User:Kuhprii/History on the DS hacking scene - Revision history

Kuhprii: note

2025-08-04T15:48:37Z

note

← Older revision		Revision as of 15:48, 4 August 2025
Line 1:		Line 1:
	Sources:		Sources:

	* https://gbatemp.net/threads/wondering-about-the-timeline-of-ds-hacking.663789/		*https://gbatemp.net/threads/wondering-about-the-timeline-of-ds-hacking.663789/

	* https://darkfader.blogspot.com/2005/		*https://darkfader.blogspot.com/2005/

	* https://pineight.com/ds/pass/#passme		*https://pineight.com/ds/pass/#passme

	* https://www.gameboy-advance.net/nintendo_ds/passme.htm		*https://www.gameboy-advance.net/nintendo_ds/passme.htm

	== The Release of the Nintendo DS ==		discontinued as of now, dont know if i will work on it for a bit, anyone feel free to

			==The Release of the Nintendo DS==
	The Nintendo DS released November 21st, of 2004.		The Nintendo DS released November 21st, of 2004.

	== 2005 ==		==2005 ==

	=== The first pass-through (January) ===		===The first pass-through (January)===
	The developer DarkFader gets his hands on the Nintendo DS, he wants to hack it. Others in the community started to capture to traffic of the cartridge (I assume Metroid Demo). DarkFader then saw header data, as well as encrypted data. He then figured that the RSA on the back, didn't apply to the actual cartridge.		The developer DarkFader gets his hands on the Nintendo DS, he wants to hack it. Others in the community started to capture to traffic of the cartridge (I assume Metroid Demo). DarkFader then saw header data, as well as encrypted data. He then figured that the RSA on the back, didn't apply to the actual cartridge.

Line 21:		Line 23:
	Once he could run his own code, he made a program that modified a string of text in the Metroid Demo, and then continued executing. That was the first pass-through.		Once he could run his own code, he made a program that modified a string of text in the Metroid Demo, and then continued executing. That was the first pass-through.

	=== The first PassMe device (February) ===		===The first PassMe device (February)===
	A developer by the name of Natrium42 makes a pass-through based on DarkFader's FPGA. It is similar to a Game-Genie. It was pretty much the same as DarkFaders's FGPA, as it altered NDS cartridge header data, changing the run address points to the GBA slot. The main difference was that PassMe was more refined.		A developer by the name of Natrium42 makes a pass-through based on DarkFader's FPGA. It is similar to a Game-Genie. It was pretty much the same as DarkFaders's FGPA, as it altered NDS cartridge header data, changing the run address points to the GBA slot. The main difference was that PassMe was more refined.

	=== WiFiMe (April) ===		===WiFiMe (April)===
	WiFiMe brought new ways to run homebrew. It ran through DS Download Play. This method required a specific wireless network card (Ralink RT2560). You also would need a program called WMB (Wireless Multiboot), that program uploads the homebrew to the console using DS Download Play. All of this works because the first version of DS Download Play used a run address from a header that wasn't located with the rest of the digitally signed code. WiFiMe specifically is a DS Download Play program that was extracted from SM64DS, it had it's run address changed to the GBA slot. This allowed WMB to act as DS, allowing you to send signed programs over to the DS.<blockquote>Note: Needs to be rewritten?</blockquote>		WiFiMe brought new ways to run homebrew. It ran through DS Download Play. This method required a specific wireless network card (Ralink RT2560). You also would need a program called WMB (Wireless Multiboot), that program uploads the homebrew to the console using DS Download Play. All of this works because the first version of DS Download Play used a run address from a header that wasn't located with the rest of the digitally signed code. WiFiMe specifically is a DS Download Play program that was extracted from SM64DS, it had it's run address changed to the GBA slot. This allowed WMB to act as DS, allowing you to send signed programs over to the DS.<blockquote>Note: Needs to be rewritten?</blockquote>

	=== FlashMe (Spring, Unknown Month) ===		===FlashMe (Spring, Unknown Month)===
	FlashMe is a modified version of the Nintendo DS firmware that checks the Game Boy Advance slot for DS code, and booting it if it is present. It also removes the signature check in DS Download Play, allowing users to send programs that didn't have Nintendo signatures via WMB.		FlashMe is a modified version of the Nintendo DS firmware that checks the Game Boy Advance slot for DS code, and booting it if it is present. It also removes the signature check in DS Download Play, allowing users to send programs that didn't have Nintendo signatures via WMB.

	=== Nintendo's fixes ===		===Nintendo's fixes===
	Nintendo fixes the vulnerabilities present in firmware version 4. They added range checks to the DS card startup code which blocked PassMe devices. They also used a new run address in the signed section of DS Download Play blocking WiFiMe. The BIOS still has a vulnerability that allowed redirection of execution to the GBA SRAM space. It was also discovered that Nintendo Wi-Fi code overwrites an area of the firmware. The original FlashMe developers didn't know this and Mario Kart DS was bricking people's consoles.
			== Nintendo fixes the vulnerabilities present in firmware version 4. They added range checks to the DS card startup code which blocked PassMe devices. They also used a new run address in the signed section of DS Download Play blocking WiFiMe. The BIOS still has a vulnerability that allowed redirection of execution to the GBA SRAM space. It was also discovered that Nintendo Wi-Fi code overwrites an area of the firmware. The original FlashMe developers didn't know this and Mario Kart DS was bricking people's consoles. ==

	=== PPFlash (Add later, Unknown month and season) ===		===PPFlash (Add later, Unknown month and season)===
	filler		filler

	=== PassMe2 (October) ===		===PassMe2 (October)===
	PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)		PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)

	=== NoPass ===		===NoPass===

Kuhprii at 02:44, 19 June 2025

2025-06-19T02:44:01Z

← Older revision		Revision as of 02:44, 19 June 2025
Line 38:		Line 38:
	=== PassMe2 (October) ===		=== PassMe2 (October) ===
	PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)		PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)

			=== NoPass ===

Abdelali221 at 19:10, 25 April 2025

2025-04-25T19:10:39Z

← Older revision		Revision as of 19:10, 25 April 2025
Line 1:		Line 1:
	Sources: ~~https://gbatemp.net/threads/wondering-about-the-timeline-of-ds-hacking.663789/~~		Sources:

	https://~~darkfader~~.~~blogspot~~.~~com/2005~~/		* https://gbatemp.net/threads/wondering-about-the-timeline-of-ds-hacking.663789/

	https://~~pineight~~.com/~~ds/pass~~/~~#passme~~		* https://darkfader.blogspot.com/2005/

	https://www.gameboy-advance.net/nintendo_ds/passme.htm		* https://pineight.com/ds/pass/#passme

			* https://www.gameboy-advance.net/nintendo_ds/passme.htm

	== The Release of the Nintendo DS ==		== The Release of the Nintendo DS ==
Line 23:		Line 25:

	=== WiFiMe (April) ===		=== WiFiMe (April) ===
	WiFiMe brought new ways to run homebrew. It ran through DS Download Play. ~~To do this~~ method~~, you need~~ a ~~PCI/PCMCIA~~ wireless network card~~, you could achieve this with a~~ Ralink ~~chipset~~. You also would need a program called WMB (Wireless Multiboot). All of this works because the first version of DS Download Play used a run address from a header that wasn't located with the rest of the digitally signed code. WiFiMe specifically is a DS Download Play program that was extracted from SM64DS, it had it's run address changed to the GBA slot. This allowed WMB to act as DS, allowing you to send signed programs over to the DS.		WiFiMe brought new ways to run homebrew. It ran through DS Download Play. This method required a specific wireless network card (Ralink RT2560). You also would need a program called WMB (Wireless Multiboot), that program uploads the homebrew to the console using DS Download Play. All of this works because the first version of DS Download Play used a run address from a header that wasn't located with the rest of the digitally signed code. WiFiMe specifically is a DS Download Play program that was extracted from SM64DS, it had it's run address changed to the GBA slot. This allowed WMB to act as DS, allowing you to send signed programs over to the DS.<blockquote>Note: Needs to be rewritten?</blockquote>

	=== FlashMe (Spring, Unknown Month) ===		=== FlashMe (Spring, Unknown Month) ===
Line 29:		Line 31:

	=== Nintendo's fixes ===		=== Nintendo's fixes ===
	Nintendo fixes the vulnerabilities present in ~~firm~~ version 4. They added range checks to the DS card startup code which blocked PassMe devices. They also used a new run address in the signed section of DS Download Play blocking WiFiMe. The BIOS still has a vulnerability that allowed redirection of execution ~~the~~ the GBA SRAM space. (It was also discovered that Nintendo Wi-Fi code overwrites an area of the firmware. The original FlashMe developers didn't know this and Mario Kart DS was bricking people's consoles.		Nintendo fixes the vulnerabilities present in firmware version 4. They added range checks to the DS card startup code which blocked PassMe devices. They also used a new run address in the signed section of DS Download Play blocking WiFiMe. The BIOS still has a vulnerability that allowed redirection of execution to the GBA SRAM space. It was also discovered that Nintendo Wi-Fi code overwrites an area of the firmware. The original FlashMe developers didn't know this and Mario Kart DS was bricking people's consoles.

	=== PPFlash (Add later, Unknown month and season) ===		=== PPFlash (Add later, Unknown month and season) ===

Kuhprii: months added

2025-04-22T16:11:14Z

months added

← Older revision		Revision as of 16:11, 22 April 2025
Line 22:		Line 22:
	A developer by the name of Natrium42 makes a pass-through based on DarkFader's FPGA. It is similar to a Game-Genie. It was pretty much the same as DarkFaders's FGPA, as it altered NDS cartridge header data, changing the run address points to the GBA slot. The main difference was that PassMe was more refined.		A developer by the name of Natrium42 makes a pass-through based on DarkFader's FPGA. It is similar to a Game-Genie. It was pretty much the same as DarkFaders's FGPA, as it altered NDS cartridge header data, changing the run address points to the GBA slot. The main difference was that PassMe was more refined.

	=== WiFiMe (~~Spring, Unknown Month~~) ===		=== WiFiMe (April) ===
	WiFiMe brought new ways to run homebrew. It ran through DS Download Play. To do this method, you need a PCI/PCMCIA wireless network card, you could achieve this with a Ralink chipset. You also would need a program called WMB (Wireless Multiboot). All of this works because the first version of DS Download Play used a run address from a header that wasn't located with the rest of the digitally signed code. WiFiMe specifically is a DS Download Play program that was extracted from SM64DS, it had it's run address changed to the GBA slot. This allowed WMB to act as DS, allowing you to send signed programs over to the DS.		WiFiMe brought new ways to run homebrew. It ran through DS Download Play. To do this method, you need a PCI/PCMCIA wireless network card, you could achieve this with a Ralink chipset. You also would need a program called WMB (Wireless Multiboot). All of this works because the first version of DS Download Play used a run address from a header that wasn't located with the rest of the digitally signed code. WiFiMe specifically is a DS Download Play program that was extracted from SM64DS, it had it's run address changed to the GBA slot. This allowed WMB to act as DS, allowing you to send signed programs over to the DS.

Kuhprii at 16:04, 22 April 2025

2025-04-22T16:04:14Z

← Older revision		Revision as of 16:04, 22 April 2025
Line 34:		Line 34:
	filler		filler

	=== PassMe2 (~~Spring, Unknown Month~~) ===		=== PassMe2 (October) ===
	PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)		PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)

Kuhprii at 16:00, 22 April 2025

2025-04-22T16:00:15Z

← Older revision		Revision as of 16:00, 22 April 2025
Line 36:		Line 36:
	=== PassMe2 (Spring, Unknown Month) ===		=== PassMe2 (Spring, Unknown Month) ===
	PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)		PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)

	~~=== NoPass (Spring, Unknown Month) ===~~
	~~A new PassMe device emerges, called NoPass.~~

Kuhprii at 15:54, 22 April 2025

2025-04-22T15:54:27Z

← Older revision		Revision as of 15:54, 22 April 2025
Line 35:		Line 35:

	=== PassMe2 (Spring, Unknown Month) ===		=== PassMe2 (Spring, Unknown Month) ===
			PassMe2 is on the same hardware as the original, but there is a new program on the CPLD. What this program does is changes the header's run address to a BIOS call that goes to shellcode in the GBA SRAM. (Maybe add more)

			=== NoPass (Spring, Unknown Month) ===
			A new PassMe device emerges, called NoPass.

Kuhprii: flashme added, nintendos fixes, added passme2 as most likely my next starting point, + other content

2025-04-22T00:13:45Z

flashme added, nintendos fixes, added passme2 as most likely my next starting point, + other content

← Older revision		Revision as of 00:13, 22 April 2025
Line 26:		Line 26:

	=== FlashMe (Spring, Unknown Month) ===		=== FlashMe (Spring, Unknown Month) ===
			FlashMe is a modified version of the Nintendo DS firmware that checks the Game Boy Advance slot for DS code, and booting it if it is present. It also removes the signature check in DS Download Play, allowing users to send programs that didn't have Nintendo signatures via WMB.

			=== Nintendo's fixes ===
			Nintendo fixes the vulnerabilities present in firm version 4. They added range checks to the DS card startup code which blocked PassMe devices. They also used a new run address in the signed section of DS Download Play blocking WiFiMe. The BIOS still has a vulnerability that allowed redirection of execution the the GBA SRAM space. (It was also discovered that Nintendo Wi-Fi code overwrites an area of the firmware. The original FlashMe developers didn't know this and Mario Kart DS was bricking people's consoles.

			=== PPFlash (Add later, Unknown month and season) ===
			filler

			=== PassMe2 (Spring, Unknown Month) ===

Kuhprii: wifime done

2025-04-20T15:49:50Z

wifime done

← Older revision		Revision as of 15:49, 20 April 2025
Line 23:		Line 23:

	=== WiFiMe (Spring, Unknown Month) ===		=== WiFiMe (Spring, Unknown Month) ===
			WiFiMe brought new ways to run homebrew. It ran through DS Download Play. To do this method, you need a PCI/PCMCIA wireless network card, you could achieve this with a Ralink chipset. You also would need a program called WMB (Wireless Multiboot). All of this works because the first version of DS Download Play used a run address from a header that wasn't located with the rest of the digitally signed code. WiFiMe specifically is a DS Download Play program that was extracted from SM64DS, it had it's run address changed to the GBA slot. This allowed WMB to act as DS, allowing you to send signed programs over to the DS.

			=== FlashMe (Spring, Unknown Month) ===

Kuhprii: first passme device done

2025-04-18T18:53:23Z

first passme device done

← Older revision		Revision as of 18:53, 18 April 2025
Line 20:		Line 20:

	=== The first PassMe device (February) ===		=== The first PassMe device (February) ===
	A developer by the name of Natrium42 makes a pass-through based on DarkFader's FPGA		A developer by the name of Natrium42 makes a pass-through based on DarkFader's FPGA. It is similar to a Game-Genie. It was pretty much the same as DarkFaders's FGPA, as it altered NDS cartridge header data, changing the run address points to the GBA slot. The main difference was that PassMe was more refined.

			=== WiFiMe (Spring, Unknown Month) ===