R4 i.L.S., Ace3DS

R4 i.L.S. and Ace3DS+

There are many known derivatives of this cart, herein "Ace3DS+". This wiki page attempts to document existing card commands.

Commands: what are they, what do they do (or at least some of them)

This list is incomplete.

Nearly all useful commands are similiar to the original R4.

ROM commands

• B000000000000000
  • Quoting ntrteam:
    • Gets the cart version (in the high halfword) and status (in the low byte).
  • EX4DS flashcart's DLDI driver seems to check for returnValue & 7 == 4 in the isInserted function. Ace3DS+ and R4iLS doesn't check it at all.
• B4XXXXXXXX000000
  • Sets the address (0xXXXXXXXX) of the FAT entry for ROM (lsb of address is 0).
  • This is a 2-byte aligned SD address. Returns 0x00000001 while the card is busy initializing the cluster map and 0x00000000 once ready. This command is polled as long as the return value is 1.
  • Unlike other commands, this is not left-shifted 9. Thus, this command as well as ROM read commands only function on non-SDHC cards.
• B6XXXXXXXX000000
  • Start ROM read at address 0xXXXXXXXX.
  • Address should be 512 byte aligned. Returns 0x00000001 while the card is busy performing the read and 0x00000000 once the data is available. This command is polled as long as the return value is 1. The data can then be read with the standard B7 command.
  • See SDHC limitation as written in 0xB4 command.

• B9XXXXXXXX000000
  • Start SD read at address 0xXXXXXXXX.
  • Address is in sectors. Returns 0x00000001 while the card is busy performing the read and 0x00000000 once the data is available. This command is polled as long as the return value is 1.
• BA00000000000000
  • Get SD data that was previously requested by command B9.
  • Returns the 512 byte block of SD data.
• BBXXXXXXXX000000
  • Start SD write to address 0xXXXXXXXX.
  • Address is in sectors. The command expects 512 bytes of data that will be written to the SD card.
• BCXXXXXXXX0000YY
  • Get SD write status for address 0xXXXXXXXX previously requested by command BC.
  • YY is an XOR of all preceding bytes in this command. Thus, BC eor XX eor XX eor XX eor XX eor 00 eor 00
  • Returns 0x00000001 while the card is busy performing the write and 0x00000000 once done. This command is polled as long as the return value is 1.
  • Without sending the address, the SD card corrupts.
  • Without sending the XOR byte, write freezes.
• BF00000000000000
  • Read R4-obfuscated data. Same as ROM read data, and thus needs 0xB4 and 0xB6 respectively.
  • A writeup of the obfuscation mechanism was done by asiekierka
    • Note that the Ace3DS+ uses key 0x4002.
  • This is used by the stage 1 loader to decrypt _DS_MENU.DAT on Ace3DS+, _DSMENU.dat on R4iLS.
    • For some reason, this command also checks header->gameTitle of said ROM. If it doesn't match the expected header value, command doesn't seem to work (needs further verification)
      • Ace3DS+ derivatives: ARM b #0xC0 (Passthrough header), ACEP
      • R4iLS derivatives: R4XX
      • Gateway Blue, R4infinity 2: R4IT

• C0XXYYYYYYYYZZ00
  • Send raw SDIO command with XX = SDIO command, YYYYYYYY = parameter, ZZ = unknown
  • After sending this, poll 0xB0 command to read status.
  • Apparently with read commands, 0xBA command works to return data.
• C20000XX00000000
  • Quoting ntrteam:
    • Sets some SD-related register on the card (?)
  • What the values in XX mean is currently unknown.
• C3FF3CA5AA555AC7
  • Send a calculated checksum via CARD_DATA_RD. Needed to fully init the flash.
  • The buffer to calculate is retrieved from the 0xC6 command.
  • After this, flash can be read/written to via AUXSPI.
• C600000000000000
  • Initialize flash. Returns 512 bytes of... something.
  • Not even ntrteam knows what this means.

AUXSPI commands

Work-in-progress. Consult ntrteam's flashcart_core repository.