4dsdev
Views: 592,363 Main | Rules/FAQ | Memberlist | Active users | Last posts | Calendar | Stats | Online users | Search 08-23-17 12:07 AM
Guest:

0 users reading I2C Device 4Ah (LED/Volume/Powerbutton/Reset controller) | 1 bot

Main - Reverse-engineering - I2C Device 4Ah (LED/Volume/Powerbutton/Reset controller) New reply


nocash
Posted on 10-11-15 03:53 PM Link | #486
On the DSi, the BPTWL chip (I2C device 4Ah) is used for LED/Volume/Powerbutton/Reset control. On the 3DS the chip is called somewhat different, but it should have the device number and same functions (plus some extra functions).

Somebody told me that 3DS people have found a firmware for that chip, is that true?

If yes, how does that firmware look like? What's it's filename, is it a separate file, or a datablock inside of a bigger file? Is there some file header, how does the instruction set look like, and is the instruction set already identified? And how is the firmware uploaded to the chip, is it stored permanently in FLASH, or only loaded temporarily to RAM? And is there anything similar on DSi? Etc...

If it's patch-able and stored permanently in FLASH, then it might be useful for forcing the "warmboot" flag to be always set (which would theoretically allow to bypass the annoying health safety message).

plutoo
Posted on 10-13-15 09:28 AM Link | #502
The 3DS MCU process contains a binary blob of approximately 0x4000 bytes. It's uploaded over I2C like this (I think):

1. Read register 15.
2. Read register 16.
3. Write firmware blob to register 0x3B if reg15 == 0 or reg16 == 0, else to register 5.

I think I read somewhere that it is supposedly an Renesas microcontroller. I was not able match up its instruction set with any public Renesas instruction set however. I can provide the firmware blob if you'd like to look at it.

nocash
Posted on 10-25-15 09:41 AM (rev. 2 of 10-25-15 09:42 AM) Link | #559
Yes, the two round dots on the package seem to be somewhat common for Renesas chips.
There're also two snippets from a decapped "BP_TWL-2" chip shown at https://chipworks.secure.force.com/catalog/ProductDetails?sku=NIN-BP_TWL-2 with text "NEC Electronics Corp. 2009, 33A" and "67".
Whereas, NEC appears to have been sold to Renesas, so both manufacturer names are probably correct. Maybe the instruction set is described in some older NEC datasheets.

The upload sequence looks odd. Especially reading register 15 and 16 - are that decimal numbers? Register 16 (=10 hex) would be the power button status,
http://problemkaputt.de/gbatek.htm#dsii2cdevice4ahbptwlchip
at least, it should be so in DSi mode; maybe the 3DS uses other register indices when running in 3DS mode...?

plutoo
Posted on 10-25-15 02:40 PM Link | #565
Yes, those are decimal numbers. Maybe it uploads firmware to register 0x3B on hard boot, and 5 on soft boot, or something like that?

On the 3DS there are two 0x4A devices on separate I2C busses. Presumably they kept the TWL I2C bus for compatibility, and added another one for 3DS. That could explain why the registers aren't matching up fully.

I'll try to match the instruction set with NEC ones.


Main - Reverse-engineering - I2C Device 4Ah (LED/Volume/Powerbutton/Reset controller) New reply

Page rendered in 0.043 seconds. (2048KB of memory used)
MySQL - queries: 26, rows: 69/69, time: 0.034 seconds.
[powered by Acmlm] Acmlmboard 2.064 (2015-10-07)
© 2005-2008 Acmlm, Xkeeper, blackhole89 et al.