====== Acekard 2/2i (NDS) programming ======

Original research provided primarily by Normmatt.

===== Hardware variants =====

==== Acekard 2, HW-40 (0x40) ====

==== Acekard 2i, HW-44 (0x44) ====

==== Acekard 2i, HW-81 (0x81) ====

===== Commands =====

==== Flash ??? (C0 00 00 00 00 00 00 00) ====

==== Get hardware revision (D1 00 00 00 00 00 00 00) ====

Returns four bytes, which are the hardware revision byte repeated.

==== ? Map table ? (D0 ?? ?? ?? ?? ?? ?? ??; HW-44, HW-81) ====

==== ? Map table ? (C2 55 AA 55 AA ?? ?? ??; HW-44, HW-81) ====

==== Unlock flash (C2 AA 55 AA 55 00 00 00; HW-44, HW-81) ====

==== Lock flash (C2 AA AA 55 55 00 00 00; HW-44, HW-81) ====

==== Unlock ASIC (C2 AA 55 55 AA 00 00 00; HW-44, HW-81) ====

==== Read flash (B7 ad ac ab aa 00 00 00; HW-44, ?) ====

  * (MSB) ad, ac, ab, aa (LSB) - address

Returns 512 bytes of data.

==== Erase flash (D4 ac ab aa 00 01 00 00; HW-44, ?) ====

  * (MSB) ac, ab, aa (LSB) - address

==== Write byte to flash (D4 ac ab aa va 03 00 00; HW-44, ?) ====

  * (MSB) ac, ab, aa (LSB) - address
  * va - byte to write

==== ? Flash ? (D8 00 00 00 00 00 C6 06; HW-81) ====

==== Erase flash (D4 ac ab aa 30 80 00 35; HW-81) ====

  * (MSB) ac, ab, aa (LSB) - address

==== Write byte to flash (D4 ac ab aa va A0 00 63; HW-81) ====

  * (MSB) ac, ab, aa (LSB) - address
  * va - byte to write