This is an old revision of the document!

Acekard 2i (NDS) programming

Hardware variants

Acekard 2i, HW-44 (0x44)

Acekard 2i, HW-81 (0x81)

R4i Gold 3DS RTS (0xA7)

Encryption: For each written byte, map bits as follows; perform the opposite for decryption.

76543210
||||||||
vvvvvvvv
52016734

Commands

Flash ??? (C0 00 00 00 00 00 00 00)

Get hardware revision (D1 00 00 00 00 00 00 00)

Returns four bytes, which are the hardware revision byte repeated.

? Map table ? (D0 ?? ?? ?? ?? ?? ?? ??; HW-44, HW-81)

? Map table ? (C2 55 AA 55 AA ?? ?? ??; HW-44, HW-81)

Unlock flash (C2 AA 55 AA 55 00 00 00; HW-44, HW-81)

Lock flash (C2 AA AA 55 55 00 00 00; HW-44, HW-81)

Unlock ASIC (C2 AA 55 55 AA 00 00 00; HW-44, HW-81)

Read flash (B7 ad ac ab aa 00 00 00; HW-44, ?)

(MSB) ad, ac, ab, aa (LSB) - address

Returns 512 bytes of data.

Erase flash (D4 ac ab aa 00 01 00 00; HW-44, ?)

(MSB) ac, ab, aa (LSB) - address

Write byte to flash (D4 ac ab aa va 03 00 00; HW-44, ?)

(MSB) ac, ab, aa (LSB) - address
va - byte to write

? Flash ? (D8 00 00 00 00 00 C6 06; HW-81)

Erase flash (D4 ac ab aa 30 80 00 35; HW-81)

(MSB) ac, ab, aa (LSB) - address

Write byte to flash (D4 ac ab aa va A0 00 63; HW-81)

(MSB) ac, ab, aa (LSB) - address
va - byte to write

Read flash (A5 ad ac ab aa 00 00 00; R4i Gold 3DS RTS)

(MSB) ad, ac, ab, aa (LSB) - address