Lotus3 - Revision history

Hexkyz: From SendCardSelfRefresh and SendCardReadRefreshStatus

2024-12-10T20:01:21Z

From SendCardSelfRefresh and SendCardReadRefreshStatus

← Older revision		Revision as of 23:01, 10 December 2024
Line 634:		Line 634:
	\|-		\|-
	\| 0x6		\| 0x6
	\|		\| SelfRefresh
	\|-		\|-
	\| 0xF		\| 0xF
Line 763:		Line 763:
	\|-		\|-
	\| 0xFA		\| 0xFA
	\|		\| ReadRefreshStatus
	\|}		\|}

Hexkyz: /* CommandId */

2024-12-03T20:57:06Z

CommandId

← Older revision		Revision as of 23:57, 3 December 2024
Line 637:		Line 637:
	\|-		\|-
	\| 0xF		\| 0xF
	\|		\| T1ReadUid
	\|-		\|-
	\| 0x10		\| 0x10
	\| ~~ReadId1Write~~		\| DebugReadId1
	\|-		\|-
	\| 0x11		\| 0x11
	\| ~~ReadId2Write~~		\| DebugReadId2
	\|-		\|-
	\| 0x12		\| 0x12
	\| ~~ReadId3Write~~		\| DebugReadId3
	\|-		\|-
	\| 0x13		\| 0x13
	\|		\| DebugReadUid
	\|-		\|-
	\| 0x15		\| 0x15
	\| ~~ReadCrc~~		\| DebugReadCrc
	\|-		\|-
	\| 0x16		\| 0x16
	\| ~~WritePage~~		\| DebugWritePage
	\|-		\|-
	\| 0x17		\| 0x17
Line 661:		Line 661:
	\|-		\|-
	\| 0x18		\| 0x18
	\| ~~Erase~~		\| DebugErase
	\|-		\|-
	\| 0x19		\| 0x19
	\| ~~ReadParameter~~		\| DebugReadParameter
	\|-		\|-
	\| 0x20		\| 0x20
	\| ~~WriteParameter~~		\| DebugWriteParameter
	\|-		\|-
	\| 0x21		\| 0x21
	\| ~~ReadPageSecure~~		\| T1ReadPage
			\|-
			\| 0x22
			\|
	\|-		\|-
	\| 0x28		\| 0x28
Line 676:		Line 679:
	\|-		\|-
	\| 0x2E		\| 0x2E
	\| ~~ChangeDebugDirect~~		\| ForceErase
	\|-		\|-
	\| 0x30		\| 0x30
	\| ~~ReadId3Secure~~		\| T1ReadId3
	\|-		\|-
	\| 0x39		\| 0x39
	\| ~~SetKey~~		\| T1SetKey
	\|-		\|-
	\| 0x56		\| 0x56
Line 689:		Line 692:
	\| 0x59		\| 0x59
	\|		\|
	\|-
	~~\| 0x67~~
	~~\| ReadId1Secure~~
	\|-		\|-
	\| 0x5B		\| 0x5B
	\| ReadPage		\| ReadPage
			\|-
			\| 0x67
			\| T1ReadId1
	\|-		\|-
	\| 0x83		\| 0x83
	\| ~~WritePageSecure~~		\| T1WritePage
	\|-		\|-
	\| 0x8A		\| 0x8A
Line 706:		Line 709:
	\|-		\|-
	\| 0xB8		\| 0xB8
	\| ~~Refresh~~		\| T1Refresh
	\|-		\|-
	\| 0xC4		\| 0xC4
	\| ~~ReadId2Secure~~		\| T1ReadId2
	\|-		\|-
	\| 0xE0		\| 0xE0
Line 718:		Line 721:
	\|-		\|-
	\| 0xE3		\| 0xE3
	\|		\| T2ReceiveCertificate
	\|-		\|-
	\| 0xE4		\| 0xE4
	\|		\| T2SendSocCertificate
	\|-		\|-
	\| 0xE5		\| 0xE5
Line 727:		Line 730:
	\|-		\|-
	\| 0xE6		\| 0xE6
	\|		\| T2ReceiveRandomValue
	\|-		\|-
	\| 0xE7		\| 0xE7
	\|		\| T2SendRandomValue
	\|-		\|-
	\| 0xE8		\| 0xE8
	\|		\| T2ReceiveDeviceChallenge
	\|-		\|-
	\| 0xE9		\| 0xE9
	\|		\| T2RespondDeviceChallenge
	\|-		\|-
	\| 0xEA		\| 0xEA
	\|		\| T2SendHostChallenge
	\|-		\|-
	\| 0xEB		\| 0xEB
	\|		\| T2ReceiveChallengeResponse
	\|-		\|-
	\| 0xEC		\| 0xEC

Hexkyz: /* UniqueData */

2024-12-03T20:37:39Z

UniqueData

← Older revision		Revision as of 23:37, 3 December 2024
Line 504:		Line 504:
	While presumed to be random, this field actually has some degree of determinism depending on the [[#MakerId\|MakerId]].		While presumed to be random, this field actually has some degree of determinism depending on the [[#MakerId\|MakerId]].

	~~[[#~~MakerId~~\|MakerId]]~~ 0:		MakerId 0:
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	\|-		\|-
Line 536:		Line 536:
	\|}		\|}

	~~[[#~~MakerId~~\|MakerId]]~~ 1:		MakerId 1:
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	\|-		\|-
Line 568:		Line 568:
	\|}		\|}

	~~[[#~~MakerId~~\|MakerId]]~~ 2:		MakerId 2:
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	\|-		\|-

Hexkyz at 21:36, 3 December 2024

2024-12-03T20:36:55Z

Show changes

Hexkyz at 23:57, 30 November 2024

2024-11-30T22:57:09Z

← Older revision		Revision as of 01:57, 1 December 2024
Line 12:		Line 12:
	\|-		\|-
	\| 60		\| 60
	\| [[#WriteOperation]]		\| [[#WriteOperation\|WriteOperation]]
	\|-		\|-
	\| 61		\| 61
	\| [[#FinishOperation]]		\| [[#FinishOperation\|FinishOperation]]
	\|-		\|-
	\| 62		\| 62
	\| [[#Sleep]]		\| [[#Sleep\|Sleep]]
	\|-		\|-
	\| 63		\| 63
	\| [[#UpdateKey]]		\| [[#UpdateKey\|UpdateKey]]
	\|}		\|}

Line 57:		Line 57:

	== OperationId ==		== OperationId ==
	The Gamecard ASIC supports a total of 20 operation commands. These commands are passed to the ASIC using the [[#WriteOperation]] MMC command.		The Gamecard ASIC supports a total of 20 operation commands. These commands are passed to the ASIC using the [[#WriteOperation\|WriteOperation]] MMC command.

	Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.		Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Line 67:		Line 67:
	\|-		\|-
	\| 0x01		\| 0x01
	\| [[#SendFirmware]]		\| [[#SendFirmware\|SendFirmware]]
	\|-		\|-
	\| 0x02		\| 0x02
	\| [[#ReceiveCertificate]]		\| [[#ReceiveCertificate\|ReceiveCertificate]]
	\|-		\|-
	\| 0x03		\| 0x03
	\| [[#SendSocCertificate]]		\| [[#SendSocCertificate\|SendSocCertificate]]
	\|-		\|-
	\| 0x04		\| 0x04
	\| [[#ReceiveRandomValue]]		\| [[#ReceiveRandomValue\|ReceiveRandomValue]]
	\|-		\|-
	\| 0x05		\| 0x05
	\| [[#SendRandomValue]]		\| [[#SendRandomValue\|SendRandomValue]]
	\|-		\|-
	\| 0x06		\| 0x06
	\| [[#ReceiveDeviceChallenge]]		\| [[#ReceiveDeviceChallenge\|ReceiveDeviceChallenge]]
	\|-		\|-
	\| 0x07		\| 0x07
	\| [[#RespondDeviceChallenge]]		\| [[#RespondDeviceChallenge\|RespondDeviceChallenge]]
	\|-		\|-
	\| 0x08		\| 0x08
	\| [[#SendHostChallenge]]		\| [[#SendHostChallenge\|SendHostChallenge]]
	\|-		\|-
	\| 0x09		\| 0x09
	\| [[#ReceiveChallengeResponse]]		\| [[#ReceiveChallengeResponse\|ReceiveChallengeResponse]]
	\|-		\|-
	\| 0x0A		\| 0x0A
	\| [[#ChangeModeToSecure]]		\| [[#ChangeModeToSecure\|ChangeModeToSecure]]
	\|-		\|-
	\| 0x0B		\| 0x0B
	\| [[#WriteRegister]]		\| [[#WriteRegister\|WriteRegister]]
	\|-		\|-
	\| 0x0C		\| 0x0C
	\| [[#ReadRegister]]		\| [[#ReadRegister\|ReadRegister]]
	\|-		\|-
	\| 0x0D		\| 0x0D
	\| [[#ChangeGcModeToDebug]]		\| [[#ChangeGcModeToDebug\|ChangeGcModeToDebug]]
	\|-		\|-
	\| 0x0E		\| 0x0E
	\| [[#GetCardHeader]]		\| [[#GetCardHeader\|GetCardHeader]]
	\|-		\|-
	\| 0x0F		\| 0x0F
	\| [[#ChangeGcModeToSecure]]		\| [[#ChangeGcModeToSecure\|ChangeGcModeToSecure]]
	\|-		\|-
	\| 0x10		\| 0x10
	\| [[#SendCardCommand]]		\| [[#SendCardCommand\|SendCardCommand]]
	\|-		\|-
	\| 0x11		\| 0x11
	\| [[#EnableCardBus]]		\| [[#EnableCardBus\|EnableCardBus]]
	\|-		\|-
	\| 0x12		\| 0x12
	\| [[#ExchangeRandomValuesInSecureMode]]		\| [[#ExchangeRandomValuesInSecureMode\|ExchangeRandomValuesInSecureMode]]
	\|-		\|-
	\| 0x13		\| 0x13
	\| [[#ReadRmaInformation]]		\| [[#ReadRmaInformation\|ReadRmaInformation]]
	\|-		\|-
	\| 0x14		\| 0x14
	\| [9.0.0+] [[#ChallengeCardExistence]]		\| [9.0.0+] [[#ChallengeCardExistence\|ChallengeCardExistence]]
	\|}		\|}

Line 462:		Line 462:

	== CommandId ==		== CommandId ==
	These commands are issued by the Gamecard ASIC to the actual Gamecard using the [[#AsicOperation\|OperationData]] passed to [[#SendCardCommand]].		These commands are issued by the Gamecard ASIC to the actual Gamecard using the [[#AsicOperation\|OperationData]] passed to [[#SendCardCommand\|SendCardCommand]].

	Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.		Additional data buffers are then read/written as pages of 0x200 bytes each, using standard MMC read/write commands.
Line 602:		Line 602:

	= AsicFirmware =		= AsicFirmware =
	This is the Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) uploaded through the [[#SendFirmware]] operation.		This is the Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) uploaded through the [[#SendFirmware\|SendFirmware]] operation.

	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"

Hexkyz at 23:52, 30 November 2024

2024-11-30T22:52:16Z

Show changes

Hexkyz: /* Gamecard commands */

2024-11-30T19:35:25Z

Gamecard commands

@@ Line 466: / Line 466: @@
 ! Command
 ! Name
 |-
 | 0x10
@@ Line 475: / Line 481: @@
 | 0x12
 | [[#ReadId3|ReadId3Write]]
 |-
 | 0x15
@@ Line 481: / Line 490: @@
 | 0x16
 | [[#WritePage|WritePage]]
 |-
 | 0x18
@@ Line 498: / Line 510: @@
 |-
 | 0x2E
-| [2.0.0+] [[#ChangeDebugDirect|ChangeDebugDirect]]
+| [[#ChangeDebugDirect|ChangeDebugDirect]]
 |-
 | 0x30
@@ Line 509: / Line 521: @@
 | [[#ReadId1|ReadId1]]
 |-
-| 0x83
+| 0x59
-| [[#WritePage|WritePageSecure]]
 |-
 | 0x5B
 | [[#ReadPage|ReadPage]]
 |-
-| 0x67
+| 0x83
-| [[#ReadId1|ReadId1Secure]]
+| [[#WritePage|WritePageSecure]]
 |-
 | 0xA5
@@ Line 532: / Line 550: @@
 | 0xE2
 | ChangeInitialData
 |}

Hexkyz: /* ReadRegister */

2024-11-30T19:18:04Z

ReadRegister

← Older revision		Revision as of 22:18, 30 November 2024
Line 198:		Line 198:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| ~~Status~~		\| Lotus3Status
	\|-		\|-
	\| 0x4		\| 0x4
	\| 0x4		\| 0x4
	\| ~~Access Control~~		\| [[XCI#AccCtrl1\|AccCtrl1]]
	\|-		\|-
	\| 0x8		\| 0x8
	\| 0x4		\| 0x4
	\|		\| Wait1TimeRead
	\|-		\|-
	\| 0xC		\| 0xC
	\| 0x4		\| 0x4
	\|		\| Wait2TimeRead
	\|-		\|-
	\| 0x10		\| 0x10
	\| 0x4		\| 0x4
	\|		\| Wait1TimeWrite
	\|-		\|-
	\| 0x14		\| 0x14
	\| 0x4		\| 0x4
	\|		\| Wait2TimeWrite
	\|-		\|-
	\| 0x18		\| 0x18
	\| 0x4		\| 0x4
	\|		\| PageRemainder
	\|-		\|-
	\| 0x1C		\| 0x1C
	\| 0x4		\| 0x4
	\|		\| LatencyTime
	\|-		\|-
	\| 0x20		\| 0x20
	\| 0x4		\| 0x4
	\|		\| LimArea
	\|-		\|-
	\| 0x24		\| 0x24
	\| 0x4		\| 0x4
	\|		\| CupVersion
	\|-		\|-
	\| 0x28		\| 0x28
	\| 0x4		\| 0x4
	\|		\| Lotus3Version
	\|-		\|-
	\| 0x2C		\| 0x2C
	\| 0x4		\| 0x4
	\|		\| Standby2
	\|}		\|}

Hexkyz at 00:29, 16 April 2024

2024-04-15T22:29:46Z

Show changes

Hexkyz: /* Types */

2022-03-22T19:52:25Z

Types

← Older revision		Revision as of 22:52, 22 March 2022
Line 1,229:		Line 1,229:

	[12.0.0+] This firmware blob was updated.		[12.0.0+] This firmware blob was updated.

			[14.0.0+] This firmware blob was updated.

	=== WriterFw ===		=== WriterFw ===
Line 1,243:		Line 1,245:

	[11.0.0+] This firmware blob was updated.		[11.0.0+] This firmware blob was updated.

			[14.0.0+] This firmware blob was updated.

	=== RmaFw ===		=== RmaFw ===