Stage2 - Revision history

PoroCYon: WRAMCNT setting in stage2 header

2023-01-07T15:11:01Z

WRAMCNT setting in stage2 header

← Older revision		Revision as of 18:11, 7 January 2023
Line 82:		Line 82:
	\|-		\|-
	\| 0x1AC		\| 0x1AC
	\| ~~0x4~~		\| 0x3
	\| Global MBK9 Slot Master Setting		\| Global MBK9 Slot Master Setting
			\|-
			\| 0x1AF
			\| 0x1
			\| Global WRAMCNT Setting
	\|-		\|-
	\| 0x1B0		\| 0x1B0

Yellows8 at 17:40, 19 December 2022

2022-12-19T16:40:31Z

← Older revision		Revision as of 19:40, 19 December 2022
Line 10:		Line 10:
	00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 \|.n...u....{..v..\|		00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 \|.n...u....{..v..\|
	00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \|................\|		00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \|................\|

			There's two header sectors [[NAND\|following]] this, however stage1 ignores these.

	This is describing two chunks of the stage2 loader: the ARM9-binary 0x26410 bytes in length at address 0x800, and the ARM7-binary 0x27588 bytes at address 0x26e00.		This is describing two chunks of the stage2 loader: the ARM9-binary 0x26410 bytes in length at address 0x800, and the ARM7-binary 0x27588 bytes at address 0x26e00.
Line 122:		Line 124:
	\| 6		\| 6
	\| 0x40		\| 0x40
	\| When booting from ~~NWRAM~~, use an 8 MHz SPI clock. If 0, use a 4 MHz SPI clock. Not used for non-NVRAM boots.		\| When booting from NVRAM, use an 8 MHz SPI clock. If 0, use a 4 MHz SPI clock. Not used for non-NVRAM boots.
	\|-		\|-
	\| 7		\| 7
Line 143:		Line 145:
	\| 0x10		\| 0x10
	\| 0x14		\| 0x14
	\| SHA1 hash, calculated over the first 0x28-bytes of [[~~NAND~~]], then the first 0x100-bytes of the header, then the last 0x80-bytes of the header (following the signature). ~~This works with both the~~ bootloader contained in TWL_FIRM, ~~and~~ the ~~real DSi ARM9 boot ROM~~.		\| SHA1 hash, calculated over the first 0x28-bytes of [[NVRAM]], then the first 0x100-bytes of the header, then the last 0x80-bytes of the header (following the signature). The bootloader contained in TWL_FIRM uses the first 0x28-bytes from NAND. For non-NAND boot mediums, this hash is calculated the same except there's no 0x28-byte block.
	\|-		\|-
	\| 0x24		\| 0x24
Line 155:		Line 157:
	\| 0x4C		\| 0x4C
	\| 0x14		\| 0x14
	\| Unknown, not used by 3DS TWL_FIRM ~~nor DSi bootrom~~. Normally all-zero.		\| Unknown, not used by 3DS TWL_FIRM. Normally all-zero. Copied to 0x01FFC880 by ARM9 [[Stage1]].
	\|-		\|-
	\| 0x60		\| 0x60
	\| 0x14		\| 0x14
	\| SHA1 of all previous fields in the RSA ~~messasge~~, used to prevent RSA signature forgery. Not used by 3DS TWL_FIRM(?).		\| SHA1 of all previous fields in the RSA message, used to prevent RSA signature forgery. Not used by 3DS TWL_FIRM(?).
	\|}		\|}

PoroCYon: /* Stage2 operations */ more info about what stage2 does

2022-12-19T14:39:09Z

Stage2 operations: more info about what stage2 does

← Older revision		Revision as of 17:39, 19 December 2022
Line 182:		Line 182:
	After Stage 2 is loaded:		After Stage 2 is loaded:
	# Main RAM (aka FCRAM aka DRAM) is allowed bus access (using the EXMEMCNT MMIO register) and initialized.		# Main RAM (aka FCRAM aka DRAM) is allowed bus access (using the EXMEMCNT MMIO register) and initialized.
			# The status registers of the BPTWL are read to check whether this is a warmboot. The powerbutton action of the BPTWL is reset as well.
	# The NAND flash is partially re-initialized		# The NAND flash is partially re-initialized
			# Various hardware components, such as the touchscreen/sound controller, Wifi chip, etc. are initialized. (Cameras aren't initialized, though.)
	# Sector 0 is read from the NAND. This is an (encrypted) DOS-style MBR.		# Sector 0 is read from the NAND. This is an (encrypted) DOS-style MBR.
	# The MBR signature and the type of the first partition are verified.		# The MBR signature and the type of the first partition are verified.

PoroCYon: be more detailed about RSA pubkey stuff

2022-12-18T16:56:43Z

be more detailed about RSA pubkey stuff

← Older revision		Revision as of 19:56, 18 December 2022
Line 129:		Line 129:
	\|}		\|}

	The RSA public keys (the one for 3DS and the other one for DSi) for the below signature can be obtained from 3DS TWL_FIRM Process9 (this is required for getting the binaries' keyY). It is also found in the DSi's ARM9 boot ROM, but this is never copied to some place outside the boot ROM. (The bootroms copy _some_ keys to WRAM/ITCM, but not this one.)		The RSA public keys (the one for 3DS and the other one for DSi) for the below signature _for NAND boots_ can be obtained from 3DS TWL_FIRM Process9 (this is required for getting the binaries' keyY). It is also found in the DSi's ARM9 boot ROM, but this is never copied to some place outside the boot ROM. (The bootroms copy _some_ keys to WRAM/ITCM, but not this one.) Public keys for NVRAM and game cartridge boots are only available from the DSi ARM9 boot ROM, and all differ from the NAND RSA public key.

	Structure of the 0x74-byte "hash-data" stored in the RSA message:		Structure of the 0x74-byte "hash-data" stored in the RSA message:

PoroCYon: describe boot header in more detail

2022-12-18T16:33:16Z

describe boot header in more detail

Show changes

Hallowizer: Hallowizer moved page Boot1 to Stage2: commonly used name

2022-10-13T20:20:16Z

Hallowizer moved page Boot1 to Stage2: commonly used name

← Older revision		Revision as of 00:20, 14 October 2022
(No difference)

Hallowizer: Removed boot0 stuff

2021-08-23T00:59:26Z

Removed boot0 stuff

← Older revision		Revision as of 04:59, 23 August 2021
Line 1:		Line 1:
	~~== Stage 1 ==~~

	~~[[Image:boot-stage1-error.jpeg\|frame\|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]~~

	The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted+signed stages from [[NAND]] flash, starting with a plaintext offset table in the sector at offset 0x200.

	~~Not much is known about this bootloader yet, but it presumably knows how to:~~
	~~# Initialize the encryption hardware~~
	~~# Read the contents of [[NVRAM]]~~
	~~# Initialize both LCDs~~
	~~# Read blocks (but not files) from the [[NAND]] flash~~
	~~# Perform some variety of integrity check on all data it reads (signature, CRC, ?)~~
	~~# Display basic hexadecimal error codes~~
	~~# Possibly factory-programming the [[NAND]] flash?~~
	~~# Might also do basic power-on self test of peripherals~~

	~~Known error codes:~~

	~~{\| border="1" cellpadding="3" cellspacing="0"~~
	~~! Error Code !! Description~~
	\|-
	~~\| 0000FE00 \|\| Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)~~
	\|-
	~~\| 0000FEFC \|\| Integrity error in first block of Stage 2 (address at 0x220)~~
	\|-
	~~\| 0000FEFD \|\| Integrity error in second block of Stage 2 (address at 0x230)~~
	\|-
	~~\| 0000FEFE \|\| Boot sector integrity error (Sector 0x200 not valid), or error in [[NVRAM]] contents.~~
	\|}

	~~== Stage 2 ==~~

	[[Image:boot-stage2-error.jpeg\|frame\|This may have been a Stage 2 bootloader error.]]		[[Image:boot-stage2-error.jpeg\|frame\|This may have been a Stage 2 bootloader error.]]

Hallowizer: Hallowizer moved page Bootloader to Boot1: Most content is boot1, will split out boot0

2021-08-23T00:57:38Z

Hallowizer moved page Bootloader to Boot1: Most content is boot1, will split out boot0

← Older revision	Revision as of 04:57, 23 August 2021
(No difference)

Kuwoh: /* Stage2 operations */

2017-11-27T10:50:46Z

Stage2 operations

← Older revision		Revision as of 13:50, 27 November 2017
Line 184:		Line 184:
	\|-		\|-
	\| "Error: 1-2435-8325" \|\| Invalid signature or partition type in MBR, invalid starting LBA.		\| "Error: 1-2435-8325" \|\| Invalid signature or partition type in MBR, invalid starting LBA.
			\|-
			\| "Error: 2-2435-8325" \|\| Invalid Firmware
	\|-		\|-
	\| "Error: 3-2435-8325" \|\| DSi Menu integrity checks failed		\| "Error: 3-2435-8325" \|\| DSi Menu integrity checks failed
	\|-		\|-
	\|}		\|}

Yellows8: /* Stage 2 */

2015-04-21T02:11:50Z

Stage 2

← Older revision		Revision as of 06:11, 21 April 2015
Line 161:		Line 161:
	Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. The stage2 bootloader binaries are not encrypted with any console-unique keys.		Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. The stage2 bootloader binaries are not encrypted with any console-unique keys.

	Stage1 uses the [[AES_Engine\|AES CTR]] to decrypt each ARM9/ARM7 binary, where keyY is from the above signature. The [[AES_Engine]] keyslot used here is the same one used for the shared areas for [[Tad]], therefore the keyX is the same as the one used for that. The following is used for the CTR, where "binblk->binblocksize" is the above binary size aligned to 0x200-bytes:		Stage1 uses the [[AES_Engine]] with mode AES-CTR to decrypt each ARM9/ARM7 binary, where keyY is from the above signature. The [[AES_Engine]] keyslot used here is the same one used for the shared areas for [[Tad]], therefore the keyX is the same as the one used for that. The following is used for the CTR, where "binblk->binblocksize" is the above binary size aligned to 0x200-bytes:

	unsigned int ctr[4];		unsigned int ctr[4];