BIOS and Bootrom
The ARM7 BIOS is split into two parts:
- the actual BIOS which is 0x8000 bytes long and starts at 0x0
- the bootrom which is probably also 0x8000 bytes long and starts at 0x8000
- The contents of 1) can only be read by instructions within the BIOS. It can therefore be dumped by applying some IRQ timer trick to find a usable ldr instruction or by just using the memcpy at 0x6bb0 with the usual arguments.
- The contents of 2) can only be read until bit 0 in register 0x04004000 or 0x04004001 (?) is cleared. It is disabled after it has been executed and can never be read again until the device is reset. It might contains keys and has not been dumped yet.
The BIOS provides the following SVC functions. Every SVC not mentioned here just jumps to an infinite loop at 0x16c (b .)
Caution: In below table, "n/a" in the NAME column seems to mean "not altered" (ie. same as in NDS BIOS). Whilst "n/a" in the DESCRIPTION column seems to mean "not any" (ie. nobody has written a description yet).
reset vectors et al
The first few words of the BIOS cannot be dumped. You can deduce them by tracing the code though (all values are noted in big endian here):
ea000006 ea000006 ea00001f ea000004 ea000003 eafffffe ea000013 ea000000