (0003h) ;/ 010h 4 Chunk Name "BTAF" (File Allocation Table Block) ;\ 014h 4 Chunk Size (including above chunk name) ; File 018h 2 Number of Files ; Allocation 01Ah 2 Reserved (0000h) ; Table 01Ch ... FAT (see below) ;/ ... 4 Chunk Name "BTNF" (File Name Table Block) ;\ ... 4 Chunk Size (including above chunk name) ; File Name ... ... FNT (see below) ; Table ... .. Padding for 4-byte alignment (FFh-filled, if any) ;/ ... 4 Chunk Name "GMIF" (File Image Block) ;\ ... 4 Chunk Size (including above chunk name) ; File Data ... ... IMG (File Data) ;/ |
Addr Size Expl. 00h 4 Start address (originated at IMG base) (0=Unused Entry) 04h 4 End address (Start+Len...-1?) (0=Unused Entry) |
Addr Size Expl. 00h 4 Offset to Sub-table (originated at FNT base) 04h 2 ID of first file in Sub-table (0000h..EFFFh) |
06h 2 Total Number of directories (1..4096) |
06h 2 ID of parent directory (F000h..FFFEh) |
Addr Size Expl. 00h 1 Type/Length 01h..7Fh File Entry (Length=1..127, without ID field) 81h..FFh Sub-Directory Entry (Length=1..127, plus ID field) 00h End of Sub-Table 80h Reserved 01h LEN File or Sub-Directory Name, case-sensitive, without any ending zero, ASCII 20h..7Eh, except for characters \/?"<>*:;| |
LEN+1 2 Sub-Directory ID (F001h..FFFFh) ;see FNT+(ID AND FFFh)*8 |
Addr Size Expl. 00h 4 Overlay ID 04h 4 RAM Address ;Point at which to load 08h 4 RAM Size ;Amount to load 0Ch 4 BSS Size ;Size of BSS data region 10h 4 Static initialiser start address 14h 4 Static initialiser end address 18h 4 File ID (0000h..EFFFh) 1Ch 4 Reserved (zero) |
DS Cartridge PassMe/PassThrough |
Addr Siz Patch 004h 4 E59FF018h ;opcode LDR PC,[027FFE24h] at 27FFE04h 01Fh 1 04h ;set autostart bit 022h 1 01h ;set ARM9 rom offset to nn01nnnnh (above secure area) 024h 4 027FFE04h ;patch ARM9 entry address to endless loop 034h 4 080000C0h ;patch ARM7 entry address in GBA slot 15Eh 2 nnnnh ;adjust header crc16 |
0A0h GBA-style Title ("DSBooter") 0ACh GBA-style Gamecode ("PASS") 0C0h ARM7 Entrypoint (32bit ARM code) |
DS Cartridge GBA Slot |
NDS: Normal 32pin slot DS Lite: Short 32pin slot (GBA cards stick out) DSi: N/A (dropped support for GBA carts, and for DS-expansions) |
DS Cart Rumble Pak |
VCC, GND, /WR, AD1, and IRQ (grounded) |
for i=0 to 0FFFh if halfword[8000000h+i*2]<>(i and FFFDh) then <not_a_ds_rumble_pak> next i |
rumble_state = rumble_state xor 0002h halfword[8000000h]=rumble_state |
DS Cart Slider with Rumble |
00h Product_ID (R) (03h) 01h Revision_ID (R) (10h=Rev. 1.0) (20h=Used in DS-option-pak) 02h Motion/Status Flags (R) 03h Delta_X (R) (signed 8bit) (automatically reset to 00h after reading) 04h Delta_Y (R) (signed 8bit) (automatically reset to 00h after reading) 05h SQUAL (R) (surface quality) (unsigned 8bit) 06h Average_Pixel (R) (unsigned 6bit, upper 2bit unused) 07h Maximum_Pixel (R) (unsigned 6bit, upper 2bit unused) 08h Reserved 09h Reserved 0Ah Configuration_bits (R/W) 0Bh Reserved 0Ch Data_Out_Lower (R) 0Dh Data_Out_Upper (R) 0Eh Shutter_Lower (R) 0Fh Shutter_Upper (R) 10h Frame_Period_Lower (R/W) 11h Frame_Period_Upper (R/W) |
7 Motion since last report or PD (0=None, 1=Motion occurred) 6 Reserved 5 LED Fault detected (0=No fault, 1=Fault detected) 4 Delta Y Overflow (0=No overflow, 1=Overflow occured) 3 Delta X Overflow (0=No overflow, 1=Overflow occured) 2 Reserved 1 Reserved 0 Resolution in counts per inch (0=400, 1=800) |
7 Reset Power up defaults (W) (0=No, 1=Reset) 6 LED Shutter Mode (0=LED always on, 1=LED only on when shutter is open) 5 Self Test (W) (0=No, 1=Perform all self tests) 4 Resolution in counts per inch (0=400, 1=800) 3 Dump 16x16 Pixel bitmap (0=No, 1=Dump via Data_Out ports) 2 Reserved 1 Reserved 0 Sleep Mode (0=Normal/Sleep after 1 second, 1=Always awake) _______ |74273 | /WR -----------------> |CLK | _____ AD1/SIO CLK ---------> |D1 Q1|--------------> CLK |74125| AD2 power control ---> |D2 Q2|---> ____ | | AD3/SIO DIR ---------> |D3 Q3|------+-|7400\________|/EN | AD8 rumble on/off ---> |D? Q?|---> +-|____/ | | AD0/SIO DTA ----+----> |D5 Q5|----------------------|A Y|--+--DTA | |_______| |- - -| | ____ +-------------------------------------|Y A|--+ /RD ---|7400\______ ____ | | /RD ---|____/ |7400\_____________________________|/EN | A19 _______________|____/ |_____| |
DS Cart Expansion RAM |
Opera (8MB RAM) (official RAM expansion for Opera browser) EZ3/4/3-in-1 (8-16MB RAM, plus FLASH, plus rumble) Supercard (32MB) M3 (32MB) G6 (32MB) |
base=9000000h, size=800000h (8MB) unlock=1, lock=0 STRH [8240000h],lock/unlock |
base=8400000h, size=VAR (8MB..16MB) locking/unlocking/detection see below |
base=8000000h, size=1FFFFFEh (32MB minus last two bytes?) unlock=5 (RAM_RW), lock=3 (MEDIA) STRH [9FFFFFEh],A55Ah STRH [9FFFFFEh],A55Ah STRH [9FFFFFEh],lock/unlock STRH [9FFFFFEh],lock/unlock |
base=8000000h, size=2000000h (32MB) unlock=00400006h, lock=00400003h LDRH Rd,[8E00002h] LDRH Rd,[800000Eh] LDRH Rd,[8801FFCh] LDRH Rd,[800104Ah] LDRH Rd,[8800612h] LDRH Rd,[8000000h] LDRH Rd,[8801B66h] LDRH Rd,[8000000h+(lock/unlock)*2] LDRH Rd,[800080Eh] LDRH Rd,[8000000h] LDRH Rd,[80001E4h] LDRH Rd,[80001E4h] LDRH Rd,[8000188h] LDRH Rd,[8000188h] |
base=8000000h, size=2000000h (32MB) unlock=6, lock=3 LDRH Rd,[9000000h] LDRH Rd,[9FFFFE0h] LDRH Rd,[9FFFFECh] LDRH Rd,[9FFFFECh] LDRH Rd,[9FFFFECh] LDRH Rd,[9FFFFFCh] LDRH Rd,[9FFFFFCh] LDRH Rd,[9FFFFFCh] LDRH Rd,[9FFFF4Ah] LDRH Rd,[9FFFF4Ah] LDRH Rd,[9FFFF4Ah] LDRH Rd,[9200000h+(lock/unlock)*2] LDRH Rd,[9FFFFF0h] LDRH Rd,[9FFFFE8h] |
ez_ram_test: ;Based on DSLinux Amadeus' detection ez_subfunc(9880000h,8000h) ;-SetRompage (OS mode) ez_subfunc(9C40000h,1500h) ;-OpenNorWrite [08400000h]=1234h ;\ if [08400000h]=1234h ; test writability at 8400000h [8000000h]=4321h ; and non-writability at 8000000h if [8000000h]<>4321h ; return true ;/ ez_subfunc(9C40000h,D200h) ;CloseNorWrite ez_subfunc(9880000h,0160h) ;SetRompage (0160h) ez_subfunc(9C40000h,1500h) ;OpenNorWrite [8400000h]=1234h ;\ if [8400000h]=1234h ; test writability at 8400000h return true ;/ return false ;-failed ez_subfunc(addr,data): STRH [9FE0000h],D200h STRH [8000000h],1500h STRH [8020000h],D200h STRH [8040000h],1500h STRH [addr],data STRH [9FC0000h],1500h |
DS Cart Unknown Extras |
DS Cart Cheat Action Replay DS |
ABCD-NNNNNNNN Game ID ;ASCII Gamecode [00Ch] and CRC32 across [0..1FFh] 00000000 XXXXXXXX manual hook codes (rarely used) (default is auto hook) 0XXXXXXX YYYYYYYY word[XXXXXXX+offset] = YYYYYYYY 1XXXXXXX 0000YYYY half[XXXXXXX+offset] = YYYY 2XXXXXXX 000000YY byte[XXXXXXX+offset] = YY 3XXXXXXX YYYYYYYY IF YYYYYYYY > word[XXXXXXX] ;unsigned ;\ 4XXXXXXX YYYYYYYY IF YYYYYYYY < word[XXXXXXX] ;unsigned ; for v1.54, 5XXXXXXX YYYYYYYY IF YYYYYYYY = word[XXXXXXX] ; when X=0, 6XXXXXXX YYYYYYYY IF YYYYYYYY <> word[XXXXXXX] ; uses 7XXXXXXX ZZZZYYYY IF YYYY > ((not ZZZZ) AND half[XXXXXXX]) ; [offset] 8XXXXXXX ZZZZYYYY IF YYYY < ((not ZZZZ) AND half[XXXXXXX]) ; instead of 9XXXXXXX ZZZZYYYY IF YYYY = ((not ZZZZ) AND half[XXXXXXX]) ; [XXXXXXX] AXXXXXXX ZZZZYYYY IF YYYY <> ((not ZZZZ) AND half[XXXXXXX]) ;/ BXXXXXXX 00000000 offset = word[XXXXXXX+offset] C0000000 YYYYYYYY FOR loopcount=0 to YYYYYYYY ;execute Y+1 times C4000000 00000000 offset = address of the C4000000 code ;v1.54 C5000000 XXXXYYYY counter=counter+1, IF (counter AND YYYY) = XXXX ;v1.54 C6000000 XXXXXXXX [XXXXXXXX]=offset ;v1.54 D0000000 00000000 ENDIF D1000000 00000000 NEXT loopcount D2000000 00000000 NEXT loopcount, and then FLUSH everything D3000000 XXXXXXXX offset = XXXXXXXX D4000000 XXXXXXXX datareg = datareg + XXXXXXXX D5000000 XXXXXXXX datareg = XXXXXXXX D6000000 XXXXXXXX word[XXXXXXXX+offset]=datareg, offset=offset+4 D7000000 XXXXXXXX half[XXXXXXXX+offset]=datareg, offset=offset+2 D8000000 XXXXXXXX byte[XXXXXXXX+offset]=datareg, offset=offset+1 D9000000 XXXXXXXX datareg = word[XXXXXXXX+offset] DA000000 XXXXXXXX datareg = half[XXXXXXXX+offset] DB000000 XXXXXXXX datareg = byte[XXXXXXXX+offset] ;bugged on pre-v1.54 DC000000 XXXXXXXX offset = offset + XXXXXXXX EXXXXXXX YYYYYYYY Copy YYYYYYYY parameter bytes to [XXXXXXXX+offset...] 44332211 88776655 parameter bytes 1..8 for above code (example) 0000AA99 00000000 parameter bytes 9..10 for above code (padded with 00s) FXXXXXXX YYYYYYYY Copy YYYYYYYY bytes from [offset..] to [XXXXXXX...] |
1st: Address used prior to launching game (eg. 23xxxxxh) 2nd: Address to write the hook at (inside the ARM7 executable) 3rd: Hook final address (huh?) 4th: Hook mode selection (0=auto, 1=mode1, 2=mode2) 5th: Opcode that replaces the hooked one (eg. E51DE004h) 6th: Address to store important stuff (default 23FE000h) 7th: Address to store the code handler (default 23FE074h) 8th: Address to store the code list (default 23FE564h) 9th: Must be 1 (00000001h) |
DS Cart Cheat Codebreaker DS |
---Initialization--- 0000CR16 GAMECODE Specify Game ID, use Encrypted codes 8000CR16 GAMECODE Specify Game ID, use Unencrypted codes BEEFC0DE XXXXXXXX Change Encryption Keys A0XXXXXX YYYYYYYY Bootup-Hook 1, X=Address, Y=Value A8XXXXXX YYYYYYYY Bootup-Hook 2, X=Address, Y=Value F0XXXXXX TYYYYYYY Code-Hook 1 (T=Type,Y=CheatEngineAddr,X=HookAddr) F8XXXXXX TPPPPPPP Code-Hook 2 (T=Type,X=CheatEngineHookAddr,P=Params) ---General codes--- 00XXXXXX 000000YY [X]=YY 10XXXXXX 0000YYYY [X]=YYYY 20XXXXXX YYYYYYYY [X]=YYYYYYYY 60XXXXXX 000000YY ZZZZZZZZ 00000000 [[X]+Z]=YY 60XXXXXX 0000YYYY ZZZZZZZZ 10000000 [[X]+Z]=YYYY 60XXXXXX YYYYYYYY ZZZZZZZZ 20000000 [[X]+Z]=YYYYYYYY 30XXXXXX 000000YY [X]=[X] + YY 30XXXXXX 0001YYYY [X]=[X] + YYYY 38XXXXXX YYYYYYYY [X]=[X] + YYYYYYYY 70XXXXXX 000000YY [X]=[X] OR YY 70XXXXXX 001000YY [X]=[X] AND YY 70XXXXXX 002000YY [X]=[X] XOR YY 70XXXXXX 0001YYYY [X]=[X] OR YYYY 70XXXXXX 0011YYYY [X]=[X] AND YYYY 70XXXXXX 0021YYYY [X]=[X] XOR YYYY ---Memory fill/copy--- 40XXXXXX 2NUMSTEP 000000YY 000000ZZ byte[X+(0..NUM-1)*STEP*1]=Y+(0..NUM-1)*Z 40XXXXXX 1NUMSTEP 0000YYYY 0000ZZZZ half[X+(0..NUM-1)*STEP*2]=Y+(0..NUM-1)*Z 40XXXXXX 0NUMSTEP YYYYYYYY ZZZZZZZZ word[X+(0..NUM-1)*STEP*4]=Y+(0..NUM-1)*Z 50XXXXXX YYYYYYYY ZZZZZZZZ 00000000 copy Y bytes from [X] to [Z] ---Conditional codes (bugged)--- 60XXXXXX 000000YY ZZZZZZZZ 01c100VV IF [[X]+Z] .. VV THEN [[X]+Z]=YY 60XXXXXX 000000YY ZZZZZZZZ 01c0VVVV IF [[X]+Z] .. VVVV THEN [[X]+Z]=YY 60XXXXXX 0000YYYY ZZZZZZZZ 11c100VV IF [[X]+Z] .. VV THEN [[X]+Z]=YYYY 60XXXXXX 0000YYYY ZZZZZZZZ 11c0VVVV IF [[X]+Z] .. VVVV THEN [[X]+Z]=YYYY 60XXXXXX YYYYYYYY ZZZZZZZZ 21c100VV IF [[X]+Z] .. VV THEN [[X]+Z]=YYYYYYYY 60XXXXXX YYYYYYYY ZZZZZZZZ 21c0VVVV IF [[X]+Z] .. VVVV THEN [[X]+Z]=YYYYYYYY ---Conditional codes (working)--- D0XXXXXX NNc100YY IF [X] .. YY THEN exec max(1,NN) lines D0XXXXXX NNc0YYYY IF [X] .. YYYY THEN exec max(1,NN) lines |
0 IF [mem] = imm THEN ... 4 IF ([mem] AND imm) = 0 THEN ... 1 IF [mem] <> imm THEN ... 5 IF ([mem] AND imm) <> 0 THEN ... 2 IF [mem] < imm THEN ... (unsigned) 6 IF ([mem] AND imm) = imm THEN ... 3 IF [mem] > imm THEN ... (unsigned) 7 IF ([mem] AND imm) <> imm THEN ... |
GAMECODE Cartridge Header[00Ch] (32bit in reversed byte-order) CR16 Cartridge Header[15Eh] (16bit in normal byte-order) XXXXXX 27bit addr (actually 7 digits, XXXXXXX, overlaps 5bit code number) |
for i=4Fh to 00h y=77628ECFh if i>13h then y=59E5DC8Ah if i>27h then y=054A7818h if i>3Bh then y=B1BF0855h address = (Key0-value) xor address value = value - Key1 - (address ror 1Bh) address = (address xor (value + y)) ror 13h if (i>13h) then if (i<=27h) or (i>3Bh) then x=Key2 xor Key1 xor Key0 else x=((Key2 xor Key1) and Key0) xor (Key1 and Key2) value=value xor (x+y+address) x = Secure[((i*4+00h) and FCh)+000h] x = Secure[((i*4+34h) and FCh)+100h] xor x x = Secure[((i*4+20h) and FCh)+200h] xor x x = Secure[((i*4+08h) and FCh)+300h] xor x address = address - (x ror 19h) next i |
Secure[0..7FFh] = Copy of the ENCRYPTED 1st 2Kbytes of the game's Secure Area Key0 = 0C2EAB3Eh, Key1 = E2AE295Dh, Key2 = E1ACC3FFh, Key3 = 70D3AF46h scramble_keys |
Key0 = Key0 + (XXXXXXXX ror 1Dh) Key1 = Key1 - (XXXXXXXX ror 05h) Key2 = Key2 xor (Key3 xor Key0) Key3 = Key3 xor (Key2 - Key1) scramble_keys |
for i=0 to FFh y = byte(xlat_table[i]) Secure[i*4+000h] = (Secure[i*4+000h] xor Secure[y*4]) + Secure[y*4+100h] Secure[i*4+400h] = (Secure[i*4+400h] xor Secure[y*4]) - Secure[y*4+200h] next i for i=0 to 63h Key0 = Key0 xor (Secure[i*4] + Secure[i*4+190h]) Key1 = Key1 xor (Secure[i*4] + Secure[i*4+320h]) Key2 = Key2 xor (Secure[i*4] + Secure[i*4+4B0h]) Key3 = Key3 xor (Secure[i*4] + Secure[i*4+640h]) next i Key0 = Key0 - Secure[7D0h] Key1 = Key1 xor Secure[7E0h] Key2 = Key2 + Secure[7F0h] Key3 = Key3 xor Secure[7D0h] xor Secure[7F0h] |
34h,59h,00h,32h,7Bh,D3h,32h,C9h,9Bh,77h,75h,44h,E0h,73h,46h,06h 0Bh,88h,B3h,3Eh,ACh,F2h,BAh,FBh,2Bh,56h,FEh,7Ah,90h,F7h,8Dh,BCh 8Bh,86h,9Ch,89h,00h,19h,CDh,4Ch,54h,30h,01h,93h,30h,01h,FCh,36h 4Dh,9Fh,FDh,D7h,32h,94h,AEh,BCh,2Bh,61h,DFh,B3h,44h,EAh,8Bh,A3h 2Bh,53h,33h,54h,42h,27h,21h,DFh,A9h,DDh,C0h,35h,58h,EFh,8Bh,33h B4h,D3h,1Bh,C7h,93h,AEh,32h,30h,F1h,CDh,A8h,8Ah,47h,8Ch,70h,0Ch 17h,4Eh,0Eh,A2h,85h,0Dh,6Eh,37h,4Ch,39h,1Fh,44h,98h,26h,D8h,A1h B6h,54h,F3h,AFh,98h,83h,74h,0Eh,13h,6Eh,F4h,F7h,86h,80h,ECh,8Eh EEh,4Ah,05h,A1h,F1h,EAh,B4h,D6h,B8h,65h,8Ah,39h,B3h,59h,11h,20h B6h,BBh,4Dh,88h,68h,24h,12h,9Bh,59h,38h,06h,FAh,15h,1Dh,40h,F0h 01h,77h,57h,F5h,5Dh,76h,E5h,F1h,51h,7Dh,B4h,FAh,7Eh,D6h,32h,4Fh 0Eh,C8h,61h,C1h,EEh,FBh,2Ah,FCh,ABh,EAh,97h,D5h,5Dh,E8h,FAh,2Ch 06h,CCh,86h,D2h,8Ch,10h,D7h,4Ah,CEh,8Fh,EBh,03h,16h,ADh,84h,98h F5h,88h,2Ah,18h,ACh,7Fh,F6h,94h,FBh,3Fh,00h,B6h,32h,A2h,ABh,28h 64h,5Ch,0Fh,C6h,23h,12h,0Ch,D2h,BAh,4Dh,A3h,F2h,C9h,86h,31h,57h 0Eh,F8h,ECh,E1h,A0h,9Ah,3Ch,65h,17h,18h,A0h,81h,D0h,DBh,D5h,AEh |
DS Cart DLDI Driver |
00h 4 DLDI ID (EDh,A5h,8Dh,BFh) (aka BF8DA5EDh) ;\patching tools will 04h 8 DLDI String (20h,"Chishm",00h) ; refuse any other 0Ch 1 DLDI Version (01h in .dldi, don't care in .nds) ;/values 0Dh 1 Size of .dldi+BSS (rounded up to 1 SHL N bytes) (max 0Fh=32Kbytes) 0Eh 1 Sections to fix/destroy (see FIX_xxx) 0Fh 1 Space in .nds file (1 SHL N) (0Eh..0Fh in .nds, can be 0 in .dldi) 10h 48 ASCII Full Driver Name (max 47 chars, plus zero padding) 40h 4 Address of ALL start (text) ;-base address (BF800000h in .dldi) 44h 4 Address of ALL end (data) ;-for highly-unstable FIX_ALL addr.adjusts 48h 4 Address of GLUE start ;\for semi-stable FIX_GLUE addr.adjusts 4Ch 4 Address of GLUE end ;/ ("Interworking glue" for ARM-vs-THUMB) 50h 4 Address of GOT start ;\for semi-stable FIX_GOT addr.adjusts 54h 4 Address of GOT end ;/ ("Global Offset Table") 58h 4 Address of BSS start ;\for zerofilling "BSS" via FIX_BSS 5Ch 4 Address of BSS end ;/ ("Block Started by Symbol") 60h 4 ASCII Short Driver/Device Name (4 chars, eg. "MYHW" for MyHardware) 64h 4 Flags 2 (see FEATURE_xxx) (usually 13h=GbaSlot, or 23h=NdsSlot) 68h 4 Address of Function startup() ;<-- must be at offset +80h !! ;\ 6Ch 4 Address of Function isInserted() ;out: 0=no/fail, 1=yes/okay ; all 70h 4 Address of Function readSectors(sector,numSectors,buf) ; return 74h 4 Address of Function writeSectors(sector,numSectors,buf) ; 0=fail, 78h 4 Address of Function clearStatus() ; 1=okay 7Ch 4 Address of Function shutdown() ;/ 80h .. Driver Code (can/must begin with "startup()") ;\max 7F80h .. .. Glue section (usually a small snippet within above code) ; bytes (when .. .. GOT section (usually after above code) (pointer table) ; having 32K .. .. BSS section (usually at end, may exceed .dldi filesize) ; allocated) .. .. Optional two garbage NOPs at end of default.dldi ;/ |
0 FIX_ALL ;-installer uses highly-unstable guessing in whole dldi file 1 FIX_GLUE ;-installer uses semi-stable address guessing in GLUE area 2 FIX_GOT ;-installer uses semi-stable address guessing in GOT area 3 FIX_BSS ;-installer will zerofill BSS area 4-7 Reserved (0) |
0 FEATURE_MEDIUM_CANREAD 00000001h (usually set) 1 FEATURE_MEDIUM_CANWRITE 00000002h (a few carts can't write) 2-3 Reserved (0) 4 FEATURE_SLOT_GBA 00000010h (need EXMEMCNT bit7 adjusted) 5 FEATURE_SLOT_NDS 00000020h (need EXMEMCNT bit11 adjusted) 6-31 Reserved (0) |
dldi area should be located at a 40h-byte aligned address in ROM image. dldi area should be located in ARM9 (or ARM7) bootcode area. |
dldi[00h..0Bh] must contain DLDI ID word/string dldi[0Fh] must contain allocated size (0Eh=16Kbyte or 0Fh=32Kbyte) dldi[40h..43h] must contain RAM base address of DLDI block and other entries should contain valid dummy strings and dummy functions. |
dldi[0Fh] must be kept as in the old .nds file (not as in .dldi file) |
DS Cart DLDI Driver - Guessed Address-Adjustments |
DS Encryption by Gamecode/Idcode (KEY1) |
NDS.ARM7 ROM: 00000030h..00001077h (values 99 D5 20 5F ..) Blowfish/NDS-mode DSi.ARM9 ROM: FFFF99A0h..FFFFA9E7h (values 99 D5 20 5F ..) "" DSi.TCM Copy: 01FFC894h..01FFD8DBh (values 99 D5 20 5F ..) "" DSi.ARM7 ROM: 0000C6D0h..0000D717h (values 59 AA 56 8E ..) Blowfish/DSi-mode DSi.RAM Copy: 03FFC654h..03FFD69Bh (values 59 AA 56 8E ..) "" DSi.Debug: (stored in launcher) (values 69 63 52 05 ..) Blowfish/DSi-debug |
Y=[ptr+0] X=[ptr+4] FOR I=0 TO 0Fh (encrypt), or FOR I=11h TO 02h (decrypt) Z=[keybuf+I*4] XOR X X=[keybuf+048h+((Z SHR 24) AND FFh)*4] X=[keybuf+448h+((Z SHR 16) AND FFh)*4] + X X=[keybuf+848h+((Z SHR 8) AND FFh)*4] XOR X X=[keybuf+C48h+((Z SHR 0) AND FFh)*4] + X X=Y XOR X Y=Z NEXT I [ptr+0]=X XOR [keybuf+40h] (encrypt), or [ptr+0]=X XOR [keybuf+4h] (decrypt) [ptr+4]=Y XOR [keybuf+44h] (encrypt), or [ptr+4]=Y XOR [keybuf+0h] (decrypt) |
encrypt_64bit(keycode+4) encrypt_64bit(keycode+0) [scratch]=0000000000000000h ;S=0 (64bit) FOR I=0 TO 44h STEP 4 ;xor with reversed byte-order (bswap) [keybuf+I]=[keybuf+I] XOR bswap_32bit([keycode+(I MOD modulo)]) NEXT I FOR I=0 TO 1040h STEP 8 encrypt_64bit(scratch) ;encrypt S (64bit) by keybuf [keybuf+I+0]=[scratch+4] ;write S to keybuf (first upper 32bit) [keybuf+I+4]=[scratch+0] ;write S to keybuf (then lower 32bit) NEXT I |
if key=nds then copy [nds_arm7bios+0030h..1077h] to [keybuf+0..1047h] if key=dsi then copy [dsi_arm7bios+C6D0h..D717h] to [keybuf+0..1047h] [keycode+0]=[idcode] [keycode+4]=[idcode]/2 [keycode+8]=[idcode]*2 IF level>=1 THEN apply_keycode(modulo) ;first apply (always) IF level>=2 THEN apply_keycode(modulo) ;second apply (optional) [keycode+4]=[keycode+4]*2 [keycode+8]=[keycode+8]/2 IF level>=3 THEN apply_keycode(modulo) ;third apply (optional) |
init_keycode(firmware_header+08h,1,0Ch,nds) ;idcode (usually "MACP"), level 1 decrypt_64bit(firmware_header+18h) ;rominfo init_keycode(firmware_header+08h,2,0Ch,nds) ;idcode (usually "MACP"), level 2 decrypt ARM9 and ARM7 bootcode by decrypt_64bit (each 8 bytes) decompress ARM9 and ARM7 bootcode by LZ77 function (swi) calc CRC16 on decrypted/decompressed ARM9 bootcode followed by ARM7 bootcode |
init_keycode(cart_header+0Ch,1,08h,nds) ;gamecode, level 1, modulo 8 decrypt_64bit(cart_header+78h) ;rominfo (secure area disable) init_keycode(cart_header+0Ch,2,08h,nds) ;gamecode, level 2, modulo 8 encrypt_64bit all NDS KEY1 commands (1st command byte in MSB of 64bit value) after loading the secure_area, calculate secure_area crc, then decrypt_64bit(secure_area+0) ;first 8 bytes of secure area init_keycode(cart_header+0Ch,3,08h,nds) ;gamecode, level 3, modulo 8 decrypt_64bit(secure_area+0..7F8h) ;each 8 bytes in first 2K of secure init_keycode(cart_header+0Ch,1,08h,dsi) ;gamecode, level 1, modulo 8 encrypt_64bit all DSi KEY1 commands (1st command byte in MSB of 64bit value) |
DS Encryption by Random Seed (KEY2) |
Seed0 = 58C56DE0E8h Seed1 = 5C879B9B05h |
Seed0 = (mmmnnn SHL 15)+6000h+Seedbyte Seed1 = 5C879B9B05h |
x = reversed_bit_order(seed0) ;ie. LSB(bit0) exchanged with MSB(bit38), etc. y = reversed_bit_order(seed1) |
x = (((x shr 5)xor(x shr 17)xor(x shr 18)xor(x shr 31)) and 0FFh)+(x shl 8) y = (((y shr 5)xor(y shr 23)xor(y shr 18)xor(y shr 31)) and 0FFh)+(y shl 8) data = (data xor x xor y) and 0FFh |
DS Firmware Serial Flash Memory |
ID 20h,40h,12h - ST M45PE20 - 256 KBytes (Nintendo DS) (in my old DS) ID 20h,50h,12h - ST M35PE20 - 256 KBytes (Nintendo DS) (in my DS-Lite) ID 20h,80h,13h - ST M25PE40 - 512 KBytes (iQue DS, with chinese charset) ID 20h,40h,11h - ST 45PE10V6 - 128 Kbytes (Nintendo DSi) (in my DSi) ID 20h,40h,13h - ST 45PE40V6 - 512 KBytes (DS Zelda, NTR-AZEP-0) ID 20h,40h,14h - ST 45PE80V6 - 1024 Kbytes (eg. Spirit Tracks, NTR-BKIP) +ID 62h,11h,00h - Sanyo ? - 512 Kbytes (P-Letter Diamond, ADAE) ID 62h,16h,00h - Sanyo LE25FW203T - 256 KBytes (Mariokart backup) +ID 62h,26h,11h - Sanyo ? - ? Kbytes (3DS: CTR-P-AXXJ) +ID 62h,26h,13h - Sanyo ? - ? Kbytes (3DS: CTR-P-APDJ) ID C2h,22h,11h - Macronix MX25L1021E? 128 Kbytes (eg. 3DS Starfox) ID C2h,22h,13h - Macronix ...? 512 Kbytes (eg. 3DS Kid Icarus, 3DS Sims 3) ID C2h,20h,17h - Macronix MX25L6445EZNI-10G 8192 Kbytes (DSi Art Academy) ID 01h,F0h,00h - Garbage/Infrared on SPI-bus? (eg. P-Letter White) ID 03h,F8h,00h - Garbage/Infrared on SPI-bus? (eg. P-Letter White 2) |
06h WREN Write Enable (No Parameters) 04h WRDI Write Disable (No Parameters) 9Fh RDID Read JEDEC Identification (Read 1..3 ID Bytes) (Manufacturer, Device Type, Capacity) 05h RDSR Read Status Register (Read Status Register, endless repeated) Bit7-2 Not used (zero) Bit1 WEL Write Enable Latch (0=No, 1=Enable) Bit0 WIP Write/Program/Erase in Progess (0=No, 1=Busy) 03h READ Read Data Bytes (Write 3-Byte-Address, read endless data stream) 0Bh FAST Read Data Bytes at Higher Speed (Write 3-Byte-Address, write 1 dummy-byte, read endless data stream) (max 25Mbit/s) 0Ah PW Page Write (Write 3-Byte-Address, write 1..256 data bytes) (changing bits to 0 or 1) (reads unchanged data, erases the page, then writes new & unchanged data) (11ms typ, 25ms max) 02h PP Page Program (Write 3-Byte-Address, write 1..256 data bytes) (changing bits from 1 to 0) (1.2ms typ, 5ms max) DBh PE Page Erase 100h bytes (Write 3-Byte-Address) (10ms typ, 20ms max) D8h SE Sector Erase 10000h bytes (Write 3-Byte-Address) (1s typ, 5s max) B9h DP Deep Power-down (No Parameters) (consumption 1uA typ, 10uA max) (3us) (ignores all further instructions, except RDP) ABh RDP Release from Deep Power-down (No Parameters) (30us) |
Set Chip Select LOW to invoke the command Transmit the instruction byte Transmit any parameter bytes Transmit/receive any data bytes Set Chip Select HIGH to finish the command |
1 D Serial Data In (latched at rising clock edge) _________ 2 C Serial Clock (max 25MHz) /|o | 3 /RES Reset 1 -| | |- 8 4 /S Chip Select (instructions start at falling edge) 2 -| | |- 7 5 /W Write Protect (makes first 256 pages read-only) 3 -| |_________|- 6 6 VCC Supply (2.7V..3.6V typ) (4V max) (DS:VDD3.3) 4 -|/ |- 5 7 VSS Ground |___________| 8 Q Serial Data Out (changes at falling clock edge) |
DS Firmware Header |
00000h-00029h Firmware Header 0002Ah-001FFh Wifi Settings 00200h-3F9FFh Firmware Code/Data ;-NDS only (not DSi) 00200h-002FEh 00h-filled ;\ 002FFh 80h ; 00300h-1F3FEh FFh-filled ; DSi only (not NDS) 1F3FFh Whatever Bootflags ; 1F400h-1F5FFh Wifi Access Point 4 ; 1F600h-1F7FFh Wifi Access Point 5 ; 1F800h-1F9FFh Wifi Access Point 6 ;/ 3FA00h-3FAFFh Wifi Access Point 1 3FB00h-3FBFFh Wifi Access Point 2 3FC00h-3FCFFh Wifi Access Point 3 3FD00h-3FDFFh Not used 3FE00h-3FEFFh User Settings Area 1 3FF00h-3FFFFh User Settings Area 2 |
Addr Size Expl. 000h 2 part3 romaddr/8 (arm9 gui code) (LZ/huffman compression) 002h 2 part4 romaddr/8 (arm7 wifi code) (LZ/huffman compression) 004h 2 part3/4 CRC16 arm9/7 gui/wifi code 006h 2 part1/2 CRC16 arm9/7 boot code 008h 4 firmware identifier (usually nintendo "MAC",nn) (or nocash "XBOO") the 4th byte (nn) occassionally changes in different versions 00Ch 2 part1 arm9 boot code romaddr/2^(2+shift1) (LZSS compressed) 00Eh 2 part1 arm9 boot code 2800000h-ramaddr/2^(2+shift2) 010h 2 part2 arm7 boot code romaddr/2^(2+shift3) (LZSS compressed) 012h 2 part2 arm7 boot code 3810000h-ramaddr/2^(2+shift4) 014h 2 shift amounts, bit0-2=shift1, bit3-5=shift2, bit6-8=shift3, bit9-11=shift4, bit12-15=firmware_chipsize/128K 016h 2 part5 data/gfx romaddr/8 (LZ/huffman compression) 018h 8 Optional KEY1-encrypted "enPngOFF"=Cartridge KEY2 Disable (feature isn't used in any consoles, instead contains timestamp) 018h 5 Firmware version built timestamp (BCD minute,hour,day,month,year) 01Dh 1 Console type FFh=Nintendo DS 20h=Nintendo DS-lite 57h=Nintendo DSi 43h=iQueDS 63h=iQueDS-lite The entry was unused (FFh) in older NDS, ie. replace FFh by 00h) Bit0 seems to be DSi/iQue related Bit1 seems to be DSi/iQue related Bit2 seems to be DSi related Bit3 zero Bit4 seems to be DSi related Bit5 seems to be DS-Lite related Bit6 indicates presence of "extended" user settings (DSi/iQue) Bit7 zero 01Eh 2 Unused (FFh-filled) 020h 2 User Settings Offset (div8) (usually last 200h flash bytes) 022h 2 Unknown (7EC0h or 0B51h) 024h 2 Unknown (7E40h or 0DB3h) 026h 2 part5 CRC16 data/gfx 028h 2 unused (FFh-filled) 02Ah-1FFh Wifi Calibration Data (see next chapter) |
000h 1Dh Zerofilled (bootcode is in new eMMC chip, not on old FLASH chip) 01Dh 6 Same as on DS (header: Console Type and User Settings Offset) 022h 6 Zerofilled (bootcode is in new eMMC chip, not on old FLASH chip) 028h..1FCh Same as on DS (wifi calibration) 1FDh 1 Wifi Board (01h=DWM-W015, 02h=DWM-W024) ;\this was 1FEh 1 Wifi Flash (20h=With access point 4/5/6) ; FFh-filled on DS 1FFh 1 Same as on DS (FFh) ;/ 200h FFh Zerofilled ;\ 2FFh Unknown (80h) ; this was bootcode on DS 00300h..1F2FFh FFh's ; 1F300h..1F3FEh FFh's ;twl-debugger: 00h's ; 1F3FFh FFh ;twl-debugger: 40h ;/ |
DS Firmware Wifi Calibration Data |
Addr Size Expl. 000h-029h Firmware Header (see previous chapter) 02Ah 2 CRC16 (with initial value 0) of [2Ch..2Ch+config_length-1] 02Ch 2 config_length (usually 0138h, ie. entries 2Ch..163h) 02Eh 1 Unused (00h) 02Fh 1 Wifi version (00h=v1..v4, 03h=v5, 05h=v6..v7, 0Fh=DSi) 030h 6 Unused (00h-filled) 036h 6 48bit MAC address (v1-v5: 0009BFxxxxxx, v6-v7: 001656xxxxxx) 03Ch 2 list of enabled channels ANDed with 7FFE (Bit1..14 = Channel 1..14) (usually 3FFEh, ie. only channel 1..13 enabled) 03Eh 2 Whatever Flags (usually FFFFh) 040h 1 RF Chip Type (usually 02h) 041h 1 RF Bits per entry at 0CEh (usually 18h=24bit=3byte) (Bit7=?) 042h 1 RF Number of entries at 0CEh (usually 0Ch) 043h 1 Unknown (usually 01h) 044h 2 Initial Value for [4808146h] ;W_CONFIG_146h 046h 2 Initial Value for [4808148h] ;W_CONFIG_148h 048h 2 Initial Value for [480814Ah] ;W_CONFIG_14Ah 04Ah 2 Initial Value for [480814Ch] ;W_CONFIG_14Ch 04Ch 2 Initial Value for [4808120h] ;W_CONFIG_120h 04Eh 2 Initial Value for [4808122h] ;W_CONFIG_122h 050h 2 Initial Value for [4808154h] ;W_CONFIG_154h 052h 2 Initial Value for [4808144h] ;W_CONFIG_144h 054h 2 Initial Value for [4808130h] ;W_CONFIG_130h 056h 2 Initial Value for [4808132h] ;W_CONFIG_132h 058h 2 Initial Value for [4808140h] ;W_CONFIG_140h 05Ah 2 Initial Value for [4808142h] ;W_CONFIG_142h 05Ch 2 Initial Value for [4808038h] ;W_POWER_TX 05Eh 2 Initial Value for [4808124h] ;W_CONFIG_124h 060h 2 Initial Value for [4808128h] ;W_CONFIG_128h 062h 2 Initial Value for [4808150h] ;W_CONFIG_150h 064h 69h Initial 8bit values for BB[0..68h] 0CDh 1 Unused (00h) |
0CEh 24h Initial 24bit values for RF[0,4,5,6,7,8,9,0Ah,0Bh,1,2,3] 0F2h 54h Channel 1..14 2x24bit values for RF[5,6] 146h 0Eh Channel 1..14 8bit values for BB[1Eh] (usually somewhat B1h..B7h) 154h 0Eh Channel 1..14 8bit values for RF[9].Bit10..14 (usually 10h-filled) |
--- Type3 values are originated at 0CEh, following addresses depend on: --- 1) number of initial values, found at [042h] ;usually 29h 2) number of BB indices, found at [0CEh+[042h]] ;usually 02h 3) number of RF indices, found at [043h] ;usually 02h --- Below example addresses assume above values to be set to 29h,02h,02h --- 0CEh 29h Initial 8bit values for RF[0..28h] 0F7h 1 Number of BB indices per channel 0F8h 1 1st BB index 0F9h 14 1st BB data for channel 1..14 107h 1 2nd BB index 108h 14 2nd BB data for channel 1..14 116h 1 1st RF index 117h 14 1st RF data for channel 1..14 125h 1 2nd RF index 126h 14 2nd RF data for channel 1..14 134h 46 Unused (FFh-filled) |
162h 1 Unknown (usually 19h..1Ch) 163h 1 Unused (FFh) (Inside CRC16 region, with config_length=138h) 164h 99h Unused (FFh-filled) (Outside CRC16 region, with config_length=138h) 1FDh 1 DSi Wifi Board (01h=DWM-W015, 02h=DWM-W024) ;\this was 1FEh 1 DSi Wifi Flash (20h=With access point 4/5/6) ; FFh-filled on DS 1FFh 1 DSi Same as on DS (FFh) ;/ |
DS Firmware Wifi Internet Access Points |
Addr Siz Expl. 000h 64 Unknown (usually 00h-filled) (no Proxy supported on NDS) 040h 32 SSID (ASCII name of the access point) (padded with 00h's) 060h 32 SSID for WEP64 on AOSS router (each security level has its own SSID) 080h 16 WEP Key 1 (for type/size, see entry E6h) 090h 16 WEP Key 2 ;\ 0A0h 16 WEP Key 3 ; (usually 00h-filled) 0B0h 16 WEP Key 4 ;/ 0C0h 4 IP Address (0=Auto/DHCP) 0C4h 4 Gateway (0=Auto/DHCP) 0C8h 4 Primary DNS Server (0=Auto/DHCP) 0CCh 4 Secondary DNS Server (0=Auto/DHCP) 0D0h 1 Subnet Mask (0=Auto/DHCP, 1..1Ch=Leading Ones) (eg. 6 = FC.00.00.00) 0D1h .. Unknown (usually 00h-filled) 0E6h 1 WEP Mode (0=None, 1/2/3=5/13/16 byte hex, 5/6/7=5/13/16 byte ascii) 0E7h 1 Status (00h=Normal, 01h=AOSS, FFh=connection not configured/deleted) 0E8h 1 Zero (not SSID Length, ie. unlike as entry 4,5,6 on DSi) 0E9h 1 Unknown (usually 00h) 0EAh 2 DSi only: MTU (Max transmission unit) (576..1500, usually 1400) 0ECh 3 Unknown (usually 00h-filled) 0EFh 1 bit0/1/2 - connection 1/2/3 (1=Configured, 0=Not configured) 0F0h 6 Nintendo Wifi Connection (WFC) 43bit User ID (ID=([F0h] AND 07FFFFFFFFFFh)*1000, shown as decimal string NNNN-NNNN-NNNN-N000) (the upper 5bit of the last byte are containing additional/unknown nonzero data) 0F6h 8 Unknown (nonzero stuff !?!) 0FEh 2 CRC16 for Entries 000h..0FDh (with initial value 0000h) |
Addr Siz Expl. 000h 32 Proxy Authentication Username (ASCII string, padded with 00's) 000h 32 Proxy Authentication Password (ASCII string, padded with 00's) 040h 32 SSID (ASCII string, padded with 00's) (see [0E8h] for length) 060h .. Maybe same as NDS 080h 16 WEP Key (zerofilled for WPA) 0xxh .. Maybe same as NDS 0C0h 4 IP Address (0=Auto/DHCP) 0C4h 4 Gateway (0=Auto/DHCP) 0C8h 4 Primary DNS Server (0=Auto/DHCP) 0CCh 4 Secondary DNS Server (0=Auto/DHCP) 0D0h 1 Subnet Mask (0=Auto/DHCP, 1..1Ch=Leading Ones) (eg. 6 = FC.00.00.00) 0D1h .. Unknown (zerofilled) 0E6h 1 WEP (00h=None/WPA/WPA2, 01h/02h/03h/05h/06h/07h=WEP, same as NDS) 0E7h 1 WPA (00h=Normal, 10h=WPA/WPA2, 13h=WPS+WPA/WPA2, FFh=unused/deleted) 0E8h 1 SSID Length in characters (01h..20h, or 00h=unused) 0E9h 1 Unknown (usually 00h) 0EAh 2 MTU Value (Max transmission unit) (576..1500, usually 1400) 0ECh 3 Unknown (usually 00h-filled) 0EFh 1 bit0/1/2 - connection 4/5/6 (1=Configured, 0=Not configured) 0F0h 14 Zerofilled (or maybe ID as on NDS, if any such ID exists for DSi?) 0FEh 2 CRC16 for Entries 000h..0FDh (with initial value 0000h) 100h 32 Precomputed PSK (based on WPA/WPA2 password and SSID) ;\all zero 120h 64 WPA/WPA2 password (ASCII string, padded with 00's) ;/for WEP 160h 33 Zerofilled 181h 1 WPA (0=None/WEP, 4=WPA-TKIP, 5=WPA2-TKIP, 6=WPA-AES, 7=WPA2-AES) 182h 1 Proxy Enable (00h=None, 01h=Yes) 183h 1 Proxy Authentication (00h=None, 01h=Yes) 184h 48 Proxy Name (ASCII string, max 47 chars, padded with 00's) 1B4h 52 Zerofilled 1E8h 2 Proxy Port (16bit) 1EAh 20 Zerofilled 1FEh 2 CRC16 for Entries 100h..1FDh (with initial value 0000h) (0=deleted) |
DS Firmware User Settings |
Addr Size Expl. 000h 2 Version (5) (Always 5, for all NDS/DSi Firmware versions) 002h 1 Favorite color (0..15) (0=Gray, 1=Brown, etc.) 003h 1 Birthday month (1..12) (Binary, non-BCD) 004h 1 Birthday day (1..31) (Binary, non-BCD) 005h 1 Not used (zero) 006h 20 Nickname string in UTF-16 format 01Ah 2 Nickname length in characters (0..10) 01Ch 52 Message string in UTF-16 format 050h 2 Message length in characters (0..26) 052h 1 Alarm hour (0..23) (Binary, non-BCD) 053h 1 Alarm minute (0..59) (Binary, non-BCD) 054h 2 056h 1 80h=enable alarm (huh?), bit 0..6=enable? 057h 1 Zero (1 byte) 058h 2x2 Touch-screen calibration point (adc.x1,y1) 12bit ADC-position 05Ch 2x1 Touch-screen calibration point (scr.x1,y1) 8bit pixel-position 05Eh 2x2 Touch-screen calibration point (adc.x2,y2) 12bit ADC-position 062h 2x1 Touch-screen calibration point (scr.x2,y2) 8bit pixel-position 064h 2 Language and Flags (see below) 066h 1 Year (2000..2255) (when having entered date in the boot menu) 067h 1 Unknown (usually 00h...08h or 78h..7Fh or so) 068h 4 RTC Offset (difference in seconds when RTC time/date was changed) 06Ch 4 Not used (FFh-filled, sometimes 00h-filled) (=MSBs of above?) |
070h 2 update counter (used to check latest) (must be 0000h..007Fh) 072h 2 CRC16 of entries 00h..6Fh (70h bytes) 074h 8Ch Not used (FFh-filled) (or extended data, see below) |
074h 1 Unknown (01h) (maybe version?) 075h 1 Extended Language (0..5=Same as Entry 064h, plus 6=Chinese) (for language 6, entry 064h defaults to english; for compatibility) (for language 0..5, both entries 064h and 075h have same value) 076h 2 Bitmask for Supported Languages (Bit0..6) (007Eh for iQue DS, ie. with chinese, but without japanese) (003Eh for DSi/EUR, ie. without chinese, and without japanese) 078h 86h Not used (FFh-filled on iQue DS, 00h-filled on DSi) 0FEh 2 CRC16 of entries 74h..FDh (8Ah bytes) |
Bit 0..2 Language (0=Japanese, 1=English, 2=French, 3=German, 4=Italian, 5=Spanish, 6..7=Reserved) (for Chinese see Entry 075h) (the language setting also implies time/data format) 3 GBA mode screen selection (0=Upper, 1=Lower) 4-5 Backlight Level (0..3=Low,Med,High,Max) (DS-Lite only) 6 Bootmenu Disable (0=Manual/bootmenu, 1=Autostart Cartridge) 9 Settings Lost (1=Prompt for User Info, and Language, and Calibration) 10 Settings Okay (0=Prompt for User Info) 11 Settings Okay (0=Prompt for User Info) (Same as Bit10) 12 No function 13 Settings Okay (0=Prompt for User Info, and Language) 14 Settings Okay (0=Prompt for User Info) (Same as Bit10) 15 Settings Okay (0=Prompt for User Info) (Same as Bit10) |
IF count1=((count0+1) AND 7Fh) THEN area1=newer ELSE area0=newer |
DS Firmware Extended Settings |
Addr Siz Expl. 00h 8 ID "XbooInfo" 08h 2 CRC16 Value [0Ch..0Ch+Length-1] 0Ah 2 CRC16 Length (from 0Ch and up) 0Ch 1 Version (currently 01h) 0Dh 1 Update Count (newer = (older+1) AND FFh) 0Eh 1 Bootmenu Flags Bit6 Important Info (0=Disable, 1=Enable) Bit7 Bootmenu Screen (0=Upper, 1=Lower) 0Fh 1 GBA Border (0=Black, 1=Gray Line) 10h 2 Temperature Calibration TP0 ADC value (x16) (sum of 16 ADC values) 12h 2 Temperature Calibration TP1 ADC value (x16) (sum of 16 ADC values) 14h 2 Temperature Calibration Degrees Kelvin (x100) (0=none) 16h 1 Temperature Flags Bit0-1 Format (0=Celsius, 1=Fahrenheit, 2=Reaumur, 3=Kelvin) 17h 1 Backlight Intensity (0=0ff .. FFh=Full) 18h 4 Date Century Offset (currently 20, for years 2000..2099) 1Ch 1 Date Month Recovery Value (1..12) 1Dh 1 Date Day Recovery Value (1..31) 1Eh 1 Date Year Recovery Value (0..99) 1Fh 1 Date/Time Flags Bit0-1 Date Format (0=YYYY-MM-DD, 1=MM-DD-YYYY, 2=DD-MM-YYYY) Bit2 Friendly Date (0=Raw Numeric, 1=With Day/Month Names) Bit5 Time DST (0=Hide DST, 1=Show DST=On/Off) Bit6 Time Seconds (0=Hide Seconds, 1=Show Seconds) Bit7 Time Format (0=24 hour, 1=12 hour) 20h 1 Date Separator (Ascii, usually Slash, or Dot) 21h 1 Time Separator (Ascii, usually Colon, or Dot) 22h 1 Decimal Separator (Ascii, usually Comma, or Dot) 23h 1 Thousands Separator (Ascii, usually Comma, or Dot) 24h 1 Daylight Saving Time (Nth) Bit 0-3 Activate on (0..4 = Last,1st,2nd,3rd,4th) Bit 4-7 Deactivate on (0..4 = Last,1st,2nd,3rd,4th) 25h 1 Daylight Saving Time (Day) Bit 0-3 Activate on (0..7 = Mon,Tue,Wed,Thu,Fri,Sat,Sun,AnyDay) Bit 4-7 Deactivate on (0..7 = Mon,Tue,Wed,Thu,Fri,Sat,Sun,AnyDay) 26h 1 Daylight Saving Time (of Month) Bit 0-3 Activate DST in Month (1..12) Bit 4-7 Deactivate DST in Month (1..12) 27h 1 Daylight Saving Time (Flags) Bit 0 Current DST State (0=Off, 1=On) Bit 1 Adjust DST Enable (0=Disable, 1=Enable) |
DS Wireless Communications |
DS Wifi I/O Map |
Address Dir Name r/w [Init] Description 4808000h R W_ID ---- [1440] Chip ID (1440h=DS, C340h=DS-Lite) 4808004h R/W W_MODE_RST 9fff [0000] Mode/Reset 4808006h R/W W_MODE_WEP --7f [0000] Mode/Wep modes 4808008h R/W W_TXSTATCNT ffff [0000] Beacon Status Request 480800Ah R/W W_X_00Ah ffff [0000] [bit7 - ingore rx duplicates] 4808010h R/W W_IF ackk [0000] Wifi Interrupt Request Flags 4808012h R/W W_IE ffff [0000] Wifi Interrupt Enable 4808018h R/W W_MACADDR_0 ffff [0000] Hardware MAC Address, 1st 2 bytes 480801Ah R/W W_MACADDR_1 ffff [0000] Hardware MAC Address, next 2 bytes 480801Ch R/W W_MACADDR_2 ffff [0000] Hardware MAC Address, last 2 bytes 4808020h R/W W_BSSID_0 ffff [0000] BSSID (first 2 bytes) 4808022h R/W W_BSSID_1 ffff [0000] BSSID (next 2 bytes) 4808024h R/W W_BSSID_2 ffff [0000] BSSID (last 2 bytes) 4808028h R/W W_AID_LOW ---f [0000] usually as lower 4bit of AID value 480802Ah R/W W_AID_FULL -7ff [0000] AID value assigned by a BSS. 480802Ch R/W W_TX_RETRYLIMIT ffff [0707] Tx Retry Limit (set from 00h-FFh) 480802Eh R/W W_INTERNAL ---1 [0000] 4808030h R/W W_RXCNT ff0e [0000] Receive control 4808032h R/W W_WEP_CNT ffff [0000] WEP engine enable 4808034h R? W_INTERNAL 0000 [0000] bit0,1 (see ports 004h,040h,1A0h) |
4808036h R/W W_POWER_US ---3 [0001] 4808038h R/W W_POWER_TX ---7 [0003] 480803Ch R/W W_POWERSTATE -r-2 [0200] 4808040h R/W W_POWERFORCE 8--1 [0000] 4808044h R W_RANDOM 0xxx [0xxx] 4808048h R/W W_POWER_? ---3 [0000] |
4808050h R/W W_RXBUF_BEGIN ffff [4000] 4808052h R/W W_RXBUF_END ffff [4800] 4808054h R W_RXBUF_WRCSR 0rrr [0000] 4808056h R/W W_RXBUF_WR_ADDR -fff [0000] 4808058h R/W W_RXBUF_RD_ADDR 1ffe [0000] 480805Ah R/W W_RXBUF_READCSR -fff [0000] 480805Ch R/W W_RXBUF_COUNT -fff [0000] 4808060h R W_RXBUF_RD_DATA rrrr [xxxx] 4808062h R/W W_RXBUF_GAP 1ffe [0000] 4808064h R/W W_RXBUF_GAPDISP -fff [0000] 4808068h R/W W_TXBUF_WR_ADDR 1ffe [0000] 480806Ch R/W W_TXBUF_COUNT -fff [0000] 4808070h W W_TXBUF_WR_DATA xxxx [xxxx] 4808074h R/W W_TXBUF_GAP 1ffe [0000] 4808076h R/W W_TXBUF_GAPDISP 0fff [0000] |
4808078h W W_INTERNAL mirr [mirr] Read: Mirror of 068h 4808080h R/W W_TXBUF_BEACON ffff [0000] Beacon Transmit Location 4808084h R/W W_TXBUF_TIM --ff [0000] Beacon TIM Index in Frame Body 4808088h R/W W_LISTENCOUNT --ff [0000] Listen Count 480808Ch R/W W_BEACONINT -3ff [0064] Beacon Interval 480808Eh R/W W_LISTENINT --ff [0000] Listen Interval 4808090h R/W W_TXBUF_CMD ffff [0000] (used by firmware part4) 4808094h R/W W_TXBUF_REPLY1 ffff [0000] (used by firmware part4) 4808098h R W_TXBUF_REPLY2 0000 [0000] (used by firmware part4) 480809Ch R/W W_INTERNAL ffff [0050] value 4x00h --> preamble+x*12h us? 48080A0h R/W W_TXBUF_LOC1 ffff [0000] 48080A4h R/W W_TXBUF_LOC2 ffff [0000] 48080A8h R/W W_TXBUF_LOC3 ffff [0000] 48080ACh W W_TXREQ_RESET fixx [0050] 48080AEh W W_TXREQ_SET fixx [0050] 48080B0h R W_TXREQ_READ --1f [0010] 48080B4h W W_TXBUF_RESET 0000 [0000] (used by firmware part4) 48080B6h R W_TXBUSY 0000 [0000] (used by firmware part4) 48080B8h R W_TXSTAT 0000 [0000] 48080BAh ? W_INTERNAL 0000 [0000] 48080BCh R/W W_PREAMBLE ---3 [0001] 48080C0h R/W x W_CMD_TOTALTIME ffff [0000] (used by firmware part4) 48080C4h R/W x W_CMD_REPLYTIME ffff [0000] (used by firmware part4) 48080C8h ? W_INTERNAL 0000 [0000] 48080D0h R/W W_RXFILTER 1fff [0401] 48080D4h R/W W_CONFIG_0D4h ---3 [0001] 48080D8h R/W W_CONFIG_0D8h -fff [0004] 48080DAh R/W W_RX_LEN_CROP ffff [0602] 48080E0h R/W W_RXFILTER2 ---f [0008] |
48080E8h R/W W_US_COUNTCNT ---1 [0000] Microsecond counter enable 48080EAh R/W W_US_COMPARECNT ---1 [0000] Microsecond compare enable 48080ECh R/W W_CONFIG_0ECh 3f1f [3F03] 48080EEh R/W W_CMD_COUNTCNT ---1 [0001] 48080F0h R/W W_US_COMPARE0 fc-- [FC00] Microsecond compare, bits 0-15 48080F2h R/W W_US_COMPARE1 ffff [FFFF] Microsecond compare, bits 16-31 48080F4h R/W W_US_COMPARE2 ffff [FFFF] Microsecond compare, bits 32-47 48080F6h R/W W_US_COMPARE3 ffff [FFFF] Microsecond compare, bits 48-63 48080F8h R/W W_US_COUNT0 ffff [0000] Microsecond counter, bits 0-15 48080FAh R/W W_US_COUNT1 ffff [0000] Microsecond counter, bits 16-31 48080FCh R/W W_US_COUNT2 ffff [0000] Microsecond counter, bits 32-47 48080FEh R/W W_US_COUNT3 ffff [0000] Microsecond counter, bits 48-63 4808100h ? W_INTERNAL 0000 [0000] 4808102h ? W_INTERNAL 0000 [0000] 4808104h ? W_INTERNAL 0000 [0000] 4808106h ? W_INTERNAL 0000 [0000] 480810Ch R/W W_CONTENTFREE ffff [0000] ... 4808110h R/W W_PRE_BEACON ffff [0000] 4808118h R/W W_CMD_COUNT ffff [0000] 480811Ch R/W W_BEACONCOUNT1 ffff [0000] reloaded with W_BEACONINT |
4808120h R/W W_CONFIG_120h 81ff [0048] init from firmware[04Ch] 4808122h R/W W_CONFIG_122h ffff [4840] init from firmware[04Eh] 4808124h R/W W_CONFIG_124h ffff [0000] init from firmware[05Eh], or 00C8h 4808126h ? W_INTERNAL fixx [ 0080] 4808128h R/W W_CONFIG_128h ffff [0000] init from firmware[060h], or 07D0h 480812Ah ? W_INTERNAL fixx [1000] lower 12bit same as W_CONFIG_128h 4808130h R/W W_CONFIG_130h -fff [0142] init from firmware[054h] 4808132h R/W W_CONFIG_132h 8fff [8064] init from firmware[056h] 4808134h R/W W_BEACONCOUNT2 ffff [FFFF] ... 4808140h R/W W_CONFIG_140h ffff [0000] init from firmware[058h], or xx 4808142h R/W W_CONFIG_142h ffff [2443] init from firmware[05Ah] 4808144h R/W W_CONFIG_144h --ff [0042] init from firmware[052h] 4808146h R/W W_CONFIG_146h --ff [0016] init from firmware[044h] 4808148h R/W W_CONFIG_148h --ff [0016] init from firmware[046h] 480814Ah R/W W_CONFIG_14Ah --ff [0016] init from firmware[048h] 480814Ch R/W W_CONFIG_14Ch ffff [162C] init from firmware[04Ah] 4808150h R/W W_CONFIG_150h ff3f [0204] init from firmware[062h], or 202h 4808154h R/W W_CONFIG_154h 7a7f [0058] init from firmware[050h] |
4808158h W W_BB_CNT mirr [00B5] BB Access Start/Direction/Index 480815Ah W W_BB_WRITE ???? [0000] BB Access data byte to write 480815Ch R W_BB_READ 00rr [00B5] BB Access data byte read 480815Eh R W_BB_BUSY 000r [0000] BB Access Busy flag 4808160h R/W W_BB_MODE 41-- [0100] BB Access Mode 4808168h R/W W_BB_POWER 8--f [800D] BB Access Powerdown |
480816Ah ? W_INTERNAL 0000 [0001] (or 0000h?) 4808170h ? W_INTERNAL 0000 [0000] 4808172h ? W_INTERNAL 0000 [0000] 4808174h ? W_INTERNAL 0000 [0000] 4808176h ? W_INTERNAL 0000 [0000] 4808178h W W_INTERNAL fixx [0800] Read: mirror of 17Ch |
480817Ch R/W W_RF_DATA2 ffff [0800] 480817Eh R/W W_RF_DATA1 ffff [C008] 4808180h R W_RF_BUSY 000r [0000] 4808184h R/W W_RF_CNT 413f [0018] |
4808190h R/W W_INTERNAL ffff [0000] 4808194h R/W W_TX_HDR_CNT ---7 [0000] used by firmware part4 (0 or 6) 4808198h R/W W_INTERNAL ---f [0000] 480819Ch R W_RF_PINS fixx [0004] 48081A0h R/W W_X_1A0h -933 [0000] used by firmware part4 (0 or 823h) 48081A2h R/W W_X_1A2h ---3 [0001] used by firmware part4 48081A4h R/W W_X_1A4h ffff [0000] "Rate used when signal test..." |
48081A8h R W_RXSTAT_INC_IF rrrr [0000] Stats Increment Flags 48081AAh R/W W_RXSTAT_INC_IE ffff [0000] Stats Increment IRQ Enable 48081ACh R W_RXSTAT_OVF_IF rrrr [0000] Stats Half-Overflow Flags 48081AEh R/W W_RXSTAT_OVF_IE ffff [0000] Stats Half-Overflow IRQ Enable 48081B0h R/W W_RXSTAT --ff [0000] 48081B2h R/W W_RXSTAT ffff [0000] RX_LengthRateErrorCount 48081B4h R/W W_RXSTAT rrff [0000] ... firmware uses also MSB ... ? 48081B6h R/W W_RXSTAT ffff [0000] 48081B8h R/W W_RXSTAT --ff [0000] 48081BAh R/W W_RXSTAT --ff [0000] 48081BCh R/W W_RXSTAT ffff [0000] 48081BEh R/W W_RXSTAT ffff [0000] 48081C0h R/W W_TX_ERR_COUNT --ff [0000] TransmitErrorCount 48081C4h R W_RX_COUNT fixx [0000] |
48081D0h R/W W_CMD_STAT ff-- [0000] 48081D2h R/W W_CMD_STAT ffff [0000] 48081D4h R/W W_CMD_STAT ffff [0000] 48081D6h R/W W_CMD_STAT ffff [0000] 48081D8h R/W W_CMD_STAT ffff [0000] 48081DAh R/W W_CMD_STAT ffff [0000] 48081DCh R/W W_CMD_STAT ffff [0000] 48081DEh R/W W_CMD_STAT ffff [0000] |
48081F0h R/W W_INTERNAL ---3 [0000] 4808204h ? W_INTERNAL fixx [0000] 4808208h ? W_INTERNAL fixx [0000] 480820Ch W W_INTERNAL fixx [0050] 4808210h R W_TX_SEQNO fixx [0000] 4808214h R W_RF_STATUS XXXX [0009] (used by firmware part4) 480821Ch W W_IF_SET fbff [0000] Force Interrupt (set bits in W_IF) 4808220h R/W W_INTERNAL ffff [0000] Bit0-1: Enable/Disable WifiRAM (locks memory at 4000h-5FFFh) 4808224h R/W W_INTERNAL ---3 [0003] 4808228h W W_X_228h fixx [0000] (used by firmware part4) (bit3) 4808230h R/W W_INTERNAL --ff [0047] 4808234h R/W W_INTERNAL -eff [0EFF] 4808238h R/W W_INTERNAL ffff [0000] ;rx_seq_no-60h+/-x ;why that? ;other day: fixed value, not seq_no related? 480823Ch ? W_INTERNAL fixx [0000] like W_TXSTAT... ONLY for beacons? 4808244h R/W W_X_244h ffff [0000] (used by firmware part4) 4808248h R/W W_INTERNAL ffff [0000] 480824Ch R W_INTERNAL fixx [0000] ;rx_mac_addr_0 480824Eh R W_INTERNAL fixx [0000] ;rx_mac_addr_1 4808250h R W_INTERNAL fixx [0000] ;rx_mac_addr_2 4808254h ? W_CONFIG_254h fixx [0000] (read: FFFFh=DS, EEEEh=DS-Lite) 4808258h ? W_INTERNAL fixx [0000] 480825Ch ? W_INTERNAL fixx [0000] 4808260h ? W_INTERNAL fixx [ 0FEF] 4808264h R W_INTERNAL fixx [0000] ;rx_addr_1 (usually "rxtx_addr-x") 4808268h R W_RXTX_ADDR fixx [0005] ;rxtx_addr 4808270h R W_INTERNAL fixx [0000] ;rx_addr_2 (usually "rx_addr_1-1") 4808274h ? W_INTERNAL fixx [ 0001] 4808278h R/W W_INTERNAL ffff [000F] 480827Ch ? W_INTERNAL fixx [ 000A] 4808290h (R/W) W_X_290h fixx [FFFF] bit 0 = ? (used by firmware part4) 4808298h W W_INTERNAL fixx [0000] 48082A0h R/W W_INTERNAL ffff [0000] 48082A2h R W_INTERNAL XXXX [7FFF] 15bit shift reg (used during tx?) 48082A4h R W_INTERNAL fixx [0000] ;rx_rate_1 not ALWAYS same as 2C4h 48082A8h W W_INTERNAL fixx [0000] 48082ACh ? W_INTERNAL fixx [ 0038] 48082B0h W W_INTERNAL fixx [0000] 48082B4h R/W W_INTERNAL -1-3 [0000] 48082B8h ? W_INTERNAL fixx [0000] 48082C0h R/W W_INTERNAL ---1 [0000] 48082C4h R W_INTERNAL fixx [000A] ;rx_rate_2 (0Ah,14h = 1,2 Mbit/s) 48082C8h R W_INTERNAL fixx [0000] ;rx_duration/length/rate (or so?) 48082CCh R W_INTERNAL fixx [0000] ;rx_framecontrol; from ieee header 48082D0h DIS W_INTERNAL ;"W_POWERACK" (internal garbage) ;normally DISABLED (unless FORCE) 48082F0h R/W W_INTERNAL ffff [0000] 48082F2h R/W W_INTERNAL ffff [0000] 48082F4h R/W W_INTERNAL ffff [0000] 48082F6h R/W W_INTERNAL ffff [0000] |
4804000h W_MACMEM RX/TX Buffers (2000h bytes) (excluding below specials) 4805F60h Used for something, not included in the rx circular buffer. 4805F80h W_WEPKEY_0 (32 bytes) 4805FA0h W_WEPKEY_1 (32 bytes) 4805FC0h W_WEPKEY_2 (32 bytes) 4805FE0h W_WEPKEY_3 (32 bytes) |
DS Wifi Control |
0-15 Chip ID (1440h on NDS, C340h on NDS-lite) |
0 Adjust some ports (0/1=see lists below) (R/W) TX Master Enable for LOC1..3 and Beacon (0=Disable, 1=Enable) 1-12 Unknown (R/W) 13 Reset some ports (0=No change, 1=Reset/see list below) (Write-Only) 14 Reset some ports (0=No change, 1=Reset/see list below) (Write-Only) 15 Unknown (R/W) |
0-2 Unknown, specify a software mode for wifi operation (may be related to hardware but a correlation has not yet been found) 3-5 WEP Encryption Key Size: 0=Reserved (acts same as 1) 1=64bit WEP (IV=24bit + KEY=40bit) (aka 3+5 bytes) ;standard/us 2=128bit WEP (IV=24bit + KEY=104bit) (aka 3+13 bytes) ;standard/world 3=152bit WEP (IV=24bit + KEY=128bit) (aka 3+16 bytes) ;uncommon 4=Unknown, mabye 256bit WEP (IV=24bit + KEY=232bit) (aka 3+29 bytes)? 5=Reserved (acts same as 1) 6=Reserved (acts same as 1) 7=Reserved (acts same as 1) 6 Unknown 8-15 Always zero |
Bit0-3 Maybe player-number, assuming that HW supports such? (1..15, or 0) Bit4-15 Not used |
Bit0-10 Association ID (AID) (1..2007, or zero) Bit11-15 Not used |
0-14 Unknown (usually zero) 15 WEP Engine Enable (0=Disable, 1=Enable) |
0-10 Random 11-15 Not used (zero) |
X = (X AND 1) XOR (X ROL 1) ;(rotation within 11bit range) |
Bit Dir Expl. 0 R/W Unknown (this does NOT affect TX) 1 R/W Preamble (0=Long, 1=Short) (this does NOT affect TX) 2 W Preamble (0=Long, 1=Short) (this does affect TX) (only at 2Mbit/s) 3-15 - Always zero |
Type Carrier Signal SFD Value PLCP Header Data Long 128bit, 1Mbit 16bit, 1Mbit 48bit, 1Mbit N bits, 1Mbit or 2Mbit Short 56bit, 1Mbit 16bit, 1Mbit 48bit, 2Mbit N bits, 2Mbit |
[4808034h]=0002h ;W_INTERNAL [480819Ch]=0046h ;W_RF_PINS [4808214h]=0009h ;W_RF_STATUS [480827Ch]=0005h ;W_INTERNAL [48082A2h]=? ;...unstable? |
[480827Ch]=000Ah ;W_INTERNAL |
[4808056h]=0000h ;W_RXBUF_WR_ADDR [48080C0h]=0000h ;W_CMD_TOTALTIME [48080C4h]=0000h ;W_CMD_REPLYTIME [48081A4h]=0000h ;W_X_1A4h [4808278h]=000Fh ;W_INTERNAL ...Also, following may be affected (results are unstable though)... [48080AEh]=? ;or rather the actual port (which it is an mirror of) [48080BAh]=? ;W_INTERNAL (occassionally unstable) [4808204h]=? ;W_INTERNAL [480825Ch]=? ;W_INTERNAL [4808268h]=? ;W_RXTX_ADDR [4808274h]=? ;W_INTERNAL |
[4808006h]=0000h ;W_MODE_WEP [4808008h]=0000h ;W_TXSTATCNT [480800Ah]=0000h ;W_X_00Ah [4808018h]=0000h ;W_MACADDR_0 [480801Ah]=0000h ;W_MACADDR_1 [480801Ch]=0000h ;W_MACADDR_2 [4808020h]=0000h ;W_BSSID_0 [4808022h]=0000h ;W_BSSID_1 [4808024h]=0000h ;W_BSSID_2 [4808028h]=0000h ;W_AID_LOW [480802Ah]=0000h ;W_AID_FULL [480802Ch]=0707h ;W_TX_RETRYLIMIT [480802Eh]=0000h ;W_INTERNAL [4808050h]=4000h ;W_RXBUF_BEGIN [4808052h]=4800h ;W_RXBUF_END [4808084h]=0000h ;W_TXBUF_TIM [48080BCh]=0001h ;W_PREAMBLE [48080D0h]=0401h ;W_RXFILTER [48080D4h]=0001h ;W_CONFIG_0D4h [48080E0h]=0008h ;W_RXFILTER2 [48080ECh]=3F03h ;W_CONFIG_0ECh [4808194h]=0000h ;W_TX_HDR_CNT [4808198h]=0000h ;W_INTERNAL [48081A2h]=0001h ;W_X_1A2h [4808224h]=0003h ;W_INTERNAL [4808230h]=0047h ;W_INTERNAL |
DS Wifi Interrupts |
0 Receive Complete (packet received and stored in the RX fifo) 1 Transmit Complete (packet is done being transmitted) (no matter if error) 2 Receive Event Increment (IRQ02, see W_RXSTAT_INC_IE) 3 Transmit Error Increment (IRQ03, see W_TX_ERR_COUNT) 4 Receive Event Half-Overflow (IRQ04, see W_RXSTAT_OVF_IE) 5 Transmit Error Half-Overflow (IRQ05, see W_TX_ERR_COUNT.Bit7) 6 Start Receive (IRQ06, a packet has just started to be received) 7 Start Transmit (IRQ07, a packet has just started to be transmitted) 8 Txbuf Count Expired (IRQ08, see W_TXBUF_COUNT) 9 Rxbuf Count Expired (IRQ09, see W_RXBUF_COUNT) 10 Not used (always zero, even when trying to set it with W_IF_SET) 11 RF Wakeup (IRQ11, see W_POWERSTATE) 12 Multiplay ...? (IRQ12, see W_CMD_COUNT) 13 Post-Beacon Timeslot (IRQ13, see W_BEACONCOUNT2) 14 Beacon Timeslot (IRQ14, see W_BEACONCOUNT1/W_US_COMPARE) 15 Pre-Beacon Timeslot (IRQ15, see W_BEACONCOUNT1/W_PRE_BEACON) |
0-15 Enable Flags, same bits as W_IF (0=Disable, 1=Enable) |
0-15 Set corresponding bits in W_IF (0=No change, 1=Set Bit) |
Caution Caution Caution Caution Caution That means, when acknowledging IF.Bit24, then NO FURTHER wifi IRQs will be executed whilst and as long as (W_IF AND W_IE) is non-zero. |
DS Wifi Power-Down Registers |
0 Disable W_US_COUNT and W_BB_ports (0=Enable, 1=Disable) 1 Unknown (usually 0) 2-15 Always zero |
0 Auto Wakeup (1=Leave Idle Mode a while after IRQ15) 1 Auto Sleep (0=Enter Idle Mode on IRQ13) 2 Unknown 3 Unknown (Write-only) (used by firmware) 4-15 Always zero |
0 Unknown (usually 0) (R/W) 1 Request Power Enable (0=No, 1=Yes/queued) (R/W, but not always) 2-7 Always zero 8 Indicates that Bit9 is about the be cleared (Read only) 9 Current power state (0=Enabled, 1=Disabled) (Read only) 10-15 Always zero |
0 New value for W_POWERSTATE.Bit9 (0=Clear/Delayed, 1=Set/Immediately) 1-14 Always zero 15 Apply Bit0 to W_POWERSTATE.Bit9 (0=No, 1=Yes) |
(Doing this is okay. Switches to power down mode. Similar to IRQ13.) [4808034h]=0002h ;W_INTERNAL [480803Ch]=02xxh ;W_POWERSTATE [48080B0h]=0000h ;W_TXREQ_READ [480819Ch]=0046h ;W_RF_PINS [4808214h]=0009h ;W_RF_STATUS (idle) |
(Don't do this. After that sequence, the hardware seems to be messed up) W_POWERSTATE.Bit8 gets set to indicate the pending operation, while pending, changes to W_POWERFORCE aren't applied to W_POWERSTATE, while pending, W_POWERACK becomes Read/Write-able, writing 0000h to W_POWERACK does clear W_POWERSTATE.Bit8, and does apply POWERFORCE.Bit0 to W_POWERSTATE.Bit9 and does deactivate Port W_POWERACK again. |
0 Unknown 1 Unknown 2-15 Always zero |
DS Wifi Receive Control |
0 Copy W_RXBUF_WR_ADDR to W_RXBUF_WRCSR (W) 1-3 Unknown (R/W) 4-6 Always zero 7 Copy W_TXBUF_REPLY1 to W_TXBUF_REPLY2, set W_TXBUF_REPLY1 to 0000h (W) 8-14 Unknown (R/W) 15 Enable Queuing received data to RX FIFO (R/W) |
0 (0=Insist on W_BSSID, 1=Accept no matter of W_BSSID) 1-6 Unknown (usually zero) 7 Unknown (0 or 1) 8 Unknown (0 or 1) 9 Unknown (0 or 1) 10 Unknown (0 or 1) (when set, receives beacons, and maybe others) 11 Unknown (usually zero) ;reportedly "allow toDS" ? 12 (0=Normal, 1=Accept even whatever garbage) 13-15 Not used (always zero) |
0 Unknown (0=Receive Data Frames, 1=Ignore Data Frames) (?) 1 Unknown 2 Unknown 3 Unknown (usually set) 4-15 Not used (always zero) |
DS Wifi Receive Buffer |
0-15 Byte-offset in Wifi Memory (usually 4000h..5FFEh) |
0-11 Halfword Address in RAM 12-15 Always zero |
0-11 Halfword Address in RAM 12-15 Always zero |
0 Always zero 1-12 Halfword Address in RAM for reading via W_RXBUF_RD_DATA 13-15 Always zero |
0-11 Halfword Address in RAM 12-15 Always zero |
0-15 Data |
0 Always zero 1-12 Halfword Address in RAM 13-15 Always zero |
Addr=Addr+2 and 1FFEh ;address increment (by W_RXBUF_RD_DATA read) if Addr=RXBUF_END then ;normal begin/end wrapping (done before gap wraps) Addr=RXBUF_BEGIN if Addr=RXBUF_GAP then ;now gap-wrap (may include further begin/end wrap) Addr=RXBUF_GAP+RXBUF_GAPDISP*2 if Addr>=RXBUF_END then Addr=Addr+RXBUF_BEGIN-RXBUF_END ;wrap more |
0-11 Halfword Offset, used with W_RXBUF_GAP (see there) 12-15 Always zero |
0-11 Decremented on reads from W_RXBUF_RD_DATA 12-15 Always zero |
DS Wifi Receive Statistics |
0-12 Increment Flags (see Port 48081B0h..1BFh) 13-15 Always zero |
0-12 Counter Increment Interrupt Enable (see 48081B0h..1BFh) (1=Enable) 13-15 Unknown (usually zero) |
0-12 Half-Overflow Flags (see Port 48081B0h..1BFh) 13-15 Always zero |
0-12 Half-Overflow Interrupt Enable (see Port 48081B0h..1BFh) (1=Enable) 13-15 Unknown (usually zero) |
Port Dir Bit Expl. 48081B0h R/W 0 W_RXSTAT ? 48081B1h - - Always 0 - 48081B2h R/W 1 W_RXSTAT ? "RX_RateErrorCount" 48081B3h R/W 2 W_RXSTAT Length>2348 error 48081B4h R/W 3 W_RXSTAT RXBUF Full error 48081B5h R 4? W_RXSTAT ? (R) (but seems to exist; used by firmware) 48081B6h R/W 5 W_RXSTAT Length=0 or Wrong FCS Error 48081B7h R/W 6 W_RXSTAT Packet Received Okay (also increments on W_MACADDR mis-match) (also increments on internal ACK packets) (also increments on invalid IEEE type=3) (also increments TOGETHER with 1BCh and 1BEh) (not incremented on RXBUF_FULL error) 48081B8h R/W 7 W_RXSTAT ? 48081B9h - - Always 0 - 48081BAh R/W 8 W_RXSTAT ? 48081BBh - - Always 0 - 48081BCh R/W 9 W_RXSTAT WEP Error (when FC.Bit14 is set) 48081BDh R/W 10 W_RXSTAT ? 48081BEh R/W 11 W_RXSTAT (duplicated sequence control) 48081BFh R/W 12 W_RXSTAT ? |
0-? Receive Okay Count (increments together with ports 48081B4h, 48081B7h) 8-? Receive Error Count (increments together with ports 48081B3h, 48081B6h) |
48081D0h Not used (always zero) 48081D1h..1DFh Client 1..15 Response Error (increments on missing replies) |
DS Wifi Transmit Control |
0-3 Reset corresponding bits in W_TXREQ_READ (0=No change, 1=Reset) 4-15 Unknown (if any) |
0-3 Set corresponding bits in W_TXREQ_READ (0=No change, 1=Set) 4-15 Unknown (if any) |
0 Send W_TXBUF_LOC1 (1=Transfer, if enabled in W_TXBUF_LOC1.Bit15) 1 Send W_TXBUF_CMD (1=Transfer, if enabled in W_TXBUF_CMD.Bit15) 2 Send W_TXBUF_LOC2 (1=Transfer, if enabled in W_TXBUF_LOC2.Bit15) 3 Send W_TXBUF_LOC3 (1=Transfer, if enabled in W_TXBUF_LOC3.Bit15) 4 Unknown (Beacon?) (always 1, except when cleared via W_POWERFORCE) 5-15 Unknown/Not used |
0 W_TXBUF_LOC1 (1=Requested Transfer busy, or not yet started at all) 1 W_TXBUF_CMD (1=Requested Transfer busy, or not yet started at all) 2 W_TXBUF_LOC2 (1=Requested Transfer busy, or not yet started at all) 3 W_TXBUF_LOC3 (1=Requested Transfer busy, or not yet started at all) 4 W_TXBUF_BEACON (1=Beacon Transfer busy) 5-15 Unknown (if any) |
0 One (or more) Packet has Completed (1=Yes) (No matter if successful, for that info see Bit1) (No matter if ALL packets are done, for that info see Bit12-13) 1 Packet Failed (1=Error) 2-7 Unknown/Not used 8-11 Usually 0, ...but firmware is checking for values 03h,08h,0Bh (gets set to 07h when transferred W_TXBUF_LOC1/2/3 did have Bit12=set) (gets set to 00h otherwise) (gets set to 03h after beacons; if enabled in W_TXSTATCNT.Bit15) (gets set to 08h or 0Bh after CMD; depending on W_TXSTATCNT.Bit13,14) 12-13 Packet which has updated W_TXSTAT (0=LOC1/BEACON/CMD, 1=LOC2, 2=LOC3) 14-15 Unknown/Not used |
0-12 Unknown (usually zero) 13 Update W_TXSTAT=0B01h and trigger IRQ01 after CMD transmits (1=Yes) 14 Update W_TXSTAT=0800h and trigger IRQ01 after CMD transmits (1=Yes) 15 Update W_TXSTAT and trigger IRQ01 after BEACON transmits (0=No, 1=Yes) |
0 IEEE FC.Bit12 and Duration (0=Auto/whatever, 1=Manual/Wifi RAM) 1 IEEE Frame Check Sequence (0=Auto/FCS/CRC32, 1=Manual/Wifi RAM) 2 IEEE Sequence Control (0=Auto/W_TX_SEQNO, 1=Manual/Wifi RAM) 3-15 Always zero |
0-11 Increments on IRQ07 (Transmit Start Interrupt) 12-15 Always zero |
DS Wifi Transmit Buffers |
0 Always zero 1-12 Halfword Address in RAM for Writes via W_TXBUF_WR_DATA 13-15 Always zero |
0-15 Data to be written to address specified in W_TXBUF_WR_ADDR |
0 Always zero 1-12 Halfword Address 13-15 Always zero |
0-11 Halfword Offset (added to; if equal to W_TXBUF_GAP) 12-15 Always zero |
0-11 Halfword Address of TX Frame Header in RAM 12 For LOC1-3: When set, W_TXSTAT.bit8-10 are set to 07h after transfer And, when set, the transferred frame-body gets messed up? For BEACON: Unknown, no effect on W_TXSTAT For CMD: Unknown, no effect on W_TXSTAT 13 IEEE Sequence Control (0=From W_TX_SEQNO, 1=Value in Wifi RAM) For BEACON: Unknown (always uses W_TX_SEQNO) (no matter of bit13) 14 Unknown 15 Transfer Request (1=Request/Pending) |
0 Disable LOC1 (0=No change, 1=Reset W_TXBUF_LOC1.Bit15) 1 Disable CMD (0=No change, 1=Reset W_TXBUF_CMD.Bit15) 2 Disable LOC2 (0=No change, 1=Reset W_TXBUF_LOC2.Bit15) 3 Disable LOC3 (0=No change, 1=Reset W_TXBUF_LOC3.Bit15) 4-5 Unknown/Not used 6 Disable REPLY2 (0=No change, 1=Reset W_TXBUF_REPLY2.Bit15) 7 Disable REPLY1 (0=No change, 1=Reset W_TXBUF_REPLY1.Bit15) 8-15 Unknown/Not used |
0-7 Location of TIM parameters within Beacon Frame Body 8-15 Not used/zero |
0-11 Decremented on writes to W_TXBUF_WR_DATA 12-15 Always zero |
DS Wifi Transmit Errors |
0-7 Retry Count (usually 07h) 8-15 Unknown (usually 07h) |
0-7 TransmitErrorCount 8-15 Always zero |
DS Wifi Status |
0 Reportedly "carrier sense" (maybe 1 during RX.DTA?) (usually 0) 1 TX.MAIN (RFU.Pin17) Transmit Data Phase (0=No, 1=Active) 2 Unknown (RFU.Pin3) Seems to be always high (Always 1=high?) 3-5 Not used (Always zero) 6 TX.ON (RFU.Pin14) Transmit Preamble+Data Phase (0=No, 1=Active) Uhhh, no that seems to be still wrong... Bit6 is often set, even when not transmitting anything... 7 RX.ON (RFU.Pin15) Receive Mode (0=No, 1=Enabled) 8-15 Not used (Always zero) |
0-3 Current Transmit/Receive State: 0 = Initial Value on power-up (before raising W_MODE_RST.Bit0) 1 = RX Mode enabled (waiting for incoming data) 2 = Switching from RX to TX (takes a few clock cycles) 3 = TX Mode active (sending preamble and data) 4 = Switching from TX to RX (takes a few clock cycles) 5 = Unknown, firmware checks for that value (maybe RX busy) 6 = Unknown, firmware checks for that value (maybe RX busy) 9 = Idle (upon IRQ13, and upon raising W_MODE_RST.Bit0) ---- 5 = Receive ACK phase ? 6 = 7 = 8 = Multiplay related ? (when sending through W_TXBUF_CMD ?) 4-15 Always zero? |
0-11 Halfword address 12-15 Always zero |
DS Wifi Timers |
0 Counter Enable (0=Disable, 1=Enable) 1-15 Always zero |
0-63 Counter Value in microseconds (incrementing) |
0 Compare Enable (0=Disable, 1=Enable) (IRQ14/IRQ15) 1 Force IRQ14 (0=No, 1=Force Now) (Write-only) 2-15 Always zero |
0 Always zero... firmware writes 1 though (maybe write-only flag?) 1-9 Always zero 10-63 Compare Value in milliseconds (aka microseconds/1024) |
0-15 Decrementing Millisecond Counter (reloaded with W_BEACONINT upon IRQ14) |
0-15 Decrementing Millisecond Counter (reloaded with FFFFh upon IRQ14) |
0-9 Frequency in milliseconds of beacon transmission 10-15 Always zero |
0-15 Pre-Beacon Time in microseconds (static value, ie. NOT decrementing) |
0-7 Decremented by hardware at IRQ14 events (ie. once every beacon) 8-15 Always zero |
0-7 Listen Interval, counted in beacons (usually 02h) 8-15 Always zero |
0-15 Decrementing microsecond counter |
W_IF.Bit13=1 ;interrupt request |
[4808034h]=0002h ;W_INTERNAL ;(similar to W_POWERFORCE=8001h) [480803Ch]=02xxh ;W_POWERSTATE ;(W_TXREQ_READ.Bit4 is kept intact though) [480819Ch]=0046h ;W_RF_PINS.7=0;disable receive (enter idle mode) (RX.ON=Low) [4808214h]=0009h ;W_RF_STATUS=9;indicate idle mode |
W_BEACONCOUNT1=W_BEACONINT ;next IRQ15/IRQ14 (Above is NOT done when IRQ14 was forced via W_US_COMPARECNT.Bit1) |
(Below IS ALSO DONE when IRQ14 was forced via W_US_COMPARECNT.Bit1) W_IF.Bit14=1 W_BEACONCOUNT2=FFFFh ;about 64 secs (ie. almost never) ;next IRQ13 ("never") W_TXREQ_READ=W_TXREQ_READ AND FFF2h if W_TXBUF_BEACON.15 then W_TXBUSY.Bit4=1 if W_LISTENCOUNT=00h then W_LISTENCOUNT=W_LISTENINT W_LISTENCOUNT=W_LISTENCOUNT-1 |
W_RF_PINS.Bit7=0 ;disable receive (RX.ON=Low) W_RF_STATUS=2 ;indicate switching from RX to TX mode |
W_RF_PINS.Bit6=1 ;transmit preamble start (TX.ON=High) W_RF_STATUS=3 ;indicate TX mode |
W_BEACONCOUNT2 = W_BEACONCOUNT2 + TagDDhSteppingValue ;next IRQ13 |
W_IF.Bit7=1 ;interrupt request W_RF_PINS.Bit1=1 ;start data transfer (preamble finished now) (TX.MAIN=High) |
[TXBUF...] = W_TX_SEQNO*10h ;auto-adjust IEEE Sequence Control W_TX_SEQNO=W_TX_SEQNO+1 ;increase sequence number |
W_RF_PINS.Bit6=0 ;disable TX (TX.ON=Low) W_RF_STATUS=4 ;indicate switching from TX to RX mode |
W_IF.Bit1=1 ;interrupt request W_RF_PINS.Bit1=0 ;disable TX (TX.MAIN=Low) W_RF_PINS.Bit7=1 ;enable RX (RX.ON=High) W_RF_STATUS=1 ;indicate RX mode |
if W_US_COMPARECNT=1 then W_IF.Bit15=1 |
W_RF_PINS.Bit7=1 ;enable RX (RX.ON=High) ;\gets set like so a good while W_RF_STATUS=1 ;indicate RX mode ;/after IRQ15 (but not immediately) |
IRQ15 Pre-Beacon (beacon will be transferred soon) IRQ14 Beacon (beacon will be transferred very soon) (carrier starts) IRQ07 Tx Start (beacon transfer starts) (if enabled in W_TXBUF_BEACON.15) IRQ01 Tx End (beacon transfer done) (if enabled in W_TXSTATCNT.15) IRQ13 Post-Beacon (beacon transferred) (unless next IRQ14 occurs earlier) |
DS Wifi Multiplay Master |
0 Enable W_CMD_COUNT (0=Disable, 1=Enable) 1-15 Always Zero |
0-15 Decremented once every 10 microseconds (Stopped at 0000h) |
0-15 Duration per ALL slave response packet(s) in microseconds |
0-15 Duration per SINGLE slave response packet in microseconds |
master_time = (master_bytes*4)+(60h) ;60h = 96 decimal = short preamble slave_time = (slave_bytes*4)+(0D0h..0D2h) all_slave_time = (EAh..F0h)+(slave_time+0Ah)*num_slaves txhdr[2] = slave_bits ;hardware header (*) ieee[2] = all_slave_time ;ieee header (duration/id) body[0] = slave_time ;duration per slave (for multiboot/pictochat) body[2] = slave_bits ;frame body -- required (*) [48080C0h] = all_slave_time ; [48080C4h] = slave_time ;duration per slave [4808118h] = (388h+(num_slaves*slave_time)+master_time+32h)/10 [4808090h] = 8000h+master_packet_address ;start transmit |
DS Wifi Multiplay Slave |
0-11 Halfword address 12-14 Unknown (the bits can be set, ie. they DO exist) 15 Enable |
0-11 Halfword address 12-14 Unknown (the bits can be set, ie. they DO exist) 15 Enable |
DS Wifi Configuration Ports |
W_CONFIG_140h = firmware[058h]+0202h ;1Mbit/s W_CONFIG_140h = firmware[058h]+0202h-6161h ;2Mbit/s with long preamble W_CONFIG_140h = firmware[058h]+0202h-6161h-6060h ;2Mbit/s with short preamble |
0-7 Decrease RX Length by N halfwords for Non-WEP packets (usually 2) 8-15 Decrease RX Length by N halfwords for WEP packets (usually 6) |
DS Wifi Baseband Chip (BB) |
0-7 Index (00h-68h) 8-11 Not used (should be zero) 12-15 Direction (5=Write BB_WRITE to Chip, 6=Read from Chip to BB_READ) |
0-7 Data to be sent to chip (by following W_BB_CNT transfer) 8-15 Not used (should be zero) |
0-7 Data received from chip (from previous W_BB_CNT transfer) 8-15 Not used (always zero) |
0 Transfer Busy (0=Ready, 1=Busy) 1-15 Always zero |
0-7 Always zero 8 Unknown (usually 1) (no effect no matter what setting?) 9-13 Always zero 14 Unknown (usually 0) (W_BB_READ gets unstable when set) 15 Always zero |
0-3 Disable whatever (usually 0Dh=disable) 4-14 Always zero 15 Disable W_BB_ports (usually 1=Disable) |
Index Num Dir Expl. 00h 1 R always 6Dh (R) (Chip ID) 01h..0Ch 12 R/W 8bit R/W 0Dh..12h 6 - always 00h 13h..15h 3 R/W 8bit R/W 16h..1Ah 5 - always 00h 1Bh..26h 12 R/W 8bit R/W 27h 1 - always 00h 28h..4Ch R/W 8bit R/W 4Dh 1 R always 00h or BFh (depending on other regs) 4Eh..5Ch R/W 8bit R/W 5Dh 1 R always 01h (R) 5Eh..61h - always 00h 62h..63h 2 R/W 8bit R/W 64h 1 R always FFh or 3Fh (depending on other regs) 65h 1 R/W 8bit R/W 66h 1 - always 00h 67h..68h 2 R/W 8bit R/W 69h..FFh - always 00h |
Addr Initial Meaning 01h 0x9E [unsetting/resetting bit 7 initializes/resets the system?] 02h unknown (firmware is messing with this register) 06h unknown (firmware is messing with this register, too) 13h 0x00 CCA operation - criteria for receiving 0=only use Carrier Sense (CS) 1=only use Energy Detection (ED) 2=receive if CS OR ED 3=receive only if CS AND ED 1Eh 0xBB see change channels flowchart (Ext. Gain when RF[09h].bit16=0) 35h 0x1F Energy Detection (ED) criteria value 0..61 (representing energy levels of -60dBm to -80dBm) |
DS Wifi RF Chip |
0-1 Upper 2bit of 18bit data 2-6 Index (00h..1Fh) (firmware uses only 00h..0Bh) 7 Command (0=Write data, 1=Read data) 8-15 Should be zero (not used with 24bit transfer) |
0-3 Command (5=Write data, 6=Read data) 4-15 Should be zero (not used with 20bit transfer) |
0-15 Lower 16bit of 18bit data |
0-7 Data (to be written to chip) (or being received from chip) 8-15 Index (usually 00h..28h) (index 40h..FFh are mirrors of 00h..3Fh) |
0 Transfer Busy (0=Ready, 1=Busy) 1-15 Always zero |
0-5 Transfer length (init from firmware[041h].Bit0-5) 6-7 Always zero 8 Unknown (init from firmware[041h].Bit7) 9-13 Always zero 14 Unknown (usually 0) 15 Always zero |
DS Wifi RF9008 Registers |
Firmware Index Data (24bit) (4bit) (18bit) 00C007h = 00h + 0C007h ;-also set to 0C008h for power-down 129C03h = 04h + 29C03h 141728h = 05h + 01728h ;\these are also written when changing channels 1AE8BAh = 06h + 2E8BAh ;/ 1D456Fh = 07h + 1456Fh 23FFFAh = 08h + 3FFFAh 241D30h = 09h + 01D30h ;-bit10..14 should be also changed per channel? """"50h = """ + """50h ;firmware v5 and up uses narrower tx filter 280001h = 0Ah + 00001h 2C0000h = 0Bh + 00000h 069C03h = 01h + 29C03h 080022h = 02h + 00022h 0DFF6Fh = 03h + 1FF6Fh |
17-16 Reserved, program to zero (0) 15-14 Reference Divider Value (0=Div2, 1=Div3, 2=Div44, 3=Div1) 3 Sleep Mode Current (0=Normal, 1=Very Low) 2 RF VCO Regulator Enable (0=Disable, 1=Enable) 1 IF VCO Regulator Enable (0=Disable, 1=Enable) 0 IF VGA Regulator Enable (0=Disable, 1=Enable) |
17 IF PLL Enable (0=Disable, 1=Enable) 16 IF PLL KV Calibration Enable (0=Disable, 1=Enable) 15 IF PLL Coarse Tuning Enable (0=Disable, 1=Enable) 14 IF PLL Loop Filter Select (0=Internal, 1=External) 13 IF PLL Charge Pump Leakage Current (0=Minimum value, 1=2*Minimum value) 12 IF PLL Phase Detector Polarity (0=Positive, 1=Negative) 11 IF PLL Auto Calibration Enable (0=Disable, 1=Enable) 10 IF PLL Lock Detect Enable (0=Disable, 1=Enable) 9 IF PLL Prescaler Modulus (0=4/5 Mode, 1=8/9 Mode) 8-4 Reserved, program to zero (0) 3-0 IF VCO Coarse Tuning Voltage (N=Voltage*16/VDD) |
17-16 Reserved, program to zero (0) 15-0 IF PLL divide-by-N value |
17 Reserved, program to zero (0) 16-8 IF VCO KV Calibration, delta N value (signed) ;DeltaF=(DN/Fr) 7-4 IF VCO Coarse Tuning Default Value 3-0 IF VCO KV Calibration Default Value |
17-10 Same as for RF[01h] (but for RF, not for IF) 9 RF PLL Prescaler Modulus (0=8/9 Mode, 1=8/10 Mode) 8-0 Same as for RF[01h] (but for RF, not for IF) |
17-6 RF PLL Divide By N Value 5-0 RF PLL Numerator Value (Bits 23-18) |
17-0 RF PLL Numerator Value (Bits 17-0) |
17-10 Same as for RF[03h] (but for RF, not for IF) ;and, DN=(deltaF/Fr)*256 |
17-13 VCO1 Warm-up Time ;TVCO1=(approximate warm-up time)*(Fr/32) 12-8 VCO1 Tuning Gain Calibration ;TLOCK1=(approximate lock time)*(Fr/128) 7-3 VCO1 Coarse Tune Calibration Reference ;VALUE=(average time)*(Fr/32) 2-0 Lock Detect Resolution (0..7) |
17 Receiver DC Removal Loop (0=Enable DC Removal Loop, 1=Disable) 16 Internal Variable Gain for VGA (0=Disable/External, 1=Enable/Internal) 15 Internal Variable Gain Source (0=From TXVGC Bits, 1=From Power Control) 14-10 Transmit Variable Gain Select (TXVGC) (0..1Fh = High..low gain) 9-7 Receive Baseband Low Pass Filter (0=Wide Bandwidth, 7=Narrow) 6-4 Transmit Baseband Low Pass Filter (0=Wide Bandwidth, 7=Narrow) 3 Mode Switch (0=Single-ended mode, 1=Differential mode) 2 Input Buffer Enable TX (0=Input Buffer Controlled by TXEN, 1=By BBEN) 1 Internal Bias Enable (0=Disable/External, 1=Enable/Internal) 0 TX Baseband Filters Bypass (0=Not Bypassed, 1=Bypassed) |
17-15 Select MID_BIAS Level (1.6V through 2.6V) 14-9 Desired output power at antenna (N*0.5dBm) 8-3 Power Control loop-variation-adjustment Offset (signed, N*0.5dB) 2-0 Desired delay for using a single TX_PE line (N*0.5us) |
17-12 Desired MAX output power when PABIAS=MAX=2.6V (N*0.5dBm) 11-6 Desired MAX output power when PABIAS=MID_BIAS (N*0.5dBm) 5-0 Desired MAX output power when PABIAS=MIN=1.6V (N*0.5dBm) |
17 IF VCO Band Current Compensation (0=Disable, 1=Enable) 16 RF VCO Band Current Compensation (0=Disable, 1=Enable) 15-0 Reserved, program to zero (0) |
Not used. |
17-0 This is a test register for internal use only. |
Not used. |
17-0 Don't care (writing any value resets the chip) |
DS Wifi Unknown Registers |
0-15 Unknown (usually zero) |
0-1 Unknown 2-3 Always zero 4-5 Unknown 6-7 Always zero 8 Unknown 9-10 Always zero 11 Unknown 12-15 Always zero |
0-1 Unknown. Firmware writes values 03h, 01h, and VAR. 2-15 Always zero |
0 Unknown (R/W) (if present) 1-15 Not used |
DS Wifi Unused Registers |
4800000h-4807FFFh Wifi WS0 Region (32K) 4808000h-4808000h Wifi WS1 Region (32K) 4810000h-4FFFFFFh Not used (00h-filled) |
Wifi-WS0-Region Wifi-WS1-Region Content 4800000h-4800FFFh 4808000h-4808FFFh Registers 4801000h-4801FFFh 4809000h-4809FFFh Registers (mirror) 4802000h-4803FFFh 480A000h-480BFFFh Unused 4804000h-4805FFFh 480C000h-480DFFFh Wifi RAM (8K) 4806000h-4806FFFh 480E000h-480EFFFh Registers (mirror) 4807000h-4807FFFh 480F000h-480FFFFh Registers (mirror) |
2030h, 2044h, 2056h, 2080h, 2090h, 2094h, 2098h, 209Ch, 20A0h, 20A4h, 20A8h, 20AAh, 20B0h, 20B6h, 20BAh, 21C0h, 2208h, 2210h, 2244h, 31D0h, 31D2h, 31D4h, 31D6h, 31D8h, 31DAh, 31DCh, 31DEh. |
Read from (W) Mirrors to (NDS) Or to (NDS-Lite) 070h W_TXBUF_WR_DATA 060h W_RXBUF_RD_DATA 074h W_TXBUF_GAP 078h W_INTERNAL 068h W_TXBUF_WR_ADDR 074h W_TXBUF_GAP 0ACh W_TXREQ_RESET 09Ch W_INTERNAL ? (zero) 0AEh W_TXREQ_SET 09Ch W_INTERNAL ? (zero) 0B4h W_TXBUF_RESET 0B6h W_TXBUSY ? (zero) 158h W_BB_CNT 15Ch W_BB_READ ? (zero) 15Ah W_BB_WRITE ? (zero) ? (zero) 178h W_INTERNAL 17Ch W_RF_DATA2 ? (zero) 20Ch W_INTERNAL 09Ch W_INTERNAL ? (zero) 21Ch W_IF_SET 010h W_IF 010h-OR-05Ch-OR-more? 228h W_X_228h ? (zero) ? (zero) 298h W_INTERNAL 084h W_TXBUF_TIM 084h W_TXBUF_TIM 2A8h W_INTERNAL 238h W_INTERNAL 238h W_INTERNAL 2B0h W_INTERNAL 084h W_TXBUF_TIM 084h W_TXBUF_TIM |
DS Wifi Initialization |
[4000304h].Bit1 = 1 ;POWCNT2 ;-Enable power to the wifi system W_MACADDR = firmware[036h] ;-Set 48bit Mac address reg[012h] = 0000h ;W_IE ;-Disable interrupts |
reg[036h] = 0000h ;W_POWER_US ;\clear all powerdown bits delay 8 ms ; (works without that killer-delay ?) reg[168h] = 0000h ;W_BB_POWER ;/ IF firmware[040h]=02h ;\ temp=BB[01h] ; for wifitype=02h only: BB[01h]=temp AND 7Fh ; reset BB[01h].Bit7, then restore old BB[01h] BB[01h]=temp ; (that BB setting enables the RF9008 chip) ENDIF ;/ delay 30 ms ;-(more killer-delay now getting REALLY slow) call init_sub_functions ;- same as "Init 16 registers by firmware[..]" ; and "Init RF registers", below. ; this or the other one probably not necessary |
reg[004h] = 0000h - W_MODE_RST ;set hardware mode reg[008h] = 0000h - W_TXSTATCNT ; reg[00Ah] = 0000h - ? W_X_00Ah ;(related to rx filter) reg[012h] = 0000h - W_IE ;disable interrupts (again) reg[010h] = FFFFh - W_IF ;acknowledge/clear any interrupts reg[254h] = 0000h - W_CONFIG_254h ; reg[0B4h] = FFFFh - W_TXBUF_RESET ;--reset all TXBUF_LOC's reg[080h] = 0000h - W_TXBUF_BEACON ;disable automatic beacon transmission reg[02Ah] = 0000h - W_AID_FULL ;\clear AID reg[028h] = 0000h - W_AID_LOW ;/ reg[0E8h] = 0000h - W_US_COUNTCNT ;disable microsecond counter reg[0EAh] = 0000h - W_US_COMPARECNT ;disable microsecond compare reg[0EEh] = 0001h - W_CMD_COUNTCNT ;(is 0001h on reset anyways) reg[0ECh] = 3F03h - W_CONFIG_0ECh ; reg[1A2h] = 0001h - ? ; reg[1A0h] = 0000h - ? ; reg[110h] = 0800h - W_PRE_BEACON ; reg[0BCh] = 0001h - W_PREAMBLE ;disable short preamble reg[0D4h] = 0003h - W_CONFIG_0D4h ; reg[0D8h] = 0004h - W_CONFIG_0D8h ; reg[0DAh] = 0602h - W_RX_LEN_CROP ; reg[076h] = 0000h - W_TXBUF_GAPDISP ;disable gap/skip (offset=zero) |
reg[146h] = firmware[044h] ;W_CONFIG_146h reg[148h] = firmware[046h] ;W_CONFIG_148h reg[14Ah] = firmware[048h] ;W_CONFIG_14Ah reg[14Ch] = firmware[04Ah] ;W_CONFIG_14Ch reg[120h] = firmware[04Ch] ;W_CONFIG_120h reg[122h] = firmware[04Eh] ;W_CONFIG_122h reg[154h] = firmware[050h] ;W_CONFIG_154h reg[144h] = firmware[052h] ;W_CONFIG_144h reg[130h] = firmware[054h] ;W_CONFIG_130h reg[132h] = firmware[056h] ;W_CONFIG_132h reg[140h] = firmware[058h] ;W_CONFIG_140h reg[142h] = firmware[05Ah] ;W_CONFIG_142h reg[038h] = firmware[05Ch] ;W_POWER_TX reg[124h] = firmware[05Eh] ;W_CONFIG_124h reg[128h] = firmware[060h] ;W_CONFIG_128h reg[150h] = firmware[062h] ;W_CONFIG_150h |
numbits = BYTE firmware[041h] ;usually 18h numbytes = (numbits+7)/8 ;usually 3 reg[0x184] = (numbits+80h) AND 017Fh -- W_RF_CNT for i=0 to BYTE firmware[042h]-1 ;number of entries (usually 0Ch) (0..0Bh) if BYTE firmware[040h]=3 RF[i]=firmware[0CEh+i] else RF_Write(numbytes at firmware[0CEh+i*numbytes]) endif |
(this should be not required, already set by firmware bootcode) reg[160h] = 0100h ;W_BB_MODE BB[0..68h] = firmware[64h+(0..68h)] |
copy 6 bytes from firmware[036h] to mac address at 0x04800018 (why again ?) |
reg[02Ch]=0007h ;W_TX_RETRYLIMIT - XXX needs to be set for every transmit? Set channel (see section on changing channels) Set Mode 2 -- sets bottom 3 bits of W_MODE_WEP to 2 Set Wep Mode / key -- Wep mode is bits 3..5 of W_MODE_WEP BB[13h] = 00h ;CCA operation (use only carrier sense, without ED) BB[35h] = 1Fh ;Energy Detection Threshold (ED) |
reg[032h] = 8000h -- W_WEP_CNT ;Enable WEP processing reg[134h] = FFFFh -- W_BEACONCOUNT2;reset post-beacon counter to LONG time reg[028h] = 0000h -- W_AID_LOW ;\clear W_AID value, again?! reg[02Ah] = 0000h -- W_AID_FULL ;/ reg[0E8h] = 0001h -- W_US_COUNTCNT ;enable microsecond counter reg[038h] = 0000h -- W_POWER_TX ;disable transmit power save reg[020h] = 0000h -- W_BSSID_0 ;\ reg[022h] = 0000h -- W_BSSID_1 ; clear BSSID reg[024h] = 0000h -- W_BSSID_2 ;/ |
reg[0AEh] = 000Dh -- W_TXREQ_SET ;flush all pending transmits (uh?) |
reg[030h] = 8000h W_RXCNT ;enable RX system (done again below) reg[050h] = 4C00h W_RXBUF_BEGIN ;(example values) reg[052h] = 5F60h W_RXBUF_END ;(length = 4960 bytes) reg[056h] = 0C00h/2 W_RXBUF_WR_ADDR ;fifo begin latch address reg[05Ah] = 0C00h/2 W_RXBUF_READCSR ;fifo end, same as begin at start. reg[062h] = 5F60h-2 W_RXBUF_GAP ;(set gap<end) (zero should work, too) reg[030h] = 8001h W_RXCNT ;enable, and latch new fifo values to hardware |
reg[030h] = 8000h W_RXCNT enable receive (again?) reg[010h] = FFFFh W_IF clear interrupt flags reg[012h] = whatever W_IE set enabled interrupts reg[1AEh] = 1FFFh W_RXSTAT_OVF_IE desired STAT Overflow interrupts reg[1AAh] = 0000h W_RXSTAT_INC_IE desired STAT Increase interrupts reg[0D0h] = 0181h W_RXFILTER set to 0x581 when you successfully connect to an access point and fill W_BSSID with a mac address for it. (W_RXFILTER) [not sure on the values for this yet] reg[0E0h] = 000Bh -- W_RXFILTER2 ; reg[008h] = 0000h -- ? W_TXSTATCNT ;(again?) reg[00Ah] = 0000h -- ? W_X_00Ah ;(related to rx filter) (again?) reg[004h] = 0001h -- W_MODE_RST ;hardware mode reg[0E8h] = 0001h -- W_US_COUNTCNT ;enable microsecond counter (again?) reg[0EAh] = 0001h -- W_US_COMPARECNT ;enable microsecond compare reg[048h] = 0000h -- W_POWER_? ;[disabling a power saving technique] reg[038h].Bit1 = 0 -- W_POWER_TX ;[this too] reg[048h] = 0000h -- W_POWER_? ;[umm, it's done again. necessary?] reg[0AEh] = 0002h -- W_TXREQ_SET ; reg[03Ch].Bit1 = 1 -- W_POWERSTATE ;queue enable power (RX power, we believe) reg[0ACh] = FFFFh -- W_TXREQ_RESET;reset LOC1..3 |
DS Wifi Flowcharts |
(1) Copy the TX Header followed by the 802.11 packet to send anywhere it will fit in MAC memory (halfword-aligned) (2) Take the offset from start of MAC memory that you put the packet, divide it by 2, and or with 0x8000 - store this in one of the W_TXBUF_LOC registers (3) Set W_TX_RETRYLIMIT, to allow your packet to be retried until an ack is received (set it to 7, or something similar) (4) Store the bit associated with the W_TXBUF_LOC register you used into W_TXREQ_SET - this will send the packet. (5) You can then read the result data in W_TXSTAT when the TX is over (you can tell either by polling or interrupt) to find out how many retries were used, and if the packet was ACK'd |
(1) Calculate the length of the new packet (read "received frame length" which is +8 bytes from the start of the packet) - total frame length is (12 + received frame length) padded to a multiple of 4 bytes. (2) Read the data out of the RX FIFO area (keep in mind it's a circular buffer and you may have to wrap around the end of the buffer) (3) Set the value of W_RXBUF_READCSR to the location of the next packet (add the length of the packet, and wrap around if necessary) |
RF[firmware[F2h+(ch-1)*6]/40000h] = firmware[F2h+(ch-1)*6] AND 3FFFFh RF[firmware[F5h+(ch-1)*6]/40000h] = firmware[F5h+(ch-1)*6] AND 3FFFFh delay a few milliseconds ;huh? IF RF[09h].bit16=0 ;External Gain (default) BB[1Eh]=firmware[146h+(ch-1)] ;set BB.Gain register ELSEIF RF[09h].bit15=0 ;Internal Gain from TXVGC Bits RF[09h].Bit10..14 = (firmware[154h+(ch-1)] AND 1Fh) ;set RF.TXVGC Bits ENDIF |
num_initial_regs = firmware[042h] addr=0CEh+num_initial_regs num_bb_writes = firmware[addr] num_rf_writes = firmware[43h] addr=addr+1 for i=1 to num_bb_writes BB[firmware[addr]] = firmware[addr+ch] addr=addr+15 next i for i=1 to num_rf_writes RF[firmware[addr]] = firmware[addr+ch] addr=addr+15 next i |
DS Wifi Hardware Headers |
Addr Siz Expl. 00h 2 Status - In: Don't care - Out: Status (0000h=Failed, 0001h=Okay) 02h 2 Unknown - In: Don't care Bit0: Usually zero. Bit1..15 --------> flags for multiboot slaves number 1..15 (Should be usually zero, except when sending multiplay commands via W_TXBUF_CMD. In that case, the slave flags should be ALSO stored in the second halfword of the FRAME BODY. Actually, the hardware seems to use only that entry (in the BODY), rather than using this entry (in the hardware header)). 04h 1 Unknown - In: Must be 00h..02h (should be 00h) (03h..FFh result in error: W_TXSTAT.Bit1 gets set, but nethertheless header entry[00h] is kept set to 0001h=Okay) ;00h = use W_TX_SEQNO (if enabled in TXBUF_LOCn) ;01h = force NOT to use W_TX_SEQNO (even if it is enabled in LOCn) ;02h = seems to behave same as 01h 05h 1 Unknown - In: Don't care - Out: Set to 00h 06h 2 Unknown - In: Don't care 08h 1 Transfer Rate (0Ah=1Mbit/s, 14h=2Mbit/s) (other values=1MBit/s, too) 09h 1 Unknown - In: Don't care 0Ah 2 Length of IEEE Frame Header+Body+checksum(s) in bytes (14bits, upper 2bits are unused/don't care) |
Addr Siz Expl. 00h 2 Flags Bit0-3: Frame type/subtype: 0 managment/any frame (except beacon and invalid subtypes) 1 managment/beacon frame 5 control/ps-poll frame 8 data/any frame (subtype0..7) (ie. except invalid subtypes) C,D,E,F unknown (firmware is checking for that values) --- C firmware uses it for data/cf-poll frame, FromDs (*) D firmware uses it for data/cf-ack frame, FromDs E,F firmware uses it for data/cf-ack frame, ToDs (*) with DA=broadcast --- Bit4: Seems to be always set Bit5-7: Seems to be always zero Bit8: Set when FC.Bit10 is set (more fragments) Bit9: Set when the lower-4bit of Sequence Control are nonzero, it is also set when FC.Bit10 is set (more fragments) So, probably, it is set on fragment-mismatch-errors Bit10-14: Seems to be always zero Bit15: Set when Frame Header's BSSID value equals W_BSSID register 02h 2 Unknown (usually 0040h) 04h 2 Time since last packet (eg. when receiving beacons: total random on first some packets, but later on it gets equal to Beacon Interval) In other cases, this value is equal to the 1st 2 bytes of the DA ? [Above time/da effects might be explained by other reason: maybe this entry is left unchanged, simply containing old WifiRAM value?] 06h 2 Transfer Rate (N*100kbit/s) (ie. 14h for 2Mbit/s) 08h 2 Length of IEEE Frame Header+Body in bytes (excluding FCS checksum) 0Ah 1 MAX RSSI ;\Received Signal Strength Indicator 0Bh 1 MIN RSSI ;/ |
DS Wifi Nintendo Beacons |
802.11 management frame 802.11 beacon header (Timestamp,BeaconInterval,Capability?) Supported rates (tagged IE, advertises 1 Mbit and 2 Mbit) DS parameter set (tagged IE, note: Distribution System, not Nintendo DS) TIM vector (tagged IE, transmitted as empty) Custom extension (tagged IE, tag DDh, see below) |
Offset Description 00h Nintendo Beacon OUI (00h,09h,BFh,00h) 04h Stepping Offset for 4808134h/W_BEACONCOUNT2 (always 000Ah) 06h Strange Timestamp (W_US_COUNT*2-VCOUNT*7Fh)/128 (0000h for multiboot) 08h 01 00 0Ah 40 00 0Ch 24 00 0Eh 40 00 10h Randomly generated stream code 12h Number of bytes from entry 18h and up (70h for multiboot) (0 if Empty) 13h Beacon Type (0Bh=Multiboot, 01h=Multicart/Pictochat, 09h=Empty) 14h 0100 0008 (some kind of max,min values?) |
18h No data. |
18h Custom data, usually containing the host name, either in 8bit ascii, or 16bit unicode format. Sometimes taken from Firmware User Settings, and sometimes from Cartridge Backup Memory. |
18h Fixed (always 2348h) 1Ah xxxx 1Ch Chatroom number (00h..03h for Chatroom A..D) 1Dh Number of users already connected (01h..10h) (including host) 1Eh Fixed (always 0004h) |
18h 24 00 40 00 (varies from game to game) 1Ch End of advertisement flag (00 for non-end, 02 for end packets) 1Dh Always 00, 01, 02, or 04 1Eh Number of players already connected 1Fh Sequence number (0 .. total_advertisement_length) 20h Checksum (on entries 22h and up) chksum=0, for i=22h to 86h step 2, chksum=chksum+halfword[i], next i, chksum=FFFFh AND NOT (chksum+chksum/10000h) 22h Sequence number in non-final packet, # of players in final packet 23h Total advertisement length - 1 (in beacons) 24h Datasize in bytes (2 byte little-endian) (0062h for seq 0..7, 0048h for seq 8, 0001h for seq 9) 26h Data (always 62h bytes, padded with 00h if Datasize<62h) |
Offset Size Description 000h 32 Icon Palette (same as for ROM Cartridge Icon) 020h 512 Icon Bitmap (same as for ROM Cartridge Icon) 220h 1 Unknown (0Bh) 221h 1 Length of hosting name ;(probably same as firmware 222h 20 Name of hosting DS (10 UCS-2) ;user name?) 236h 1 Max number of players 237h 1 Unknown (00h) 238h 96 Game name (48 UCS-2) (same as 1st line of ROM Cartridge Title) 298h 192 Description (96 UCS-2) (same as further lines of ROM Cart Title) 358h 64 00's if no users are connected <---WRONG: LEN=1, not 64 398h 0 End of data if no users are connected |
Host A advertises a game in beacon frames as described above Client B sends an authentication request (sequence 1) to A ;\step 1 Host A replies with an ACK ;/ Host A sends an authentication reply (sequence 2) to B ;\step 2 (uh, no ACK here?) ;/ Client B sends an association request ;\step 3 Host A replies with an ACK ;/ Host A sends an association response ;\step 4 Client B replies with an ACK ;/ |
DS Wifi Nintendo DS Download Play |
Host sends some Pings, client(s) send PongReplies Host sends more Pings, client(s) send UsernameReplies Host sends RSA frame, client(s) send RsaReply Host sends NDS header, client(s) send DataReply Host sends ARM9 binary, client(s) send DataReply Host sends ARM7 binary, client(s) send DataReply Host sends Done message, no reply from client(s) |
03:09:BF:00:00:00 host to client main data flow ;via 4808090h/W_TXBUF_CMD 03:09:BF:00:00:10 client to host replies ;via 4808094h/W_TXBUF_REPLY1 03:09:BF:00:00:03 host to client feedback flow ;acknowledges the replies? |
00h 2 Value for W_CMD_REPLYTIME (0106h) 02h 2 Slave Flags, bit1..15 for slave 1..15 (1=connected) (eg. 0002h) 04h 1 Size in halfwords 05h 1 Flags 06h 1 Command (01h=Ping/NameRequest, 03h=RSA, 04h=DataPacket, 05h=Done) For Command 01h (Ping): ;\ 07h 4 Unused (zerofilled) ; For Command 03h (RSA): ; 07h E0h RSA Signature Frame (see below) ; Payload For Command 04h (Data Packet): ; 07h 1 Unknown (zero) ; 08h 2 Packet Number (0000h and up) ; 0Ah .. Data ; For Command 05h (Done): ; 07h .. Unknown ;/ For all commands (whatever trailing three bytes): xxh 3 Unknown (00h,02h,00h) |
00h 2 Unknown/fixed (8104h) 02h 1 Reply Type (00h=Pong, 07h=Username, 08h=RsaReply, 09h=DataReply) For Reply Type 00h (PongReply): 03h 7 Unused (zerofilled) For Reply Type 07h (UsernameReply): 03h 1 Username fragment (01h..04h) 04h 6 Username Char[0,1,2] ;for fragment 01h 04h 6 Username Char[3,4,5] ;for fragment 02h 04h 6 Username Char[6,7,8] ;for fragment 03h 04h 6 Username Char[9], bytes 01h,00h,00h,00h ;for fragment 04h For Reply Type 08h (RsaReply): 03h 7 Unused (garbage, usually same as Name fragment 02h) For Reply Type 09h (DataReply): 03h 2 Last packet (the packet number being acknowledged) 05h 2 Best packet (the highest continuous packet number seen so far) 07h 3 Unused (zerofilled) |
00h 1 Unknown (random/garbage?) (unknown value... maybe per slave flags?) 01h 3 Unused (zerofilled) |
00h 4 ARM9 execute address 04h 4 ARM7 execute address 08h 4 Zerofilled 0Ch 4 Header destination (temp) 10h 4 Header destination (actual) 14h 4 Header size (160h) 18h 4 Zerofilled 1Ch 4 ARM9 destination address (temp) 20h 4 ARM9 destination address (actual) 24h 4 ARM9 binary size 28h 4 Zerofilled 2Ch 4 ARM7 destination address (temp) (usually 22C0000h in Main RAM) 30h 4 ARM7 destination address (actual) (usually somewhere in WRAM) 34h 4 ARM7 binary size 38h 4 Unknown (00000001h) 3Ch 4 Signature ID (61h,63h,01h,00h) (aka "ac", or backwards "ca") ;\ 40h 80h Signature RSA (RSA signature in OpenPGP SHA1 format) ; C0h 4 Signature Footer ;/ C4h 36 Zerofilled E8h - End of frame payload |
00h 14h SHA1 on Header 14h 14h SHA1 on ARM9 bootcode 28h 14h SHA1 on ARM7 bootcode 3Ch 4 Signature Footer (the four bytes from [C0h]) |
Over the Hedge (download contains a 2D minigame) |
Eragon Lara Croft Tomb Raider Legend Magnetica Metroid Prime Hunters Demo Submarine Tech Demo (and many trailers with non-playable movie clips) |
DS Wifi IEEE802.11 Frames |
10..30 bytes MAC Header 0..2312 bytes Frame Body (in practice, network MTU is circa 1500 bytes max) 4 bytes Frame Check Sequence (FCS) (aka checksum) |
Size Content 2 Frame Control Field (FC) 2 Duration/ID 6 Address 1 (6) Address 2 (if any) (6) Address 3 (if any) (2) Sequence Control (if any) (6) Address 4 (if any) |
Bit Expl. 0-1 Protocol Version (0=Current, 1..3=Reserved) 2-3 Type (0=Managment, 1=Control, 2=Data, 3=Reserved) 4-7 Subtype (see next chapters) (meaning depends on above Type) 8 To Distribution System (DS) 9 From Distribution System (DS) 10 More Fragments 11 Retry 12 Power Managment (0=Active, 1=STA will enter Power-Safe mode after..) 13 More Data 14 Wired Equivalent Privacy (WEP) Encryption (0=No, 1=Yes) 15 Order |
0000h..7FFFh Duration (0-32767) 8000h Fixed value within frames transmitted during the CFP (CFP=Contention Free Period) 8001h..BFFFh Reserved C000h Reserved C001h..C7D7h Association ID (AID) (1..2007) in PS-Poll frames C7D8h..FFFFh Reserved |
0 Group Flag (0=Individual Address, 1=Group Address) 1 Local Flag (0=Universally Administered Address, 1=Locally Administered) 2-23 22bit Manufacturer ID (assigned by IEEE) 24-47 24bit Device ID (assigned by the Manufacturer) |
00 09 BF xx xx xx NDS-Consoles (Original NDS with firmware v1-v5) 00 16 56 xx xx xx NDS-Consoles (Newer NDS-Lite with firmware v6 and up) 00 23 CC xx xx xx DSi-Consoles (Original DSi with early mainboard; nocash) 00 24 1E xx xx xx DSi-Consoles (Another DSi; scanlime) 40 F4 07 xx xx xx DSI Consoles (with DWM-W024; nocash) 03 09 BF 00 00 00 NDS-Multiboot: host to client (main data flow) 03 09 BF 00 00 10 NDS-Multiboot: client to host (replies) 03 09 BF 00 00 03 NDS-Multiboot: host to client (acknowledges replies) FF FF FF FF FF FF Broadcast to all stations (eg. Beacons) |
Bit Expl. 0-3 Fragment Number (0=First (or only) fragment) 4-15 Sequence Number |
3 bytes Initialization Vector (WEP IV) 1 byte Pad (6bit, all zero), Key ID (2bit) 1..? bytes Data (encrypted data) 4 bytes ICV (encrypted CRC32 across Data) |
DS Wifi IEEE802.11 Managment Frames (Type=0) |
FC(2), Duration(2), DA(6), SA(6), BSSID(6), Sequence Control(2) |
Subtype Frame Body 0 Association request Capability, ListenInterval, SSID, SuppRates 1 Association response Capability, Status, AID, SuppRates 2 Reassociation request Capability, ListenInterval, CurrAP, SSID, SuppRates 3 Reassociation response Capability, Status, AID, SuppRates 4 Probe request SSID, SuppRates 5 Probe response Same as for Beacon (but without TIM) 8 Beacon Timestamp,BeaconInterval,Capability,SSID,SuppRates, FH Parameter Set (when using Frequency Hopping), DS Parameter Set (when using Direct Sequence), CF Parameter Set (when supporting PCF), IBSS Parameter Set (when in an IBSS), TIM (when generated by AP) 9 Announcement traffic indication message (ATIM) Body is "null" (=none?) A Disassociation ReasonCode B Authentication AuthAlgorithm, AuthSequence, Status, ChallengeText C Deauthentication ReasonCode |
Timestamp: value of the TSFTIMER (see 11.1) of a frame's source. Uh? |
Current AP (Access Point): MAC Address of AP with which station is associated |
Capability Information (see list below) Status code (see list below) (0000h=Successful, other=Error code) Reason code (see list below) (Error code) Association ID (AID) (C000h+1..2007) Authentication Algorithm (0=Open System, 1=Shared Key, 2..FFFFh=Reserved) Authentication Transaction Sequence Number (Open System:1-2, Shared Key:1-4) Beacon Interval (Time between beacons, N*1024 us) Listen Interval (see note below) |
ID LEN Expl. 00h 00h-20h SSID Service Set Identity (LEN=0 for broadcast SSID) (ASCII) 01h 01h-08h Supported rates; each (nn AND 7Fh)*500kbit/s, bit7=flag 02h 05h FH (Frequency Hopping) Parameter Set DwellTime(16bit), HopSet, HopPattern, HopIndex 03h 01h DS (Distribution System) Parameter Set; Channel (01h..0Eh) 04h 06h CF Parameter Set; Count, Period, MaxDuration, RemainDuration 05h 04h..FEh TIM; Count,Period,Control, 1-251 bytes PartialVirtualBitmap 06h 02h IBSS Parameter Set; ATIM Window length (16bit) 07h-0Fh - Reserved (07h) .. 802.11d Country (08h) .. 802.11d Hopping Pattern Params (09h) .. 802.11d Hopping Pattern Table (0Ah) .. 802.11d Request 10h 02h..FEh Challenge text; 1-253 bytes Authentication data (Used only for Shared Key sequence no 2,3) (none such for Open System) (none such for Shared key sequence no 1,4) 11h-1Fh - Reserved for challenge text extension 20h-FFh - Reserved (20h) .. 802.11h Power Constraint (21h) .. 802.11h Power Capability (22h) .. 802.11h TPC Request (Transmit Power Control) (23h) .. 802.11h TPC Report (24h) .. 802.11h Supported Channels (25h) .. 802.11h Channel Switch Announcement (26h) .. 802.11h Measurement Request (27h) .. 802.11h Measurement Report (28h) .. 802.11h Quiet (29h) .. 802.11h IBSS DFS 2Ah .. 802.11g ERP Information (spotted in newer beacons) 30h var 802.11i Reserved but used for WPA2 RSNIE <-- officially 32h .. 802.11g Extended Supported Rates (spotted in newer beacons) DDh var Reserved but used for WPA RSNIE <-- vendor specific DDh var Reserved but used by Nintendo for NDS-Multiboot beacons 2Dh .. Unknown (spotted in newer beacons) 2Fh .. Unknown (spotted in newer beacons) 3Dh .. Unknown (spotted in newer beacons) 7Fh .. Unknown (spotted in newer beacons) |
Bit0 ESS Bit1 IBSS Bit2 CF-Pollable Bit3 CF-Poll Request Bit4 Privacy Bit5 Short Preamble (IEEE802.11b only) Bit6 PBCC (IEEE802.11b only) Bit7 Channel Agility (IEEE802.11b only) Bit5-7 Reserved (0) (original IEEE802.11 specs) Bit8-15 Reserved (0) |
... used to indicate to the AP how often an STA wakes to listen to Beacon management frames. The value of this parameter is the STA's Listen Interval parameter of the MLME-Associate. request primitive and is expressed in units of Beacon Interval. |
00h Reserved 01h Unspecified reason 02h Previous authentication no longer valid 03h Deauthenticated because sending station is leaving (or has left) IBSS or ESS 04h Disassociated due to inactivity 05h Disassociated because AP is unable to handle all currently associated stations 06h Class 2 frame received from nonauthenticated station 07h Class 3 frame received from nonassociated station 08h Disassociated because sending station is leaving (or has left) BSS 09h Station requesting (re)association is not authenticated with responding station 0Ah..FFFFh Reserved |
00h Successful 01h Unspecified failure 02h..09h Reserved 0Ah Cannot support all requested cap's in the Capability Information field 0Bh Reassociation denied due to inability to confirm that association exists 0Ch Association denied due to reason outside the scope of this standard 0Dh Responding station doesn't support the specified authentication algorithm 0Eh Received an Authentication frame with authentication transaction sequence number out of expected sequence 0Fh Authentication rejected because of challenge failure 10h Authentication rejected due to timeout waiting for next frame in sequence 11h Association denied because AP is unable to handle additional associated stations 12h Association denied due to requesting station not supporting all of the data rates in the BSSBasicRateSet parameter 13h Association denied due to requesting station not supporting the Short Preamble option (IEEE802.11b only) 14h Association denied due to requesting station not supporting the PBCC Modulation option (IEEE802.11b only) 15h Association denied due to requesting station not supporting the Channel Agility option (IEEE802.11b only) 13h-15h Reserved (original IEEE802.11 specs) 16h..FFFFh Reserved |
DS Wifi IEEE802.11 Control and Data Frames (Type=1 and 2) |
Subtype Frame Header 0-9 Reserved - - - - A Power Save (PS)-Poll FC AID BSSID TA B Request To Send (RTS) FC Duration RA TA C Clear To Send (CTS) FC Duration RA - D Acknowledgment (ACK) FC Duration RA - E Contention-Free (CF)-End FC Duration RA BSSID F CF-End + CF-Ack FC Duration RA BSSID |
FC, Duration/ID, Address 1, Address 2, Address 3, Sequence Control, Address 4 (only on From DS to DS), Frame Body, FCS. |
Frame Control Address 1 Address 2 Address 3 Address 4 From STA to STA DA SA BSSID - From DS to STA DA BSSID SA - From STA to DS BSSID SA DA - From DS to DS RA TA DA SA |
0 Data 1 Data + CF-Ack 2 Data + CF-Poll 3 Data + CF-Ack + CF-Poll 4 Null function (no data) 5 CF-Ack (no data) 6 CF-Poll (no data) 7 CF-Ack + CF-Poll (no data) 8-F Reserved |
DS Wifi WPA/WPA2 Handshake Messages (EAPOL) |
00h 2 Version/Type (or Type/Version?) (01 03) 02h 2 Length of [04h..end] (005Fh+LEN) ;BIG-ENDIAN 04h 1 Descriptor Type (FEh=WPA, 02h=WPA2) 05h 2 Key Information (flags, see below) ;BIG-ENDIAN 07h 2 Key Length (0=None, 20h=TKIP, 10h=CCMP, 05h/0Dh=WEP) ;BIG-ENDIAN 09h 8 Key Replay Counter (usually 0 or 1 in first message) ;BIG-ENDIAN 11h 32 Key Nonce (ANonce/SNonce) 31h 16 Key Data IV (RC4 uses IV+KEK) (not used for AES-Key-Wrap) 41h 8 Key RSC (TSC/PN) (whatever, for GTK) ;LITTLE-ENDIAN 49h 8 Reserved (zerofilled) 51h 16 Key MIC on [00h..end] (with MIC initially zerofilled) ;HMAC 61h 2 Key Data Length (LEN) (00 nn) ;BIG-ENDIAN 63h LEN Key Data (can be encrypted in certain messages) |
0-2 Key Descriptor Version (1=WPA/MD5/RC4, 2=WPA2/SHA1/AESkeywrap) 3 Key Type (0=Group, 1=Pairwise) 4-5 Reserved (0) or WPA Group Key Index (1 or 2) (zero for WPA2) 6 Install (0=No, 1=Yes, configure temporal key) 7 Key Ack (0=No, 1=Yes, AP wants a reply; with same Key Replay Counter) 8 Key MIC (0=No, 1=Yes, key frame contains MIC) 9 Secure (0=No, 1=Yes, initial key-exchange complete) 10 Error (0=No, 1=Yes, MIC failure and Request=1) 11 Request (0=No, 1=Yes, request AP to invoke a new handshake) 12 Encrypted(0=No, 1=Yes, Key Data is encrypted; via RC4 or AESkeywrap) 13-15 Reserved (0) |
00h 1 Element ID (for WPA: DDh=RSNIE - for WPA2: 30h=RSNIE, DDh=KDE) 01h 1 Element Length of [02h..end] 02h .. Element Data (OUI's etc.) |
EAPOL Descriptor Type values WPA WPA2 Meaning FEh 02h Indicates if ElementIDs and OUIs are WPA or WPA2 EAPOL Key Information flags/values 0089h 008Ah Handshake #1 ;\ 0109h 010Ah Handshake #2 ; 4-way Handshake 01C9h 13CAh Handshake #3 ; 0109h(again) 030Ah Handshake #4 ;/ 0391h/03A1h 1382h Handshake #5 ;\Group Key Handshake 0311h/0321h 0302h Handshake #6 ;/ EAPOL Key Data Element IDs DDh 30h Element ID for RSNIE (Robust Network Security info) - DDh Element ID for KDE (Key Data Encapsulation) - DDh Element ID for padding (followed by 00h-bytes) RSNIE Prefix OUI's (WPA only): 00-50-F2-01 - Element Vendor OUI for RSNIE RSNIE Group Cipher suite selector OUI's (aka Multicast): 00-50-F2-01 00-0F-AC-01 RSNIE Group Cipher WEP-40 (default for US/NSA) 00-50-F2-02 00-0F-AC-02 RSNIE Group Cipher TKIP (default for WPA) 00-50-F2-04 00-0F-AC-04 RSNIE Group Cipher CCMP (default for WPA2) 00-50-F2-05 00-0F-AC-05 RSNIE Group Cipher WEP-104 (default for WEP) RSNIE Pairwise Cipher suite selector OUI's (aka Unicast): 00-50-F2-00 00-0F-AC-00 RSNIE Pairwise Cipher None (WEP, Group Cipher only) 00-50-F2-02 00-0F-AC-02 RSNIE Pairwise Cipher TKIP (default for WPA) 00-50-F2-04 00-0F-AC-04 RSNIE Pairwise Cipher CCMP (default for WPA2) RSNIE Authentication AKM suite selector OUI's : 00-50-F2-01 00-0F-AC-01 RSNIE Authentication over IEEE 802.1X (radius?) 00-50-F2-02 00-0F-AC-02 RSNIE Authentication over PSK (default/home use) KDE Key Data Encapsulation OUI's (WPA2 only): - 00-0F-AC-01 KDE GTK (followed by 2+N bytes) - 00-0F-AC-02 KDE STAKey (followed by 2+6+N bytes) - 00-0F-AC-03 KDE MAC address (followed by 6 bytes) - 00-0F-AC-04 KDE PMKID (followed by 16 bytes) |
WPA2 RSNIE (Robust Network Security Information Element): 00h 1 Element ID (30h=RSNIE for WPA2) 01h 1 Element Len of [02h..end] (usually 14h) 02h 2 RSNIE Version 1 (01 00) ;WHATEVER-ENDIAN? 04h 4 RSNIE Group Cipher Suite OUI (CCMP) (00 0F AC 04) 08h 2 RSNIE Pairwise Cipher Suite Count (1) (01 00) ;LITTLE-ENDIAN 0Ah 4 RSNIE Pairwise Cipher Suite OUI (CCMP) (00 0F AC 04) 0Eh 2 RSNIE Authentication Count (1) (01 00) ;LITTLE-ENDIAN 10h 4 RSNIE Authentication OUI (PSK) (00 0F AC 02) 14h 2 RSNIE Capabilities (00 00) ;LITTLE-ENDIAN? 16h (2) RSNIE Optional PMKID Count ;\usually none such ;LITTLE-ENDIAN 18h (16)RSNIE Optional PMKID's ;/ WPA RSNIE (Robust Network Security Information Element): 00h 1 Element ID (DDh=Vendor/RSNIE for WPA) 01h 1 Element Len of [02h..end] (usually 16h or 18h) 02h 4 Element Vendor OUI for RSNIE (00 50 F2 01) ;<-- WPA only 06h 2 RSNIE Version value? (1) (01 00) ;WHATEVER-ENDIAN? 08h 4 RSNIE Mcast OUI (TKIP) (00 50 F2 02) 0Ch 2 RSNIE Ucast Count (1) (01 00) ;LITTLE-ENDIAN 0Eh 4 RSNIE Ucast OUI (TKIP) (00 50 F2 02) 12h 2 RSNIE Auth AKM Count (1) (01 00) ;LITTLE-ENDIAN 14h 4 RSNIE Auth AKM OUI (PSK) (00 50 F2 02) 18h (2) RSNIE Capabilities maybe? (00 00) ;LITTLE-ENDIAN? RSN Capabilities flags (usually 0000h) (also spotted: 0C 00): 0 RSN Pre-Auth capabilities 1 RSN No Pairwise capabilities 2-3 RSN PTKSA Replay Counters (0..3 = 1,2,4,16 replay counters) 4-5 RSN GTKSA Replay Counters (0..3 = 1,2,4,16 replay counters) 6 Managment Frame Protection Required 7 Managment Frame Protection Capable 8 Joint Multi-band RSNA 9 PeerKey Enabled 10 SPP A-MSDU Capable 11 SPP A-MSDU Required 12 PBAC 13 Ext Key ID for Unicast 14-15 Reserved (0) |
WPA2 KDE GTK (Key Data Encapsulation for Group Key, in encrypted Key Data): 00h 1 Element ID (DDh=KDE for WPA2) 01h 1 Element Len (16h) 02h 4 KDE OUI GTK (00-0F-AC-01) (occurs in message 3/5) 06h 1 KDE GTK Key ID (01h or 02h) ;bit2: Tx ? 07h 1 KDE GTK Reserved (00h) 08h 16 KDE GTK Key GTK (for Key ID from above byte [06h]) WPA2 KDE PKMID (Key Data Encapsulation for PKMID) (optional, not needed): 00h 1 Element ID (DDh=KDE for WPA2) 01h 1 Element Len (14h) 02h 4 KDE OUI PMKID (00-0F-AC-04) (optionally occurs in message 1) 06h 16 KDE PMKID (useless checksum on PMK, sometimes exposed in message 1) WPA2 KDE Padding (for padding Key Data to Nx8 bytes for AES-Key-wrap): 00h 1 Element ID (DDh=KDE for WPA2) 01h 0-6 Padding (00h) (aka Element Len=00h) WPA GTK (raw Group Key; without Element ID or KDE-style encapsulation): 00h 16 Key GTK (for Key ID from Key Information bit4-5) (in message 5) |
DS Wifi WPA/WPA2 Keys and MICs |
PSK Preshared Key (based on password and SSID) PMK Pairwise Master Key (same as PSK) PTK Pairwise Transient Key (based on PMK, AA, SPA, ANonce, SNonce) KCK EAPOL Key Confirmation Key (PTK.bit0..127) ;for handshake MIC's KEK EAPOL Key Encryption Key (PTK.bit128..255) ;for handshake Key Data TK Temporal Key (TKIP:PTK.bit256..511, CCMP:PTK.bit256..383) GMK Group Master Key (don't care, used only internally by the access point) GTK Group Transient Key (for multicast/broadcast) (based on GMK, AA, GNonce) |
password ASCII password for the Wifi network SSID ASCII name of access point AA MAC address of access point (BSSID) SPA MAC address of DSi console Anonce Random number from access point (handshake message #1 and #3) Snonce Random number from console (handshake message #2) Gnonce Random number internally used by access point (don't care) |
MIC Message Integrity Code, checksum on EAPOL messages PMKID PMK ID, checksum on PMK and AA, SPA (optional, don't care) |
for i=0 to (dstlen-1)/14 call SHA1HMAC(src,srclen, key,keylen, tmpdst) tmpsum[0..13] = tmpdst[0..13] for j=1 to numrounds-1 ;only if numrounds>1 tmpsrc[0..13] = tmpdst[0..13], tmpsrclen=14 call SHA1HMAC(tmpsrc,tmpsrclen, key,keylen, tmpdst) tmpsum[0..13] = tmpsum[0..13] XOR tmpdst[0..13] next j src[srclen-1] = src[srclen-1] + 01h ;increase last byte of src len=min(14,(dstlen-i*14)) dst[i*14+(0..(len-1))] = tmpsum[0..(len-1)] next i src[srclen-1] = src[srclen-1] - (dstlen+13)/14 ;undo increments, if desired |
key = password, keylen = len(password) ;ASCII string src = ssid + bytes(00h,00h,00h,01h), srclen = len(ssid)+4 ;ASCII string dst = PSK, dstlen = 32, numrounds=4096 call PRF(key,keylen, src,srclen, dst,dstlen, numrounds) PMK=PSK |
src[0..21] = "Pairwise key expansion" src[22] = byte(00h) src[23..28] = min(AA,SPA) ;\MAC addresses (AA=BSSID, SPA=console) src[29..34] = max(AA,SPA) ;/ src[35..66] = min(ANonce,SNonce) ;\nonces from 4-way handshake message 1+2 src[67..98] = max(ANonce,SNonce) ;/ src[99] = byte(00h) srclen = 22+1+6+6+32+32+1 = 100 key=PSK, keylen=32, numrounds=1 dst=PTK, dstlen=64 ;WPA needs dstlen=64 (WPA2 would also work with len=48) call PRF(key,keylen, src,srclen, dst,dstlen, numrounds) KCK = PTK[00h..0Fh] ;-for EAPOL handshake MIC checksums KEK = PTK[10h..1Fh] ;-for EAPOL handshake Key Data decryption TK.key = PTK[20h..2Fh] ;-for data packets TX.tx = PTK[30h..37h] ;\needed for WPA/TKIP only (not WPA2/AES) TX.rx = PTK[38h..3Fh] ;/ TK.keyindex = 0 |
GTK.key = GTK[00h..0Fh] ;-for data packets GTX.tx = GTK[10h..17h] ;\needed for WPA/TKIP only (not WPA2/AES) GTX.rx = GTK[18h..1Fh] ;/ GTK.keyindex = 1 or 2 ;WPA: from EAPOL Key Information bit4-5 GTK.keyindex = 1 or 2 ;WPA2: from EAPOL Key Data KDE entry |
oldmic = EAPOL[51h..60h] EAPOL[51h..60h] = zerofill src=EAPOL, srclen=EAPOL[02h]*100h+EAPOL[03h] key=KCK, keylen=16 if (EAPOL[06h] AND 07h)=1 then call MD5HMAC(src,srclen, key,keylen, dst) if (EAPOL[06h] AND 07h)=2 then call SHA1HMAC(src,srclen, key,keylen, dst) newmic = dst[0..0Fh] ;16-byte MD5 result, or first 16byte of SHA1 result EAPOL[51h..60h] = newmic if newmic <> oldmic then error ;when verifying MIC |
key=PMK, keylen=32 src[0..7] = "PMK Name" src[8..13] = AA ;aka MAC address of access point (BSSID) src[14..19] = SPA ;aka MAC address of console srclen = 8+6+6 = 20 call SHA1HMAC(src,srclen, key,keylen, dst) PMKID = dst[0..0Fh] ;first 16byte of SHA1 result |
src[0..18] = "Group key expansion" src[19] = byte(00h) src[20..25] = AA ;MAC address (AA=BSSID) src[26..57] = GNonce ;whaever random/timer/index src[58] = byte(00h) srclen = 19+1+6+32+1 = 59 key=GMK, keylen=32, numrounds=1 ;whatever random key dst=GTK, dstlen=32 call PRF(key,keylen, src,srclen, dst,dstlen, numrounds) |
DS Wifi WPA/WPA2 Encryption |
Encrypt/Decrypt WPA/WEP packets --> RC4 (Rivest Cipher 4 aka ARC4) Encrypt/Decrypt WPA EAPOL key data --> RC4 (Rivest Cipher 4 aka ARC4) Encrypt/Decrypt WPA2 EAPOL key data --> AES-Key-Wrap/Unwrap Encrypt/Decrypt WPA2 packets --> AES-CCMP (AES-CTR-with-CBC-MAC) |
RC4(src,dst,len,preskip,key,keylen): for i=0 to FFh, sbox[i]=i, next i ;-clear sbox j=0 ;\ for i=0 to FFh ; j=(j+sbox[i]+key[i mod keylen]) and FFh ; apply key swap(sbox[i],sbox[j] ; next i ;/ i=0, j=0 for k=1 to preskip+len i=(i+1) and FFh, j=(j+sbox[i]) and FFh, swap(sbox[i],sbox[j]) if preskip>0 then preskip=preskip-1 else [dst]=[src] xor sbox[(sbox[i]+sbox[j]) and FFh], dst=dst+1, src=src+1 next k parameters for WEP/WPA packets (done by hardware): key=iv(3)+password(5/13), keylen=3+5/13 ;WEP Key=WEP.IV+Password key=iv(3)+from PTK???, keylen=3+??? ;WPA Key=WEP.IV+??? src=data(n)+icv(4), srclen=n+4 ;src, for WEP src=data(n)+mic(8)+icv(4), srclen=n+8+4 ;src, for WPA preskip=0 parameters for WPA EAPOL key data (requires software implementation): key=EAPOL[31h..40h]+KEK[00h..0Fh], keylen=10h+10h ;Key = EAPOL Key IV + KEK src=EAPOL+63h, srclen=bigendian(EAPOL[61h]) ;src, for WPA preskip=100h |
AES-Key-Wrap/Unwrap(src,dst,len,key,keylen,mode) (for WPA2 EAPOL Key Data) if (len and 7)<>0 then error ;must be multiple of 8 ;-verify len aes_setkey(mode,key,keylen) ;-init key if mode=ENCRYPT and [src+00h..07h]<>A6A6A6A6A6A6A6A6h then error ;-verify IV if mode=ENCRYPT then org=dst+8, count=1 ;-for wrap if mode=DECRYPT then org=dst+len-8, count=((len-8)/8)*6 ;-for unwrap [dst+0..len-1] = [src+0..len-1] ;copy IV+DATA to dst [tmp+00h..07h] = [dst+00h..07h] ;read IV from dst+0 for i=1 to 6 ptr=org for j=1 to (len-8)/8 [tmp+08h..0Fh] = [ptr+00h..07h] ;read DATA from dst+index if mode=ENCRYPT then aes_crypt_block(ENCRYPT,tmp,tmp) ;encrypt tmp [tmp+07h]=[tmp+07h] xor count ;adjust byte[7] if mode=DECRYPT then aes_crypt_block(DECRYPT,tmp,tmp) ;decrypt tmp [ptr+00h..07h] = [tmp+08h..0Fh] ;writeback DATA to dst+index if mode=ENCRYPT then ptr=ptr+8, count=count+1 if mode=DECRYPT then ptr=ptr-8, count=count-1 next j next i [dst+00h..07h] = [tmp+00h..07h] ;writeback IV to dst+0 if mode=DECRYPT and [dst+00h..07h]<>A6A6A6A6A6A6A6A6h then error ;-verify IV Parameters for Wrap/Unwrap: mode=ENCRYPT ;<-- for Wrap (encrypt, used by access points) mode=DECRYPT ;<-- for Unwrap (decrypt, used by clients) key=KEK, keylen=10h bytes (128bit) src=EAPOL+63h, srclen=bigendian(EAPOL[61h]) |
.. MAC Header ;-Normal Header 1 TSC1 ;\ WEPSeed[1]=(TSC1 OR 20h) AND 7Fh 1 WEPSeed[1] ; WEP IV and Flags 1 TSC0 (LSB) ; (Flags: bit0-4=Rsvd, bit5=ExtIV, bit6-7=KeyID) 1 Flags ;/ (bit5: 0=No/WEP, 1=Yes/TKIP) 1 TSC2 ;\ 1 TSC3 ; WPA Extended IV 1 TSC4 ; 1 TSC5 (MSB) ;/ .. Data ;-Normal Data ;\ 8 MIC ;-WPA MIC "Michael" ; encrypted area 4 ICV ;-WEP ICV ;/ 4 FCS ;-Normal FCS |
.. MAC Header ;-Normal Header 1 PN0 (LSB) ;\ 1 PN1 ; CCMP Header (IV and Flags) 1 Rsvd ; (Flags: bit0-4=Rsvd, bit5=ExtIV, bit6-7=KeyID) 1 Flags ; (bit5: 0=No/WEP, 1=Yes/TKIP) 1 PN2 ; 1 PN3 ; 1 PN4 ; 1 PN5 (MSB) ;/ .. Data ;-Normal Data ;\encrypted area 8 MIC ;-CCMP MIC "AES MAC?" ;/ 4 FCS ;-Normal FCS |
6 DA 6 SA 1 Priority (0) (reserved for future) 3 Zero (0) (also reserved for future) .. Data 8 MIC (M0..M7) (aka L0..L3, R0..R3) |
TTAK = Phase1 (TK, TA, TSC) WEP seed = Phase2 (TTAK, TK, TSC) |
DS Xboo |
Console Pin/Names Parallel Port Pin/Names RFU.9 FMW.1 D ---|>|--- DSUB.14 CNTR.14 AutoLF RFU.6 FMW.2 C ---|>|--- DSUB.1 CNTR.1 Strobe RFU.10 FMW.3 /RES ---|>|--- DSUB.16 CNTR.31 Init RFU.7 FMW.4 /S ---|>|--- DSUB.17 CNTR.36 Select RFU.5 FMW.5 /W --. SL1A - - N.C. RFU.28 FMW.6 VCC __| SL1B - - N.C. RFU.2,12 FMW.7 VSS --------- DSUB.18-25 CNTR.19-30 Ground RFU.8 FMW.8 Q --------- DSUB.11 CNTR.11 Busy P00 Joypad-A ---|>|--- DSUB.2 CNTR.2 D0 P01 Joypad-B ---|>|--- DSUB.3 CNTR.3 D1 P02 Joypad-Select ---|>|--- DSUB.4 CNTR.4 D2 P03 Joypad-Start ---|>|--- DSUB.5 CNTR.5 D3 P04 Joypad-Right ---|>|--- DSUB.6 CNTR.6 D4 P05 Joypad-Left ---|>|--- DSUB.7 CNTR.7 D5 P06 Joypad-Up ---|>|--- DSUB.8 CNTR.8 D6 P07 Joypad-Down ---|>|--- DSUB.9 CNTR.9 D7 RTC.1 INT aka SI --------- DSUB.10 CNTR.10 /Ack |
http://problemkaputt.de/nds-pins.gif (GIF-Image, 7.5KBytes) |
DSi Reference |
DSi Basic Differences to NDS |
4004020h - SCFG_WL 4004C04h - GPIO_WIFI BPTWL[30h] - Wifi LED related (also needed to enable Atheros Wifi SDIO) |
DSi I/O Map |
0000000h 64Kbyte ARM7 BIOS (unlike NDS which had only 16KB) 2000000h 16MByte Main RAM (unlike NDS which had only 4MB) 3000000h 800Kbyte Shared RAM (unlike NDS which had only 32KB) 4004000h New DSi I/O Ports 8000000h Fake GBA Slot (32MB+64KB) (FFh-filled; when mapped to current CPU) C000000h Mirror of 16Mbyte Main RAM D000000h Open Bus? in retail version, Extra 16Mbyte MainRAM in debug version FFFF000h 64Kbyte ARM9 BIOS (unlike NDS which had only 4KB) |
4000004h 2 DISPSTAT (new Bit6, LCD Initialization Ready Flag) 4000204h 2 EXMEMCNT (removed Bit0-7, ie. the GBA-slot related bits) 4000210h 4 IE (new interrupt sources, removed GBA-slot IRQ) 4000214h 4 IF (new interrupt sources, removed GBA-slot IRQ) 40021A0h 4 Unknown, nonzero, probably same/silimar as on DSi7 side 40021A4h 4 Unknown, zero, probably same/silimar as on DSi7 side 40021A8h .. 40021Bxh .. 4102010h 4 |
4004000h 2 SCFG_A9ROM DSi - NDS9 - ROM Status (R) [0000h] 4004004h 2 SCFG_CLK DSi - NDS9 - New Block Clock Control (R/W) 4004006h 2 SCFG_RST DSi - NDS9 - New Block Reset (R/W) 4004008h 4 SCFG_EXT DSi - NDS9 - Extended Features (R/W) 4004010h 2 SCFG_MC Memory Card Interface Status (16bit) (undocumented) |
4004040h 4 MBK1 WRAM-A Slots for Bank 0,1,2,3 ;\Global ARM7+ARM9 4004044h 4 MBK2 WRAM-B Slots for Bank 0,1,2,3 ; Slot Mapping 4004048h 4 MBK3 WRAM-B Slots for Bank 4,5,6,7 ; (R or R/W, depending 400404Ch 4 MBK4 WRAM-C Slots for Bank 0,1,2,3 ; on MBK9 setting) 4004050h 4 MBK5 WRAM-C Slots for Bank 4,5,6,7 ;/ 4004054h 4 MBK6 WRAM-A Address Range ;\Local ARM9 Side 4004058h 4 MBK7 WRAM-B Address Range ; (R/W) 400405Ch 4 MBK8 WRAM-C Address Range ;/ 4004060h 4 MBK9 WRAM-A/B/C Slot Write Protect (R) |
4004100h 4 NDMAGCNT NewDMA Global Control ;-Control 4004104h 4 NDMA0SAD NewDMA0 Source Address ;\ 4004108h 4 NDMA0DAD NewDMA0 Destination Address ; 400410Ch 4 NDMA0TCNT NewDMA0 Total Length for Repeats ; NewDMA0 4004110h 4 NDMA0WCNT NewDMA0 Logical Block Size ; 4004114h 4 NDMA0BCNT NewDMA0 Block Transfer Timing/Interval ; 4004118h 4 NDMA0FDATA NewDMA0 Fill Data ; 400411Ch 4 NDMA0CNT NewDMA0 Control ;/ 4004120h 4 NDMA1SAD ;\ 4004124h 4 NDMA1DAD ; 4004128h 4 NDMA1TCNT ; NewDMA1 400412Ch 4 NDMA1WCNT ; 4004130h 4 NDMA1BCNT ; 4004134h 4 NDMA1FDATA ; 4004138h 4 NDMA1CNT ;/ 400413Ch 4 NDMA2SAD ;\ 4004140h 4 NDMA2DAD ; 4004144h 4 NDMA2TCNT ; NewDMA2 4004148h 4 NDMA2WCNT ; 400414Ch 4 NDMA2BCNT ; 4004150h 4 NDMA2FDATA ; 4004154h 4 NDMA2CNT ;/ 4004158h 4 NDMA3SAD ;\ 400415Ch 4 NDMA3DAD ; 4004160h 4 NDMA3TCNT ; NewDMA3 4004164h 4 NDMA3WCNT ; 4004168h 4 NDMA3BCNT ; 400416Ch 4 NDMA3FDATA ; 4004170h 4 NDMA3CNT ;/ |
4004200h 2 CAM_MCNT Camera Module Control (16bit) 4004202h 2 CAM_CNT Camera Control (16bit) 4004204h 4 CAM_DAT Camera Data (32bit) 4004210h 4 CAM_SOFS Camera Trimming Starting Position Setting (32bit) 4004214h 4 CAM_EOFS Camera Trimming Ending Position Setting (32bit) |
4004300h 2 DSP_PDATA DSP Transfer Data (16bit) 4004304h 2 DSP_PADR DSP Transfer Address (16bit) 4004308h 2 DSP_PCFG DSP Configuration (16bit) 400430Ch 2 DSP_PSTS DSP Status (16bit) 4004310h 2 DSP_PSEM DSP ARM9-to-DSP Semaphore (16bit) 4004314h 2 DSP_PMASK DSP DSP-to-ARM9 Semaphore Mask (16bit) 4004318h 2 DSP_PCLEAR DSP DSP-to-ARM9 Semaphore Clear (W) (16bit) 400431Ch 2 DSP_SEM DSP DSP-to-ARM9 Semaphore Data (16bit) 4004320h 2 DSP_CMD0 DSP Command Register 0 (16bit) 4004324h 2 DSP_REP0 DSP Reply Register 0 (16bit) 4004328h 2 DSP_CMD1 DSP Command Register 1 (16bit) 400432Ch 2 DSP_REP1 DSP Reply Register 1 (16bit) 4004330h 2 DSP_CMD2 DSP Command Register 2 (16bit) 4004334h 2 DSP_REP2 DSP Reply Register 2 (16bit) 4004340h 40h Unknown (looks like mirror of 4004300h..400433Fh) 4004380h 40h Unknown (looks like mirror of 4004300h..400433Fh) 40043C0h 40h Unknown (looks like mirror of 4004300h..400433Fh) |
4000004h 2 DISPSTAT (new Bit6, LCD Initialization Ready Flag) (as DSi9?) 4000204h 2 EXMEMCNT (removed Bit0-7: GBA-slot related bits) (as DSi9?) 4000210h 4 IE (new interrupt sources, removed GBA-slot IRQ) 4000214h 4 IF (new interrupt sources, removed GBA-slot IRQ) 4000218h IE2 (new register with more new interrupt sources) 400021Ch IF2 (new register with more new interrupt sources) |
40021A0h 4 Unknown, nonzero, probably related to below 40021A4h 40021A4h 4 Unknown, related to 40001A4h (Gamecard Bus ROMCTRL) 40021A8h .. 40021Bxh .. 4102010h 4 |
4004000h 1 SCFG_A9ROM used by BIOS and SystemFlaw (bit0,1) 4004001h 1 SCFG_A7ROM used by BIOS and SystemFlaw (bit0,1,2) 4004004h 2 SCFG_CLK7 used by SystemFlaw 4004006h 2 SCFG_JTAG Debugger Control 4004008h 4 SCFG_EXT7 used by SystemFlaw 4004010h 2 SCFG_MC Memory Card Interface Control (R/W) 4004012h 2 SCFG_1988H Unknown, there is something (?) (SysMenu: 1988h) 4004014h 2 SCFG_264CH Unknown, there is something (?) (SysMenu: 264Ch) 4004020h 2 SCFG_WL Wireless Disable ;bit0 = wifi? 4004024h 2 SCFG_OP Debugger Type (R) ;bit0-1 = (0=retail, ?=debug) |
4004040h 4 MBK1 WRAM-A Slots for Bank 0,1,2,3 ;\ 4004044h 4 MBK2 WRAM-B Slots for Bank 0,1,2,3 ; Global ARM7+ARM9 4004048h 4 MBK3 WRAM-B Slots for Bank 4,5,6,7 ; Slot Mapping (R) 400404Ch 4 MBK4 WRAM-C Slots for Bank 0,1,2,3 ; (set on ARM9 side) 4004050h 4 MBK5 WRAM-C Slots for Bank 4,5,6,7 ;/ 4004054h 4 MBK6 WRAM-A Address Range ;\Local ARM7 Side 4004058h 4 MBK7 WRAM-B Address Range ; (R/W) 400405Ch 4 MBK8 WRAM-C Address Range ;/ 4004060h 4 MBK9 WRAM-A/B/C Slot Write Protect (R/W) |
4004100h 74h NewDMA (new DMA, as on ARM9i, see there) |
4004400h 4 AES_CNT (R/W) 4004404h 4 AES_BLKCNT (W) 4004408h 4 AES_WRFIFO (W) 400440Ch 4 AES_RDFIFO (R) 4004420h 16 AES_IV (W) 4004430h 16 AES_MAC (W) 4004440h 48 AES_KEY0 (W) ;used for modcrypt 4004470h 48 AES_KEY1 (W) ;used for ? 40044A0h 48 AES_KEY2 (W) ;used for JPEG signatures 40044D0h 48 AES_KEY3 (W) ;used for eMMC sectors |
4004500h 1 I2C_DATA 4004501h 1 I2C_CNT |
4004600h 2 MIC_CNT ? 4004604h 4 MIC_DATA ? |
4004700h 2 SNDEXCNT <-- can be read even in DS mode! |
4004800h 2 SD_CMD Command and Response/Data Type 4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh) 4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords) 4004808h 2 SD_STOP_INTERNAL_ACTION 400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count" 400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords) 400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req) 4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable) 4004824h 2 SD_CARD_CLK_CTL Card Clock Control 4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length 4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh) 400482Ah 2 Fixed always zero? 400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status 4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?) 4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?) 4004834h 2 SD_CARD_IRQ_ENABLE ;(SD_TRANSACTION_CTL) 4004836h 2 SD_CARD_IRQ_STAT ;(SD_CARD_INTERRUPT_CONTROL) 4004838h 2 SD_CARD_IRQ_DISABLE ;(SDCTL_CLK_AND_WAIT_CTL) 400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION) 400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL) 400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL) 4004840h 2 Fixed always 003Fh? 4004842h 2 Fixed always 002Ah? 4004844h 6Eh Fixed always zerofilled? 40048B2h 2 Fixed always FFFFh? 40048B4h 6 Fixed always zerofilled? 40048BAh 2 Fixed always 0200h? 40048BCh 1Ch Fixed always zerofilled? 40048D8h 2 SD_DATA_CTL 40048DAh 6 Fixed always zerofilled? 40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset) 40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV) 40048E4h 2 Fixed always zero? 40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR) 40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header) 40048EAh 6 Fixed always zerofilled? 40048F0h 2 Fixed always zero? ;(RESERVED10) 40048F2h 2 ? Can be 0003h 40048F4h 2 ? Can be 0770h 40048F6h 2 SD_WRPROTECT_2 (R) ;Wprot for eMMC (RESERVED4) 40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5) 40048FAh 2 ? Can be 0000h..0007h (nonzero, unlike SDIO) (RESERVED6) 40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7) 40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision) 4004900h 2 SD_DATA32_IRQ 4004902h 2 Fixed always zero? 4004904h 2 SD_DATA32_BLK_LEN 4004906h 2 Fixed always zero? 4004908h 2 SD_DATA32_BLK_COUNT 400490Ah 2 Fixed always zero? 400490Ch 4 SD_DATA32_FIFO 4004910h F0h Fixed always zerofilled? |
4004A00h 512 SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there) 4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h) 4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5) 4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6) |
4004C00h 1 GPIO Data In (R) (even in DS mode) 4004C00h 1 GPIO Data Out (W) 4004C01h 1 GPIO Data Direction (R/W) 4004C02h 1 GPIO Interrupt Edge Select (R/W) 4004C03h 1 GPIO Interrupt Enable (R/W) 4004C04h 2 GPIO_WIFI (R/W) |
4004D00h 8 CPU/Console ID Code (64bit) (R) 4004D08h 2 CPU/Console ID Flag (1bit) (R) |
8030200h 2 GBA area, accessed alongsides with SDIO port [4004A30h] (bug?) |
DSi Control Registers (SCFG) |
0 ARM9 BIOS Upper 32K half of DSi BIOS (0=Enabled, 1=Disabled) 1 ARM9 BIOS for NDS Mode (0=DSi BIOS, 1=NDS BIOS) 2-15 Unused (0) 16-31 Unspecified (0) |
00h DSi ROM mapped at FFFFxxxxh, full 64K enabled (during bootstage 1 only) 01h DSi ROM mapped at FFFFxxxxh, lower 32K only 03h NDS ROM mapped at FFFFxxxxh (internal setting) 00h NDS ROM mapped at FFFFxxxxh (visible setting due to SCFG_EXT.bit31=0) |
0 ARM9 BIOS Upper 32K half of DSi BIOS (0=Enabled, 1=Disabled) 1 ARM9 BIOS for NDS Mode (0=DSi BIOS, 1=NDS BIOS) 2-7 Unused (0) 8 ARM7 BIOS Upper 32K half of DSi BIOS (0=Enabled, 1=Disabled) 9 ARM7 BIOS for NDS Mode (0=DSi BIOS, 1=NDS BIOS) 10 Access to Console ID registers (0=Enabled, 1=Disabled) (4004Dxxh) 11-31 Unused (0) |
0 ARM9 CPU Clock (0=NITRO/67.03MHz, 1=TWL/134.06MHz) (TCM/Cache) 1 Teak DSP Block Clock (0=Stop, 1=Run) 2 Camera Interface Clock (0=Stop, 1=Run) 3-6 Unused (0) 7 New Shared RAM Clock (0=Stop, 1=Run) (set via ARM7) (R) 8 Camera External Clock (0=Disable, 1=Enable) ("outputs at 16.76MHz") 9-15 Unused (0) 16-31 See below (Port 4004006h, SCFG_RST) |
0 SD/MMC Clock (0=Stop, 1=Run) (should be same as SCFG_EXT7.bit18) 1 Unknown/used (0=Stop, 1=Run) (?) (maybe SDIO/wifi clock or so?) 2 Unknown/used (0=Stop, 1=Run) (?) 3-6 Unused (0) 7 New Shared RAM Clock (0=Stop, 1=Run) 8 Touchscreen Clock (0=Stop, 1=Run) (needed for touchscr input) 9-15 Unused (0) 16-31 See below (Port 4004006h, SCFG_JTAG) |
0 DSP Block Reset (0=Apply Reset, 1=Release Reset) 1-15 Unused (0) |
0 ARM7SEL (set when debugger can do ARM7 debugging) 1 CPU JTAG Enable 2-7 Unused (0) 8 DSP JTAG Enable 9-15 Unused (0) |
0 Revised ARM9 DMA Circuit (0=NITRO, 1=Revised) 1 Revised Geometry Circuit (0=NITRO, 1=Revised) 2 Revised Renderer Circuit (0=NITRO, 1=Revised) 3 Revised 2D Engine Circuit (0=NITRO, 1=Revised) 4 Revised Divider Circuit (0=NITRO, 1=Revised) 5-6 Unused (0) 7 Revised Card Interface Circuit (0=NITRO, 1=Revised) 8 Extended ARM9 Interrupts (0=NITRO, 1=Extended) 9-11 Unused (0) 12 Extended LCD Circuit (0=NITRO, 1=Extended) 13 Extended VRAM Access (0=NITRO, 1=Extended) 14-15 Main Memory RAM Limit (0..1=4MB/DS, 2=16MB/DSi, 3=32MB/DSiDebugger) 16 Access to New DMA Controller (0=Disable, 1=Enable) (40041xxh) 17 Access to Camera Interface (0=Disable, 1=Enable) (40042xxh) 18 Access to Teak DSP Block (0=Disable, 1=Enable) (40043xxh) 19-23 Unused (0) 24 Access to 2nd NDS Cart Slot (0=Disable, 1=Enable) (set via ARM7) (R) 25 Access to New Shared WRAM (0=Disable, 1=Enable) (set via ARM7) (R) 26-30 Unused (0) 31 Access to SCFG/MBK registers (0=Disable, 1=Enable) (4004000h-4004063h) |
8307F100h for DSi firmware, DSi cartridges and DSiware 03000000h for NDS cartridges (and DSiware in NDS mode, eg. Pictochat) |
Mode 2000000h-2FFFFFFh C000000h-CFFFFFFh D000000h-DFFFFFFh 4MB (0 or 1) 1st 4MB (+mirrors) Zerofilled Zerofilled 16MB (2) 1st 16MB 1st 16MB (mirror) 1st 16MB (mirror) 32MB (3) 1st 16MB 1st 16MB (mirror) Open bus (or 2nd 16MB) |
0 Revised ARM7 DMA Circuit (0=NITRO, 1=Revised) 1 Revised Sound DMA (0=NITRO, 1=Revised) 2 Revised Sound (0=NITRO, 1=Revised) 3-6 Unused (0) 7 Revised Card Interface Circuit (0=NITRO, 1=Revised) (set via ARM9) (R) 8 Extended ARM7 Interrupts (0=NITRO, 1=Extended) (4000218h) 9 Undocumented/Unknown ?? (0=NITRO, 1=Extended) (?) 10 Extended Sound DMA ? (0=NITRO, 1=Extended) (?) 11 Undocumented/Unknown ?? (0=NITRO, 1=Extended) (?) 12 Extended LCD Circuit (0=NITRO, 1=Extended) (set via ARM9) (R) 13 Extended VRAM Access (0=NITRO, 1=Extended) (set via ARM9) (R) 14-15 Main Memory RAM Limit (0..1=4MB, 2=16MB, 3=32MB) (set via ARM9) (R) 16 Access to New DMA Controller (0=Disable, 1=Enable) (40041xxh) 17 Access to AES Unit (0=Disable, 1=Enable) (40044xxh) 18 Access to SD/MMC registers (0=Disable, 1=Enable) (40048xxh-40049xxh) 19 Access to SDIO Wifi registers (0=Disable, 1=Enable) (4004Axxh-4004Bxxh) 20 Access to Microphone regs (0=Disable, 1=Enable) (40046xxh) 21 Access to SNDEXCNT register (0=Disable, 1=Enable) (40047xxh) 22 Access to I2C registers (0=Disable, 1=Enable) (40045xxh) 23 Access to GPIO registers (0=Disable, 1=Enable) (4004Cxxh) 24 Access to 2nd NDS Cart Slot (0=Disable, 1=Enable) (40021xxh) 25 Access to New Shared WRAM (0=Disable, 1=Enable) (3xxxxxxh) 26-27 Unused (0) 28 Undocumented/Unknown (0=???, 1=Normal) (?) 29-30 Unused (0) 31 Access to SCFG/MBK registers (0=Disable, 1=Enable) (4004000h-4004063h) |
93FFFB06h for DSi Firmware (Bootcode and SysMenu/Launcher) 13FFFB06h for DSiware (eg. SysSettings, Flipnote, PaperPlane) 13FBFB06h for DSi Cartridges (eg. System Flaw) (bit18=0=sdmmc off) 12A03000h for NDS cartridges (and DSiware in NDS mode, eg. Pictochat) |
0 1st NDS Slot Game Cartridge (0=Inserted, 1=Ejected) (R) 1 1st NDS Slot Unknown/Undocumented (0) 2-3 1st NDS Slot Power State (0=Off, 1=PrepareOn, 2=On, 3=RequestOff) (R/W) 4 2nd NDS Slot Game Cartridge (always 1=Ejected) ;\DSi (R) 5 2nd NDS Slot Unknown/Undocumented (0) ; prototype 6-7 2nd NDS Slot Power State (always 0=Off) ;/relict (R/W) 8-14 Unknown/Undocumented (0) 15 Swap NDS Slots (0=Normal, 1=Swap) (R/W) 16-31 ARM7: See Port 4004012h, ARM9: Unspecified (0) |
0=Power is off 1=Prepare Power on (shall be MANUALLY changed to state=2) 2=Power is on 3=Request Power off (will be AUTOMATICALLY changed to state=0) |
wait until state<>3 ;wait if pwr off busy? exit if state<>0 ;exit if already on? wait 1ms, then set state=1 ;prepare pwr on? or want RESET ? wait 10ms, then set state=2 ;apply pwr on? ;better: 1ms wait 27ms, then set ROMCTRL=20000000h ;release reset signal ;better: 0ms wait 120ms ;more insane delay? ;better: 1ms |
wait until state<>3 ;wait if pwr off busy? exit if state<>2 ;exit if already off? set state=3 ;request pwr off? wait until state=0 ;wait until pwr off <-- SLOW: 153ms!!! |
0-15 Unknown (R/W) |
0 OFFB, Related to Wifi Enable flag from TWLCFGn.dat files? 1-15 Unknown/unused (0) |
0-1 Debug Hardware Type (0=Retail, other=debug variants) 2-3 Unknown/unused (0) 4 Unknown (maybe used, since it isn't masked & copied to RAM) 5-15 Unknown/unused (0) |
DSi XpertTeak (DSP) |
DSi Teak Misc |
TeakLite Architecture Specification Revision 4.41 (DSP Group Inc.) OakDSPCore Technical Manuals for CWDSP1640 or CWDSP167x (LSI Logic) OakDSPCore DSP Subsystem AT75C (Atmel) |
TeakLite II disassembler dll in RVDS (RealView Developer Suite) 4.0 Pro |
0000h..7FFFh X Space (for RAM, with 1-stage write-buffer) ;min zero 8000h..87FFh Z Space (for Memory-mapped I/O, no write-buffer) ;min zero 8800h..FFFFh Y Space (for RAM, with 1-stage write-buffer)) ;min 1Kword |
NumCycles = max(NumberOfOpcodeWords, NumberOfDataReadsWrites) |
DSi Teak I/O Ports (on ARM9 Side) |
0-15 Data (one stage of the 16-stage Read FIFO) |
0-15 Data (one stage of the 16-stage Write FIFO) |
0-15 Lower 16bit of Address in DSP Memory |
0 DSP Reset (0=Release, 1=Reset) ;should be held "1" for 8 DSP clks 1 Address Auto-Increment (0=Off, 1=On) 2-3 DSP Read Data Length (0=1 word, 1=8 words, 2=16 words, 3=Free-Run) 4 DSP Read Start Flag (mem transfer via Read FIFO) (1=Start) 5 Interrupt Enable Read FIFO Full (0=Off, 1=On) 6 Interrupt Enable Read FIFO Not-Empty (0=Off, 1=On) 7 Interrupt Enable Write FIFO Full (0=Off, 1=On) 8 Interrupt Enable Write FIFO Empty (0=Off, 1=On) 9 Interrupt Enable Reply Register 0 (0=Off, 1=On) 10 Interrupt Enable Reply Register 1 (0=Off, 1=On) 11 Interrupt Enable Reply Register 2 (0=Off, 1=On) 12-15 DSP Memory Transfer (0=Data Memory, 1=MMIO Register, 5=Program Memory) |
0 Read Transfer Underway Flag (0=No, 1=Yes/From DSP Memory) 1 Write Transfer Underway Flag (0=No, 1=Yes/To DSP Memory) 2 Peripheral Reset Flag (0=No/Ready, 1=Reset/Busy) 3-4 Unused 5 Read FIFO Full Flag (0=No, 1=Yes) 6 Read FIFO Not-Empty Flag (0=No, 1=Yes) ;ARM9 may read DSP_PDATA 7 Write FIFO Full Flag (0=No, 1=Yes) 8 Write FIFO Empty Flag (0=No, 1=Yes) 9 Semaphore IRQ Flag (0=None, 1=IRQ) 10 Reply Register 0 Update Flag (0=Was Written by DSP, 1=No) 11 Reply Register 1 Update Flag (0=Was Written by DSP, 1=No) 12 Reply Register 2 Update Flag (0=Was Written by DSP, 1=No) 13 Command Register 0 Read Flag (0=Was Read by DSP, 1=No) 14 Command Register 1 Read Flag (0=Was Read by DSP, 1=No) 15 Command Register 2 Read Flag (0=Was Read by DSP, 1=No) |
0-15 ARM9-to-DSP Semaphore 0..15 Flags (0=Off, 1=On) |
0-15 DSP-to-ARM9 Semaphore 0..15 Interrupt Disable (0=Enable, 1=Disable) |
0-15 DSP-to-ARM9 Semaphore 0..15 Clear (0=No Change, 1=Clear) |
0-15 DSP-to-ARM9 Semaphore 0..15 Flags (0=Off, 1=On) |
0-15 Command/Data to DSP |
0-15 Reply/Data from DSP |
DSi Teak I/O Map (on Teak side) |
8000h 3300 3300 3300 R Fixed 3300h 8002h 3300 3300 3300 R Fixed 3300h (maybe mirror of port 8000h) |
8004h 0000 0000 87FF 8006h ? ? ? ?? DANGER (crashes on read) 8008h..800Eh 3300 3300 3300 R Fixed 3300h (maybe mirror of port 8000h) |
8010h 0000 0000 0003 8012h 0000 0000 0003 8014h 0000 0000 FFFF 8016h 0000 0000 0000 8018h 0000 0000 BDEF ;...(writing [8018h]=8018h causes "8238h") 801Ah C902 C902 C902 R used for chip detect (for xpert_offsets_tbl) 801Ch 0003 0003 0003 801Eh 0003 0003 0003 |
8020h 0000 0000 ?? DANGER (causes TRAP exception) 8022h 0000 0000 0000 8024h 0000 0000 FFFF R/W 8026h 0000 0000 FFFF R/W 8028h 0000 0000 0000 802Ah 0000 0000 0000 802Ch 0000 0000 FFFF R/W 802Eh 0000 0000 FFFF R/W 8030h 0000 0000 ;\ <-- DANGER 8032h 0000 0000 0000 ; 8034h 0000 0000 FFFF ; looks like resembling port 8020h..802Fh 8036h 0000 0000 FFFF ; 8038h 0000 0000 0000 ; 803Ah 0000 0000 0000 ; 803Ch 0000 0000 FFFF ; 803Eh 0000 0000 FFFF ;/ 8040h..804Eh 3300 3300 3300 R Fixed 3300h (maybe mirror of port 8000h) |
8050h 7000 0000 F03F 8052h 0000 0000 7F7F 8054h 0000 0000 0000 8056h 0000 0000 0001 8058h 0000 0000 0000 805Ah..805Eh F03F F03F F03F R Mirror of port 8050h |
8060h 0105 0105 0105 <-- or other value (034Fh when [NNNNh]=NNNNh) 8061h 0000 0000 0000 8062h FFFF 0000 FFFF ;\ 8063h 0F03 0000 0F03 ;/ 8064h FFFF 0000 FFFF ;\ 8065h 0F03 0000 0F03 ;/ 8066h FFFF 0000 FFFF ;\ 8067h 0F03 0000 0F03 ;/ 8068h 00FF 0000 00FF ;\ 8069h 00FF 0000 00FF ; 806Ah 00FF 0000 00FF ;/ 806Bh FFFF 0000 FFFF 806Ch FFFF 0000 FFFF 806Dh 0000 0000 DANGER (causes TRAP exception) 806Eh 3001 0000 FFFF 806Fh 0000 0000 BFFF 8070h 0000 0000 0001 8072h 0000 0000 FFFF 8074h C000 C000 C000 8076h..807Eh 0105 0105 0105 R Mirror of port 8060h |
8080h C00E 0000 FFFF 8082h 0001 0000 0001 8084h 8000 DANGER 8086h 0000 DANGER 8088h 0000 0000 07BF 808Ah 0000 0000 07BF 808Ch 0000 0000 07BF 808Eh 0000 0000 07BF 8090h 0000 0000 06BF ;! 8092h 0000 0000 05BF ;! 8094h 0000 0000 07BF 8096h 0000 0000 0002 8098h 0000 0000 0302 809Ah 0000 0000 0003 809Ch 0000 0000 0003 809Eh 0000 0000 0003 80A0h 0000 0000 0003 80A2h 0000 0000 0003 80A4h 0000 0000 0003 80A6h 0000 0000 0003 80A8h 0000 0000 0003 80AAh 0000 0000 FFFF waitstates? writing FFFFh causes SLOWDOWN? 80ACh 0000 0000 FFFF 80AEh 0000 0000 FFFF 80B0h..80BEh FFFF FFFF FFFF R Mirror of port 8080h |
80C0h xxxx xxxx xxxx R/W T_REPLY0 (to ARM) 80C2h 4300 4300 4300 R T_CMD0 (from ARM) 80C4h 0000 0000 FFFF R/W T_REPLY1 (to ARM) 80C6h 3123 3123 3123 R T_CMD1 (from ARM) 80C8h 0000 0000 FFFF R/W T_REPLY2 (to ARM) 80CAh 3223 3223 3223 R T_CMD2 (from ARM) 80CCh 0000 0000 FFFF R/W APBP_SetSemaphore DSP-to-ARM (R/W) 80CEh 0000 ?? (unknown, maybe semaphore irq-mask?) (R/W) 80D0h 0000 ?? APBP_AckSemaphore ARM-to-DSP (W) 1=clr 80D2h AFFE AFFE AFFE R APBP_GetSemaphore ARM-to-DSP (R) 80D4h 0000 ?? (parts R/W, irq mask?)(DANGER: can crash cpu) 80D6h 03C0 03C0 03C0 R command/reply flags 80D8h 3B00 3B00 3B00 R <-- ..can be this or that 80DAh..80DEh 0000 0000 0000 R Fixed 0000h |
80E0h 0000 0000 0000 R Fixed 0000h 80E2h+N*6 0000 0000 0FBF R/W ;\whatever N=0..2(0010h=?,0020h=?,0025h=dma?) 80E4h+N*6 0000 0000 03FF R/W ; whatever N=0..2(0200h=read, 0300h=write) 80E6h+N*6 0000 0000 00FF R/W ;/whatever N=0..2(bit0-7=dma0..7,0000h=reset) 80F4h 0000 0000 FC00 R/W 80F6h 0000 0000 0000 ?? 80F8h 0000 0000 0000 ?? 80FAh 0000 0000 FFFF R/W 80FCh FFFF 0000 FFFF R/W 80FEh 0000 0000 FFFF R/W |
8100h FFFF 0000 FFFF 8102h 0FFF 0000 0FFF 8104h 0000 0000 FFFF 8106h 0000 0000 FFFF 8108h 0000 0000 FFFF 810Ah 0000 0000 FFFF 810Ch 0014 0014 0014 R Mirror of port 811Ah 810Eh 0000 0000 FFFF 8110h 0000 0000 00FF 8112h 0000 DANGER 8114h 1E20 R/W miu_config_page_memory_limits (done 2x) 8116h 1E20 0100 403F 8118h 1E20 0100 403F 811Ah 0014 00x4 R/W DANGER crashes (but bit4 can be cleared) 811Ch 0004 0000 007F 811Eh 8000 R/W miu_relocate_mmio (8000h AND FC00h) (done 1x) 8120h 0000 0000 000F 8122h 0000 0000 007F 8124h..813Eh 0014 0014 0014 R Mirror of port 811Ah |
8140h+N*4 0000 0000 FFFF ;\whatever, for Index N=0..0Eh 8142h+N*4 0000 0000 803F ;/ 817Ch 0000 0000 FFFF ;\whatever, for Index 0Fh 817Eh 0000 0000 C03F ;/ ;<--with bit14! |
8180h 0000 0000 0000 ?? 8182h 0000 0000 0000 ?? 8184h 0001 0000 00FF R/W channel enable flag(s)? 8186h 0000 0000 00FF R/W 8188h..818Ch 0000 0000 0000 R Fixed 0000h seox (end of transfer flags?) 818Eh 3210 0000 7777 R/W ;\ 8190h 7654 0000 7777 R/W ;/ 8192h 0000 0000 7C03 R/W 8194h..81B4h 0000 0000 0000 R Fixed 0000h 81B6h 0000 0000 FFFF R/W 81B8h 0000 0000 FFFF R/W 81BAh 0000 0000 FFFF R/W 81BCh 0000 0000 FFFF R/W 81BEh 0000 0000 0007 R/W gcs_dtcca (dma channel; bank for 81C0h-81DEh) 81C0h:0..7 0000 0000 FFFF R/W ;\ ;\maybe addr1? ;lo ;\ 81C2h:0..7 0000 0000 FFFF R/W ; ;/ ;hi ; 81C4h:0..7 0000 0000 FFFF R/W ; ;\maybe addr2? ;lo ; five actual params 81C6h:0..7 0000 0000 FFFF R/W ; ;/ ;hi ; 81C8h:0..7 FFFF 0001 FFFF R/W ; ;-maybe len? ;/ 81CAh:0..7 0001 0001 FFFF R/W ; ;-usually 1 ;\ 81CCh:0..7 0001 0001 FFFF R/W ; ;-usually 1 ; config stuff for 81CEh:0..7 0001 0000 FFFF R/W ; ;-2,4,2,1 ; memory type, 81D0h:0..7 0001 0000 FFFF R/W ; ;-4,2,2,1 ; transfer direction, 81D2h:0..7 0001 0000 FFFF R/W ; ;-2,4,0,1 ; etc? 81D4h:0..7 0001 0000 FFFF R/W ; ;-4,2,0,1 ; (code vs data 81D6h:0..7 0001 0000 FFFF R/W ; ;-0,0,0,1 ; memory and such) 81D8h:0..7 0001 0000 FFFF R/W ; ;-0,0,0,1 ; 81DAh:0..7 F200 0000 F7FF R/W ; ;-670h,607h,400h,250h; 81DCh:0..7 0000 0000 1FF7 R/W ; ;-usually 300h ; 81DEh:0..7 0000 0000 00FF R/W ;/ ;-usually 0 ;/ 81E0h..81FEh 0000 0000 0000 R Fixed 0000h |
8200h 4020 4020 4020 R interrupt request flags (0=none, 1=irq) 8202h 0000 0000 0000 W interrupt acknowledge (0=ack, 1=no change) 8204h 0000 0000 FFFF ?? force IRQ flag set? (0=no change, 1=set?) 8206h 0000 0000 FFFF R/W enable as int0 (0=disable, 1=enable) 8208h 0000 0000 FFFF R/W enable as int1 (0=disable, 1=enable) 820Ah 0000 0000 FFFF R/W enable as int2 (0=disable, 1=enable) 820Ch 0000 0000 FFFF R/W enable as vint (0=disable, 1=enable) 820Eh 2000 0000 FFFF R/W (lsb of type0..3) 8210h 2000 0000 FFFF R/W (msb of type0..3) 8212h+N*4 0003 0000 8003 R/W ;\(lsw for irq 0..15) (bit0-1,15 are R/W) 8214h+N*4 FC00 0000 FFFF R/W ;/(msw for irq 0..15) for vint: proc? (16bit) 8252h 0000 0000 FFFF R/W ?? 8254h 0000 0000 5555 R/W ?? 8256h 0000 0000 5555 R/W ?? 8258h..827Eh 0000 0000 0000 R Fixed 0000h (or 6004h when [NNNNh]=NNNNh) |
8280h+N*80h 0005 0000 FFFF .. ;\ 8282h+N*80h 0000 0000 7FE7 ; 8284h+N*80h 0000 0000 0FE7 ; btdmp_prepare_receive_channel params 8286h+N*80h 0000 0000 0003 ; 8288h+N*80h 1FFF 0000 1FFF ; 828Ah+N*80h 0000 0000 0FFF ; 828Ch+N*80h 0000 0000 3FFF ;/ 828Eh+N*80h 0000 0000 FFFF ;\ 8290h+N*80h 0000 0000 FFFF ;/ 8292h+... 0000 0000 0000 R Fixed 0000h 829Eh+N*80h 0000 0000 8000 btdmp_enable_receive_channel (0=off, ?=on) 82A0h+N*80h 0005 0000 FFFF ... ;\ 82A2h+N*80h 0000 0000 7FE7 ; 82A4h+N*80h 0000 0000 0FE7 ; btdmp_prepare_transmit_channel params 82A6h+N*80h 0000 0000 0003 ; 82A8h+N*80h 1FFF 0000 1FFF ; 82AAh+N*80h 0000 0000 0FFF ; 82ACh+N*80h 0000 0000 3FFF ;/ 82AEh+N*80h 0000 0000 FFFF ;\ 82B0h+N*80h 0000 0000 FFFF ;/ 82B2h+... 0000 0000 0000 R Fixed 0000h 82BEh+N*80h 0000 0000 8000 btdmp_enable_transmit_channel(0=off, ?=on) 82C0h+N*80h 001x 001F 001F R DSPAudio_UpdateFifo, state1 (bit3=recv) 82C2h+N*80h 0057 005x 0057 R DSPAudio_UpdateFifo, state2 (bit3/4=send) 82C4h+N*80h E0A1 FFFF E0A1 R? DSPAudio_UpdateFifo, recv 82C6h+N*80h 0000 0000 0000 W DSPAudio_SendToOutput, send 82C8h+N*80h 0000 0000 0003 ?? 82CAh+N*80h 0000 0000 0003 btdmp_fifo_flush_transmit_channel 82CCh+... 0000 0000 0000 R Fixed 0000h 8380h..867Eh 03C0 03C0 03C0 R Mirror of Port 80D6h |
8680h..87FEh 03C0 03C0 03C0 R Mirror of Port 80D6h |
? ? ? ? ? ? ? APBP AHBM MIU ? DMA ICU AUDIO ? #0 3333 0000 0010 0020 0050 0060 0080 00A0 3333 00C0 3333 0100 0180 0200 3333 #1 0000 0004 0010 0020 0050 0060 0080 00C0 00E0 0100 0140 0180 0200 0280 0680 #2 3333 0004 0010 3333 3333 0020 0040 3333 3333 0060 3333 3333 0120 3333 3333 |
DSi Teak I/O Ports (on Teak Side) |
xx=[baseIO+06h] whatever (reading does crash/halt/hang the teak CPU) a1=[baseIO+1Ah] used to detect hardware type (for xpert_offsets_tbl) |
[apbpIO+00h]=a0l APBP_SetReplyRegister0 a0=[apbpIO+02h] APBP_GetCommandRegister0 ;80C2h (that is, set1) [apbpIO+04h]=a0l APBP_SetReplyRegister1 a0=[apbpIO+06h] APBP_GetCommandRegister1 ;80C6h (that is, set1) [apbpIO+08h]=a0l APBP_SetReplyRegister2 a0=[apbpIO+0Ah] APBP_GetCommandRegister2 ;80CAh (that is, set1) [apbpIO+0Ch]=a0l APBP_SetSemaphore DSP-to-ARM (R/W) [apbpIO+0Eh] (unknown, maybe semaphore irq-mask?) (R/W) [apbpIO+10h] APBP_AckSemaphore ARM-to-DSP (W) 1=clr [IO+12h] bits [apbpIO+12h] APBP_GetSemaphore ARM-to-DSP (R) [apbpIO+14h] (unused) (parts R/W) (DANGER: can crash cpu) test[apbpIO+16h].bit5 APBP_CheckReplyRegister0 <-- unreliable ? test[apbpIO+16h].bit6 APBP_CheckReplyRegister1 test[apbpIO+16h].bit7 APBP_CheckReplyRegister2 ;IO+16 mirrored to end test[apbpIO+16h].bit8 APBP_CheckCommandRegister0 ; of IO area! test[apbpIO+16h].bit12 APBP_CheckCommandRegister1 test[apbpIO+16h].bit13 APBP_CheckCommandRegister2 test[apbpIO+16h].bit9 APBP_CheckSemaphoreRequest [apbpIO+18h] (unknown, Ex00h, some status?) [apbpIO+1Ah] (unknown/unused, zero, not R/W) [apbpIO+1Ch] (unknown/unused, zero, not R/W) [apbpIO+1Eh] (unknown/unused, zero, not R/W) (unimplemented) APBP_GetSemaphore (unimplemented) APBP_ClearSemaphore (unimplemented) APBP_MaskSemaphore |
[ahbmIO+N*06h+02h+00h]=x whatever (0010h=?, 0020h=?, 0025h=dma?) [ahbmIO+N*06h+02h+02h]=x whatever (0200h=read, 0300h=write) [ahbmIO+N*06h+02h+04h]=x whatever (xxxxh=?, 0000h=reset) |
[miuIO+14h]=xxxx ;miu_config_page_memory_limits (done 2x) [miuIO+1Eh]=a1 AND FC00h ;miu_relocate_mmio (8000h) (done 1x) |
xxx |
[dmaIO+04h] channel enable flag(s)? [dmaIO+08h..] seox (end of transfer flags? in multiple bits/registers?) [dmaIO+3Eh] gcs_dtcca (control register or so) [dmaIO+40h] param [dmaIO+42h] param [dmaIO+44h] param [dmaIO+46h] param [dmaIO+48h] param [dmaIO+4Ah] param [dmaIO+4Ch] param [dmaIO+4Eh] param [dmaIO+50h] param [dmaIO+52h] param [dmaIO+54h] param [dmaIO+56h] param [dmaIO+58h] param [dmaIO+5Ah] param [dmaIO+5Ch] param [dmaIO+5Eh] param |
[icuIO+00h].bit9..15 IRQ interrupt request flags (0=none, 1=irq) [icuIO+02h].bit9..15 IRQ interrupt acknowledge (0=ack, 1=no change) [icuIO+04h].bit0..12,14..15 IRQ force IRQ flag set? (0=no change, 1=set irq) [icuIO+06h].bit9..15 IRQ enable as int0 (0=disable, 1=enable) [icuIO+08h].bit9..15 IRQ enable as int1 (0=disable, 1=enable) [icuIO+0Ah].bit9..15 IRQ enable as int2 (0=disable, 1=enable) [icuIO+0Ch].bit9..15 IRQ enable as vint (0=disable, 1=enable) [icuIO+0Eh].bit9..15 IRQ (lsb of type0..3) [icuIO+10h].bit9..15 IRQ (msb of type0..3) [icuIO+12h+(9..15)*4] IRQ (lsw for irq 9..15) (bit0-1,15 are R/W) [icuIO+14h+(9..15)*4] IRQ (msw for irq 9..15) for vint: proc? (16bit) |
icu.ack 00h-08h - icu.ack 09h timer_1 int2 (05A0h) icu.ack 0Ah timer_0 int1a (0590h) icu.ack 0Bh btdmp int1b (05C0h) icu.ack 0Ch-0Dh - icu.ack 0Eh apbp int0 (0550h..0580h) (cmd0,cmd1,cmd2,semaphorerequest) icu.ack 0Fh dma vint (05B0h) (DSPAudio_UpdateFifo) (v=VariableVect?) |
code:00000h ;start (reset) code:00002h ;trap_handler (trap/break) code:00004h ;nmi_handler code:00006h ;int0_handler code:0000Eh ;int1_handler code:00016h ;int2_handler variable?? ;vint_handler (without push/pop?) |
test [audioIO+40h].bit3 DSPAudio_UpdateFifo, state1 (recv) test [audioIO+42h].bit4 DSPAudio_UpdateFifo, state2 (send) a0=[audioIO+44h] DSPAudio_UpdateFifo, recv test [audioIO+42h].bit3 DSPAudio_SendToOutput, state [audioIO+46h]=x DSPAudio_SendToOutput, send [audioIO+N*80h+00h]=x btdmp_prepare_receive_channel, param0, bit9=irq? [audioIO+N*80h+02h]=x btdmp_prepare_receive_channel, param1 [audioIO+N*80h+04h]=x btdmp_prepare_receive_channel, param2 [audioIO+N*80h+06h]=x btdmp_prepare_receive_channel, param3 [audioIO+N*80h+08h]=x btdmp_prepare_receive_channel, param4 [audioIO+N*80h+0Ah]=x btdmp_prepare_receive_channel, param5 [audioIO+N*80h+0Ch]=x btdmp_prepare_receive_channel, param6 [audioIO+N*80h+1Eh]=x btdmp_enable_receive_channel (0=disable, [9013h]=enable) [audioIO+N*80h+20h]=x btdmp_prepare_transmit_channel, param0, bit8=irq? [audioIO+N*80h+22h]=x btdmp_prepare_transmit_channel, param1 [audioIO+N*80h+24h]=x btdmp_prepare_transmit_channel, param2 [audioIO+N*80h+26h]=x btdmp_prepare_transmit_channel, param3 [audioIO+N*80h+28h]=x btdmp_prepare_transmit_channel, param4 [audioIO+N*80h+2Ah]=x btdmp_prepare_transmit_channel, param5 [audioIO+N*80h+2Ch]=x btdmp_prepare_transmit_channel, param6 [audioIO+N*80h+3Eh]=x btdmp_enable_transmit_channel(0=disable, [9013h]=enable) [audioIO+N*80h+4Ah]=[9012h] btdmp_fifo_flush_transmit_channel |
xxx |
DSi Teak CPU Registers |
a0e:a0h:a0l (4:16:16 bits) = a0 (36bit) ;TL2: 40bit (8:16:16) a1e:a1h:a1l (4:16:16 bits) = a1 (36bit) ;TL2: 40bit (8:16:16) b0e:b0h:b0l (4:16:16 bits) = b0 (36bit) ;TL2: 40bit (8:16:16) b1e:b1h:b1l (4:16:16 bits) = b1 (36bit) ;TL2: 40bit (8:16:16) |
r0 ;TL ;16bit ;\ r1 ;TL ;16bit ; r2 ;TL ;16bit ; old TL1 registers r3 ;TL ;16bit ; r4 ;TL ;16bit ; r5 ;TL ;16bit ;/ r6 ;TL2 ;16bit ;<-- new TL2 register r7 ;TL ;16bit ;<-- aka rb (with optional immediate, MemR7Imm) |
x0 ;TL ;16bit ;- y0 ;TL ;16bit ;- x1 ;TL2 ;16bit ;- y1 ;TL2 ;16bit ;- p0 ;TL ;33bit! ;\Px ;TL2: 33bit p0e:p0 ? ;TL1: 32bit? p1 ;TL2 ;33bit! ;/ ;TL2: 33bit p1e:p1 ? ;TL1: N/A p0h ;TL ;16bit ; ;<-- aka ph ;<-- called "p0" (aka "p") in "RegisterP0" |
Unsigned = Unsigned * Unsigned ;use shift 0 Unsigned = Unsigned * Signed ;use shift +1 Unsigned = Signed * Signed ;use shift +2 Signed = Unsigned * Unsigned ;use shift -1 Signed = Unsigned * Signed ;use shift 0 Signed = Signed * Signed ;use shift +1 |
pc ;TL ;18bit! ;-program counter (TL2: 18bit, TL1: 16bit) sp ;TL ;16bit ;-stack pointer (decreasing on push/call) sv ;TL ;16bit ;-shift value (negative=right) (for shift-by-register) mixp ;TL ;16bit ;-related to min/max/mind/maxd lc ;TL ;16bit ;-Loop Counter (of block repeat) repc ;TL ;16bit ;-Repeat Counter (for "rep" opcode) dvm ;TL ;16bit ;-Data Value Match (data breakpoints) (and for trap) |
vtr0 ;TL2 16bit ;\related to vtrshr,vtrmov,vtrclr vtr1 ;TL2 16bit ;/(saved C/C1 carry flags for Viterby decoding) prpage ;TL2 4bit ;-??? (bit0-3 used/dangerous, bit4-15 always 0) |
ext0 ;TL ;16bit ext1 ;TL ;16bit ext2 ;TL ;16bit ext3 ;TL ;16bit |
page ;TL ;8bit "load" st1.bit0-7 (page for MemImm8) ;aka "lpg" ps ;TL ;2bit "load" st1.bit10-11 (product shifter for multiply?) ps01 ;TL2 ;4bit "load" mod0...? (maybe separate "ps" for p0 and p1 ?) movpd ;TL2 ;2bit "load" stt2.bit6-7 (page for reading DATA from ProgMem) modi ;TL ;9bit "load" cfgi.bit7-15 =imm9 modj ;TL ;9bit "load" cfgj.bit7-15 =imm9 stepi ;TL ;7bit "load" cfgi.bit0-6 =imm7 stepj ;TL ;7bit "load" cfgj.bit0-6 =imm7 |
st0 bit0,2-11 ;\control/status (cntx) st1 bit10-11 (and "swap": bit0-7) ; (TL2: probably also SttMod) st2 bit0-7 ;/ a0 <--> b0 manualswap only? ;\accumulators (swap) a1 <--> b1 autoswapped? ;/ r0 <--> r0b ;\ r1 <--> r1b ; r4 <--> r4b ; BankFlags (banke) r7 <--> r7b ;TL2 ; cfgi <--> cfgib ; cfgj <--> cfgjb ;TL2 ;/ Ar,Arp <--> ? ;TL2 ;-? (bankr and/or cntx) |
dmod ;TL ;suffix ;\ dmodi ;TL2 ;suffix ; dmodj ;TL2 ;suffix ; dmodij ;TL2 ;suffix ;/ context;TL ;suffix ;<-- (related to "cntx") eu ;TL ;suffix ;<-- (aka "Axheu", now "Axh,eu") dbrv ;TL2 ;suffix ;\for "bitrev" ebrv ;TL2 ;suffix ;/ s ;TL ;suffix ;\param for "cntx" opcode ;"s" also for opcode 88D1h r ;TL ;suffix ;/ |
TL: x y p ph rb lpg a0heu a1heu TL2: x0 y0 p0 p0h r7 page a0h,eu a1h,eu |
DSi Teak CPU Control/Status Registers |
Old registers (for TeakLite): st0/st1/st2, and icr New registers (for TeakLiteII): stt0/stt1/stt2, and mod0/mod1/mod2/mod3 |
ZMNVCEL- add, addh, addl, cmp, cmpu, sub, subh, subl, inc, dec, neg ZMNVCEL- maa, maasu, mac, macsu, macus, macuu, msu, sqra, rnd, pacr, movr ZMN-C--- or ZM--C--- addv, cmpv, subv, and ZMN--E-- clr, clrr, copy, divs, swap, not, xor ZMN--0L- lim ZMNVCELR norm ZMN-CE-- rol, ror ZMN-CE-- movs, movsi, shfc, shfi, shl, shl4, shr, shr4 ;for logical shift ZMNVCEL- movs, movsi, shfc, shfi, shl, shl4, shr, shr4 ;for arithmetic shift ZMN--E-- mov, movp, pop ;when dst=ac,bc (whut?) ;\ xxxxxxxx mov, movp, pop ;when dst=st0 ; mov etc. ------L- mov, push ;when src=aXL,aXH,bXL,bXH ; -------- mov, movp, pop, push ;when src/dst neither of above ;/ ZMN--E-- cntx s ;store shadows (new flags for a1) ;\cntx ZMNVCELR cntx r ;restore shadows (old flags) ;/ ZM------ set, rst, chng Z------- tst0, tst1, tstb -M------ max, maxd, min -------R modr -------- mpy, mpyi, mpysu, sqr, exp -------- banke, dint, eint, load, nop, bkrep, rep, break, trap, movd -------- br, brr, call, calla, callr, ret, retd, reti, retid, rets |
__________________________ Old registers (TeakLite) __________________________ |
0 SAT R/W Saturation Mode (0=Off, 1=Saturate "Ax to data") ;mod0.0 1 IE R/W Interrupt Enable (0=Disable, 1=Enable) ;dint/eint ;mod3.7 2 IM0 R/W Interrupt INT0 Mask (0=Disable, 1=Enable if IE=1) ;mod3.8 3 IM1 R/W Interrupt INT1 Mask (0=Disable, 1=Enable if IE=1) ;mod3.9 4 R R/W Flag: rN is Zero ;see Cond nr ;stt1.4 5 L R/W Flag: Limit ;see Cond l ;L=(LM or VL) ;stt0.0+1 6 E R/W Flag: Extension ;see Cond e ;stt0.2 7 C R/W Flag: Carry ;see Cond c ;stt0.3 8 V R/W Flag: Overflow ;see Cond v ;stt0.4 9 N R/W Flag: Normalized ;see Cond nn ;stt0.5 10 M R/W Flag: Minus ;see Cond gt,ge,lt,le ;stt0.6 11 Z R/W Flag: Zero ;see Cond eq,neq,gt,le ;stt0.7 12-15 a0e R/W Accumulator 0 Extension Bits ;a0.32-35 |
0-7 PAGE R/W Data Memory Page (for MemImm8) (see "load page") ;mod1.0-7 8-9 - - Reserved (read: always set) ;- 10-11 PS R/W Product Shifter for P0 (see "load ps")(multiply?) ;mod0.10-11 (0=No Shift, 1=SHR1, 2=SHL1, 3=SHL2) 12-15 a1e R/W Accumulator 1 Extension Bits ;a1.32-35 |
0-3 MDn R/W Enable cfgi.modi modulo for R0..R3 (0=Off, 1=On) ;mod2.0-3 4-5 MDn R/W Enable cfgj.modj modulo for R4..R5 (0=Off, 1=On) ;mod2.4-5 6 IM2 R/W Interrupt INT2 Mask (0=Disable, 1=Enable if IE=1) ;mod3.10 7 S R/W Shift Mode (0=Arithmetic, 1=Logic) ;mod0.7 8 OU0 R/W OUSER0 User Output Pin ;mod0.8 9 OU1 R/W OUSER1 User Output Pin ;mod0.9 10 IU0 R IUSER0 User Input Pin (zero) ;see Cond iu0,niu0 ;stt1.?? 11 IU1 R IUSER1 User Input Pin (zero) ;see Cond iu1 ;stt1.?? 12 - - Reserved (read: always set) ;- 13 IP2 R Interrupt Pending INT2 (0=No, 1=IRQ) ;stt2.2 14 IP0 R Interrupt Pending INT0 (0=No, 1=IRQ) ;stt2.0 15 IP1 R Interrupt Pending INT1 (0=No, 1=IRQ) ;stt2.1 |
0 NMIC R/W NMI Context switching enable (0=Off, 1=On) ;mod3.0 1 IC0 R/W INT0 Context switching enable (0=Off, 1=On) ;mod3.1 2 IC1 R/W INT1 Context switching enable (0=Off, 1=On) ;mod3.2 3 IC2 R/W INT2 Context switching enable (0=Off, 1=On) ;mod3.3 4 LP R InLoop (when inside one or more "bkrep" loops) ;stt2.15 5-7 BCn R Block repeat nest. counter ;see "bkrep" ;stt2.12-14 8-15 - - Reserved (read: always set) ;- |
_________________________ New registers (TeakLiteII) _________________________ |
0 LM R/W Flag: Limit, set if saturation has/had occured ;st0.5 1 VL R/W Flag: LatchedV, set if overflow has/had occurred ;st0.5, too 2 E R/W Flag: Extension ;see Cond e ;st0.6 3 C R/W Flag: Carry ;see Cond c ;st0.7 4 V R/W Flag: Overflow ;see Cond v ;st0.8 5 N R/W Flag: Normalized ;see Cond nn ;st0.9 6 M R/W Flag: Minus ;see Cond gt,ge,lt,le ;st0.10 7 Z R/W Flag: Zero ;see Cond eq,neq,gt,le ;st0.11 8-10 - - Unknown (reads as zero) 11 C1 R/W Flag: Carry1 (2nd carry, for dual-operation opcodes) 12-15 - - Unknown (reads as zero) |
0-3 - - Unknown (reads as zero) 4 R R/W Flag: rN is Zero ;see Cond nr ;st0.4 5-13 - - Unknown (reads as zero) (IU1 and IU0 should be here!) 14 P0E R/W Upper bit of 33bit P0 register ;\shifted-in on ;p0.32 15 P1E R/W Upper bit of 33bit P1 register ;/arith right shifts ;p1.32 |
0 IP0 R Interrupt Pending INT0 (0=No, 1=IRQ) ;st2.14 1 IP1 R Interrupt Pending INT1 (0=No, 1=IRQ) ;st2.15 2 IP2 R Interrupt Pending INT2 (0=No, 1=IRQ) ;st2.13 3 IPV R Interrupt Pending VINT ;- 4-5 - - Unknown (reads as zero) ;- 6-7 PCMhi R/W Program Memory Bank (for ProgMemRn/ProgMemAxl) ("load movpd") 8-11 - - Unknown (reads as zero) ;- 12-14 BCn R Block repeat nest. counter ;see "bkrep" ;icr.5-7 15 LP R InLoop (when inside one or more "bkrep" loops) ;icr.4 |
0 SAT R/W Saturation Mode (0=Off, 1=Saturate "Ax to data"?) ;st0.0 1 SATA R/W Saturation Mode on store (0=Off, 1="(Ax op data) to Ax"?) 2 ? R Unknown (reads as one) 3 - - Unknown (reads as zero) 4 - - Unknown (reads as zero) 5-6 HWM R/W Halfword Multiply ... Modify y0 (and y1?) 0=read y0/y1 directly (full 16bit words) 1=Takes y0>>8 and y1>>8 (logic shift) 2=Takes y0&0xFF and y1&0xFF 3=Takes y0>>8 and y1&&0xFF 7 S R/W Shift Mode (0=Arithmetic, 1=Logic) ;st2.7 8 OU0 R/W OUSER0 User Output Pin ;st2.8 9 OU1 R/W OUSER1 User Output Pin ;st2.9 10-11 PS0 R/W Product Shifter for P0 (see "load ps")(multiply?) ;st1.10-11 12 - - Unknown (reads as zero) 13-14 PS1 R/W Product Shifter for P1 (see "load ps")(multiply?) 15 - - Unknown (reads as zero) |
0-7 PAGE R/W Data Memory Page (for MemImm8) (see "load page") ;st1.0-7 8-11 - - Unknown (reads as zero) 12 STP16 R/W banke opcode (0=exchange cfgi/cfgj, 1=cfgi/cfgj+stepi0/stepj0) 1=use stepi0/j0 instead of stepi/j for stepping Rn registers 13 CMD R/W Change Modulo mode (0=New TL2 style, 1=TL1 style) 14 EPI R/W Unknown (1=Set R3=0 after any "modr R3" or "access[R3]"?) 15 EPJ R/W Unknown (1=Set R7=0 after any "modr R7" or "access[R7]"?) |
0-3 MDn R/W Enable cfgi.modi modulo for R0..R3 (0=Off, 1=On) ;st2.0-3 4-5 MDn R/W Enable cfgj.modj modulo for R4..R5 (0=Off, 1=On) ;st2.4-5 6-7 MDn R/W Enable cfgj.modj modulo for R6..R7 (0=Off, 1=On) ;TL2 only 8-11 BRn R/W Step +s for R0..R3 (0=cfgi.stepi, 1=stepi0) 12-15 BRn R/W Step +s for R4..R7 (0=cfgj.stepi, 1=stepj0) |
0 NMIC R/W NMI Context switching enable (0=Off, 1=On) ;icr.0 1 IC0 R/W INT0 Context switching enable (0=Off, 1=On) ;icr.1 2 IC1 R/W INT1 Context switching enable (0=Off, 1=On) ;icr.2 3 IC2 R/W INT2 Context switching enable (0=Off, 1=On) ;icr.3 4 OU2 R/W Unknown (R/W) 5 OU3 R/W Unknown (R/W) 6 OU4 ? ---DANGER BIT--- (1=hangs/crashes when set) 7 IE R/W Interrupt Enable (0=Disable, 1=Enable) ;dint/eint ;st0.1 8 IM0 R/W Interrupt INT0 Mask (0=Disable, 1=Enable if IE=1) ;st0.2 9 IM1 R/W Interrupt INT1 Mask (0=Disable, 1=Enable if IE=1) ;st0.3 10 IM2 R/W Interrupt INT2 Mask (0=Disable, 1=Enable if IE=1) ;st2.6 11 IMV R/W Interrupt VINT Mask (0=Disable, 1=Enable if IE=1?) 12 - - Unknown (reads as zero) 13 CCNTA R/W Unknown (R/W) 14 CPC R/W Stack word order for PC on call/ret (0=Normal, 1=Reversed) 15 CREP R/W Unknown (R/W) |
DSi Teak CPU Address Config/Step/Modulo |
_______________________________ Address Config _______________________________ |
0-2 R/W PM1/PM3 Post Modify Step (0..7 = +0,+1,-1,+s,+2,-2,+2,-2) 3-4 R/W CS1/CS3 Offset (0..3 = +0,+1,-1,-1) 5-7 R/W PM0/PM2 Post Modify Step (0..7 = +0,+1,-1,+s,+2,-2,+2,-2) 8-9 R/W CS0/CS2 Offset (0..3 = +0,+1,-1,-1) 10-12 R/W RN1/RN3 Register (0..7 = R0..R7) 13-15 R/W RN0/RN2 Register (0..7 = R0..R7) |
0-2 R/W PIn Post Modify Step I (0..7 = +0,+1,-1,+s,+2,-2,+2,-2) 3-4 R/W CIn Offset I (0..3 = +0,+1,-1,-1) 5-7 R/W PJn Post Modify Step J (0..7 = +0,+1,-1,+s,+2,-2,+2,-2) 8-9 R/W CJn Offset J (0..3 = +0,+1,-1,-1) 10-11 R/W RIn Register I (0..3 = R0..R3) 12 - - Unused (always zero) 13-14 R/W RJn Register J (0..3 = R4..R7) 15 - - Unused (always zero) |
________________________________ Step/Modulo ________________________________ |
0-6 stepi/stepj (7bit) (see "load stepi/stepj") ;step "Rn+s" ? 7-15 modi/modj (9bit) (see "load modi/modj") |
0-16 stepi0/stepj0 |
DSi TeakLite II Instruction Set Encoding |
Base Ver Opcode (with parameter bits located at @bitnumber and up) D4FBh TL add MemImm16@16, Ax@8 A600h TL add MemImm8@0, Ax@8 86C0h TL add Imm16@16, Ax@8 C600h TL add Imm8u@0, Ax@8 D4DBh TL add MemR7Imm16@16, Ax@8 4600h TL add MemR7Imm7s@0, Ax@8 8680h TL add MemRn@0, Ax@8 || Rn@0stepZIDS@3 86A0h TL add RegisterP0@0, Ax@8 D2DAh TL2 add Ab@10, Bx@0 5DF0h TL2 add Bx@1, Ax@0 9070h TL2 add MemR01@8, sv, Abh@2 || sub MemR01@8offsZI@0, sv, Abl@2 || mov Abl@2, MemR45@8 || R01@8stepII2@0, R45@8stepII2@1 5DB0h TL2 add MemR04@1, sv, Abh@2 || sub MemR04@1offsZI@0, sv, Abl@2 || R04@1stepII2@0 6F80h TL2 add MemR45@2, MemR01@2, Abh@3 || add MemR45@2offsZI@1, MemR01@2offsZI@0, Abl@3 || R01@2stepII2@0, R45@2stepII2@1 6FA0h TL2 add MemR45@2, MemR01@2, Abh@3 || sub MemR45@2offsZI@1, MemR01@2offsZI@0, Abl@3 || R01@2stepII2@0, R45@2stepII2@1 5E30h TL2 add MemR45@8, sv, Abh@2 || sub MemR45@8offsZI@1, sv, Abl@2 || mov Abl@2, MemR01@8 || R01@8stepII2@0, R45@8stepII2@1 5DC0h TL2 add p0, p1, Ab@2 D782h TL2 add p1, Ax@0 5DF8h TL2 add Px@1, Bx@0 D38Bh TL2 add r6, Ax@4 4590h TL2 add3 p0, p1, Ab@2 4592h TL2 add3a p0, p1, Ab@2 4593h TL2 add3aa p0, p1, Ab@2 5DC1h TL2 adda p0, p1, Ab@2 B200h TL addh MemImm8@0, Ax@8 9280h TL addh MemRn@0, Ax@8 || Rn@0stepZIDS@3 92A0h TL addh Register@0, Ax@8 9464h TL2 addh r6, Ax@0 90E0h TL2 addhp MemR0425@2, Px@4, Ax@8 || R0425@2stepII2D2S@0 ;p=ProgMem? Px? B400h TL addl MemImm8@0, Ax@8 9480h TL addl MemRn@0, Ax@8 || Rn@0stepZIDS@3 94A0h TL addl Register@0, Ax@8 9466h TL2 addl r6, Ax@0 906Ch TL2 addsub p0, p1, Ab@0 49C2h TL2 addsub p1, p0, Ab@4 916Ch TL2 addsuba p0, p1, Ab@0 49C3h TL2 addsuba p1, p0, Ab@4 E700h TL addv Imm16@16, MemImm8@0 86E0h TL addv Imm16@16, MemRn@0 || Rn@0stepZIDS@3 87E0h TL addv Imm16@16, Register@0 47BBh TL2 addv Imm16@16, r6 D4F9h TL and MemImm16@16, Ax@8 A200h TL and MemImm8@0, Ax@8 82C0h TL and Imm16@16, Ax@8 C200h TL and Imm8u@0, Ax@8 D4D9h TL and MemR7Imm16@16, Ax@8 4200h TL and MemR7Imm7s@0, Ax@8 8280h TL and MemRn@0, Ax@8 || Rn@0stepZIDS@3 82A0h TL and RegisterP0@0, Ax@8 6770h TL2 and Ab@2, Ab@0, Ax@12 ;TL2 only D389h TL2 and r6, Ax@4 4B80h TL banke BankFlags6@0 ;{r0}{,r1}{,r4}{,cfgi}{,r7}{,cfgj} 8CDFh TL2 bankr ;without operand ? 8CDCh TL2 bankr Ar@0 8CD0h TL2 bankr Ar@2, Arp@0 8CD8h TL2 bankr Arp@0 5EB8h TL2 bitrev Rn@0 D7E8h TL2 bitrev Rn@0, dbrv D7E0h TL2 bitrev Rn@0, ebrv 5C00h TL bkrep NoReverse, Imm8u@0, Address16@16 5D00h TL bkrep NoReverse, Register@0, Address18@16and5 8FDCh TL2 bkrep NoReverse, r6, Address18@16and0 DA9Ch TL2 bkreprst MemR0425@0 5F48h TL2 bkreprst MemSp, Unused2@0 DADCh TL2 bkrepsto MemR0425@0, Unused1@10 9468h TL2 bkrepsto MemSp, Unused3@0 4180h TL br Address18@16and4, Cond@0 D3C0h TL break ;break 5000h TL brr RelAddr7@4, Cond@0 41C0h TL call Address18@16and4, Cond@0 D480h TL calla Axl@8 D381h TL2 calla Ax@4 1000h TL callr RelAddr7@4, Cond@0 9068h TL2 cbs Axh@0, Axh@not0, r0, ge 9168h TL2 cbs Axh@0, Axh@not0, r0, gt D49Eh TL2 cbs Axh@8, Bxh@5, r0, ge D49Fh TL2 cbs Axh@8, Bxh@5, r0, gt D5C0h TL2 cbs MemR01@2, MemR45@2, ge || R01@2stepII2@0, R45@2stepII2@1 D5C8h TL2 cbs MemR01@2, MemR45@2, gt || R01@2stepII2@0, R45@2stepII2@1 E500h TL chng Imm16@16, MemImm8@0 84E0h TL chng Imm16@16, MemRn@0 || Rn@0stepZIDS@3 85E0h TL chng Imm16@16, Register@0 47BAh TL2 chng Imm16@16, r6 0038h TL2 chng Imm16@16, SttMod@0 6760h TL clr Implied ConstZero, Ax@12, Cond@0 ;aX=0 6F60h TL clr Implied ConstZero, Bx@12, Cond@0 ;bX=0 8ED0h TL2 clr Implied ConstZero, Ab@2, Ab@0 5DFEh TL2 clrp p0 5DFFh TL2 clrp p0, p1 5DFDh TL2 clrp p1 67C0h TL clrr Implied Const8000h, Ax@12, Cond@0 ;aX=8000h 6F70h TL2 clrr Implied Const8000h, Bx@12, Cond@0 ;bX=8000h 8DD0h TL2 clrr Implied Const8000h, Ab@2, Ab@0 D4FEh TL cmp MemImm16@16, Ax@8 AC00h TL cmp MemImm8@0, Ax@8 8CC0h TL cmp Imm16@16, Ax@8 CC00h TL cmp Imm8u@0, Ax@8 D4DEh TL cmp MemR7Imm16@16, Ax@8 4C00h TL cmp MemR7Imm7s@0, Ax@8 8C80h TL cmp MemRn@0, Ax@8 || Rn@0stepZIDS@3 8CA0h TL cmp RegisterP0@0, Ax@8 4D8Ch TL2 cmp Ax@1, Bx@0 D483h TL2 cmp b0, b1 D583h TL2 cmp b1, b0 DA9Ah TL2 cmp Bx@10, Ax@0 8B63h TL2 cmp p1, Ax@4 D38Eh TL2 cmp r6, Ax@4 BE00h TL cmpu MemImm8@0, Ax@8 9E80h TL cmpu MemRn@0, Ax@8 || Rn@0stepZIDS@3 9EA0h TL cmpu Register@0, Ax@8 8A63h TL2 cmpu r6, Ax@3 ED00h TL cmpv Imm16@16, MemImm8@0 8CE0h TL cmpv Imm16@16, MemRn@0 || Rn@0stepZIDS@3 8DE0h TL cmpv Imm16@16, Register@0 47BEh TL2 cmpv Imm16@16, r6 D390h TL cntx r ;restore shadows D380h TL cntx s ;store shadows 67F0h TL copy Implied Ax@not12, Ax@12, Cond@0 ;aX=aY 67E0h TL dec Implied Const1, Ax@12, Cond@0 ;aX=aX-1 43C0h TL dint ;IE=0, interrupt disable 0E00h TL divs MemImm8@0, Ax@8 4380h TL eint ;IE=1, interrupt enable 9460h TL exp Bx@0, Implied sv 9060h TL exp Bx@0, Implied sv, Ax@8 9C40h TL exp MemRn@0, Implied sv || Rn@0stepZIDS@3 9840h TL exp MemRn@0, Implied sv, Ax@8 || Rn@0stepZIDS@3 9040h TL exp RegisterP0@0, Implied sv, Ax@8 9440h TL exp RegisterP0@0, Implied sv D7C1h TL2 exp r6, Implied sv D382h TL2 exp r6, Implied sv, Ax@4 67D0h TL inc Implied Const1, Ax@12, Cond@0 ;aX=aX+1 49C0h TL lim a0 ;aka a0,a0 49D0h TL lim a0, a1 49F0h TL lim a1 ;aka a1,a1 49E0h TL lim a1, a0 4D80h TL load Imm2u@0, ps ;st1.bit11-10=imm2 DB80h TL load Imm7s@0, stepi ;cfgi.LSB=imm7 DF80h TL load Imm7s@0, stepj ;cfgj.LSB=imm7 0400h TL load Imm8u@0, page ;st1.LSBs=imm8 ;aka "lpg" 0200h TL load Imm9u@0, modi ;cfgi.MSB=imm9 0A00h TL load Imm9u@0, modj ;cfgj.MSB=imm9 D7D8h TL2 load Imm2u@1, movpd, Unused1@0 ;stt2.bit6.7 (page for ProgMem) 0010h TL2 load Imm4u@0, ps01 ;mod0.bit10-11,13-14 and st1.10-11 ? D400h TL maa MemR45@2, MemR0123@0, Ax@11 || R0123@0stepZIDS@3, R45@2stepZIDS@5 8400h TL maa MemRn@0, Imm16@16, Ax@11 || Rn@0stepZIDS@3 8420h TL maa y0, MemRn@0, Ax@11 || Rn@0stepZIDS@3 8440h TL maa y0, Register@0, Ax@11 E400h TL maa y0, MemImm8@0, Ax@11 5EA8h TL2 maa y0, r6, Ax@0 D700h TL maasu MemR45@2, MemR0123@0, Ax@11 || R0123@0stepZIDS@3, R45@2stepZIDS@5 8700h TL maasu MemRn@0, Imm16@16, Ax@11 || Rn@0stepZIDS@3 8720h TL maasu y0, MemRn@0, Ax@11 || Rn@0stepZIDS@3 8740h TL maasu y0, Register@0, Ax@11 5EAEh TL2 maasu y0, r6, Ax@0 D200h TL mac MemR45@2, MemR0123@0, Ax@11 || R0123@0stepZIDS@3, R45@2stepZIDS@5 8200h TL mac MemRn@0, Imm16@16, Ax@11 || Rn@0stepZIDS@3 8220h TL mac y0, MemRn@0, Ax@11 || Rn@0stepZIDS@3 8240h TL mac y0, Register@0, Ax@11 E200h TL mac y0, MemImm8@0, Ax@11 5EA4h TL2 mac y0, r6, Ax@0 4D84h TL2 mac y0, x1, Ax@1, Unused1@0 5E28h TL2 mac1 MemR45@2, MemR01@2, Ax@8 || R01@2stepII2@0, R45@2stepII2@1 D600h TL macsu MemR45@2, MemR0123@0, Ax@11 || R0123@0stepZIDS@3, R45@2stepZIDS@5 8600h TL macsu MemRn@0, Imm16@16, Ax@11 || Rn@0stepZIDS@3 E600h TL macsu y0, MemImm8@0, Ax@11 8620h TL macsu y0, MemRn@0, Ax@11 || Rn@0stepZIDS@3 8640h TL macsu y0, Register@0, Ax@11 5EACh TL2 macsu y0, r6, Ax@0 D300h TL macus MemR45@2, MemR0123@0, Ax@11 || R0123@0stepZIDS@3, R45@2stepZIDS@5 8300h TL macus MemRn@0, Imm16@16, Ax@11 || Rn@0stepZIDS@3 8320h TL macus y0, MemRn@0, Ax@11 || Rn@0stepZIDS@3 8340h TL macus y0, Register@0, Ax@11 5EA6h TL2 macus y0, r6, Ax@0 D500h TL macuu MemR45@2, MemR0123@0, Ax@11 || R0123@0stepZIDS@3, R45@2stepZIDS@5 8500h TL macuu MemRn@0, Imm16@16, Ax@11 || Rn@0stepZIDS@3 8520h TL macuu y0, MemRn@0, Ax@11 || Rn@0stepZIDS@3 8540h TL macuu y0, Register@0, Ax@11 5EAAh TL2 macuu y0, r6, Ax@0 8460h TL max NoReverse, Ax@8, Implied Ax@not8, Bogus MemR0, ge, Implied mixp, Implied r0 || R0stepZIDS@3 ;when aY >= aX 8660h TL max NoReverse, Ax@8, Implied Ax@not8, Bogus MemR0, gt, Implied mixp, Implied r0 || R0stepZIDS@3 ;when aY > aX 5E21h TL2 max a0h, a1h || max a0l, a1l || vtrshr 5F21h TL2 max a1h, a0h || max a1l, a0l || vtrshr D784h TL2 max Axh@1, Bxh@0 || max Axl@1, Bxl@0 || vtrshr 4A40h TL2 max Axh@3, Bxh@4 || max Axl@3, Bxl@4 || mov Axl@not3, MemR04@1 || vtrshr || R04@1stepII2@0 4A44h TL2 max Axh@3, Bxh@4 || max Axl@3, Bxl@4 || mov Axh@not3, MemR04@1 || vtrshr || R04@1stepII2@0 45A0h TL2 max Axh@4, Bxh@3 || max Axl@4, Bxl@3 || mov Axh@not4, MemR45@2 || mov Axl@not4, MemR01@2 || vtrshr || R01@2stepII2@0, R45@2stepII2@1 D590h TL2 max Axh@6, Bxh@5 || max Axl@6, Bxl@5 || mov Axh@not6, MemR01@2 || mov Axl@not6, MemR45@2 || vtrshr || R01@2stepII2@0, R45@2stepII2@1 4A60h TL2 max Bxh@4, Axh@3 || max Bxl@4, Axl@3 || mov Bxl@not4, MemR04@1 || vtrshr || R04@1stepII2@0 4A64h TL2 max Bxh@4, Axh@3 || max Bxl@4, Axl@3 || mov Bxh@not4, MemR04@1 || vtrshr || R04@1stepII2@0 8060h TL maxd NoReverse, Ax@8, MemR0, ge, Implied mixp, Implied r0 || R0stepZIDS@3 ;when (r0) >= aX 8260h TL maxd NoReverse, Ax@8, MemR0, gt, Implied mixp, Implied r0 || R0stepZIDS@3 ;when (r0) > aX 8860h TL min NoReverse, Ax@8, Implied Ax@not8, Bogus MemR0, le, Implied mixp, Implied r0 || R0stepZIDS@3 ;when aY <= aX 8A60h TL min NoReverse, Ax@8, Implied Ax@not8, Bogus MemR0, lt, Implied mixp, Implied r0 || R0stepZIDS@3 ;when aY < aX 43C2h TL2 min Axh@0, Axh@not0 || min Axl@0, Axl@not0 || vtrshr D2B8h TL2 min Axh@11, Bxh@10 || min Axl@11, Bxl@10 || mov Axh@not11, MemR01@2 || mov Axl@not11, MemR45@2 || vtrshr || R01@2stepII2@0, R45@2stepII2@1 4A00h TL2 min Axh@3, Bxh@4 || min Axl@3, Bxl@4 || mov Axl@not3, MemR04@1 || vtrshr || R04@1stepII2@0 4A04h TL2 min Axh@3, Bxh@4 || min Axl@3, Bxl@4 || mov Axh@not3, MemR04@1 || vtrshr || R04@1stepII2@0 45E0h TL2 min Axh@4, Bxh@3 || min Axl@4, Bxl@3 || mov Axh@not4, MemR45@2 || mov Axl@not4, MemR01@2 || vtrshr || R01@2stepII2@0, R45@2stepII2@1 D4BAh TL2 min Axh@8, Bxh@0 || min Axl@8, Bxl@0 || vtrshr 4A20h TL2 min Bxh@4, Axh@3 || min Bxl@4, Axl@3 || mov Bxl@not4, MemR04@1 || vtrshr || R04@1stepII2@0 4A24h TL2 min Bxh@4, Axh@3 || min Bxl@4, Axl@3 || mov Bxh@not4, MemR04@1 || vtrshr || R04@1stepII2@0 47A0h TL2 mind NoReverse, Ax@3, MemR0, le, Implied mixp, Implied r0 || R0stepZIDS@0 47A4h TL2 mind NoReverse, Ax@3, MemR0, lt, Implied mixp, Implied r0 || R0stepZIDS@0 0080h TL modr MemRn@0stepZIDS@3 00A0h TL modr MemRn@0stepZIDS@3, dmod ;Disable modulo D294h TL2 modr MemR0123@10stepII2D2S0@0 || modr MemR4567@10stepII2D2S0@5 0D80h TL2 modr MemR0123@5stepII2D2S0@1 || modr MemR4567@5stepII2D2S0@3, dmod 0D81h TL2 modr MemR0123@5stepII2D2S0@1, dmod || modr MemR4567@5stepII2D2S0@3, dmod 8464h TL2 modr MemR0123@8stepII2D2S0@0, dmod || modr MemR4567@8stepII2D2S0@3 5DA0h TL2 modr MemRn@0stepD2 5DA8h TL2 modr MemRn@0stepD2, dmod 4990h TL2 modr MemRn@0stepI2 4998h TL2 modr MemRn@0stepI2, dmod D290h TL mov Ab@10, Ab@5 D298h TL mov Abl@10, dvm D2D8h TL mov Abl@10, x0 3000h TL mov Ablh@9, MemImm8@0 D4BCh TL mov Axl@8, MemImm16@16 D49Ch TL mov Axl@8, MemR7Imm16@16 DC80h TL mov Axl@8, MemR7Imm7s@0 D4B8h TL mov MemImm16@16, Ax@8 6100h TL mov MemImm8@0, Ab@11 6200h TL mov MemImm8@0, Ablh@10 6500h TL mov MemImm8@0, Axh@12, eu ;aka Axheu 6000h TL mov MemImm8@0, R0123457y0@10 6D00h TL mov MemImm8@0, sv D491h TL mov dvm, Ab@5 D492h TL mov icr, Ab@5 5E20h TL mov Imm16@16, Bx@8 5E00h TL mov Imm16@16, Register@0 4F80h TL mov Imm5u@0, icr ;uh, but icr is 8bit wide (only 4bit are R/W)? 2500h TL mov Imm8s@0, Axh@12 ;signed! 2900h TL mov Imm8s@0, ext0 2D00h TL mov Imm8s@0, ext1 3900h TL mov Imm8s@0, ext2 3D00h TL mov Imm8s@0, ext3 2300h TL mov Imm8s@0, R0123457y0@10 ;signed! 0500h TL mov Imm8s@0, sv 2100h TL mov Imm8u@0, Axl@12 ;unsigned! D498h TL mov MemR7Imm16@16, Ax@8 D880h TL mov MemR7Imm7s@0, Ax@8 98C0h TL mov MemRn@0, Bx@8 || Rn@0stepZIDS@3 1C00h TL mov MemRn@0, Register@5 || Rn@0stepZIDS@3 47E0h TL mov MemSp, Register@0 47C0h TL mov mixp, Register@0 2000h TL mov R0123457y0@9, MemImm8@0 4FC0h TL mov Register@0, icr 5E80h TL mov Register@0, mixp 1800h TL mov Register@5, MemRn@0 || Rn@0stepZIDS@3 5EC0h TL mov RegisterP0@0, Bx@5 5800h TL mov RegisterP0@0, Register@5 D490h TL mov repc, Ab@5 7D00h TL mov sv, MemImm8@0 D493h TL mov x0, Ab@5 D49Bh TL2 mov a0h, stepi0 D59Bh TL2 mov a0h, stepj0 4390h TL2 mov a0h, MemR0425@2 || mov y0, MemR0425@2offsZIDZ@0 || R0425@2stepII2D2S@0 43D0h TL2 mov a1h, MemR0425@2 || mov y0, MemR0425@2offsZIDZ@0 || R0425@2stepII2D2S@0 8FD4h TL2 mov Ab@0, p0 43A0h TL2 mov Abh@3, MemR01@2 || mov Abl@3, MemR45@2 || R01@2stepII2@0, R45@2stepII2@1 43E0h TL2 mov Abh@3, MemR45@2 || mov Abl@3, MemR01@2 || R01@2stepII2@0, R45@2stepII2@1 9D40h TL2 mov Abh@4, MemR04@1 || mov Abh@2, MemR04@1offsZI@0 || R04@1stepII2@0 9164h TL2 mov Abl@0, prpage 9064h TL2 mov Abl@0, repc D394h TL2 mov Abl@0, x1 D384h TL2 mov Abl@0, y1 9540h TL2 mov Abl@3, ArArp@0 9C60h TL2 mov Abl@3, SttMod@0 9560h TL2 mov ArArp@0, Abl@3 D488h TL2 mov ArArp@0, MemR04@8 || R04@8stepII2@5 5F50h TL2 mov ArArpSttMod@0, MemR7Imm16@16 886Bh TL2 mov Ax@8, pc 8C60h TL2 mov Axh@4, MemR4567@8 || mov MemR0123@8, Axh@4 || R0123@8stepII2D2S@0, R4567@8stepII2D2S@2 4800h TL2 mov Axh@6, MemR0123@4 || movr MemR4567@4, Axh@6 || R0123@4stepII2D2S@0, R4567@4stepII2D2S@2 4900h TL2 mov Axh@6, MemR0123@4 || mov MemR4567@4, Axh@6 || R0123@4stepII2D2S@0, R4567@4stepII2D2S@2 7F80h TL2 mov Axh@6, MemR4567@4 || movr MemR0123@4, Axh@6 || R0123@4stepII2D2S@0, R4567@4stepII2D2S@2 8863h TL2 mov Bx@8, pc 0008h TL2 mov Imm16@16, ArArp@0 0023h TL2 mov Imm16@16, r6 0001h TL2 mov Imm16@16, repc 8971h TL2 mov Imm16@16, stepi0 8979h TL2 mov Imm16@16, stepj0 0030h TL2 mov Imm16@16, SttMod@0 5DD0h TL2 mov Imm4u@0, prpage 80C4h TL2 mov MemR01@9, Abh@10 || mov MemR45@9, Abl@10 || R01@9stepII2@0, R45@9stepII2@8 D292h TL2 mov MemR0425@10_MemR0425@10offsZIDZ@5, Px@0 || R0425@10stepII2D2S@5 D7D4h TL2 mov MemR04@1, repc || R04@1stepII2@0 5F4Ch TL2 mov MemR04@1, sv || sub3 MemR04@1, p0, p1, b0 || R04@1stepII2@0 D4B4h TL2 mov MemR04@1, sv || sub3rnd MemR04@1, p0, p1, b1 || R04@1stepII2@0 DE9Ch TL2 mov MemR04@1, sv || sub3rnd MemR04@1, p0, p1, b0 || R04@1stepII2@0 4B40h TL2 mov MemR04@3, sv || addsub MemR04@3, p1, p0, Bx@0 || R04@3stepII2@2 4B42h TL2 mov MemR04@3, sv || addsubrnd MemR04@3, p1, p0, Bx@0 || R04@3stepII2@2 8062h TL2 mov MemR04@4, ArArp@8 || R04@4stepII2@3 8063h TL2 mov MemR04@4, SttMod@8 || R04@4stepII2@3 9960h TL2 mov MemR04@4, sv || addsub MemR04@4, p1, p0, Bx@2 || R04@4stepD2S@3 ;<-- ordered p1, p0 here ! 99E0h TL2 mov MemR04@4, sv || addsubrnd MemR04@4, p1, p0, Bx@2 || R04@4stepD2S@3 ;<-- ordered p1, p0 here ! 9860h TL2 mov MemR04@4, sv || sub3 MemR04@4, p0, p1, Bx@2 || R04@4stepD2S@3 98E0h TL2 mov MemR04@4, sv || sub3rnd MemR04@4, p0, p1, Bx@2 || R04@4stepD2S@3 8873h TL2 mov MemR04@8, sv || sub3 MemR04@8, p0, p1, b1 || R04@8stepII2@3 D4C0h TL2 mov MemR45@5, Abh@2 || mov MemR01@5, Abl@2 || R01@5stepII2@0, R45@5stepII2@1 4D90h TL2 mov MemR7Imm16@16, ArArpSttMod@0 D2DCh TL2 mov MemR7Imm16@16, repc, Unused2@0, Unused1@10 1B20h TL2 mov MemRn@0, r6 || Rn@0stepZIDS@3 ;override 1800h (mov a1,MemRn@0) D29Ch TL2 mov MemSp, r6, Unused2@0, Unused1@10 8A73h TL2 mov mixp, Bx@3 4381h TL2 mov mixp, r6 4382h TL2 mov p0h, Bx@0 D3C2h TL2 mov p0h, r6 4B60h TL2 mov p0h, Register@0 ;<-- here "p0h" as source 8FD8h TL2 mov p1, Ab@0 88D0h TL2 mov Px@1, MemR0425@8_MemR0425@8offsZIDZ@2 || R0425@8stepII2D2S@2 88D1h TL2 mov Px@1, MemR0425@8_MemR0425@8offsZIDZ@2,s || R0425@8stepII2D2S@2 D481h TL2 mov r6, Bx@8 1B00h TL2 mov r6, MemRn@0 || Rn@0stepZIDS@3 ;override 1800h (mov a0,MemRn@0) 43C1h TL2 mov r6, mixp 5F00h TL2 mov r6, Register@0 5F60h TL2 mov Register@0, r6 D2D9h TL2 mov repc, Abl@10 D7D0h TL2 mov repc, MemR04@1 || R04@1stepII2@0 D3C8h TL2 mov repc, MemR7Imm16@16, Unused3@0 D482h TL2 mov stepi0, a0h D582h TL2 mov stepj0, a0h D2F8h TL2 mov SttMod@0, Abl@10 49C1h TL2 mov x1, Ab@4 D299h TL2 mov y1, Ab@10 5EB0h TL2 mov prpage, Abl@0 49A0h TL2 mov SttMod@0, MemR04@4 || R04@4stepII2@3 4DC0h TL2 mova Ab@4, MemR0425@2_MemR0425@2offsZIDZ@0 || R0425@2stepII2D2S@0 4BC0h TL2 mova MemR0425@2_MemR0425@2offsZIDZ@0, Ab@4 || R0425@2stepII2D2S@0 5F80h TL movd MemR0123@0,ProgMemR45@2 || R0123@0stepZIDS@3, R45@2stepZIDS@5 0040h TL movp ProgMemAxl@5, Register@0 0D40h TL2 movp ProgMemAx@5, Register@0 0600h TL movp ProgMemRn@0, MemR0123@5 || R0123@5stepZIDS@7, Rn@0stepZIDS@3 D499h TL2 movpdw ProgMemAx@8_ProgMemAx@8offsI, pc 8864h TL movr MemR0425@3, Abh@8 || R0425@3stepII2D2S@0 ;op*10000h+8000h 9CE0h TL movr MemRn@0, Ax@8 || Rn@0stepZIDS@3 9CC0h TL movr RegisterP0@0, Ax@8 5DF4h TL2 movr Bx@1, Ax@0 8961h TL2 movr r6, Ax@3 6300h TL movs Implied sv, MemImm8@0, Ab@11 0180h TL movs Implied sv, MemRn@0, Ab@5 || Rn@0stepZIDS@3 0100h TL movs Implied sv, RegisterP0@0, Ab@5 5F42h TL2 movs Implied sv, r6, Ax@0 4080h TL movsi Implied Imm5s@0, R0123457y0@9, Ab@5, Bogus Imm5s@0 D000h TL mpy MemR45@2, MemR0123@0 || R0123@0stepZIDS@3, R45@2stepZIDS@5 8000h TL mpy MemRn@0, Imm16@16 || Rn@0stepZIDS@3 8020h TL mpy y0, MemRn@0 || Rn@0stepZIDS@3 8040h TL mpy y0, Register@0 E000h TL mpy y0, MemImm8@0 5EA0h TL2 mpy y0, r6 CB00h TL2 mpy MemR45@5, MemR01@5 || mpysu MemR45@5offsZI@4, MemR01@5offsZI@3 || sub3 p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CB01h TL2 mpy MemR45@5, MemR01@5 || mpyus MemR45@5offsZI@4, MemR01@5offsZI@3 || sub3 p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CB02h TL2 mpy MemR45@5, MemR01@5 || mpysu MemR45@5offsZI@4, MemR01@5offsZI@3 || sub3a p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CB03h TL2 mpy MemR45@5, MemR01@5 || mpyus MemR45@5offsZI@4, MemR01@5offsZI@3 || sub3a p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CB04h TL2 mpy MemR45@5, MemR01@5 || mpysu MemR45@5offsZI@4, MemR01@5offsZI@3 || add3 p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CB05h TL2 mpy MemR45@5, MemR01@5 || mpyus MemR45@5offsZI@4, MemR01@5offsZI@3 || add3 p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CB06h TL2 mpy MemR45@5, MemR01@5 || mpysu MemR45@5offsZI@4, MemR01@5offsZI@3 || add3a p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CB07h TL2 mpy MemR45@5, MemR01@5 || mpyus MemR45@5offsZI@4, MemR01@5offsZI@3 || add3a p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 D5E0h TL2 mpy MemR04@1, x1 || mpy y1, x0 || sub3 p0, p1, Ax@3 || R04@1stepII2@0 D5E4h TL2 mpy MemR04@1, x1 || mpy y1, x0 || add3 p0, p1, Ax@3 || R04@1stepII2@0 C800h TL2 mpy MemR4567@4, MemR0123@4 || mpy MemR4567@4offsZIDZ@2, MemR0123@4offsZIDZ@0 || add3 p0, p1, Ab@6 || R0123@4stepII2D2S@0, R4567@4stepII2D2S@2 C900h TL2 mpy MemR4567@4, MemR0123@4 || mpy MemR4567@4offsZIDZ@2, MemR0123@4offsZIDZ@0 || sub3 p0, p1, Ab@6 || R0123@4stepII2D2S@0, R4567@4stepII2D2S@2 80C2h TL2 mpy MemR45@0, MemR01@0 || mpy MemR45@0offsZI@9, MemR01@0offsZI@8 || add3a p0, p1, Ab@10 || R01@0stepII2@8, R45@0stepII2@9 49C8h TL2 mpy MemR45@2, MemR01@2 || mpy MemR45@2offsZI@1, MemR01@2offsZI@0 || sub3a p0, p1, Ab@4 || R01@2stepII2@0, R45@2stepII2@1 80C8h TL2 mpy MemR45@2, MemR01@2 || mpy MemR45@2offsZI@1, MemR01@2offsZI@0 || addsub p0, p1, Ab@10 || R01@2stepII2@0, R45@2stepII2@1 81C8h TL2 mpy MemR45@2, MemR01@2 || mpy MemR45@2offsZI@1, MemR01@2offsZI@0 || addsuba p0, p1, Ab@10 || R01@2stepII2@0, R45@2stepII2@1 82C8h TL2 mpy MemR45@2, MemR01@2 || mpy MemR45@2offsZI@1, MemR01@2offsZI@0 || add p0, p1, Ab@10 || R01@2stepII2@0, R45@2stepII2@1 83C8h TL2 mpy MemR45@2, MemR01@2 || mpy MemR45@2offsZI@1, MemR01@2offsZI@0 || adda p0, p1, Ab@10 || R01@2stepII2@0, R45@2stepII2@1 00C0h TL2 mpy MemR45@3, MemR01@3 || mpy MemR45@3offsZI@2, MemR01@3offsZI@1 || sub p0, p1, Ab@4 || R01@3stepII2@1, R45@3stepII2@2 00C1h TL2 mpy MemR45@3, MemR01@3 || mpy MemR45@3offsZI@2, MemR01@3offsZI@1 || suba p0, p1, Ab@4 || R01@3stepII2@1, R45@3stepII2@2 0D20h TL2 mpy MemR45@3, MemR01@3 || mpyus MemR45@3offsZI@2, MemR01@3offsZI@1 || add3a p0, p1, Ax@0, dmodi || R01@3stepII2@1, R45@3stepII2@2 0D30h TL2 mpy MemR45@3, MemR01@3 || mpyus MemR45@3offsZI@2, MemR01@3offsZI@1 || add3a p0, p1, Ax@0, dmodj || R01@3stepII2@1, R45@3stepII2@2 4B50h TL2 mpy MemR45@3, MemR01@3 || mpyus MemR45@3offsZI@2, MemR01@3offsZI@1 || add3a p0, p1, Ax@0, dmodij || R01@3stepII2@1, R45@3stepII2@2 D7A0h TL2 mpy MemR45@3, MemR01@3 || mpy MemR45@3offsZI@2, MemR01@3offsZI@1 || add3 sv, p0, p1, Ax@4 || R01@3stepII2@1, R45@3stepII2@2 D7A1h TL2 mpy MemR45@3, MemR01@3 || mpy MemR45@3offsZI@2, MemR01@3offsZI@1 || add3rnd sv, p0, p1, Ax@4 || R01@3stepII2@1, R45@3stepII2@2 9861h TL2 mpy MemR45@4, MemR01@4 || mpy MemR45@4offsZI@3, MemR01@4offsZI@2 || add3 p0, p1, Ax@8, dmodj || R01@4stepII2@2, R45@4stepII2@3 9862h TL2 mpy MemR45@4, MemR01@4 || mpy MemR45@4offsZI@3, MemR01@4offsZI@2 || add3 p0, p1, Ax@8, dmodi || R01@4stepII2@2, R45@4stepII2@3 9863h TL2 mpy MemR45@4, MemR01@4 || mpy MemR45@4offsZI@3, MemR01@4offsZI@2 || add3 p0, p1, Ax@8, dmodij || R01@4stepII2@2, R45@4stepII2@3 98E1h TL2 mpy MemR45@4, MemR01@4 || mpy MemR45@4offsZI@3, MemR01@4offsZI@2 || add3a p0, p1, Ax@8, dmodj || R01@4stepII2@2, R45@4stepII2@3 98E2h TL2 mpy MemR45@4, MemR01@4 || mpy MemR45@4offsZI@3, MemR01@4offsZI@2 || add3a p0, p1, Ax@8, dmodi || R01@4stepII2@2, R45@4stepII2@3 98E3h TL2 mpy MemR45@4, MemR01@4 || mpy MemR45@4offsZI@3, MemR01@4offsZI@2 || add3a p0, p1, Ax@8, dmodij || R01@4stepII2@2, R45@4stepII2@3 4DA0h TL2 mpy y0, MemR04@3 || mpyus y1, MemR04@3offsZI@2 || sub3 p0, p1, Ax@4 || R04@3stepII2@2 4DA1h TL2 mpy y0, MemR04@3 || mpyus y1, MemR04@3offsZI@2 || sub3a p0, p1, Ax@4 || R04@3stepII2@2 4DA2h TL2 mpy y0, MemR04@3 || mpyus y1, MemR04@3offsZI@2 || add3 p0, p1, Ax@4 || R04@3stepII2@2 4DA3h TL2 mpy y0, MemR04@3 || mpyus y1, MemR04@3offsZI@2 || add3a p0, p1, Ax@4 || R04@3stepII2@2 94E0h TL2 mpy y0, MemR04@4 || mpy y1, MemR04@4offsZI@3 || sub3 p0, p1, Ax@8 || R04@4stepII2@3 94E2h TL2 mpy y0, MemR04@4 || mpy y1, MemR04@4offsZI@3 || sub3a p0, p1, Ax@8 || R04@4stepII2@3 94E4h TL2 mpy y0, MemR04@4 || mpy y1, MemR04@4offsZI@3 || add3 p0, p1, Ax@8 || R04@4stepII2@3 94E6h TL2 mpy y0, MemR04@4 || mpy y1, MemR04@4offsZI@3 || add3a p0, p1, Ax@8 || R04@4stepII2@3 94E1h TL2 mpy y0, MemR04@4 || mpysu y1, MemR04@4offsZI@3 || sub3 p0, p1, Ax@8 || R04@4stepII2@3 94E3h TL2 mpy y0, MemR04@4 || mpysu y1, MemR04@4offsZI@3 || sub3a p0, p1, Ax@8 || R04@4stepII2@3 94E5h TL2 mpy y0, MemR04@4 || mpysu y1, MemR04@4offsZI@3 || add3 p0, p1, Ax@8 || R04@4stepII2@3 94E7h TL2 mpy y0, MemR04@4 || mpysu y1, MemR04@4offsZI@3 || add3a p0, p1, Ax@8 || R04@4stepII2@3 8862h TL2 mpy y0, x1 || mpy MemR04@4, x0 || sub3 p0, p1, Ax@8 || R04@4stepII2@3 8A62h TL2 mpy y0, x1 || mpy MemR04@4, x0 || add3 p0, p1, Ax@8 || R04@4stepII2@3 4D88h TL2 mpy y0, x1 || mpy y1, x0 || sub p0, p1, Ax@1 5E24h TL2 mpy y0, x1 || mpy y1, x0 || add p0, p1, Ab@0 8061h TL2 mpy y0, x1 || mpy y1, x0 || add3 p0, p1, Ab@8 8071h TL2 mpy y0, x1 || mpy y1, x0 || add3a p0, p1, Ab@8 8461h TL2 mpy y0, x1 || mpy y1, x0 || sub3 p0, p1, Ab@8 8471h TL2 mpy y0, x1 || mpy y1, x0 || sub3a p0, p1, Ab@8 D484h TL2 mpy y0, x1 || mpy y1, x0 || add3aa p0, p1, Ab@0 D49Dh TL2 mpy y0, x1 || mpy y1, x0 || sub p0, p1, Bx@5 D4A0h TL2 mpy y0, x1 || mpy y1, x0 || addsub p0, p1, Ab@0 4FA0h TL2 mpy y0, x1 || mpy y1, x0 || add3 p0, p1, Ab@3 || mov Axh@6, MemR04@1 || mov Bxh@2, MemR04@1offsZI@0 || R04@1stepII2@0 5818h TL2 mpy y0, x1 || mpy y1, x0 || addsub sv, p0, p1, Ax@0 || mov Axh@0, MemR0425@7 || mov Axh@not0, MemR0425@7offsZI@6 || R0425@7stepII2@6 ;override 5800h+18h (mov a0, Register) 5838h TL2 mpy y0, x1 || mpy y1, x0 || addsubrnd sv, p0, p1, Ax@0 || mov Axh@0, MemR0425@7 || mov Axh@not0, MemR0425@7offsZI@6 || R0425@7stepII2@6 ;override 5800h+38h (mov a1, Register) 80D0h TL2 mpy y0, x1 || mpy y1, x0 || addsub sv, p0, p1, Ax@10 || mov Axh@9, MemR04@3 || mov Bxh@8, MemR04@3offsZI@2 || R04@3stepII2@2 80D1h TL2 mpy y0, x1 || mpy y1, x0 || addsubrnd sv, p0, p1, Ax@10 || mov Axh@9, MemR04@3 || mov Bxh@8, MemR04@3offsZI@2 || R04@3stepII2@2 80D2h TL2 mpy y0, x1 || mpy y1, x0 || add3 sv, p0, p1, Ax@10 || mov Axh@9, MemR04@3 || mov Bxh@8, MemR04@3offsZI@2 || R04@3stepII2@2 80D3h TL2 mpy y0, x1 || mpy y1, x0 || add3rnd sv, p0, p1, Ax@10 || mov Axh@9, MemR04@3 || mov Bxh@8, MemR04@3offsZI@2 || R04@3stepII2@2 D3A0h TL2 mpy y0, x1 || mpy y1, x0 || addsub p0, p1, Ab@3 || mov Axh@6, MemR04@1 || mov Bxh@2, MemR04@1offsZI@0 || R04@1stepII2@0 4D89h TL2 mpy y0, x1 || mpyus y1, x0 || sub p0, p1, Ax@1 5F24h TL2 mpy y0, x1 || mpyus y1, x0 || add p0, p1, Ab@0 8069h TL2 mpy y0, x1 || mpyus y1, x0 || add3 p0, p1, Ab@8 8079h TL2 mpy y0, x1 || mpyus y1, x0 || add3a p0, p1, Ab@8 8469h TL2 mpy y0, x1 || mpyus y1, x0 || sub3 p0, p1, Ab@8 8479h TL2 mpy y0, x1 || mpyus y1, x0 || sub3a p0, p1, Ab@8 D584h TL2 mpy y0, x1 || mpyus y1, x0 || add3aa p0, p1, Ab@0 D59Dh TL2 mpy y0, x1 || mpyus y1, x0 || sub p0, p1, Bx@5 D5A0h TL2 mpy y0, x1 || mpyus y1, x0 || addsub p0, p1, Ab@0 0800h TL mpyi NoReverse, Implied p0, y0, Imm8s@0 ;multiply ;aka "mpys" D100h TL mpysu MemR45@2, MemR0123@0 || R0123@0stepZIDS@3, R45@2stepZIDS@5 8100h TL mpysu MemRn@0, Imm16@16 || Rn@0stepZIDS@3 8120h TL mpysu y0, MemRn@0 || Rn@0stepZIDS@3 8140h TL mpysu y0, Register@0 CA00h TL2 mpysu MemR45@5, MemR01@5 || mpysu MemR45@5offsZI@4, MemR01@5offsZI@3 || sub3a p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CA01h TL2 mpysu MemR45@5, MemR01@5 || mpyus MemR45@5offsZI@4, MemR01@5offsZI@3 || sub3a p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CA02h TL2 mpysu MemR45@5, MemR01@5 || mpysu MemR45@5offsZI@4, MemR01@5offsZI@3 || sub3aa p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CA03h TL2 mpysu MemR45@5, MemR01@5 || mpyus MemR45@5offsZI@4, MemR01@5offsZI@3 || sub3aa p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CA04h TL2 mpysu MemR45@5, MemR01@5 || mpysu MemR45@5offsZI@4, MemR01@5offsZI@3 || add3a p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CA05h TL2 mpysu MemR45@5, MemR01@5 || mpyus MemR45@5offsZI@4, MemR01@5offsZI@3 || add3a p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CA06h TL2 mpysu MemR45@5, MemR01@5 || mpysu MemR45@5offsZI@4, MemR01@5offsZI@3 || add3aa p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 CA07h TL2 mpysu MemR45@5, MemR01@5 || mpyus MemR45@5offsZI@4, MemR01@5offsZI@3 || add3aa p0, p1, Ab@6 || R01@5stepII2@3, R45@5stepII2@4 5EA2h TL2 mpysu y0, r6 D080h TL msu MemR45@2,MemR0123@0,Ax@8 || R0123@0stepZIDS@3, R45@2stepZIDS@5 90C0h TL msu MemRn@0, Imm16@16, Ax@8 || Rn@0stepZIDS@3 ;multiply, subtract 9080h TL msu y0, MemRn@0, Ax@8 || Rn@0stepZIDS@3 90A0h TL msu y0, Register@0, Ax@8 B000h TL msu y0,MemImm8@0, Ax@8 9462h TL2 msu y0, r6, Ax@0 8264h TL2 msusu y0, MemR0425@3, Ax@8 || R0425@3stepII2D2S@0 6790h TL neg Ax@12, Cond@0 ;aX=0-aX 0000h TL nop 94C0h TL norm Ax@8, Bogus MemRn@0 || Rn@0stepZIDS@3 ;if N=0 (aX=aX*2,rN+/-) 6780h TL not Ax@12, Cond@0 ;aX=not aX D4F8h TL or MemImm16@16, Ax@8 A000h TL or MemImm8@0, Ax@8 80C0h TL or Imm16@16, Ax@8 C000h TL or Imm8u@0, Ax@8 D4D8h TL or MemR7Imm16@16, Ax@8 4000h TL or MemR7Imm7s@0, Ax@8 8080h TL or MemRn@0, Ax@8 || Rn@0stepZIDS@3 80A0h TL or RegisterP0@0, Ax@8 D291h TL2 or Ab@10, Ax@6, Ax@5 D4A4h TL2 or Ax@8, Bx@1, Ax@0 D3C4h TL2 or b0, Bx@1, Ax@0 D7C4h TL2 or b1, Bx@1, Ax@0 D388h TL2 or r6, Ax@4 67B0h TL pacr Implied Const8000h, Implied p0, Ax@12, Cond@0 ;aX=shfP+8000h D7C2h TL2 pacr1 Implied Const8000h, Implied p1, Ax@0 5E60h TL pop Register@0 47B4h TL2 pop Abe@0 80C7h TL2 pop ArArpSttMod@8 0006h TL2 pop Bx@5, Unused1@0 D7F4h TL2 pop prpage, Unused2@0 D496h TL2 pop Px@0 0024h TL2 pop r6, Unused1@0 D7F0h TL2 pop repc, Unused2@0 D494h TL2 pop x0 D495h TL2 pop x1 0004h TL2 pop y1, Unused1@0 47B0h TL2 popa Ab@0 5F40h TL push Imm16@16 5E40h TL push Register@0 D7C8h TL2 push Abe@1, Unused1@0 D3D0h TL2 push ArArpSttMod@0 D7FCh TL2 push prpage, Unused2@0 D78Ch TL2 push Px@1, Unused1@0 D4D7h TL2 push r6, Unused1@5 D7F8h TL2 push repc, Unused2@0 D4D4h TL2 push x0, Unused1@5 D4D5h TL2 push x1, Unused1@5 D4D6h TL2 push y1, Unused1@5 4384h TL2 pusha Ax@6, Unused2@0 D788h TL2 pusha Bx@1, Unused1@0 0C00h TL rep Imm8u@0 ;repeat next opcode N+1 times 0D00h TL rep Register@0 ;repeat next opcode N+1 times 0002h TL2 rep r6, Unused1@0 4580h TL ret Cond@0 ;=pop pc D780h TL retd ;delayed return (after 2 clks) 45C0h TL reti Cond@0 ;Don't context switch 45D0h TL reti Cond@0, context ;Do context switch D7C0h TL retid ;delayed, from interrupt D3C3h TL2 retid context 0900h TL rets Imm8u@0 ;ret+dealloc sp (for INCOMING pushed params) 67A0h TL rnd Implied Const8000h, Ax@12, Cond@0 ;aX=aX+8000h 6750h TL rol Implied Const1, Ax@12, Cond@0 ;aX=aX rcl 1 (37bit rotate) 6F50h TL rol Implied Const1, Bx@12, Cond@0 ;bX=bX rcl 1 (37bit rotate) 6740h TL ror Implied Const1, Ax@12, Cond@0 ;aX=aX rcr 1 (37bit rotate) 6F40h TL ror Implied Const1, Bx@12, Cond@0 ;bX=bX rcr 1 (37bit rotate) E300h TL rst Imm16@16, MemImm8@0 82E0h TL rst Imm16@16, MemRn@0 || Rn@0stepZIDS@3 83E0h TL rst Imm16@16, Register@0 47B9h TL2 rst Imm16@16, r6 4388h TL2 rst Imm16@16, SttMod@0 E100h TL set Imm16@16, MemImm8@0 80E0h TL set Imm16@16, MemRn@0 || Rn@0stepZIDS@3 81E0h TL set Imm16@16, Register@0 47B8h TL2 set Imm16@16, r6 43C8h TL2 set Imm16@16, SttMod@0 D280h TL shfc Implied sv, Ab@10, Ab@5, Cond@0 9240h TL shfi Implied Imm6s@0, Ab@10, Ab@7, Bogus Imm6s@0 6720h TL shl Implied Const1, Ax@12, Cond@0 ;aX=aX*2 6F20h TL shl Implied Const1, Bx@12, Cond@0 ;bX=bX*2 6730h TL shl4 Implied Const4, Ax@12, Cond@0 ;aX=aX*10h 6F30h TL shl4 Implied Const4, Bx@12, Cond@0 ;bX=bX*10h 6700h TL shr Implied Const1, Ax@12, Cond@0 ;aX=aX/2 6F00h TL shr Implied Const1, Bx@12, Cond@0 ;bX=bX/2 6710h TL shr4 Implied Const4, Ax@12, Cond@0 ;aX=aX/10h 6F10h TL shr4 Implied Const4, Bx@12, Cond@0 ;bX=bX/10h BA00h TL sqr MemImm8@0 9A80h TL sqr MemRn@0 || Rn@0stepZIDS@3 9AA0h TL sqr Register@0 D790h TL2 sqr Abh@2 || sqr Abl@2 || add3 p0, p1, Ab@0 49C4h TL2 sqr Abh@4 || mpysu Abh@4, Abl@4 || add3a p0, p1, Ab@0 4B00h TL2 sqr MemR0425@4 || sqr MemR0425@4offsZIDZ@2 || add3 p0, p1, Ab@0 || R0425@4stepII2D2S@2 5F41h TL2 sqr r6 BC00h TL sqra MemImm8@0, Ax@8 9C80h TL sqra MemRn@0, Ax@8 || Rn@0stepZIDS@3 9CA0h TL sqra Register@0, Ax@8 9062h TL2 sqra r6, Ax@8, Unused1@0 D4FFh TL sub MemImm16@16, Ax@8 AE00h TL sub MemImm8@0, Ax@8 8EC0h TL sub Imm16@16, Ax@8 CE00h TL sub Imm8u@0, Ax@8 D4DFh TL sub MemR7Imm16@16, Ax@8 4E00h TL sub MemR7Imm7s@0, Ax@8 8E80h TL sub MemRn@0, Ax@8 || Rn@0stepZIDS@3 8EA0h TL sub RegisterP0@0, Ax@8 8A61h TL2 sub Ab@3, Bx@8 8861h TL2 sub Bx@4, Ax@3 8064h TL2 sub MemR01@8, sv, Abh@3 || add MemR01@8offsZI@0, sv, Abl@3 || mov MemR45@8, sv || R01@8stepII2@0, R45@8stepII2@1 5DE0h TL2 sub MemR04@1, sv, Abh@2 || add MemR04@1offsZI@0, sv, Abl@2 || R04@1stepII2@0 6FC0h TL2 sub MemR45@2, MemR01@2, Abh@3 || add MemR45@2offsZI@1, MemR01@2offsZI@0, Abl@3 || R01@2stepII2@0, R45@2stepII2@1 6FE0h TL2 sub MemR45@2, MemR01@2, Abh@3 || sub MemR45@2offsZI@1, MemR01@2offsZI@0, Abl@3 || R01@2stepII2@0, R45@2stepII2@1 5D80h TL2 sub MemR45@2, sv, Abh@3 || add MemR45@2offsZI@1, sv, Abl@3 || mov MemR01@2, sv || R01@2stepII2@0, R45@2stepII2@1 5DC2h TL2 sub p0, p1, Ab@2 D4B9h TL2 sub p1, Ax@8 8FD0h TL2 sub Px@1, Bx@0 D38Fh TL2 sub r6, Ax@4 80C6h TL2 sub3 p0, p1, Ab@10 82C6h TL2 sub3a p0, p1, Ab@10 83C6h TL2 sub3aa p0, p1, Ab@10 5DC3h TL2 suba p0, p1, Ab@2 B600h TL subh MemImm8@0, Ax@8 9680h TL subh MemRn@0, Ax@8 || Rn@0stepZIDS@3 96A0h TL subh Register@0, Ax@8 5E23h TL2 subh r6, Ax@8 B800h TL subl MemImm8@0, Ax@8 9880h TL subl MemRn@0, Ax@8 || Rn@0stepZIDS@3 98A0h TL subl Register@0, Ax@8 5E22h TL2 subl r6, Ax@8 EF00h TL subv Imm16@16, MemImm8@0 8EE0h TL subv Imm16@16, MemRn@0 || Rn@0stepZIDS@3 8FE0h TL subv Imm16@16, Register@0 47BFh TL2 subv Imm16@16, r6 4980h TL swap SwapTypes4@0 0020h TL trap ;software interrupt A800h TL tst0 Axl@8, MemImm8@0 8880h TL tst0 Axl@8, MemRn@0 || Rn@0stepZIDS@3 88A0h TL tst0 Axl@8, Register@0 E900h TL tst0 Imm16@16, MemImm8@0 88E0h TL tst0 Imm16@16, MemRn@0 || Rn@0stepZIDS@3 89E0h TL tst0 Imm16@16, Register@0 D38Ch TL2 tst0 Axl@4, r6 47BCh TL2 tst0 Imm16@16, r6 9470h TL2 tst0 Imm16@16, SttMod@0 AA00h TL tst1 Axl@8, MemImm8@0 Implied Not 8A80h TL tst1 Axl@8, MemRn@0 Implied Not || Rn@0stepZIDS@3 8AA0h TL tst1 Axl@8, Register@0 Implied Not EB00h TL tst1 Imm16@16, MemImm8@0 Implied Not 8AE0h TL tst1 Imm16@16, MemRn@0 Implied Not || Rn@0stepZIDS@3 8BE0h TL tst1 Imm16@16, Register@0 Implied Not D38Dh TL2 tst1 Axl@4, r6 Implied Not 47BDh TL2 tst1 Imm16@16, r6 Implied Not 9478h TL2 tst1 Imm16@16, SttMod@0 Implied Not 80C1h TL2 tst4b a0l, MemR0425@10 || R0425@10stepII2D2S@8 4780h TL2 tst4b a0l, MemR0425@2, Ax@4 || R0425@2stepII2D2S@0 F000h TL tstb NoReverse, Implied Not MemImm8@0, Imm4bitno@8 9020h TL tstb NoReverse, Implied Not MemRn@0, Imm4bitno@8 || Rn@0stepZIDS@3 9000h TL tstb NoReverse, Implied Not Register@0, Imm4bitno@8 9018h TL2 tstb NoReverse, Implied Not r6, Imm4bitno@8 ;override tstb a0,Imm4 0028h TL2 tstb NoReverse, Implied Not SttMod@0, Imm4bitno@16, Unused12@20 5F45h TL2 vtrclr vtr0 ;vtr0=0 ;for Viterbi decoding... 5F47h TL2 vtrclr vtr0, vtr1 ;vtr0=0, vtr1=0 ;(saved C/C1 carry flags) 5F46h TL2 vtrclr vtr1 ;vtr1=0 D383h TL2 vtrmov Axl@4 ;Axl=(vtr1 and FF00h)+(vtr0/100h) D29Ah TL2 vtrmov vtr0, Axl@0 ;Axl=vtr0 D69Ah TL2 vtrmov vtr1, Axl@0 ;Axl=vtr1 D781h TL2 vtrshr ;vtr0=vtr0/2+C*8000h, vtr1=vtr1/2+C1*8000h D4FAh TL xor MemImm16@16, Ax@8 A400h TL xor MemImm8@0, Ax@8 84C0h TL xor Imm16@16, Ax@8 C400h TL xor Imm8u@0, Ax@8 D4DAh TL xor MemR7Imm16@16, Ax@8 4400h TL xor MemR7Imm7s@0, Ax@8 8480h TL xor MemRn@0, Ax@8 || Rn@0stepZIDS@3 84A0h TL xor RegisterP0@0, Ax@8 D38Ah TL2 xor r6, Ax@4 8800h TL undefined Unused5@0, Unused1@8 ;(mpy/mpys without A in bit11) 8820h TL undefined Unused5@0, Unused1@8 ;(mpy/mpys without A in bit11) 8840h TL undefined Unused5@0, Unused1@8 ;(mpy/mpys without A in bit11) D800h TL undefined Unused7@0, Unused1@8 ;(mpy/mpys without A in bit11) 9B80h TL undefined Unused6@0 ;(sqr without A in bit8) BB00h TL undefined Unused8@0 ;(sqr without A in bit8) E800h TL undefined Unused8@0 ;(mpy without A in bit11) 5EA1h TL2 undefined Unused1@1 ;(mpy/mpys without A in bit11) 5DFCh TL2 undefined 8CDEh TL2 undefined D3C1h TL2 undefined 5EB4h TL2 undefined Unused2@0 |
DSi TeakLite II Operand Encoding |
name native nocash MemRn (Rn) [Rn] MemSp (sp) [sp] ProgMemRn (Rn) [code:movpd:Rn] ProgMemAxl (Axl) [code:movpd:Axl] ProgMemAx (Ax) [code:Ax] ProgMemAx_.. (Ax),(Ax+) [code:Ax]:[code:Ax+] MemImm8 0xNN [page:NNh] MemImm16 [##0xNNNN] [NNNNh] MemR7Imm7s (r7+#0xNN), (r7+#-NNN) [r7+/-NNh] MemR7Imm16 (r7+##0xNNNN) [r7+NNNNh] |
Address18 0xNNNNN NNNNNh ;for bkrep/br/call Address16 0xNNNN NNNNh ;for bkrep RelAddr7 0xNNNN NNNNh ;for jmp ImmN: #0xNNNN NNNNh ImmNs: #0xNN, #-NNN +/-NNh Imm16: ##0xNNNN NNNNh Imm4bitno: ... 1 shl N ConstZero <implied> 0000h Const1 <implied> 0001h Const4 <implied> 0004h Const8000h <implied> 8000h |
Register: RegisterP0: Ax: Axl: Axh: Px: 00: r0 00: r0 0: a0 0: a0l 0: a0h 0: p0 01: r1 01: r1 1: a1 1: a1l 1: a1h 1: p1 02: r2 02: r2 03: r3 03: r3 Bx: Bxl: Bxh: Ablh: 04: r4 04: r4 0: b0 0: b0l 0: b0h 0: b0l 05: r5 05: r5 1: b1 1: b1l 1: b1h 1: b0h 06: r7 06: r7 2: b1l 07: y0 07: y0 Ab: Abl: Abh: Abe: 3: b1h 08: st0 08: st0 0: b0 0: b0l 0: b0h 0: b0e 4: a0l 09: st1 09: st1 1: b1 1: b1l 1: b1h 1: b1e 5: a0h 0A: st2 0A: st2 2: a0 2: a0l 2: a0h 2: a0e 6: a1l 0B: p0h !! 0B: p0 !! 3: a1 3: a1l 3: a1h 3: a1e 7: a1h 0C: pc 0C: pc 0D: sp 0D: sp Cond: 0E: cfgi 0E: cfgi 0: true ;Always ;always 0F: cfgj 0F: cfgj 1: eq ;Equal to zero ;Z=1 10: b0h 10: b0h 2: neq ;Not equal to zero ;Z=0 11: b1h 11: b1h 3: gt ;Greater than zero ;M=0 and Z=0 12: b0l 12: b0l 4: ge ;Greater or equal to zero ;M=0 13: b1l 13: b1l 5: lt ;Less than zero ;M=1 14: ext0 14: ext0 6: le ;Less or equal to zero ;M=1 or Z=1 15: ext1 15: ext1 7: nn ;Normalize flag is cleared ;N=0 16: ext2 16: ext2 8: c ;Carry flag is set ;C=1 17: ext3 17: ext3 9: v ;Overflow flag is set ;V=1 18: a0 18: a0 A: e ;Extension flag is set ;E=1 19: a1 19: a1 B: l ;Limit flag is set ;L=1 1A: a0l 1A: a0l C: nr ;R flag is cleared ;R=0 1B: a1l 1B: a1l D: niu0 ;Input user pin 0 cleared ;IUSER0=0 1C: a0h 1C: a0h E: iu0 ;Input user pin 0 set ;IUSER0=1 1D: a1h 1D: a1h F: iu1 ;Input user pin 1 set ;IUSER1=1 1E: lc 1E: lc 1F: sv 1F: sv |
R0123457y0: Rn: ArArpSttMod: ArArp: SttMod: 0: r0 0: r0 0: ar0 0: ar0 0: stt0 1: r1 1: r1 1: ar1 1: ar1 1: stt1 2: r2 2: r2 2: arp0 2: arp0 2: stt2 3: r3 3: r3 3: arp1 3: arp1 3: reserved 4: r4 4: r4 4: arp2 4: arp2 4: mod0 5: r5 5: r5 5: arp3 5: arp3 5: mod1 6: r7 ;aka rb 6: r6 ;TL2 only 6: reserved 6: reserved 6: mod2 7: y0 ;aka y 7: r7 ;TL2 only 7: reserved 7: reserved 7: mod3 8: stt0 R01: R04: R45: 9: stt1 Ar: BankFlags: 0: r0 0: r0 0:r4 A: stt2 0: ar0 01h: cfgi 1: r1 1: r4 1:r5 B: reserved 1: ar1 02h: r4 C: mod0 04h: r1 R0123: R0425: R4567: D: mod1 Arp: 08h: r0 0: r0 0: r0 0: r4 E: mod2 0: arp0 10h: r7 ;TL2 1: r1 1: r4 1: r5 F: mod3 1: arp1 20h: cfgj ;TL2 2: r2 2: r2 2: r6 2: arp2 3: r3 3: r5 3: r7 3: arp3 |
SwapTypes: val native nocash ;meaning 0: (a0,b0) a0,b0 ;a0 <--> b0 ;flags(a0) 1: (a0,b1) a0,b1 ;a0 <--> b1 ;flags(a0) 2: (a1,b0) a1,b0 ;a1 <--> b0 |