It was about this time last year when I released open source save game hacks for two DSi hybrid games, Cooking Coach and Classic Word Games. I kind of expected somebody somewhere to pick these up and make them do something a little bit more useful than change the screen colors but it looks like I was a little optimistic on that front. Most people that have done anything at all seem to have been trying to do as much as possible in the 8KiB or so available in each save game. Interestingly not one single DSi hybrid game I’ve been able to find since appears to have a name entry – bit odd considering how easy it is to test for and correct buffer overflows for this specific situation. If anyone knows any different, please let me know.
Since last year I’ve spent a bit of time hunting around DSi hybrid games and playing around with a few ideas I had about how best to utilise the exploits for homebrew. Mostly I’ve been updating devkitARM & libnds with a few things needed to allow normally compiled homebrew to use the extra 12meg when run in DSi mode. I’m still a little undecided on how best to approach the hybrid model – Nintendo seem to be using a system where extra code is loaded in DSi mode from separate binaries in the .nds container format.
So anyway, lest I ramble on for several pages with background and random thoughts, on to the meat of this post. One of the first things that I did on getting into DSi mode was dump the DS mode firmware. As I expected this was identical to the dump made in DS mode – it contains only the wifi module settings and the user data at the end of a 128K flash chip. Most interesting of all was the large block of unwritten space between the two but unfortunately the first 64KiB is protected but that still leaves 61KiB writable – plenty for my nefarious purposes. After some further testing I confirmed that the wifi module flash chip could be written from DS mode and later read when we use the save game exploits to get into DSi mode. This gave me the motivation I needed to revisit a half finished project I had to upload homebrew to a DS over wifi. As an added bonus the wifi uploader also works with a standard DS, everything you need is in the archive.
Nintendo seem to have pre-empted an approach like this in more recent consoles, both the DSiXL and later model DSi units seem to deny write access to the wifi module chip. Even when using other methods to load code via the save exploits there seems to be no access to the wifi hardware at all – that’s probably dependent on a wifi enabled hybrid game. Whether Nintendo can or will update earlier units with similar security remains to be seen. Currently all early consoles I’ve tried this method with have been able to run code with wifi access regardless of updated firmware or not. I bought a DSiXL a few days ago to confirm this but I have another couple of methods which work on that – they’re not yet in a releasable state but hopefully that won’t be the case for long.
In order to use this method you’ll need three things, a DSi compatible flashcard, one of the two exploited games and a means to write to the eeprom on your chosen game. Eepinator will work if you have a standard DS or there are a couple of devices which allow you to do this from a PC. If you’re one of the many homebrewers who likes to play with mcus then you can probably rig up something with a dev board. I have an arduino and a Fletchtronics Bumble-b sitting at the back of my desk, I might have a play around with those over the next few days and post a howto for those. If you’ve already done something like that then please do get in touch, no point in reinventing the wheel.
One word of warning before we get to the all important download link. Nintendo will probably declare your warranty void due to unauthorised software so proceed at your own risk. This method also won’t allow you to run rom dumps and it’s not something I plan to support at any point in the future. Obviously I can’t control what you do when you have the ability to run code but please consider not releasing anything that’s piracy related or has the potential to enable piracy. I believe homebrew can thrive as long as we distance ourselves from the people who want to get their games for free.
Please don’t mirror this file, I intend to update it as I add features. Pay attention to the license in the README. It would also be nice if the various news sites that pick these things up would make a bit of an effort and not just copy this post verbatim.
If you’d like to help support devkitPro here are some amazon affiliate links for Cooking Coach
My Healthy Cooking Coach (US edition)
Note for UK users, I ordered a couple of copies of Cooking Coach from the main amazon.co.uk listing from inet video. Unfortunately no-one told them that DSi hybrid games are region locked on the DSi, order from the Indigo Starfish listing instead.
If IRC is your thing then come join the rest of the homebrew gang in #dsdev on irc.blitzed.org.
It just hit me, what if with that 8kb you made a small boot program that loaded your bigger program possibly stored on the SD memory card?
Nothing currently available has access to the DSi SD card but this exploit does load bigger progams over wifi.
I found new dsi game hscks on hybrid game.
It crashed,but I cannot use it.
Which game was it & why can’t you use it?
What is it actually downloading then? Is there homebrew available to download yet or do you have to point it to a url to download something? Also is it now possible for exploits to be created and then run with this and how do you run downloaded homebrew do you have to use an app or something on a flashcart to run it?
It’s not downloading anything. The exploit is the code which is written to the savegame and launches the wifi loader installed on the wifi eeprom in DS mode. The wifi loader is a simple client which receives DS/DSi binaries from the host application. Any DS homebrew compiled with the latest devkitARM and associated libraries will run just fine with increased cpu and RAM on the DSi. Obviously code which needs access to a filesystem won’t currently work with this exploit.
Tested with SuperCard DSTwo
DSiLink gives a failed to connect error
DSlink works, but when sending a recv -1, errno 22 error
but great work you seem to be the only one to hack the DSi
I just got a successful install on my DSi 1.4.2…
So… What did I just do? xD (besides voiding my warranty ;3)
You installed some code in the flash on the wifi board that needs launched from a savegame hack. Read the instructions in the archive.