Table of Contents

M3DS Real (NDS) programming
- Control flags
- Commands

M3DS Real (NDS) programming

Original research provided mostly by lifehackerhansol.

Control flags

KEY1 gap1 length: 0, 256 for SD write and/or multi-sector commands.
KEY1 gap2 length: 24
KEY2 encryption: Enabled for data and commands
Transfer clock rate: 6.7 MHz
Data block size: 4 bytes (512 bytes for SD commands)

Commands

Get card information (B0 ?? ?? ?? ?? ?? ?? ??)

SD multi-sector read request (B1 sd sc sb sa 00 00 00)

(MSB) sd sc sb sa (LSB) - sector address

SD multi-sector read next (B2 sd sc sb sa 00 00 00)

(MSB) sd sc sb sa (LSB) - sector address

SD multi-sector end (B3 ?? ?? ?? ?? ?? ?? ??)

SD multi-sector write start (B4 sd sc sb sa 00 00 00)

(MSB) sd sc sb sa (LSB) - sector address

SD multi-sector write next (B5 sd sc sb sa 00 00 00)

(MSB) sd sc sb sa (LSB) - sector address

SD multi-sector write status (B6 sd sc sb sa 00 00 00)

(MSB) sd sc sb sa (LSB) - sector address

SD read data (BA 00 00 00 00 00 00 00)

Returns the 512 bytes read via the “SD read start” command.

SD write status (BC sd sc sb sa 00 00 00)

(MSB) sd sc sb sa (LSB) - sector address

Returns zero if done, non-zero if ongoing.

SD read request (BD sd sc sb sa 00 00 00)

(MSB) sd sc sb sa (LSB) - sector address

Returns zero when data is ready to access, non-zero if ongoing.

SD write start (BE sd sc sb sa 00 00 00)

(MSB) sd sc sb sa (LSB) - sector address

Followed by 512 bytes of SD card data.

? (C8 ?? ?? ?? ?? ?? ?? ??)

? (CC ?? ?? ?? ?? ?? ?? ??)

? Get cart region ? (CD ?? ?? ?? ?? ?? ?? ??)