FlashMe

History of FlashMe

Loopy started developing FlashMe after the appearance of PassMe and WiFiMe. The reason is quite simple: both methods for launching homebrew applications were extremely inconvenient. The first PassMe (not factory-made, but homemade) were boards with a soldered Nintendo DS cartridge, and for WiFiMe to work, a special Wi-Fi board with the Ralink RT2500 chipset was needed (and it often cost more than PassMe).

Not only did it look terrible, but it was also not very reliable. One careless move and everything was ruined.

Let's take a look at how the firmware was implemented on the Nintendo DS. Essentially, the firmware is an interactive shell. In simple terms, when you turn on the console, the BIOS starts first, then it launches the firmware and transfers control to it. The firmware itself is stored on a separate flash memory chip with a capacity of 256 kilobytes.

The flash memory chip is labeled F5Z08C4F 3.

Let's visualize it.

Flash memory with a capacity of 256 kilobytes.

The firmware occupies the entire 256 kilobytes, but a quarter of it is empty.

On the left is the firmware code, and on the right is empty space.

At the same time, it was immediately discovered that the first 64 kilobytes of data were write-protected.

The part that is protected from overwriting.

On April 11, 2005, DarkFader posted a message where he announced that he had discovered how to bypass the firmware protection (for the first 64 kilobytes). The protection is disabled if the SL1 contacts are shorted. He also added that Loopy had started working on the first patch for the firmware to allow launching NDS applications from GBA cartridges.

The SL1 element is located slightly to the left and above the center.

Around the 20th of April 2005, the zero version of this firmware appeared. You had to download the file getID.ds.gba and, using PassMe or WiFiMe, as well as a Game Boy Advance flash cartridge, launch this file on the console. You would get a code, for example: CREM57I27HWAK. And a firmware file was generated for your code. Accordingly, each console had to send its own code.

Additional FlashMe code was written to the empty part of the original firmware.

FlashMe writes its code to the free part on the right.

But the part with the original firmware was also changed, and the changes had to be made to the protected part. For this, the SL1 contacts had to be shorted on the console. The most interesting thing is that access to these contacts is available from the battery compartment. Most likely, Nintendo left themselves a loophole for repairs, and hackers took advantage of it.

Now you should have an idea of how the console was flashed.

We won't go through each version of FlashMe. Most of the time, there were only minor fixes. Let's focus on one problem.

Perhaps the most interesting thing happened during the release of Mario Kart. On October 23, 2005, a user with the nickname YaW created a thread on the gbadev.org forum, where he wrote that after playing Mario Kart DS online, his console no longer turned on. The same thing happened to his friend. Fortunately, the FlashMe developers had already added a firmware recovery method to the firmware code, and nothing irreversible happened.

Loopy started investigating what had happened. It turned out that the empty space in the firmware was not there by accident. Nintendo used it to store Wi-Fi and other online settings.

It turned out that the right part is reserved for Wi-Fi and network data.

And it turned out that while the firmware was in RAM, the part that was on the unprotected part of the chip was overwritten. And as I told you earlier, it was in this part that FlashMe was installed.

And so, in the fifth part of FlashMe (NDS-FW-V5), the developers compressed the firmware so that it did not occupy the empty space.

Of course, there were no more such bright events, and soon the FlashMe updates ended. In April 2007, the last version of the FlashMe firmware was released – NDS-FW-V8a. This is practically the perfect version, with the exception of one drawback – the sleep mode. It did not work if no cartridge was inserted into the console.

Why do we need FlashMe in 2023?

Perhaps the main question is why would you want to flash your Nintendo DS console?

To answer this question, let's look at what we got by installing the firmware:

1. In the first 10% of the firmware, a fail-safe code was installed. That is, if your firmware was corrupted for some reason, you would have a chance to restore it (which was relevant, as someone released a virus on the Nintendo DS that killed the firmware).

2. The annoying health warning screen disappeared. That is, the console immediately booted into the firmware's start menu.

3. There was no longer a need to use PassMe and WiFiMe (they allowed launching Game Boy Advance flash cartridges in Nintendo DS mode, meaning you could launch NDS games from a GBA cartridge).

These are the three main benefits that the FlashMe firmware provided.

If we update these benefits, it turns out that the first point is no longer needed: viruses are no longer found, and no one flashes their console anymore. The third point lost its relevance in 2008 when Slot-1 flash cartridges began to appear en masse. But the second point is still somewhat relevant. If you are annoyed by the constantly appearing health warning, then this is your only salvation.

But there was one secret point, which is why I myself reflashed my console.

FlashMe and Nintendo DS Backlight

As you know, the Nintendo DS was released for almost two years. During this time, Nintendo closed various loopholes that hackers found. But not only the software part changed, but also the hardware. Starting from the end of the 4th firmware, the Nintendo DS began to install the same backlight chip as the Nintendo DS Lite. That is, if you have a later revision of the Nintendo DS, then you will have this chip.

How to find out which firmware you have is described in the article: «Nintendo DS Firmware».

If you have the fifth or later firmware, then there is a 99% chance that this feature will work. But the fourth firmware needs to be checked additionally.

Unscrew the battery compartment and remove the battery. There is a small hole there. If it says 20, then you have this chip.

What do we need?

So, if you have decided to install FlashMe, you will need a flash cartridge. It's not that simple here. On the one hand, not all flash cartridges can run the flashme.nds file (this is the main file for installing the firmware), on the other hand, this can be fixed.

Let's touch on this problem a little. When you develop your own program (homebrew application), you need to somehow save data on the flash cartridge. And all cartridges have different read/write commands. That is, you developed your program for R4, but it won't run on other flash cartridges. To solve this problem, Chishm developed DLDI (Dynamically Linked Device Interface). In simple terms, you added the DLDI interface to your homebrew, and the flash cartridge developers added the ability to work with DLDI to their firmware. However, for obvious reasons, not all flash cartridges support the DLDI interface.

For this article, I will use a regular R4 flash cartridge clone (DLDI is NOT built into it), which can be bought on AliExpress.

What do we need?

R4 SDHC flash cartridge.

Memory card for it (no more than 32 gigabytes):

You will also need a small Phillips and flathead screwdriver.

Download the archives:

r4i-sdhc-ysmenu.zip – we will need it to avoid using the standard firmware of this clone (it won't be able to run flashme.nds);

sd-card-formatter.zip – we will need it to format the memory card;

flashme8a.zip – the firmware file.

If you have everything bought and the files downloaded, you can proceed.

How to install FlashMe firmware?

Before we start, I want to draw your attention: this guide works with any flash cartridge if it can run the flashme.nds file. If you are lucky and no additional settings are needed, then go to step 4, and if not, try to find out if YSMenu can be installed on your flash cartridge.

Step 1.

Run the file SD Card Formatter 5.0.2 Setup EN.exe (from the sc-card-formatter.zip archive) and install the program.

Insert the memory card of your flash cartridge into your computer and open the SD Card Formatter program.

Select the drive of your memory card (mine is H:\).

Select Overwrite format.

Click Format.

Wait for the formatting to complete.

Step 2.

Unzip r4i-sdhc-ysmenu.zip. Inside there will be 2 folders and 4 files:

Copy them to the root of the memory card.

Step 3.

Unzip flashme8a.zip. There you will see 4 more archives:

Let's take a closer look at each:

FlashMe-8a – the main version of the firmware. Removes the health screen and gives all the bonuses we talked about above. By default, if a Game Boy Advance flash cartridge that can boot in NDS mode is inserted into the Nintendo DS, it will boot directly into this mode when the console is turned on (you need to press Select when turning on the console to prevent this).

FlashMe-noautoboot – the archive contains two files:

flashme_noauto - the same firmware as the option above, but it won't automatically boot the GBA flash cartridge in NDS mode (you need to press Select when turning on the console, and then the automatic boot will occur).

flashme_stealth_noauto – the console boots as usual (with the health screen) imitating the original firmware. Automatic boot of the GBA cartridge in NDS mode is also disabled.

FlashMe-noinstaller – removes FlashMe.

Flashme-stealth - the console boots as usual (with the health screen) imitating the original firmware.

After you choose the version you need, copy the firmware file to the console (to the root of the memory card).

The file structure on my memory card looked like this:

Step 4. Unscrew the battery cover and remove it. You don't need to remove the battery. In the top hole is the SL1 element (if it's hidden under a sticker, you can remove it). You will need to short it with a flathead screwdriver, but not now.

Step 5. Remove the memory card, insert it into the flash cartridge. Insert it into the Nintendo DS and turn on the console (you don't need to screw the battery cover back on). Launch the flash cartridge. The following menu will open immediately:

Step 6. Select flashme.nds. And press A. The console will create system files (TTMENU.SYS) and launch the program. You will enter the following menu:

Attention! Although the chance of bricking your console is small, it can happen. FROM NOW ON, YOU PROCEED AT YOUR OWN RISK!

Before proceeding, fully charge your console. Do not remove the console from the charger during the flashing process! Do not turn off the console under any circumstances.

Step 7. Press X – B – X – B.

The message Progress: 0% will appear.

Now you need to short the SL1 contacts. A simple flathead screwdriver will do.

Note that if the progress stops, the SL1 contacts are not pressed. The program will wait until you press them again. So losing contact is not a big deal!

The main problems can be due to two things: the battery falls out or you turn off the console. If the first 10% have been flashed, then most likely you will be able to restore the console, in other cases it will turn into a brick.

Do not turn off the console at 100% under any circumstances. You can only turn it off after the message appears: Firmware flashing completed successfully. It is safe to turn off your DS.

After the message appears, you can turn off and turn on the console.

If you reflashed it for the backlight, then press the brightness button on the start menu (in the lower left corner).