Table of Contents

Acekard 2/2i (NDS) programming

Original research provided primarily by Normmatt.

Hardware variants

Acekard 2, HW-40 (0x40)

Acekard 2i, HW-44 (0x44)

Acekard 2i, HW-81 (0x81)

Commands

Flash ??? (C0 00 00 00 00 00 00 00)

Get hardware revision (D1 00 00 00 00 00 00 00)

Returns four bytes, which are the hardware revision byte repeated.

? Map table ? (D0 ?? ?? ?? ?? ?? ?? ??; HW-44, HW-81)

? Map table ? (C2 55 AA 55 AA ?? ?? ??; HW-44, HW-81)

Unlock flash (C2 AA 55 AA 55 00 00 00; HW-44, HW-81)

Lock flash (C2 AA AA 55 55 00 00 00; HW-44, HW-81)

Unlock ASIC (C2 AA 55 55 AA 00 00 00; HW-44, HW-81)

Read flash (B7 ad ac ab aa 00 00 00; HW-44, ?)

Returns 512 bytes of data.

Erase flash (D4 ac ab aa 00 01 00 00; HW-44, ?)

Write byte to flash (D4 ac ab aa va 03 00 00; HW-44, ?)

? Flash ? (D8 00 00 00 00 00 C6 06; HW-81)

Erase flash (D4 ac ab aa 30 80 00 35; HW-81)

Write byte to flash (D4 ac ab aa va A0 00 63; HW-81)