Depackaging the Nintendo 3DS CPU | Hacker News Reader

Depackaging the Nintendo 3DS CPU

gaasedelen.blogspot.co.uk

126 pointsrobin_reala46 comments

This is incredibly awesome work, and I envy students who can actually take a course in this stuff!

However it makes me realize in what kind of weirdly antagonistic society we live. In an ideal universe, you could just ask the Nintendo engineers for the chip layouts, or for the boot ROM. It reminds me of a documentary I saw the other day where they tested the chicken content of chicken salad. Again, in an ideal universe, you could just ask the manufacturer. Of course that would be naive in the real world, since manufacturers and consumers have different interests. Most of the time we don't notice anything weird about this. A bit of competition is usually considered a good thing. But every now and then I have a WTF moment... Why are we working against each other? How much productivity do we loose through duplication of effort? Are the losses from this smaller or bigger than the gains from healthy competition? I have no great answer for that...

Oh and sorry for hijacking the comment area for a rant about the world and so on ;-).

In an ideal world, nobody would steal chip designs and boot ROMs to create counterfeit products.

In an ideal world, we'd all be living in a post-scarcity economy with Basic Income and no IP laws and no "currency" to speak of.

In an ideal world. An ideal world sounds really cool! The implementation details might get a little crazy though.

An hour goes by and no one has called me on this? "Basic Income" and "no 'currency' to speak of" seem contradictory. I'd go for no currency rather than BI now that I think of it. Replicators for everyone!

In an ideal world, DS piracy wouldn't have been as rampant and Nintendo wouldn't have needed to add DRM.

No one ever "needs" to add DRM. That is just an arbitrary business strategy among many possible strategies which may or may not actually work.

If you're interested in that kind of stuff I highly reccomend watching Karsten Nohl's "Reviving smart card analysis" talk from Chaos Communication Camp 2011 [0].

Basically he takes pictures of the circuits on the smart card and then reverses the logic from that. There's even software to assist with that [1].

As a pure software guy I was pretty baffeled when I saw this the first time.

[0] https://www.youtube.com/watch?v=fFx6Rn57DrY

[1] http://www.degate.org/

There was also a great talk at Defcon 21 (last year) walking through a similar process all the way to using a picture of the ROM and image recognition to pull binary data. The first half is about building the lab to do this kind of work so you can skip the first 1/3 - 1/2 if you don't care about that part.

https://www.youtube.com/watch?v=0Z4aF-qiziM

That page has web buttons that overlap my scrollbar.... how is that even a thing? please make it stop.

Not sure you actually want to know, but it’s not the page that has the scrollbar here but an inner div with overflow-y:scroll;

With the added benefit that if you click a picture, you'll have to scroll all the way back down again!

In Firefox at least, you can open the post from the RSS feed and read it without Javascript:

http://gaasedelen.blogspot.co.uk/feeds/posts/default?alt=rss...

For fuck sake, is it possible to have a HN comments page without complaints about the design of TFA? Speak to the author if you have a problem with their site! Don't mumble about it from a distance!

I think it's useful to point out egregious bad behavior in web design/implementation. Others can learn from the mistake, or people who wouldn't necessarily see something wrong with it can learn from the backlash it generates.

Reimplementing scrolling. Isn't JavaScript amazing?

CSS, not Javascript, luckily.

That is div#gadget-dock. It technically located beneath the blog post, but it has a fixed position that is on top of the scroll bar. It has a z-index of 3000, which puts it on top of everything else.

Not to mention that if you click on any of the images to view the larger version of the images, hitting the back button resets you to the top of the page and you have to re-navigate to where you were. And this is in the latest version of Chrome on a Mac.

What's old is new again.

I always open these up in a new tab (usually can be done fast with third click, or ctrl+click), then close the tab when I'm done. It's fast, you can keep reading the original site while the image/webpage/whatever loads, and the problem you mention never happens.

I seem to recall that imaging the bootloader ROM straight off the silicon was how the original Gameboy's bootloader was finally pulled out.

I just forget who did it, which is unfortunate.

I spent a fair bit of time trying to find an article or something about this, but came up empty. I was especially curious to know how you can decode the program's bits from the silicon.

I found a similar idea here: http://members.iinet.net.au/~lantra9jp1/gurudumps1/decap/ind... The photo in the upper-right looks like it could reasonably be turned into binary, if you knew what you were looking at.

Anyone have any more info about how this actually works?

Currently on mobile, will update tomorrow.

Start here:

http://www.visual6502.org/

Somewhere in that site they detail the step by step process of decapping, delayering photographing and identifying the logic.

There's also a JavaScript simulator, check it out.

The CCC also had a few lectures about decapping. The most interesting one is about backside scanning the die to bypass the safety features.

The CCC backside attack is here:

https://www.youtube.com/watch?v=dtviiOJ-2hI

It contains lots of info and technical details.

Another one:

https://www.youtube.com/watch?v=KVmpBPbGPsQ

This is what an actual ROM looks like:

https://docs.google.com/document/d/18IGx18NQY_Q1PJVZ-bHywao9...

As the last image shows, the ROM table values are extracted by graphics processing the photo.

It's also possible to dump the ROM by reading it byte by byte, but this depends on the architecture (not always possible) and is typically done for mask ROMs that contain data.

Thanks a lot!

See my lecture notes: http://security.cs.rpi.edu/courses/hwre-spring2014/Lecture9_...

That is one classy lab.

the lab has broken down.. #mirror?

http://webcache.googleusercontent.com/search?q=cache:xj_VqrM...

alternative alternant http://siliconpr0n.org/archive/doku.php?id=azonenberg:ninten...

blogspot.co.uk, aka Google, is down?

That's the guy's apartment. I guess he lives and breaths electronics (but not the fumes, he has an exhaust for soldering).

Nice setup. I was almost expecting an RF anechoic chamber for the bedroom. The bonus would be you can shut the door, and it would be a very quiet sleeping space.

As someone who knows nothing about this stuff, can someone explain to me how soaking the CPU in sulfuric acid removes the packaging material, but does no harm to the chip inside?

Sulphuric acid is powerful enough to react with polymers, but not to dissolve silicon.

"does no harm" might be an exaggeration here. It's doubtful you'd have a functional chip. But the fine structure remains, clearly.

Toss some nitric acid in there, forming aqua regia, and you'll dissolve the whole chip including any gold.

> It's doubtful you'd have a functional chip

I have a couple of fully functional examples on my desk that say otherwise. If you actually want to keep the device usable to the point that you can still solder it to a board, then you normally preserve most of the package, bond wires, and leadframe which requires more care during decap. For this particular specimen we didn't bother because we just wanted the ROM.

Here's an example of a fully functional decapped device soldered back to a board: http://i.imgur.com/UebB3FO.jpg

My lecture notes at http://security.cs.rpi.edu/courses/hwre-spring2014/Lecture3_... go into more detail on various methods, chemical and otherwise, for decapping with and without preserving the leadframe.

Interesting stuff. Thank you for taking the time to explain.

Wow, this is a world I've never seen before.

In you want more:

http://zeptobars.ru/en/

The nice thing is they decap old/common devices.

Wait, so are they actually trying to take a picture of the boot ROM used by the 3DS?

It seems that way. This looks similar to what byuu did for SNES games. Some SNES games have special dedicated chips, and decapping them allows you to recreate the logic. It's an expensive and very difficult process though, which is why it's rare to actually see someone attempt it in the open.

More info on Dr Decapitator’s SNES decapping escapades at Mameworld (archive.org link as the subsite is dead): http://web.archive.org/web/20111115180306/http://decap.mamew...

It's impressive how Nintendo can continue selling heavily underpowered processors to gamers and nobody complains.

It's been like that for a long time. I'd argue that for mobile devices, you don't really need that much power anyway to make something fun and adapted to the format. The PSP is still selling well in Japan and developers are still making game for it to this day.

Less power means longer battery life, and it doesn't matter as long as the games are fun. The game being fun is much more important than how new the processor is.

I never understood this arguement. So Nintendo do not pick the most powerful CPU/GPU available. Why does that really matter? It is a lot more powerful than the device before it and it has amazing games on it still.

With a handheld the most important number, to me, is battery life. I still feel that Nintendo (and Sony) could do more by using a more efficient or lower power chip and get a couple more hours out of the device.

Then again I do not care that much for graphics so perhaps my opinion is in the minority. There are several things I would change about the 3DS if I could but upping the processing power is not one of them.

It is like the Mac/PC or Android/iPhone hardware question. If someone cares how many cores their computer has then they will probably shop for an Android phone with a fancy processor. Most Mac buyers pick "the cheap one", "the middle one", or "the fast one" and couldn't tell you how much ram, or which processor is inside their laptop.

In the end, it's the experience of the games you care about that matters.

I bought my 3DS for basically 3 games, and while the graphics don't compare to my phone or tablet, the fact that I can even have them in a portable form factor prevents me from caring that it's underpowered.

Reply on news.ycombinator.com