3DS reverse engineering

Discussion of development of software for any "obsolete" computer or video game system.
TuxSH
Posts: 1
Joined: Tue May 19, 2020 12:47 pm

Re: 3DS reverse engineering

Post by TuxSH » Mon Jun 01, 2020 1:45 pm

I've added a few regs: You can find a fully commented sleep mode entry function: I've made some other changes as well.
Hope this helps.

profi200
Posts: 49
Joined: Fri May 10, 2019 4:48 am

Re: 3DS reverse engineering

Post by profi200 » Mon Jun 22, 2020 3:51 pm

Another little puzzle piece. The GBA RTC on 3DS works a little different than you think. You need to set the base BCD date and time and the regs you named "HEX" contain the offset from this base. This can be confirmed by for example setting the time and date to the correct current one and then starting a new save in one of the RTC enabled Pokémon games. The offset will increase quite high as the game resets the RTC to 1.1.2000 00:00.

Legacy Process9 does set the current BCD date and time and uses the offset it stores along the savegame. I currently don't do that and set the date and time with offset 0. Looks like i can get away with this and it's still working.

From source/arm9/hardware/lgy.c:

Code: Select all

Result LGY_setGbaRtc(const GbaRtc rtc)
{
	// Set base time and date.
	REG_LGY_GBA_RTC_BCD_TIME = rtc.time;
	REG_LGY_GBA_RTC_BCD_DATE = rtc.date;

	//while(REG_LGY_GBA_RTC_CNT & LGY_RTC_CNT_BUSY);
	//REG_LGY_GBA_RTC_CNT = 0; // Legacy P9 does this. Useless?
	REG_LGY_GBA_RTC_HEX_TIME = 1u<<15; // Time offset 0 and 24h format.
	REG_LGY_GBA_RTC_HEX_DATE = 0;      // Date offset 0.
	REG_LGY_GBA_RTC_CNT = LGY_RTC_CNT_WR;
	while(REG_LGY_GBA_RTC_CNT & LGY_RTC_CNT_BUSY);

	if(REG_LGY_GBA_RTC_CNT & LGY_RTC_CNT_WR_ERR) return RES_GBA_RTC_ERR;
	else                                         return RES_OK;
}

Result LGY_getGbaRtc(GbaRtc *const out)
{
	//while(REG_LGY_GBA_RTC_CNT & LGY_RTC_CNT_BUSY);
	//REG_LGY_GBA_RTC_CNT = 0; // Legacy P9 does this. Useless?
	REG_LGY_GBA_RTC_CNT = LGY_RTC_CNT_RD;
	while(REG_LGY_GBA_RTC_CNT & LGY_RTC_CNT_BUSY);

	if((REG_LGY_GBA_RTC_CNT & LGY_RTC_CNT_WR_ERR) == 0u)
	{
		out->time = REG_LGY_GBA_RTC_BCD_TIME;
		out->date = REG_LGY_GBA_RTC_BCD_DATE;

		return RES_OK;
	}

	return RES_GBA_RTC_ERR;
}

Also another strange thing i found. Setting bit 7 in REG_LGY_GBA_RTC_HEX_TIME makes the entire(?) GBA hardware hang no matter if at runtime or before doing the final switch to GBA mode. It just dies including graphics and sound. This seems unrecoverable (could not get it to work at all after setting this bit).

nocash
Posts: 1341
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: 3DS reverse engineering

Post by nocash » Fri Oct 16, 2020 9:59 pm

Released no$gba v3.03 - http://problemkaputt.de/gba.htm

My latest finding was the system settings file, it's called the "config savegame", apart from the system settings it does also contain a copy of the HWCAL calibration settings, accessing that file requires deciphering DISA containers and SAVE filesystem... and then I got a bit side-tracked and spent the next 4-5 months on improving my filesystem viewer and adding specs for various nds/dsi/3ds file formats.

Code: Select all

17 Oct 2020 - version 3.03
- filesys viewer: supports deeply nested/compressed/encrypted filesystems
- filesys viewer: allows to browse into dozens of compressed/archive filetypes
- filesys viewer: added file/folder/archive/device icons, added save-as button
- filesys viewer: auto-mounts child archives when expanding treeview items
- filesys viewer: detects about 150 different filetypes
- nds/help: file formats for sound, 2d/3d-video, message, manuals
- 3ds/help: file formats for sound, 3d-video, message, mpo, cro0/crr0, config
- compression/help: specs for Yaz0, ASH0, ALZ1, zip compression
- archive/help: specs for arcless, narcless, sarc, zar, encrypted arika archives
- gba/eeprom: ignores non-DMA access (Tomato Adventure) (thanks Unknown W.B.)
- gba/eeprom: avoids crash by stripping upper 4bit of 14bit addresses
- gba/debug: fixed nonsense warnings on jumps to 300xxxxh (caused by dsi mapper)
- dsi/ndma: gxfifo ndma mode support, fixed ndma ctrl bits in iomap (thanks ttb)
- 3ds/help: MCU: added missing IRQ 26,27,28,29 and IRQ 18,19,20,21
- 3ds/help: added aes keyslot summary
- 3ds/help: specs for partitions, cleanup for FIRM encryption chapter
- 3ds/help: confirmed GBA footer format (removed most of the guess/maybe stuff)
- debug: fixed lost data/stack/regs window focus after emulation run
homepage - patreon - you can think of a bit as a bottle that is either half full or half empty

profi200
Posts: 49
Joined: Fri May 10, 2019 4:48 am

Re: 3DS reverse engineering

Post by profi200 » Sat Oct 17, 2020 8:05 am

Recommendation (not exactly related to 3DS reverse engineering):
Split gbatek into multiple html files. It has become so big that lower end devices struggle with the site. Lower end for example being older ARMv7 tablets/smartphones or if you try to browse the site on a Raspberry Pi.
It even took seconds to load on a relatively modern i7 machine when i still had ADSL (got my connection upgraded to 100 Mbit/s VDSL recently).

nocash
Posts: 1341
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: 3DS reverse engineering

Post by nocash » Wed Oct 21, 2020 11:54 pm

profi200 wrote:
Sat Oct 17, 2020 8:05 am
Recommendation (not exactly related to 3DS reverse engineering):
Split gbatek into multiple html files. It has become so big that lower end devices struggle with the site. Lower end for example being older ARMv7 tablets/smartphones or if you try to browse the site on a Raspberry Pi.
It even took seconds to load on a relatively modern i7 machine when i still had ADSL (got my connection upgraded to 100 Mbit/s VDSL recently).
Yes, the html version doesn't work too well. Thanks for pointing out! I've been wondering about that (and some other changes) for a while, too.
I've just made a separate topic for it: Reformatting GBATEK html version
homepage - patreon - you can think of a bit as a bottle that is either half full or half empty

nocash
Posts: 1341
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: 3DS reverse engineering

Post by nocash » Mon Mar 29, 2021 12:42 pm

I've recently purchased an Old3DS and a handful of 3DS game cartridges. After all the time that I had spend on dreaming of having a 3DS with english GUI and working top screen and with game cartridges... it was a bit disapointing, the 3D effect can be quickly distracting, the screen is a bit small (or I need new glasses), and the games are ranging between classic NDS- and NES-style quality. Looking back, I had more fun with the broken japanese New3DS.

Anyways, I've now taken the 3DS apart, and started looking at the mainboard pinouts yesterday.

What I have so far are test points...

Code: Select all

3DS Testpoints
--------------

Testpoints for Old 3DS (Mainboard "C/CTR-CPU-01")
  TP1   P2.pin2+3+4+6 (GND)                           (near charger)
  TP2   ... reportedly +1.2V                          (near charger)
  TP3   ... reportedly +2.8V                          (near powerman)
  TP4   P2.pin1+5 (4.6VIN)                            (near charger)
  TP5   ... reportedly +1.8V                          (near mcu)
  TP6   ... reportedly +2.8V                          (near powerman)
  TP7   ... reportedly +1.8V             (always on)  (near charger)
  TP8   ... reportedly +3.6V..+3.9V Ubat (always on)  (near charger)
  TP9   ... reportedly +3.6V..+3.9V      (always on)  (near start button)
  TP10  ... reportedly +1.8V             (always on)  (near charger)
  TP11  ... reportedly +1.8V             (always on)  (near charger)
  TP12  ... reportedly +3.7V..+4.0V                   (near powerman)
  TP13  P14.pin??? SD.Card.pin4 Supply VDD +
  TP14
  TP15
  TP16                                                (near powerman)
  TP17
  TP18                                                (near powerman)
  TP19                                                (near powerman)
  TP20
  TP21
  TP22  P4.plus Battery +                             (near powerman)
  TP23  P4.center Battery (near MCU)                  (near mcu)
  TP24
  TP25  GND? Battery or so?                           (near powerman)
  TP26
  TP27
  TP28
  TP29
  TP30
  TP31
  TP32
  TP33  I2C Bus MCU SDA  ;\for FuelGauge, Accel, Powerman, Tsc?
  TP34  I2C Bus MCU SCL  ;/
  TP35
  TP36      near AIC
  TP37      near AIC
  TP38  Fuel Gauge: Battery Voltage Input (CELL)
  TP39  Fuel Gauge: Power Supply (VDD)
  TP40
  TP41  P12.Pin3+4 Lower Backlight
  TP42  P12.Pin1+2 Lower Backlight
  TP43                   ;\lower right board edge (with thick capacitors)
  TP44                   ;/(maybe upper backlight, or speakers?)
  TP45
  TP46  P10.pin3 Microphone  ;\what is that? plus/minus? or left/right?
  TP47  P10.pin2 Microphone  ;/   (reportedly TP46 = enable or 3.2V supply??)
  TP48  P3.pin1 Headphone Audio Ground? (GNDed when plug inserted)
  TP49  P3.pin4 Headphone Insert Detect? (GNDed when plug inserted)
  TP50  P3.pin2 Headphone Audio Left
  TP51  P3.pin3 Headphone Audio Right
  TP52  SW1  Button POWER
  TP53
  TP54
  TP55  SW2  Button HOME
  TP56  DL5 RGB LED green
  TP57      ? has 2ohm to GND
  TP58  Button WIFI
  TP59  DL1 Wifi LED orange
  TP60      near MCU
  TP61      near AIC
  TP62      near AIC
  TP63      near MCU
  TP64      near AIC
  TP65      near AIC
  TP66      near MCU
  TP67  DL2 Power LED blue
  TP68  P11.pin4 Circle Pad Y (0.2V=Down, 1.5V=Up)
  TP69  P11.pin2 Circle Pad X (0.2V=Left, 1.5V=Right)
  TP70  DL3 Power LED red
  TP71  DL4 Wifi button LED green
  TP72      near MCU
  TP73  MCU Volume Slider (P17.pin2)
  TP74  MCU        ;\
  TP75  MCU FLMD0  ;
  TP76  MCU TOOL1  ; PCB Side B
  TP77  MCU TOOL0  ; (under green solder stop)
  TP78  MCU GND    ;
  TP79  MCU        ;/
  TP80  SW4  Button Start
  TP81  SW5  Button Select
  TP82  P15.pin4 Right Shoulder Button
  TP83  P16.pin3 Left Shoulder button
  TP84   ...reportedly 1.8V, maybe hinge or pendown? right of (Nintendo) logo
  TP85  SW6  Button Up
  TP86  SW7  Button X
  TP87  SW8  Button Left
  TP88  SW10 Button Y
  TP89  SW11 Button A
  TP90  SW9  Button Right
  TP91  SW12 Button Down
  TP92  SW13 Button B
  TP93  P14.pin??? SD Card /UNLOCK   (GNDed=Unlocked)
  TP94  P14.pin??? SD Card /INSERTED (GNDed=Inserted)
  TP95  NDS Slot P1.pin2  CLK
  TP96  P14.pin??? SD.Card.pin2 Cmd  (via 57 ohm)
  TP97  P14.pin??? SD.Card.pin1 Data3
  TP98  P14.pin??? SD.Card.pin9 Data2
  TP99  NDS Slot P1.pin6  /SaveCS
  TP100 P14.pin??? SD.Card.pin8 Data1
  TP101 P14.pin??? SD.Card.pin7 Data0
  TP102 NDS Slot P1.pin7  IRQ
  TP103 P14.pin??? SD.Card.pin5 Clk
  TP104 NDS Slot P1.pin12 D3
  TP105 NDS Slot P1.pin13 D4
  TP106 NDS Slot P1.pin16 D7
  TP107 NDS Slot P1.pin4  /RomCS
  TP108 NDS Slot P1.pin5  /Reset
  TP109 NDS Slot P1.pin18 /Insert Signal
  TP110 NDS Slot P1.pin9  D0
  TP111 NDS Slot P1.pin10 D1
  TP112 NDS Slot P1.pin11 D2
  TP113 NDS Slot P1.pin14 D5
  TP114 NDS Slot P1.pin15 D6
  TP115
  TP116
  TP117
  TP118
  TP119
  TP120
  TP121
  TP122
  TP123
  TP124
  TP125
  TP126
  TP127
  TP128
  TP129
  TP130
  TP131 Upper Screen PWM (1166.7kHz, duty 2.7%-25%)
  TP132 Lower Screen PWM (1166.7kHz, duty 5.0%-54%)
  TP133
  TP134
  TP135        9k6..9k9 to U10 ?  (maybe random leak)
  TP136
  TP137
  TP138
  TP139
  TP140
  TP141
  TP142
  TP143
  TP144 I2C Bus2 SDA (IrDA and Gyro)
  TP145
  TP146 I2C Bus2 SCL (390kHz)  ;reportedly SCL/SDA vice-versa, but seems wrong
  TP147
  TP148
  TP149    ... 47.6kHz I2S word select?
  TP150    ... 1.52MHz I2S clock?
  TP151
  TP152    ... 16.7MHz clock
  TP153
  TP154
  TP155
  TP156
  TP157
  TP158
  TP159
  TP160
  TP161
  TP162
  TP163
  TP164
  TP165 Lower Screen R7 (red)
  TP166 Lower Screen R3 (red)
  TP167 Lower Screen G7 (green)
  TP168 Lower Screen G3 (green)
  TP169 Lower Screen B7 (blue)
  TP170 Lower Screen B3 (blue)
  TP171 Lower Screen R6 (red)
  TP172 Lower Screen R2 (red)
  TP173 Lower Screen G6 (green)
  TP174 Lower Screen G2 (green)
  TP175 Lower Screen B6 (blue)
  TP176 Lower Screen B2 (blue)
  TP177 Lower Screen R5 (red)
  TP178 Lower Screen R1 (red)
  TP179 Lower Screen G5 (green)
  TP180 Lower Screen G1 (green)
  TP181 Lower Screen B5 (blue)
  TP182 Lower Screen B1 (blue)
  TP183 Lower Screen R4 (red)
  TP184 Lower Screen R0 (red)
  TP185 Lower Screen G4 (green)
  TP186 Lower Screen G0 (green)
  TP187 Lower Screen B4 (blue)
  TP188 Lower Screen B0 (blue)
  TP189 Lower Screen Dotclk (11MHz)
  TP190 Lower Screen VSYNC (24.77kHz)
  TP191 Lower Screen HSYNC (59.8Hz)
  TP192
  TP193
  TP194
  TP195
  TP196
  TP197
  TP198
  TP199
  TP200
  TP201
  TP202
  TP203
  TP204
  TP205 P9.pin4   ;to upper...?
  TP206 P9.pin5   ;to upper...?
  TP207 P9.pin6   ;to upper...?
  TP208 P9.pin7   ;to upper...?
  TP209
  TP210
  TP211
  TP212
  TP213 P13.Pin1 Touchpad
  TP214 P13.Pin2 Touchpad
  TP215 P13.Pin3 Touchpad
  TP216 P13.Pin4 Touchpad
  TP217
  TP218
  TP219
  TP220
  TP221
  TP222
  TP223
  TP224
  TP225
  TP226
  TP227
  TP228
  TP229
  TP230
  TP231
  TP232
  TP233
  TP234
  TP235
  TP236
  TP237
  TP238
  TP239
  TP240
  TP241 TH1 (battery temperature sensor) (off/normal 9Kohm to GND) (8K=warmer)
  TP242    ? near wifi socket
  TP243    ? near wifi socket
  TP244    ? near select button
  TP245    ? near wifi socket           ;-PCB Side B (underneath NDS slot)
  TP246    ? near wifi socket
  TP247    ? near wifi socket
  TP248    ? near wifi socket
  TP249 eMMC DAT0       ;\
  TP250 eMMC DAT1       ; PCB Side B
  TP251 eMMC DAT2       ; (eMMC CLK has no known TP)
  TP252 eMMC DAT3       ;
  TP253 eMMC CMD        ;/
  TP254    ? near circle pad connector
  TP255    ? near main cpu (near eMMC CLK signal)
  TP256 DL5 RGB LED blue                            ? pcb top-right
  TP257 DL5 RGB LED red                             ? pcb top-right
  TP258    ? near select button
  TP259    ? pcb top-right    ... maybe charger related?
Testpoints for 3DS XL and 2DS
3DS XL and 2DS have some extra test points at TP260 and up (unknown if
TP1-TP259 are same as on 3DS, at least some seem to be same or similar).
  TP260 eMMC CLK        ;exists on both 2DS and 3DS XL (has no TP on 3DS)
  TP261 ?
  TP262 ?               ;spotted on 2DS (near power button)
  TP263 ?               ;spotted on 2DS (near power button)
  TP264 ?               ;spotted on 2DS (near power button)

Testpoints for New 3DS, New 3DS XL, and New 2DS
New 3DS and New 3DS XL (and probably New 2DS) have testpoints, but without text
layer (so they could be used/described only via photos or drawings).
And connectors...

Code: Select all

3DS Connector Pinouts
---------------------

P1 - 19pin - NDS/DSi cartridge slot (17pin slot + 2pin switch at right side)
  1  GND   NDS Slot P1.pin1  GND
  2  TP95  NDS Slot P1.pin2  CLK
  3        NDS Slot P1.pin3  ?
  4  TP107 NDS Slot P1.pin4  /RomCS
  5  TP108 NDS Slot P1.pin5  /Reset
  6  TP99  NDS Slot P1.pin6  /SaveCS
  7  TP102 NDS Slot P1.pin7  IRQ
  8        NDS Slot P1.pin8  3.3V
  9  TP110 NDS Slot P1.pin9  D0
  10 TP111 NDS Slot P1.pin10 D1
  11 TP112 NDS Slot P1.pin11 D2
  12 TP104 NDS Slot P1.pin12 D3
  13 TP105 NDS Slot P1.pin13 D4
  14 TP113 NDS Slot P1.pin14 D5
  15 TP114 NDS Slot P1.pin15 D6
  16 TP106 NDS Slot P1.pin16 D7
  17 GND   NDS Slot P1.pin17 GND
  18 TP109 NDS Slot P1.pin18 /Insert Signal
  19 GND   NDS Slot P1.pin19 /Insert GND

P2 - 6pin - External Power Supply input (4.6V DC IN) (with sticky glue!)
  1  TP4 4.6VIN (Power pin +)
  2  TP1 GND    (Power pin -)
  3  TP1 GND    (Shield)
  4  TP1 GND    (Shield)
  5  TP4 4.6VIN (goldplate)
  6  TP1 GND    (goldplate)
Note: This connector has pretty bad solder pads (breaks off easily).

P3 - 5pin - Headphone (stereo, plus switch)
  1  TP48 Headphone Audio Ground?  (GNDed when plug inserted)
  2  TP50 Headphone Audio Left     (tip)
  3  TP51 Headphone Audio Right    (ring)
  4  TP49 Headphone Insert Detect? (GNDed when plug inserted)
  5  GND

P4 - 3pin - Battery
  plus   TP22 P4.plus Battery +
  center TP23 P4.center (testpoint near MCU)
  minus  GND

P5 - 50pin - Wifi daughterboard (DWM-W028)
https://fccid.io/EW4DWMW028/Label/ID-label-location-1272988.pdf
  1  MCLK         2  RF_CSRF
  3  GND          4  BB_CSBB
  5  RXPE         6  BB_RF_SDIN
  7  TXPE         8  BB_RF_SDOUT
  9  CCA          10 BB_RF_SCK
  11 TRDATA       12 GND
  13 TRCLK        14 BBP_SLEEP_L
  15 TRRDY        16 RF_SLEEP_L
  17 TRST_L       18 SEL_ATH_L
  19 GND          20 GND
  21 SDIO_DATA_0  22 JTAG_TDO
  23 SDIO_DATA_1  24 JTAG_TMS
  25 SDIO_DATA_2  26 JTAG_TDI
  27 SDIO_DATA_3  28 JTAG_TCK
  29 GND          30 SPI_CS2
  31 SDIO_CLK     32 W_B
  33 GND          34 SPI_CLK
  35 SDIO_CMD     36 SPI_DO   MISO
  37 UART_TXD     38 SPI_DI   MOSI
  39 UART_RXD     40 SYS_RST_L
  41 GND          42 ATH_TX_H
  43 CLK32k       44 RESET
  45 GND          46 GND
  47 VDD_18       48 VDD_33
  49 VDD_18       50 VDD_33
Functionally same as DSi, but not pin-compatible, and with two UART pins
(instead of the NC pins).

P6 - 29pin - ... to upper (on PCB side A)
  1                 2  GND
  3                 4  GND
  5                 6
  7  GND            8
  9                 10 GND
  11                12
  13 GND            14
  15                16 GND
  17                18
  19 GND            20
  21                22
  23 GND            24
  25                26
  27 GND            28
  29

P7 - 21pin - ... to upper
  1  GND            2     thick wire
  3     thick wire  4     thick wire
  5                 6
  7                 8     thick wire
  9                 10    thick wire
  11                12
  13                14
  15                16
  17                18
  19                20
  21 GND

P8 - 43pin - Lower Screen: Video
CAUTION: Below is NONSENSE (for example, pin9 is clearly GND)
  1     Supply -6V
  2     Supply 12V
  3     Dotclk (11MHz)
  4     /HBL, Horizontal blank (low while blanking)
  5     /VBL, Vertical blank (low while blanking)
  6     2v2, Loopback of pin 07?
  7     2v2, Content latch? Shorting to GND or to pin 6 will "lock" the screen
            memory while still allowing the screen to refresh itself.
            uh, there is memory in the screen?
  8     GND
  9     HCL Horizontal clock
  10    GND
  11    Contrast BIAS (usually 4.5V..4.8V)
  12    Flicker BIAS (usually voltage same as above)
  13    ??? Might be a transistor? Shorted to ground if off, 2.36V if on.
  14    Supply +6V
  15    ??? Loopback of pin 14 ? Shorting this with pin 14 or GND will make
            the 3DS turn off with a harsh pop sound.
  16    ??? ???
  17    ??? ???
  18-25 RED 0..7 Red pixel bits
  26    GND
  27-34 BLUE 7..0 Blue pixel bits
  35    GND
  36-43 GREEN 7..0 Green pixel bits
Some of the unknown pins are probably I2C bus (Device 1:2Eh)?

P9 - 37pin - ... to upper
  1                 2  GND
  3  GND            4  TP205
  5  TP206          6  TP207
  7  TP208          8
  9                 10
  11                12
  13                14
  15                16 GND
  17                18 GND
  19                20
  21                22
  23                24
  25                26
  27                28
  29                30
  31                32
  33                34
  35 GND            36 GND
  37

P10 - 4pin - Microphone
  1 GND
  2 TP47   ;\what is that? plus/minus? or left/right?
  3 TP46   ;/
  4 GND

P11 - 4pin - Circle Pad (analog joystick)
  1  GND
  2  TP69 Circle Pad X (0.2V=Left, 1.5V=Right)
  3  some power?
  4  TP68 Circle Pad Y (0.2V=Down, 1.5V=Up)

P12 - 4pin - Lower Screen: Backlight
  1  TP42  ;\
  2  TP42  ;/
  3  TP41  ;\
  4  TP41  ;/

P13 - 4pin - Lower Screen: Tochpad
  1  TP213 Touchpad
  2  TP214 Touchpad
  3  TP215 Touchpad
  4  TP216 Touchpad

P14 - 20pin - SD Card Slot
  1  GND            2  TP..
  3  GND            4  TP..
  5  GND            6  GND
  7  GND            8  TP..
  9  GND            10 TP..
  11 GND            12 GND
  13 GND            14 TP..
  15 GND            16 TP..
  17 TP13 VDD       18 TP..
  19 TP13 VDD       20 TP..
Unknown which pin is where, but the related signals are TP93-TP94, TP96-TP98,
TP100-TP101, TP103, and GND.

P15 - 8pin - Right Shoulder button
  1  GND            2  GND
  3  GND            4  TP82 Button R
  5  GND            6  GND
  7  GND            8  GND

P16 - 8pin - Left Shoulder button
  1  GND            2  GND
  3  TP83 Button L  4  GND
  5  GND            6  GND
  7  GND            8  GND

P17 - 3pin - Volume Slider  (on PCB side A)
  1  ... some supply?          (red wire)
  2  TP73  MCU Volume Slider   (white wire)
  3  GND                       (black wire)

P18 - 1pin ;\shield for eMMC
P19 - 1pin ;/
P20 - 1pin ;\shield for MCU
P21 - 1pin ;/
GNDed clips for holding shielding plates.

P22 - N/A
P23 - N/A
None such.

P24 - 12pin - IR daughterboard (I2C Device 2:9Ah)
  1  TP144 I2C Bus2 SDA   2  TP146 I2C Bus2 SCL
  3  GND                  4  GND
  5                       6
  7  GND                  8  GND
  9  GND                  10
  11 TP3 Supply 2.8V      12 TP3 Supply 2.8V
The unknown pins may include /RESET and /IRQ?

P25 - 1pin ;--? antenna cable holder or so?
GNDed clip for holding antenna cable or so?
Some of the pinouts were described here:
- http://www.3dbrew.org/wiki/Hardware
- http://www.3dbrew.org/wiki/TP_Nets
- http://www.3dbrew.org/wiki/Pinouts
- http://www.3dbrew.org/wiki/Video_Capture
Are there other docs with more pins somewhere?

Still unknown TP testpoints are...
- I2C Bus0, I2C Bus1
- SPI Bus0, SPI Bus1 (and unused SPI Bus2, if it has any TPs)
- Upper video, Upper backlight, Parallax barrier
- All three Cameras, Camera LED, 3D Slider, 3D LED
- Speakers, Wifi, Hinge, Pendown, IRQs
- MCU Reset and PVDD for unbricking via TOOL pins

For the two known I2C buses. The MCU's own bus was described on the "Hardware" page, and bus2 was on the "TP Nets" page. Confusingly, both seem to have SCL and SDA swapped (when comparing the signals to FuelGauge and Gyroscope datasheets). EDIT: Oops, sorry, the "TP Nets" page was correct (TP144 should be SCL).
Last edited by nocash on Wed Mar 31, 2021 6:57 pm, edited 1 time in total.
homepage - patreon - you can think of a bit as a bottle that is either half full or half empty

calima
Posts: 1326
Joined: Tue Oct 06, 2015 10:16 am

Re: 3DS reverse engineering

Post by calima » Tue Mar 30, 2021 12:16 am

Nintendo makes the XL versions for the elderly.

KayBur
Posts: 12
Joined: Mon Mar 29, 2021 6:47 am

Re: 3DS reverse engineering

Post by KayBur » Wed Mar 31, 2021 5:01 am

nocash wrote:
Mon Mar 29, 2021 12:42 pm
I've recently purchased an Old3DS and a handful of 3DS game cartridges. After all the time that I had spend on dreaming of having a 3DS with english GUI and working top screen and with game cartridges... it was a bit disapointing, the 3D effect can be quickly distracting, the screen is a bit small (or I need new glasses), and the games are ranging between classic NDS- and NES-style quality. Looking back, I had more fun with the broken japanese New3DS.

Anyways, I've now taken the 3DS apart, and started looking at the mainboard pinouts yesterday.

What I have so far are test points...

Code: Select all

3DS Testpoints
--------------

Testpoints for Old 3DS (Mainboard "C/CTR-CPU-01")
  TP1   P2.pin2+3+4+6 (GND)                           (near charger)
  TP2   ... reportedly +1.2V                          (near charger)
  TP3   ... reportedly +2.8V                          (near powerman)
  TP4   P2.pin1+5 (4.6VIN)                            (near charger)
  TP5   ... reportedly +1.8V                          (near mcu)
  TP6   ... reportedly +2.8V                          (near powerman)
  TP7   ... reportedly +1.8V             (always on)  (near charger)
  TP8   ... reportedly +3.6V..+3.9V Ubat (always on)  (near charger)
  TP9   ... reportedly +3.6V..+3.9V      (always on)  (near start button)
  TP10  ... reportedly +1.8V             (always on)  (near charger)
  TP11  ... reportedly +1.8V             (always on)  (near charger)
  TP12  ... reportedly +3.7V..+4.0V                   (near powerman)
  TP13  P14.pin??? SD.Card.pin4 Supply VDD +
  TP14
  TP15
  TP16                                                (near powerman)
  TP17
  TP18                                                (near powerman)
  TP19                                                (near powerman)
  TP20
  TP21
  TP22  P4.plus Battery +                             (near powerman)
  TP23  P4.center Battery (near MCU)                  (near mcu)
  TP24
  TP25  GND? Battery or so?                           (near powerman)
  TP26
  TP27
  TP28
  TP29
  TP30
  TP31
  TP32
  TP33  I2C Bus MCU SDA  ;\for FuelGauge, Accel, Powerman, Tsc?
  TP34  I2C Bus MCU SCL  ;/
  TP35
  TP36      near AIC
  TP37      near AIC
  TP38  Fuel Gauge: Battery Voltage Input (CELL)
  TP39  Fuel Gauge: Power Supply (VDD)
  TP40
  TP41  P12.Pin3+4 Lower Backlight
  TP42  P12.Pin1+2 Lower Backlight
  TP43                   ;\lower right board edge (with thick capacitors)
  TP44                   ;/(maybe upper backlight, or speakers?)
  TP45
  TP46  P10.pin3 Microphone  ;\what is that? plus/minus? or left/right?
  TP47  P10.pin2 Microphone  ;/   (reportedly TP46 = enable or 3.2V supply??)
  TP48  P3.pin1 Headphone Audio Ground? (GNDed when plug inserted)
  TP49  P3.pin4 Headphone Insert Detect? (GNDed when plug inserted)
  TP50  P3.pin2 Headphone Audio Left
  TP51  P3.pin3 Headphone Audio Right
  TP52  SW1  Button POWER
  TP53
  TP54
  TP55  SW2  Button HOME
  TP56  DL5 RGB LED green
  TP57      ? has 2ohm to GND
  TP58  Button WIFI
  TP59  DL1 Wifi LED orange
  TP60      near MCU
  TP61      near AIC
  TP62      near AIC
  TP63      near MCU
  TP64      near AIC
  TP65      near AIC
  TP66      near MCU
  TP67  DL2 Power LED blue
  TP68  P11.pin4 Circle Pad Y (0.2V=Down, 1.5V=Up)
  TP69  P11.pin2 Circle Pad X (0.2V=Left, 1.5V=Right)
  TP70  DL3 Power LED red
  TP71  DL4 Wifi button LED green
  TP72      near MCU
  TP73  MCU Volume Slider (P17.pin2)
  TP74  MCU        ;\
  TP75  MCU FLMD0  ;
  TP76  MCU TOOL1  ; PCB Side B
  TP77  MCU TOOL0  ; (under green solder stop)
  TP78  MCU GND    ;
  TP79  MCU        ;/
  TP80  SW4  Button Start
  TP81  SW5  Button Select
  TP82  P15.pin4 Right Shoulder Button
  TP83  P16.pin3 Left Shoulder button
  TP84   ...reportedly 1.8V, maybe hinge or pendown? right of (Nintendo) logo
  TP85  SW6  Button Up
  TP86  SW7  Button X
  TP87  SW8  Button Left
  TP88  SW10 Button Y
  TP89  SW11 Button A
  TP90  SW9  Button Right
  TP91  SW12 Button Down
  TP92  SW13 Button B
  TP93  P14.pin??? SD Card /UNLOCK   (GNDed=Unlocked)
  TP94  P14.pin??? SD Card /INSERTED (GNDed=Inserted)
  TP95  NDS Slot P1.pin2  CLK
  TP96  P14.pin??? SD.Card.pin2 Cmd  (via 57 ohm)
  TP97  P14.pin??? SD.Card.pin1 Data3
  TP98  P14.pin??? SD.Card.pin9 Data2
  TP99  NDS Slot P1.pin6  /SaveCS
  TP100 P14.pin??? SD.Card.pin8 Data1
  TP101 P14.pin??? SD.Card.pin7 Data0
  TP102 NDS Slot P1.pin7  IRQ
  TP103 P14.pin??? SD.Card.pin5 Clk
  TP104 NDS Slot P1.pin12 D3
  TP105 NDS Slot P1.pin13 D4
  TP106 NDS Slot P1.pin16 D7
  TP107 NDS Slot P1.pin4  /RomCS
  TP108 NDS Slot P1.pin5  /Reset
  TP109 NDS Slot P1.pin18 /Insert Signal
  TP110 NDS Slot P1.pin9  D0
  TP111 NDS Slot P1.pin10 D1
  TP112 NDS Slot P1.pin11 D2
  TP113 NDS Slot P1.pin14 D5
  TP114 NDS Slot P1.pin15 D6
  TP115
  TP116
  TP117
  TP118
  TP119
  TP120
  TP121
  TP122
  TP123
  TP124
  TP125
  TP126
  TP127
  TP128
  TP129
  TP130
  TP131 Upper Screen PWM (1166.7kHz, duty 2.7%-25%)
  TP132 Lower Screen PWM (1166.7kHz, duty 5.0%-54%)
  TP133
  TP134
  TP135        9k6..9k9 to U10 ?  (maybe random leak)
  TP136
  TP137
  TP138
  TP139
  TP140
  TP141
  TP142
  TP143
  TP144 I2C Bus2 SDA (IrDA and Gyro)
  TP145
  TP146 I2C Bus2 SCL (390kHz)  ;reportedly SCL/SDA vice-versa, but seems wrong
  TP147
  TP148
  TP149    ... 47.6kHz I2S word select?
  TP150    ... 1.52MHz I2S clock?
  TP151
  TP152    ... 16.7MHz clock
  TP153
  TP154
  TP155
  TP156
  TP157
  TP158
  TP159
  TP160
  TP161
  TP162
  TP163
  TP164
  TP165 Lower Screen R7 (red)
  TP166 Lower Screen R3 (red)
  TP167 Lower Screen G7 (green)
  TP168 Lower Screen G3 (green)
  TP169 Lower Screen B7 (blue)
  TP170 Lower Screen B3 (blue)
  TP171 Lower Screen R6 (red)
  TP172 Lower Screen R2 (red)
  TP173 Lower Screen G6 (green)
  TP174 Lower Screen G2 (green)
  TP175 Lower Screen B6 (blue)
  TP176 Lower Screen B2 (blue)
  TP177 Lower Screen R5 (red)
  TP178 Lower Screen R1 (red)
  TP179 Lower Screen G5 (green)
  TP180 Lower Screen G1 (green)
  TP181 Lower Screen B5 (blue)
  TP182 Lower Screen B1 (blue)
  TP183 Lower Screen R4 (red)
  TP184 Lower Screen R0 (red)
  TP185 Lower Screen G4 (green)
  TP186 Lower Screen G0 (green)
  TP187 Lower Screen B4 (blue)
  TP188 Lower Screen B0 (blue)
  TP189 Lower Screen Dotclk (11MHz)
  TP190 Lower Screen VSYNC (24.77kHz)
  TP191 Lower Screen HSYNC (59.8Hz)
  TP192
  TP193
  TP194
  TP195
  TP196
  TP197
  TP198
  TP199
  TP200
  TP201
  TP202
  TP203
  TP204
  TP205 P9.pin4   ;to upper...?
  TP206 P9.pin5   ;to upper...?
  TP207 P9.pin6   ;to upper...?
  TP208 P9.pin7   ;to upper...?
  TP209
  TP210
  TP211
  TP212
  TP213 P13.Pin1 Touchpad
  TP214 P13.Pin2 Touchpad
  TP215 P13.Pin3 Touchpad
  TP216 P13.Pin4 Touchpad
  TP217
  TP218
  TP219
  TP220
  TP221
  TP222
  TP223
  TP224
  TP225
  TP226
  TP227
  TP228
  TP229
  TP230
  TP231
  TP232
  TP233
  TP234
  TP235
  TP236
  TP237
  TP238
  TP239
  TP240
  TP241 TH1 (battery temperature sensor) (off/normal 9Kohm to GND) (8K=warmer)
  TP242    ? near wifi socket
  TP243    ? near wifi socket
  TP244    ? near select button
  TP245    ? near wifi socket           ;-PCB Side B (underneath NDS slot)
  TP246    ? near wifi socket
  TP247    ? near wifi socket
  TP248    ? near wifi socket
  TP249 eMMC DAT0       ;\
  TP250 eMMC DAT1       ; PCB Side B
  TP251 eMMC DAT2       ; (eMMC CLK has no known TP)
  TP252 eMMC DAT3       ;
  TP253 eMMC CMD        ;/
  TP254    ? near circle pad connector
  TP255    ? near main cpu (near eMMC CLK signal)
  TP256 DL5 RGB LED blue                            ? pcb top-right
  TP257 DL5 RGB LED red                             ? pcb top-right
  TP258    ? near select button
  TP259    ? pcb top-right    ... maybe charger related?
Testpoints for 3DS XL and 2DS
3DS XL and 2DS have some extra test points at TP260 and up (unknown if
TP1-TP259 are same as on 3DS, at least some seem to be same or similar).
  TP260 eMMC CLK        ;exists on both 2DS and 3DS XL (has no TP on 3DS)
  TP261 ?
  TP262 ?               ;spotted on 2DS (near power button)
  TP263 ?               ;spotted on 2DS (near power button)
  TP264 ?               ;spotted on 2DS (near power button)

Testpoints for New 3DS, New 3DS XL, and New 2DS
New 3DS and New 3DS XL (and probably New 2DS) have testpoints, but without text
layer (so they could be used/described only via photos or drawings).
And connectors...

Code: Select all

3DS Connector Pinouts
---------------------

P1 - 19pin - NDS/DSi cartridge slot (17pin slot + 2pin switch at right side)
  1  GND   NDS Slot P1.pin1  GND
  2  TP95  NDS Slot P1.pin2  CLK
  3        NDS Slot P1.pin3  ?
  4  TP107 NDS Slot P1.pin4  /RomCS
  5  TP108 NDS Slot P1.pin5  /Reset
  6  TP99  NDS Slot P1.pin6  /SaveCS
  7  TP102 NDS Slot P1.pin7  IRQ
  8        NDS Slot P1.pin8  3.3V
  9  TP110 NDS Slot P1.pin9  D0
  10 TP111 NDS Slot P1.pin10 D1
  11 TP112 NDS Slot P1.pin11 D2
  12 TP104 NDS Slot P1.pin12 D3
  13 TP105 NDS Slot P1.pin13 D4
  14 TP113 NDS Slot P1.pin14 D5
  15 TP114 NDS Slot P1.pin15 D6
  16 TP106 NDS Slot P1.pin16 D7
  17 GND   NDS Slot P1.pin17 GND
  18 TP109 NDS Slot P1.pin18 /Insert Signal
  19 GND   NDS Slot P1.pin19 /Insert GND

P2 - 6pin - External Power Supply input (4.6V DC IN) (with sticky glue!)
  1  TP4 4.6VIN (Power pin +)
  2  TP1 GND    (Power pin -)
  3  TP1 GND    (Shield)
  4  TP1 GND    (Shield)
  5  TP4 4.6VIN (goldplate)
  6  TP1 GND    (goldplate)
Note: This connector has pretty bad solder pads (breaks off easily).

P3 - 5pin - Headphone (stereo, plus switch)
  1  TP48 Headphone Audio Ground?  (GNDed when plug inserted)
  2  TP50 Headphone Audio Left     (tip)
  3  TP51 Headphone Audio Right    (ring)
  4  TP49 Headphone Insert Detect? (GNDed when plug inserted)
  5  GND

P4 - 3pin - Battery
  plus   TP22 P4.plus Battery +
  center TP23 P4.center (testpoint near MCU)
  minus  GND

P5 - 50pin - Wifi daughterboard (DWM-W028)
https://fccid.io/EW4DWMW028/Label/ID-label-location-1272988.pdf
  1  MCLK         2  RF_CSRF
  3  GND          4  BB_CSBB
  5  RXPE         6  BB_RF_SDIN
  7  TXPE         8  BB_RF_SDOUT
  9  CCA          10 BB_RF_SCK
  11 TRDATA       12 GND
  13 TRCLK        14 BBP_SLEEP_L
  15 TRRDY        16 RF_SLEEP_L
  17 TRST_L       18 SEL_ATH_L
  19 GND          20 GND
  21 SDIO_DATA_0  22 JTAG_TDO
  23 SDIO_DATA_1  24 JTAG_TMS
  25 SDIO_DATA_2  26 JTAG_TDI
  27 SDIO_DATA_3  28 JTAG_TCK
  29 GND          30 SPI_CS2
  31 SDIO_CLK     32 W_B
  33 GND          34 SPI_CLK
  35 SDIO_CMD     36 SPI_DO   MISO
  37 UART_TXD     38 SPI_DI   MOSI
  39 UART_RXD     40 SYS_RST_L
  41 GND          42 ATH_TX_H
  43 CLK32k       44 RESET
  45 GND          46 GND
  47 VDD_18       48 VDD_33
  49 VDD_18       50 VDD_33
Functionally same as DSi, but not pin-compatible, and with two UART pins
(instead of the NC pins).

P6 - 29pin - ... to upper (on PCB side A)
  1                 2  GND
  3                 4  GND
  5                 6
  7  GND            8
  9                 10 GND
  11                12
  13 GND            14
  15                16 GND
  17                18
  19 GND            20
  21                22
  23 GND            24
  25                26
  27 GND            28
  29

P7 - 21pin - ... to upper
  1  GND            2     thick wire
  3     thick wire  4     thick wire
  5                 6
  7                 8     thick wire
  9                 10    thick wire
  11                12
  13                14
  15                16
  17                18
  19                20
  21 GND

P8 - 43pin - Lower Screen: Video
CAUTION: Below is NONSENSE (for example, pin9 is clearly GND)
  1     Supply -6V
  2     Supply 12V
  3     Dotclk (11MHz)
  4     /HBL, Horizontal blank (low while blanking)
  5     /VBL, Vertical blank (low while blanking)
  6     2v2, Loopback of pin 07?
  7     2v2, Content latch? Shorting to GND or to pin 6 will "lock" the screen
            memory while still allowing the screen to refresh itself.
            uh, there is memory in the screen?
  8     GND
  9     HCL Horizontal clock
  10    GND
  11    Contrast BIAS (usually 4.5V..4.8V)
  12    Flicker BIAS (usually voltage same as above)
  13    ??? Might be a transistor? Shorted to ground if off, 2.36V if on.
  14    Supply +6V
  15    ??? Loopback of pin 14 ? Shorting this with pin 14 or GND will make
            the 3DS turn off with a harsh pop sound.
  16    ??? ???
  17    ??? ???
  18-25 RED 0..7 Red pixel bits
  26    GND
  27-34 BLUE 7..0 Blue pixel bits
  35    GND
  36-43 GREEN 7..0 Green pixel bits
Some of the unknown pins are probably I2C bus (Device 1:2Eh)?

P9 - 37pin - ... to upper
  1                 2  GND
  3  GND            4  TP205
  5  TP206          6  TP207
  7  TP208          8
  9                 10
  11                12
  13                14
  15                16 GND
  17                18 GND
  19                20
  21                22
  23                24
  25                26
  27                28
  29                30
  31                32
  33                34
  35 GND            36 GND
  37

P10 - 4pin - Microphone
  1 GND
  2 TP47   ;\what is that? plus/minus? or left/right?
  3 TP46   ;/
  4 GND

P11 - 4pin - Circle Pad (analog joystick)
  1  GND
  2  TP69 Circle Pad X (0.2V=Left, 1.5V=Right)
  3  some power?
  4  TP68 Circle Pad Y (0.2V=Down, 1.5V=Up)

P12 - 4pin - Lower Screen: Backlight
  1  TP42  ;\
  2  TP42  ;/
  3  TP41  ;\
  4  TP41  ;/

P13 - 4pin - Lower Screen: Tochpad
  1  TP213 Touchpad
  2  TP214 Touchpad
  3  TP215 Touchpad
  4  TP216 Touchpad

P14 - 20pin - SD Card Slot
  1  GND            2  TP..
  3  GND            4  TP..
  5  GND            6  GND
  7  GND            8  TP..
  9  GND            10 TP..
  11 GND            12 GND
  13 GND            14 TP..
  15 GND            16 TP..
  17 TP13 VDD       18 TP..
  19 TP13 VDD       20 TP..
Unknown which pin is where, but the related signals are TP93-TP94, TP96-TP98,
TP100-TP101, TP103, and GND.

P15 - 8pin - Right Shoulder button
  1  GND            2  GND
  3  GND            4  TP82 Button R
  5  GND            6  GND
  7  GND            8  GND

P16 - 8pin - Left Shoulder button
  1  GND            2  GND
  3  TP83 Button L  4  GND
  5  GND            6  GND
  7  GND            8  GND

P17 - 3pin - Volume Slider  (on PCB side A)
  1  ... some supply?          (red wire)
  2  TP73  MCU Volume Slider   (white wire)
  3  GND                       (black wire)

P18 - 1pin ;\shield for eMMC
P19 - 1pin ;/
P20 - 1pin ;\shield for MCU
P21 - 1pin ;/
GNDed clips for holding shielding plates.

P22 - N/A
P23 - N/A
None such.

P24 - 12pin - IR daughterboard (I2C Device 2:9Ah)
  1  TP144 I2C Bus2 SDA   2  TP146 I2C Bus2 SCL
  3  GND                  4  GND
  5                       6
  7  GND                  8  GND
  9  GND                  10
  11 TP3 Supply 2.8V      12 TP3 Supply 2.8V
The unknown pins may include /RESET and /IRQ?

P25 - 1pin ;--? antenna cable holder or so?
GNDed clip for holding antenna cable or so?
Some of the pinouts were described here:
- http://www.3dbrew.org/wiki/Hardware
- http://www.3dbrew.org/wiki/TP_Nets
- http://www.3dbrew.org/wiki/Pinouts
- http://www.3dbrew.org/wiki/Video_Capture
Are there other docs with more pins somewhere?

Still unknown TP testpoints are...
- I2C Bus0, I2C Bus1
- SPI Bus0, SPI Bus1 (and unused SPI Bus2, if it has any TPs)
- Upper video, Upper backlight, Parallax barrier
- All three Cameras, Camera LED, 3D Slider, 3D LED
- Speakers, Wifi, Hinge, Pendown, IRQs
- MCU Reset and PVDD for unbricking via TOOL pins

For the two known I2C buses. The MCU's own bus was described on the "Hardware" page, and bus2 was on the "TP Nets" page. Confusingly, both seem to have SCL and SDA swapped (when comparing the signals to FuelGauge and Gyroscope datasheets).

Did you manage to find the pattern of work of the board? The process of optimizing the operation of old equipment for modern systems is very interesting.

nocash
Posts: 1341
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: 3DS reverse engineering

Post by nocash » Wed Mar 31, 2021 7:13 pm

More complete...

Testpoints (and some CL links)...

Code: Select all

3DS Testpoints
--------------

TP Testpoints for Old 3DS (Mainboard "C/CTR-CPU-01")
  TP1   P2.pin2+3+4+6 (GND)                                     (near charger)
  TP2   ... reportedly +1.2V                        (CL5)       (near charger)
  TP3   ... reportedly +2.8V  actually 3.3V (wifi)? (CL9+CP10)  (near powerman)
  TP4   P2.pin1+5 (4.6VIN)                                      (near charger)
  TP5   ... reportedly +1.8V                                    (near mcu)
  TP6   ... reportedly +2.8V                        (CL11)      (near powerman)
  TP7   ... reportedly +1.8V             (always on)            (near charger)
  TP8   ... reportedly +3.6V..+3.9V Ubat (always on)            (near charger)
  TP9   ... reportedly +3.6V..+3.9V      (always on)        (near start button)
  TP10  ... reportedly +1.8V             (always on)            (near charger)
  TP11  ... reportedly +1.8V             (always on)            (near charger)
  TP12  ... reportedly +3.7V..+4.0V                             (near powerman)
  TP13  P14.pin17+19 SD.Card.pin4 Supply VDD +      (CL12)      (near sd slot)
  TP14                                                          (near AIC)
  TP15
  TP16       (CL13)                                             (near powerman)
  TP17                                                          (near button y)
  TP18                                                          (near powerman)
  TP19                                                          (near powerman)
  TP20
  TP21  same as TP79 (mcu unbricking related)                  (near home butt)
  TP22  P4.plus Battery +                                       (near powerman)
  TP23  P4.center Battery (near MCU)                            (near mcu)
  TP24  P6.pin3 Upper screen... maybe supply?                   (near gyro)
  TP25  GNDed? Battery or so? (CL19?)                           (near powerman)
  TP26                                                          (near eMMC)
  TP27                                                          (near AIC)
  TP28                (CL14)                                    (near powerman)
  TP29                                                          (near AIC)
  TP30  P7.pin6 (via 1-2 ohm?)                                  (near button y)
  TP31  P7.pin5                                                 (near eMMC)
  TP32  P8.pin29      (CL15)                                    (near button b)
  TP33  I2C Bus MCU SDA  ;\for FuelGauge, Accel, Powerman, Tsc? (near powerman)
  TP34  I2C Bus MCU SCL  ;/                                     (near powerman)
  TP35  P6.pin22 Upper screen...                                (near sd slot)
  TP36  P6.pin28 and P8.pin42 BOTH screens...                   (near AIC)
  TP37  P8.pin33 Lower screen...                                (near AIC)
  TP38  Fuel Gauge: Battery Voltage Input (CELL)                (near powerman)
  TP39  Fuel Gauge: Power Supply (VDD)                          (near powerman)
  TP40  P6.pin29 and P8.pin43 for BOTH screens...               (near button b)
  TP41  P12.Pin3+4 Lower Backlight (CL8)                     (lower left edge)
  TP42  P12.Pin1+2 Lower Backlight                           (lower left edge)
  TP43  P7.pin3 Upper Backlight?   (via C35 to CL17)         (lower right edge)
  TP44  P7.pin4 Upper Backlight?   (CL16)                    (lower right edge)
  TP45                                                          (near start)
  TP46  P10.pin3 Microphone  ;\what is that? plus/minus? or left/right?
  TP47  P10.pin2 Microphone  ;/   (reportedly TP46 = enable or 3.2V supply??)
  TP48  P3.pin1 Headphone Audio Ground? (GNDed when plug inserted)
  TP49  P3.pin4 Headphone Insert Detect? (GNDed when plug inserted)
  TP50  P3.pin2 Headphone Audio Left
  TP51  P3.pin3 Headphone Audio Right
  TP52  SW1  Button POWER
  TP53  U9.pin...? accel "1st pin from top on left side" TENEO  (near select)
  TP54  U9.pin...? accel "2nd pin from top on left side" TENEO  (near select)
  TP55  SW2  Button HOME
  TP56  DL5 RGB LED green
  TP57  GNDed via 0ohm EM7                              (near headphone)
  TP58  Button WIFI
  TP59  DL1 Wifi LED orange
  TP60  P7.pin20                                        (near MCU)
  TP61  P7.pin15+16                                     (near AIC)
  TP62  P7.pin13+14                                     (near AIC)
  TP63  ?                                               (near MCU)
  TP64  P7.pin7+8                                       (near AIC)
  TP65  P7.pin9+10                                      (near AIC)
  TP66  P7.pin11                                        (near MCU)
  TP67  DL2 Power LED blue
  TP68  P11.pin4 Circle Pad Y (0.2V=Down, 1.5V=Up)
  TP69  P11.pin2 Circle Pad X (0.2V=Left, 1.5V=Right)
  TP70  DL3 Power LED red
  TP71  DL4 Wifi button LED green
  TP72      near MCU
  TP73  MCU Volume Slider (P17.pin2)
  TP74  MCU        ;\
  TP75  MCU FLMD0  ;
  TP76  MCU TOOL1  ; PCB Side B
  TP77  MCU TOOL0  ; (under green solder stop)
  TP78  MCU GND    ;
  TP79  MCU        ;/  ;<-- same as TP21
  TP80  SW4  Button Start
  TP81  SW5  Button Select
  TP82  P15.pin4 Right Shoulder Button
  TP83  P16.pin3 Left Shoulder button
  TP84   ...reportedly 1.8V, maybe hinge or pendown? right of (Nintendo) logo
  TP85  SW6  Button Up
  TP86  SW7  Button X
  TP87  SW8  Button Left
  TP88  SW10 Button Y
  TP89  SW11 Button A
  TP90  SW9  Button Right
  TP91  SW12 Button Down
  TP92  SW13 Button B
  TP93  P14.pin8  SD Card /UNLOCK   (GNDed=Unlocked)
  TP94  P14.pin10 SD Card /INSERTED (GNDed=Inserted)
  TP95  P1.pin2   NDS Slot CLK                          (near AIC)
  TP96  P14.pin14 SD.Card.pin2 Cmd  (via 57 ohm)
  TP97  P14.pin18 SD.Card.pin1 Data3
  TP98  P14.pin20 SD.Card.pin9 Data2
  TP99  P1.pin6   NDS Slot /SaveCS
  TP100 P14.pin2  SD.Card.pin8 Data1
  TP101 P14.pin4  SD.Card.pin7 Data0
  TP102 P1.pin7   NDS Slot IRQ
  TP103 P14.pin16 SD.Card.pin5 Clk
  TP104 P1.pin12  NDS Slot D3
  TP105 P1.pin13  NDS Slot D4
  TP106 P1.pin16  NDS Slot D7
  TP107 P1.pin4   NDS Slot /RomCS
  TP108 P1.pin5   NDS Slot /Reset
  TP109 P1.pin18  NDS Slot /Insert Signal
  TP110 P1.pin9   NDS Slot D0
  TP111 P1.pin10  NDS Slot D1
  TP112 P1.pin11  NDS Slot D2
  TP113 P1.pin14  NDS Slot D5
  TP114 P1.pin15  NDS Slot D6
  TP115 SPI Bus0 CLK       (wifi flash, etc)            (near aic)
  TP116 SPI Bus0 MISO                                   (near aic)
  TP117 SPI Bus0 MOSI                                   (near aic)
  TP118 ?        Device0? (powerman?)                   (near aic)
  TP119 SPI Bus0 Device1  (wifi flash)                  (near wifi)
  TP120 ?        Device2? (dsi tsc?)                    (near aic)
  TP121             ;\                                  (near aic)
  TP122             ; guess: maybe SPI Bus1             (near aic)
  TP123             ; with Device0? (3ds tsc?)          (near aic)
  TP124             ;/                                  (near aic)
  TP125                                                 (near aic)
  TP126    ... to U10 ... maybe Hinge sensor?           (near mcu)
  TP127   I2C Bus0 (?)  ;also P9.pin23                  (near aic)
  TP128   I2C Bus0 (?)  ;also P9.pin24                  (near aic)
  TP129   I2C Bus1...?  ;also P8.pin38 and P9.pin13     (near mcu)
  TP130   I2C Bus1...?  ;also P8.pin37 and P9.pin12     (near mcu)
  TP131 Upper Screen PWM (1166.7kHz, duty 2.7%-25%)     (near main cpu)
  TP132 Lower Screen PWM (1166.7kHz, duty 5.0%-54%)     (near main cpu)
  TP133                                                 (near mcu)
  TP134                                                 (near mcu)
  TP135                                                 (near mcu)
  TP136                                                 (near AIC)
  TP137      (also CL37)                                (near AIC)
  TP138                                                 (near AIC)
  TP139                                                 (near AIC)
  TP140                                                 (near AIC/wifi)
  TP141 P24.pin5 IrDA ...                               (near IrDA)
  TP142                                                 (?)
  TP143   ?                                     (near main cpu)
  TP144 I2C Bus2 SCL (390kHz)                   (near main cpu)
  TP145
  TP146 I2C Bus2 SDA (IrDA and Gyro)            (near main cpu)
  TP147                                         (near AIC)
  TP148
  TP149    ... 47.6kHz I2S word select?         (near AIC)
  TP150    ... 1.52MHz I2S clock?               (near AIC)
  TP151
  TP152    ... 16.7MHz clock                    (near AIC)
  TP153
  TP154
  TP155                                         (near main cpu)
  TP156                                         (near AIC)
  TP157                                         (near mcu)
  TP158
  TP159 P6.pin12 Upper screen video ...
  TP160 P6.pin11 Upper screen video ...
  TP161 P6.pin14 Upper screen video ...
  TP162 P6.pin15 Upper screen video ...
  TP163 P6.pin8  Upper screen video ...
  TP164 P6.pin9  Upper screen video ...
  TP165 Lower Screen R7 (red)
  TP166 Lower Screen R3 (red)
  TP167 Lower Screen G7 (green)
  TP168 Lower Screen G3 (green)
  TP169 Lower Screen B7 (blue)
  TP170 Lower Screen B3 (blue)
  TP171 Lower Screen R6 (red)
  TP172 Lower Screen R2 (red)
  TP173 Lower Screen G6 (green)
  TP174 Lower Screen G2 (green)
  TP175 Lower Screen B6 (blue)
  TP176 Lower Screen B2 (blue)
  TP177 Lower Screen R5 (red)
  TP178 Lower Screen R1 (red)
  TP179 Lower Screen G5 (green)
  TP180 Lower Screen G1 (green)
  TP181 Lower Screen B5 (blue)
  TP182 Lower Screen B1 (blue)
  TP183 Lower Screen R4 (red)
  TP184 Lower Screen R0 (red)
  TP185 Lower Screen G4 (green)
  TP186 Lower Screen G0 (green)
  TP187 Lower Screen B4 (blue)
  TP188 Lower Screen B0 (blue)
  TP189 Lower Screen Dotclk (11MHz)
  TP190 Lower Screen VSYNC (24.77kHz)
  TP191 Lower Screen HSYNC (59.8Hz)
  TP192 P9.pin34 Camera Data...?  (via RA7 to CPU/TP220) ;\
  TP193 P9.pin33 Camera Data...?  (via RA7 to CPU)       ;
  TP194 P9.pin32 Camera Data...?  (via RA7 to CPU)       ; camera side of
  TP195 P9.pin31 Camera Data...?  (via RA7 to CPU)       ; camera data bus
  TP196 P9.pin30 Camera Data...?  (via RA8 to CPU)       ;
  TP197 P9.pin29 Camera Data...?  (via RA8 to CPU)       ;
  TP198 P9.pin27 Camera Data...?  (via RA8 to CPU/TP227) ;
  TP199 P9.pin28 Camera Data...?  (via RA8 to CPU)       ;/
  TP200 P9.pin26 Camera...?
  TP201 P9.pin37 Camera...?
  TP202 P9.pin25 Camera...?
  TP203 P9.pin17 Camera...?
  TP204 P9.pin20 Camera...?
  TP205 P9.pin4  Camera Maybe Data?
  TP206 P9.pin5  Camera Maybe Data?
  TP207 P9.pin6  Camera Maybe Data?
  TP208 P9.pin7  Camera Maybe Data?
  TP209 P9.pin8  Camera Maybe Data?
  TP210 P9.pin9  Camera Maybe Data?
  TP211 P9.pin10 Camera Maybe Data?
  TP212 P9.pin11 Camera Maybe Data?
  TP213 P13.Pin1 Touchpad
  TP214 P13.Pin2 Touchpad
  TP215 P13.Pin3 Touchpad
  TP216 P13.Pin4 Touchpad
  TP217 P9.pin14 Camera...?                (near main cpu)
  TP218 P9.pin15 Camera...?                (near main cpu)
  TP219 P9.pin1  Camera...?
  TP220 Camera, via 270ohm RA7 to TP192     ;\
  TP221 N/A  ;\                             ;
  TP222 N/A  ; probably also RA7 and RA8    ; CPU side of
  TP223 N/A  ; (but have no TPs on PCB)     ; camera data bus
  TP224 N/A  ;                              ; (wired alike as on DSi)
  TP225 N/A  ;                              ;      `;note: RCLK should
  TP226 N/A  ;/                             ;       ;also have resistor?
  TP227 Camera, via 270ohm RA8 to TP198     ;/ ;note: other camera has no RA's?
  TP228                                    (near main cpu, top)
  TP229                                    (near main cpu, top)
  TP230                                    (near main cpu, top)   ;\ ?
  TP231 N/A ?                                                     ;
  TP232 N/A ?                                                     ;
  TP233 N/A ?                                                     ;
  TP234 N/A ?                                                     ;
  TP235 N/A ?                                                     ;
  TP236 N/A ?                                                     ;
  TP237                                    (near main cpu, top)   ;/
  TP238                                    (near main cpu, top)
  TP239   ?                                (near main cpu, low/right)
  TP240   ?                                (near home button)
  TP241 TH1 (battery temperature sensor) (off/normal 9Kohm to GND) (8K=warmer)
  TP242 P5.pin43 Wifi CLK32k                                    (near mcu)
  TP243 RESET (for wifi, and maybe others)                      (near wifi)
  TP244 P8.pin39 Lower screen...                                (near P8)
  TP245                   ;\?    ;-PCB Side B (underneath NDS slot, near wifi)
  TP246                   ;/                                    (near wifi)
  TP247 P5.pin9  Wifi CCA                                       (near wifi)
  TP248 P5.pin15 Wifi TRRDY                                     (near wifi)
  TP249 eMMC DAT0       ;\
  TP250 eMMC DAT1       ; PCB Side B
  TP251 eMMC DAT2       ; (eMMC CLK has no known TP)
  TP252 eMMC DAT3       ;
  TP253 eMMC CMD        ;/
  TP254    ?                                            (near circle pad)
  TP255    ?                        (near main cpu, near eMMC CLK signal)
  TP256 DL5 RGB LED blue                            ? pcb top-right
  TP257 DL5 RGB LED red                             ? pcb top-right
  TP258    ? near select button
  TP259    ? pcb top-right    ... maybe charger related?
Yet unknown TPs details are...
  I2C Bus0, I2C Bus1
  SPI Bus0, SPI Bus1 (and unused SPI Bus2, if it has any TPs)
  Upper video, Upper backlight, Parallax barrier
  All three Cameras, Camera LED, 3D Slider, 3D LED
  Speakers, Wifi, Hinge, Pendown, IRQs
  Debug/jtag (if any)

Testpoints for 3DS XL and 2DS
3DS XL and 2DS have some extra test points at TP260 and up (unknown if
TP1-TP259 are same as on 3DS, at least some seem to be same or similar).
  TP260 eMMC CLK        ;exists on both 2DS and 3DS XL (has no TP on 3DS)
  TP261 ?
  TP262 ?               ;spotted on 2DS (near power button)
  TP263 ?               ;spotted on 2DS (near power button)
  TP264 ?               ;spotted on 2DS (near power button)

Testpoints for New 3DS, New 3DS XL, and New 2DS
New 3DS and New 3DS XL (and probably New 2DS) have testpoints, but without text
layer (so they could be used/described only via photos or drawings).

CL Cut-Links for Old 3DS (Mainboard "C/CTR-CPU-01")
  CL1                           (near AIC, low/right)
  CL2                           (near MCU, up/right)
  CL3                           (near cpu, up, underneath nds-slot))
  CL4
  CL5  TP2                                        (near powerman, right)
  CL6  TP1 GND                                    (near powerman, right)
  CL7                                             (near MCU, low/right)
  CL8  TP41 Lower Backlight                       (near powerman, up/right)
  CL9  TP3                                        (near powerman, left)
  CL10 TP3                                        (near powerman, left)
  CL11 TP6                                        (near powerman, left)
  CL12 TP13                                       (near powerman, up/left)
  CL13 TP16                                       (near powerman, up/left)
  CL14 TP28                                       (near powerman, up/left)
  CL15 TP32                                       (near powerman, up/left)
  CL16 TP44 Upper Backlight?                      (near powerman, low/right)
  CL17 via C35 to TP43 Upper Backlight?           (near powerman, low/right)
  CL18                                            (near U8)
  CL19 GNDed (TP25?)                              (near powerman, low)
  CL20                          (near AIC, low)
  CL21                          (near AIC, up)
  CL22                          (near AIC, up)
  CL23                          (near AIC, up)
  CL24                          (near AIC, up)
  CL25                          (near AIC, up)
  CL26                          (near AIC, up)
  CL27                          (near AIC, up)
  CL28                          (near AIC, up)
  CL29                          (near AIC, up)
  CL30                          (near nds-slot)
  CL31                          (near nds-slot)
  CL32                          (near nds-slot)
  CL33                          (near AIC, up/left)
  CL34                          (near nds-slot)
  CL35                          (near nds-slot)
  CL36                          (near nds-slot)
  CL37 TP137                    (near nds-slot)
  CL38                          (near AIC, up/right)
  CL39                          (near AIC, low/right)
  CL40                          (near AIC, left)
  CL41
  CL42                          (near nds-slot)
  CL43                          (near AIC, up)
  CL44                          (near AIC, low/right)
  CL45                          (near AIC, low/right)
  CL46                          (near MCU, up/right)
  CL47                          (near MCU, left)
  CL48                          (near MCU, left)
  CL49                          (near cpu, right, underneath nds-slot))
  CL50                          (near cpu, low/right, underneath nds-slot))
  CL51                          (near U12, underneath nds-slot)
  CL52                          (near cpu, right, underneath nds-slot))
  CL53                          (near cpu, low/right, underneath nds-slot))
  CL54                          (near cpu, low/right, underneath nds-slot))
  CL55                          (near cpu, up, underneath nds-slot))
  CL56                          (near gyro)
Resistor Arrays
  RA1      4x 180ohm  4bit SD Slot Databus (pass-thru)
  RA2      4x 100ohm  4bit eMMC Databus (pass-thru)
  RA3      4x 56Kohm? 4bit SD Slot Databus (pull-up)
  RA5      4x 57Kohm? 4bit eMMC Databus (pull-up)
  RA7,RA8  8x 270ohm  8bit Camera Databus
  RA11     4x 56Kohm? ??? whatever (4x pull-DOWN)
  EM23     4x 0ohm?    (near P13 touchpad)
  EM24     4x 0ohm?    (near cpu, underneath nds-slot)

See also
  http://www.3dbrew.org/wiki/Hardware
  http://www.3dbrew.org/wiki/TP_Nets
  http://www.3dbrew.org/wiki/Pinouts
  http://www.3dbrew.org/wiki/Video_Capture
And connectors...

Code: Select all

3DS Connector Pinouts
---------------------

Connectors in Old 3DS with Mainboard "C/CTR-CPU-01"...

P1 - 19pin - NDS/DSi cartridge slot (17pin slot + 2pin switch at right side)
  1  GND   NDS Slot GND
  2  TP95  NDS Slot CLK
  3        NDS Slot ?
  4  TP107 NDS Slot /RomCS
  5  TP108 NDS Slot /Reset
  6  TP99  NDS Slot /SaveCS
  7  TP102 NDS Slot IRQ
  8        NDS Slot 3.3V
  9  TP110 NDS Slot D0
  10 TP111 NDS Slot D1
  11 TP112 NDS Slot D2
  12 TP104 NDS Slot D3
  13 TP105 NDS Slot D4
  14 TP113 NDS Slot D5
  15 TP114 NDS Slot D6
  16 TP106 NDS Slot D7
  17 GND   NDS Slot GND
  18 TP109 NDS Slot /Insert Signal
  19 GND   NDS Slot /Insert GND

P2 - 6pin - External Power Supply input (4.6V DC IN) (with sticky glue!)
  1  TP4 4.6VIN (Power pin +)
  2  TP1 GND    (Power pin -)
  3  TP1 GND    (Shield)
  4  TP1 GND    (Shield)
  5  TP4 4.6VIN (goldplate)
  6  TP1 GND    (goldplate)
Note: This connector has pretty bad solder pads (breaks off easily).

P3 - 5pin - Headphone (stereo, plus switch)
  1  TP48 Headphone Audio Ground?  (GNDed when plug inserted)
  2  TP50 Headphone Audio Left     (tip)
  3  TP51 Headphone Audio Right    (ring)
  4  TP49 Headphone Insert Detect? (GNDed when plug inserted)
  5  GND

P4 - 3pin - Battery
  plus   TP22 P4.plus Battery +
  center TP23 P4.center (testpoint near MCU)
  minus  GND

P5 - 50pin - Wifi daughterboard (DWM-W028)
https://fccid.io/EW4DWMW028/Label/ID-label-location-1272988.pdf
  1        MCLK         2        RF_CSRF
  3  GND   GND          4        BB_CSBB
  5        RXPE         6        BB_RF_SDIN
  7        TXPE         8        BB_RF_SDOUT
  9  TP247 CCA          10       BB_RF_SCK
  11       TRDATA       12 GND   GND
  13       TRCLK        14       BBP_SLEEP_L
  15 TP248 TRRDY        16       RF_SLEEP_L
  17       TRST_L       18       SEL_ATH_L
  19 GND   GND          20 GND   GND
  21       SDIO_DATA_0  22       JTAG_TDO
  23       SDIO_DATA_1  24       JTAG_TMS
  25       SDIO_DATA_2  26       JTAG_TDI
  27       SDIO_DATA_3  28       JTAG_TCK
  29 GND   GND          30 TP119 SPI_CS2 (SPI_BUS0_DEVICE1)
  31       SDIO_CLK     32       W_B
  33 GND   GND          34 TP115 SPI_CLK (SPI_BUS0_CLK)
  35       SDIO_CMD     36 TP116 SPI_DO  (SPI_BUS0_MISO)
  37       UART_TXD     38 TP117 SPI_DI  (SPI_BUS0_MOSI)
  39       UART_RXD     40       SYS_RST_L
  41 GND   GND          42       ATH_TX_H
  43 TP242 CLK32k       44 TP243 RESET
  45 GND   GND          46 GND   GND
  47 TP5   VDD_18       48 TP3   VDD_33
  49 TP5   VDD_18       50 TP3   VDD_33
Functionally same as DSi, but not pin-compatible, and with two UART pins
(instead of the NC pins).

P6 - 29pin - Upper Screen Video? (connector P6 is on PCB side A)
  1                     2  GND
  3  TP24               4  GND
  5  TP5   Supply 1.8V  6  TP5   Supply 1.8V
  7  GND                8  TP163
  9  TP164              10 GND
  11 TP160              12 TP159
  13 GND                14 TP161
  15 TP162              16 GND
  17                    18
  19 GND                20 TP5   Supply 1.8V
  21                    22 TP35
  23 GND                24 TP130 I2C Bus1...?
  25 TP129 I2C Bus1...? 26
  27 GND                28 TP36
  29 TP40

P7 - 21pin - Upper Backlight/Parallax?, Speakers, 3D LED/Slider, Camera LED
  1  GND                2       thick wire
  3  TP43 thick wire    4  TP44 thick wire    ;TP43/TP44 = upper backlight?
  5  TP31               6  TP30
  7  TP64               8  TP64 thick wire    ;\speaker?
  9  TP65               10 TP65 thick wire    ;/
  11 TP66               12
  13 TP62               14 TP62               ;\speaker?
  15 TP61               16 TP61               ;/
  17 TP5  Supply 1.8V   18
  19                    20 TP60
  21 GND

P8 - 43pin - Lower Screen: Video
  1  TP186 G0 (green)   2  TP180 G1 (green)
  3  TP174 G2 (green)   4  TP168 G3 (green)
  5  TP185 G4 (green)   6  TP179 G5 (green)
  7  TP173 G6 (green)   8  TP167 G7 (green)
  9  GND                10 TP188 B0 (blue)
  11 TP182 B1 (blue)    12 TP176 B2 (blue)
  13 TP170 B3 (blue)    14 TP187 B4 (blue)
  15 TP181 B5 (blue)    16 TP175 B6 (blue)
  17 TP169 B7 (blue)    18 GND
  19 TP165 R7 (red)     20 TP171 R6 (red)
  21 TP177 R5 (red)     22 TP183 R4 (red)
  23 TP166 R3 (red)     24 TP172 R2 (red)
  25 TP178 R1 (red)     26 TP184 R0 (red)
  27 GND                28
  29 TP32 (and C188)    30 GND
  31   via R76 to GND   32
  33 TP37               34 GND
  35 TP189 Dotclk 11MHz 36 GND
  37 TP130 I2C Bus1...? 38 TP129 I2C Bus1...?
  39 TP244              40 TP190 VSYNC 24.77kHz
  41 TP191 HSYNC 59.8Hz 42 TP36
  43 TP40
CAUTION: Below is NONSENSE (for example, pin9 is clearly GND)
  http://www.3dbrew.org/wiki/Pinouts - with REVERSED pin numbers & bogus...
  OK BAD
  43 1     Supply -6V
  42 2     Supply 12V
  41 3     Pixel Clock                                  (uh?)
  40 4     /HBL, Horizontal blank (low while blanking)  (uh??)
  39 5     /VBL, Vertical blank (low while blanking)    (uh???)
  38 6     2v2, Loopback of pin 07?                     (uh????)
  37 7     2v2, Content latch? screen memory??          (uh?????)
  36 8     GND
  35 9     HCL Horizontal clock                         (uh?)
  34 10    GND
  33 11    Contrast BIAS (usually 4.5V..4.8V)
  32 12    Flicker BIAS (usually voltage same as above)
  31 13    ??? Might be a transistor? Shorted if off???
  30 14    Supply +6V                                   (uh????)
  29 15    ??? Loopback of pin 14 ? harsh pop sound.    (uh?????)
  28 16    ??? ???
  27 17    ??? ???                                      (uh??????)
  .. 18-25 RED 0..7 Red pixel bits
  18 26    GND
  .. 27-34 BLUE 7..0 Blue pixel bits
  9  35    GND
  .. 36-43 GREEN 7..0 Green pixel bits

P9 - 37pin - Cameras (in upper screen unit)
  1  TP219              2  GND
  3  GND                4  TP205 Maybe Data?    ;\
  5  TP206 Maybe Data?  6  TP207 Maybe Data?    ; extra 3DS camera
  7  TP208 Maybe Data?  8  TP209 Maybe Data?    ;
  9  TP210 Maybe Data?  10 TP211 Maybe Data?    ;
  11 TP212 Maybe Data?  12 TP130 I2C Bus1...?   ;/
  13 TP129 I2C Bus1...? 14 TP217
  15 TP218              16 GND
  17 TP203              18 GND
  19                    20 TP204
  21 TP5   Supply 1.8V  22 TP6   Supply 2.8V
  23 TP127 I2C Bus0 (?) 24 TP128 I2C Bus0 (?)   ;\
  25 TP202              26 TP200                ;
  27 TP198 Data...?     28 TP199 Data...?       ; DSi cameras
  29 TP197 Data...?     30 TP196 Data...?       ;
  31 TP195 Data...?     32 TP194 Data...?       ;
  33 TP193 Data...?     34 TP192 Data...?       ;/
  35 GND                36 GND
  37 TP201
This should include CAM_D0-D7, CAM_RST, RCLK, CKI, HSYNC, VSYNC, SCL, SDA for
DSi cameras (and most or all of those also for the extra 3DS camera).

P10 - 4pin - Microphone
  1 GND
  2 TP47   ;\what is that? plus/minus? or left/right?
  3 TP46   ;/
  4 GND

P11 - 4pin - Circle Pad (analog joystick)
  1  GND
  2  TP69 Circle Pad X (0.2V=Left, 1.5V=Right)
  3  TP5  Supply 1.8V
  4  TP68 Circle Pad Y (0.2V=Down, 1.5V=Up)

P12 - 4pin - Lower Screen: Backlight
  1  TP42  ;\
  2  TP42  ;/
  3  TP41  ;\
  4  TP41  ;/

P13 - 4pin - Lower Screen: Tochpad
  1  TP213 Touchpad
  2  TP214 Touchpad
  3  TP215 Touchpad
  4  TP216 Touchpad

P14 - 20pin - SD Card Slot
  1  GND            2  TP100 Data1
  3  GND            4  TP101 Data0
  5  GND            6  GND
  7  GND            8  TP93 /Unlock
  9  GND            10 TP94 /Inserted
  11 GND            12 GND
  13 GND            14 TP96  Cmd
  15 GND            16 TP103 Clk
  17 TP13 VDD       18 TP97  Data3
  19 TP13 VDD       20 TP98  Data2

P15 - 8pin - Right Shoulder button
  1  GND            2  GND
  3  GND            4  TP82 Button R
  5  GND            6  GND
  7  GND            8  GND

P16 - 8pin - Left Shoulder button
  1  GND            2  GND
  3  TP83 Button L  4  GND
  5  GND            6  GND
  7  GND            8  GND

P17 - 3pin - Volume Slider  (on PCB side A)
  1  TP5  Supply 1.8V         (red wire)
  2  TP73 MCU Volume Slider   (white wire)
  3  GND                      (black wire)

P18 - 1pin ;\shield for eMMC
P19 - 1pin ;/
P20 - 1pin ;\shield for MCU
P21 - 1pin ;/
GNDed clips for holding shielding plates.

P22 - N/A
P23 - N/A
None such.

P24 - 12pin - IR daughterboard (I2C Device 2:9Ah)
  1  TP146 I2C Bus2 SDA   2  TP144 I2C Bus2 SCL
  3  GND                  4  GND
  5  TP141                6
  7  GND                  8  GND
  9  GND                  10
  11 TP3 Supply 2.8V      12 TP3 Supply 2.8V       ;<-- or both rather 3.3V ?
The unknown pins may include /RESET and /IRQ?

P25 - 1pin ;--? antenna cable holder or so?
GNDed clip for holding antenna cable or so?
The weird lower backlight specs on Pinouts page turned out to be numbered backwards - the first/last two pins are marked "1,2" and "42,43" on the PCB, apparently that has led somebody to the conclusion that Pin 1 is the one with marking "43" - I don't know how that could happen. With the reversed numbering, 24bit RGB pins seem to be correct (going by the Video Capture page), but the control/supply pins seem to be bogus (GND is rated as 6V, and what seems to be I2C is marked "lock memory loopback" or so).
KayBur wrote:
Wed Mar 31, 2021 5:01 am
Did you manage to find the pattern of work of the board? The process of optimizing the operation of old equipment for modern systems is very interesting.
Yee, it's all haywire, but it's exactly as you said.
homepage - patreon - you can think of a bit as a bottle that is either half full or half empty

KayBur
Posts: 12
Joined: Mon Mar 29, 2021 6:47 am

Re: 3DS reverse engineering

Post by KayBur » Thu Apr 01, 2021 7:04 am

nocash wrote:
Wed Mar 31, 2021 7:13 pm
KayBur wrote:
Wed Mar 31, 2021 5:01 am
Did you manage to find the pattern of work of the board? The process of optimizing the operation of old equipment for modern systems is very interesting.
Yee, it's all haywire, but it's exactly as you said.
Why is it not normal? Out of the box - that's for sure. But there is nothing abnormal in such experiments on the old technique.

nocash
Posts: 1341
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: 3DS reverse engineering

Post by nocash » Thu Apr 01, 2021 11:39 am

I usually keep the pattern in the box. I've also tried a bag, but there was a problem with mould.
homepage - patreon - you can think of a bit as a bottle that is either half full or half empty

nocash
Posts: 1341
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: 3DS reverse engineering

Post by nocash » Sat Apr 03, 2021 5:43 am

The Connector Pinouts are all complete now!
Except, one pin on Upper Video connector: I haven't found a testpoint (or other signal) that connects to P6.pin26.
The wifi pins are documented in the FCCID doc, but most of them seem to have no testpoints on the mainboard (but some do, and there might be few more that I haven't found yet).

Code: Select all

3DS Connector Pinouts
---------------------

Connectors in Old 3DS with Mainboard "C/CTR-CPU-01"...

P1 - 19pin - NDS/DSi cartridge slot (17pin slot + 2pin switch at right side)
  1  GND   NDS Slot GND
  2  TP95  NDS Slot CLK
  3  NC?   NDS Slot ?
  4  TP107 NDS Slot /RomCS
  5  TP108 NDS Slot /Reset
  6  TP99  NDS Slot /SaveCS
  7  TP102 NDS Slot IRQ
  8  TP16  NDS Slot 3.3V
  9  TP110 NDS Slot D0
  10 TP111 NDS Slot D1
  11 TP112 NDS Slot D2
  12 TP104 NDS Slot D3
  13 TP105 NDS Slot D4
  14 TP113 NDS Slot D5
  15 TP114 NDS Slot D6
  16 TP106 NDS Slot D7
  17 GND   NDS Slot GND
  18 TP109 NDS Slot /Insert Signal
  19 GND   NDS Slot /Insert GND

P2 - 6pin - External Power Supply input (4.6V DC IN) (with sticky glue!)
  1  TP4   4.6VIN (Power pin +)
  2  TP1   GND    (Power pin -)
  3  TP1   GND    (Shield)
  4  TP1   GND    (Shield)
  5  TP4   4.6VIN (goldplate +)    ;\alternate contacts (requires constanr
  6  TP1   GND    (goldplate -)    ;/presssure, maybe for expansion hardware)
Note: This surface mounted connector breaks off easily, but it can be soldered
back in without problems (the 2DS uses a better connector with thru-holes; and
without goldplates).

P3 - 5pin - Headphone (stereo, plus switch)
  1  TP48   Headphone Audio Ground?  (GNDed when plug inserted)
  2  TP50   Headphone Audio Left     (tip)
  3  TP51   Headphone Audio Right    (ring)
  4  TP49   Headphone Insert Detect? (GNDed when plug inserted)
  5  GND
Note: Unlike NDS/DSi, the 3DS has no connector for external microphone.

P4 - 3pin - Battery
  +  TP22  Battery +
  x  TP23  Battery type/detect/alert?
  -  GND   Battery -

P5 - 50pin - Wifi daughterboard (DWM-W028) (and probably same for J27H023.01)
https://fccid.io/EW4DWMW028/Label/ID-label-location-1272988.pdf
  1        MCLK         2        RF_CSRF
  3  GND   GND          4        BB_CSBB
  5        RXPE         6        BB_RF_SDIN
  7        TXPE         8        BB_RF_SDOUT
  9  TP247 CCA          10       BB_RF_SCK
  11       TRDATA       12 GND   GND
  13       TRCLK        14       BBP_SLEEP_L
  15 TP248 TRRDY        16       RF_SLEEP_L
  17       TRST_L       18       SEL_ATH_L
  19 GND   GND          20 GND   GND
  21       SDIO_DATA_0  22       JTAG_TDO
  23       SDIO_DATA_1  24       JTAG_TMS
  25       SDIO_DATA_2  26       JTAG_TDI
  27       SDIO_DATA_3  28       JTAG_TCK
  29 GND   GND          30 TP119 SPI_CS2 (SPI FLASH /CS)
  31       SDIO_CLK     32       W_B     (SPI FLASH /WP)
  33 GND   GND          34 TP115 SPI_CLK (SPI Bus0 CLK)
  35       SDIO_CMD     36 TP116 SPI_DO  (SPI Bus0 MISO)
  37       UART_TXD     38 TP117 SPI_DI  (SPI Bus0 MOSI)
  39       UART_RXD     40       SYS_RST_L
  41 GND   GND          42       ATH_TX_H
  43 TP242 CLK32k       44 TP243 RESET
  45 GND   GND          46 GND   GND
  47 TP5   VDD_18       48 TP3   VDD_33
  49 TP5   VDD_18       50 TP3   VDD_33
Functionally same as DSi, but not pin-compatible, and with two UART pins
(instead of the NC pins).

P6 - 29pin - Upper Screen Video (connector P6 is on PCB side A)
  1  TP32  Supply...?   2  GND
  3  TP24               4  GND
  5  TP5   Supply 1.8V  6  TP5   Supply 1.8V
  7  GND                8  TP163 Video...
  9  TP164 Video...     10 GND
  11 TP160 Video...     12 TP159 Video...
  13 GND                14 TP161 Video...
  15 TP162 Video...     16 GND
  17 TP32  Supply...?   18 TP32  Supply...?
  19 GND                20 TP5   Supply 1.8V
  21 TP24  ...          22 TP35  ...
  23 GND                24 TP130 I2C Bus1...?
  25 TP129 I2C Bus1...? 26 ?                  ;pin26 = what ????????
  27 GND                28 TP36  Supply...?
  29 TP40  Supply...?

P7 - 21pin - Upper Backlight/Parallax?, Speakers, 3D LED/Slider, Camera LED
  1  GND                2  TP44                ;\upper backlight?    ;\or
  3  TP43               4  TP45                ;/with THREE pins???  ; vice
  5  TP31               6  TP30                ;-parallax ?          ;/versa?
  7  TP64  Speaker L... 8  TP64  Speaker L...  ;\left speaker
  9  TP65  Speaker L... 10 TP65  Speaker L...  ;/
  11 TP66               12 TP28  Supply?       ;-Camera LED ?
  13 TP62  Speaker R... 14 TP62  Speaker R...  ;\right speaker
  15 TP61  Speaker R... 16 TP61  Speaker R...  ;/
  17 TP5   Supply 1.8V  18 TP72  3D ..slider?  ;-3D LED?      ;\or vice-versa?
  19 TP28  Supply?      20 TP60  3D ..LED?     ;-3D Slider?   ;/or mixed?
  21 GND

P8 - 43pin - Lower Screen: Video
  1  TP186 G0 (green)   2  TP180 G1 (green)
  3  TP174 G2 (green)   4  TP168 G3 (green)
  5  TP185 G4 (green)   6  TP179 G5 (green)
  7  TP173 G6 (green)   8  TP167 G7 (green)
  9  GND                10 TP188 B0 (blue)
  11 TP182 B1 (blue)    12 TP176 B2 (blue)
  13 TP170 B3 (blue)    14 TP187 B4 (blue)
  15 TP181 B5 (blue)    16 TP175 B6 (blue)
  17 TP169 B7 (blue)    18 GND
  19 TP165 R7 (red)     20 TP171 R6 (red)
  21 TP177 R5 (red)     22 TP183 R4 (red)
  23 TP166 R3 (red)     24 TP172 R2 (red)
  25 TP178 R1 (red)     26 TP184 R0 (red)
  27 GND                28 TP5   Supply
  29 TP32  Supply...?   30 GND
  31 TP5   Supply       32 TP26
  33 TP37               34 GND
  35 TP189 Dotclk 11MHz 36 GND
  37 TP130 I2C Bus1...? 38 TP129 I2C Bus1...?
  39 TP244              40 TP190 VSYNC 24.77kHz
  41 TP191 HSYNC 59.8Hz 42 TP36  Supply...?
  43 TP40  Supply...?
CAUTION: Below is NONSENSE (for example, pin9 is clearly GND)
  http://www.3dbrew.org/wiki/Pinouts - with REVERSED pin numbers & bogus...
  OK BAD
  43 1     Supply -6V                                              ;-supply?
  42 2     Supply 12V                                              ;-supply?
  41 3     Pixel Clock                                  (uh?)      ;-HSYNC
  40 4     /HBL, Horizontal blank (low while blanking)  (uh??)     ;-VSYNC
  39 5     /VBL, Vertical blank (low while blanking)    (uh???)    ;-maybe DEN?
  38 6     2v2, Loopback of pin 07?                     (uh????)   ;-I2C
  37 7     2v2, Content latch? screen memory??          (uh?????)  ;-I2C
  36 8     GND                                                     ;-GND
  35 9     HCL Horizontal clock                         (uh?)      ;-Dotclk
  34 10    GND                                                     ;-GND
  33 11    Contrast BIAS (usually 4.5V..4.8V)                      ;- ?
  32 12    Flicker BIAS (usually voltage same as above)            ;- ?
  31 13    ??? Might be a transistor? Shorted if off??? (whut?)    ;-supply
  30 14    Supply +6V                                   (uh????)   ;-GND
  29 15    ??? Loopback of pin 14 ? harsh pop sound.    (uh?????)  ;-supply?
  28 16    ??? ???                                                 ;-supply
  27 17    ??? ???                                      (uh??????) ;-GND
  .. 18-25 RED 0..7 Red pixel bits
  18 26    GND
  .. 27-34 BLUE 7..0 Blue pixel bits
  9  35    GND
  .. 36-43 GREEN 7..0 Green pixel bits

P9 - 37pin - Cameras (in upper screen unit)
  1  TP219              2  GND                  ;\
  3  GND                4  TP205 Maybe Data?    ;
  5  TP206 Maybe Data?  6  TP207 Maybe Data?    ; extra 3DS camera ?
  7  TP208 Maybe Data?  8  TP209 Maybe Data?    ; (13 signals)
  9  TP210 Maybe Data?  10 TP211 Maybe Data?    ;
  11 TP212 Maybe Data?  12 TP130 I2C Bus1...?   ;
  13 TP129 I2C Bus1...? 14 TP217                ;
  15 TP218              16 GND                  ;/
  17 TP203              18 GND                  ;\maybe both cameras?
  19 GND                20 TP204                ; (2 signals and supply)
  21 TP5   Supply 1.8V  22 TP6   Supply 2.8V    ;/
  23 TP127 I2C Bus0 (?) 24 TP128 I2C Bus0 (?)   ;\
  25 TP202              26 TP200                ;
  27 TP198 Data...?     28 TP199 Data...?       ; DSi cameras ?
  29 TP197 Data...?     30 TP196 Data...?       ; (13 signals)
  31 TP195 Data...?     32 TP194 Data...?       ;
  33 TP193 Data...?     34 TP192 Data...?       ;
  35 GND                36 GND                  ;
  37 TP201                                      ;/
This should include CAM_D0-D7, CAM_RST, RCLK, CKI, HSYNC, VSYNC, SCL, SDA for
DSi cameras (and most or all of those also for the extra 3DS camera) (maybe RST
and/or RCLK and/or CKI are shared).

P10 - 4pin - Microphone
  1  GND
  2  TP47  ;\what is that? plus/minus? or left/right?
  3  TP46  ;/
  4  GND

P11 - 4pin - Circle Pad (analog joystick)
  1  GND
  2  TP69 Circle Pad X (0.2V=Left, 1.5V=Right)
  3  TP5  Supply 1.8V
  4  TP68 Circle Pad Y (0.2V=Down, 1.5V=Up)

P12 - 4pin - Lower Screen: Backlight
  1  TP42  ;\
  2  TP42  ;/
  3  TP41  ;\
  4  TP41  ;/

P13 - 4pin - Lower Screen: Touchpad
  1  TP213 Touchpad
  2  TP214 Touchpad
  3  TP215 Touchpad
  4  TP216 Touchpad

P14 - 20pin - SD Card Slot
  1  GND            2  TP100 Data1
  3  GND            4  TP101 Data0
  5  GND            6  GND
  7  GND            8  TP93  /Unlock
  9  GND            10 TP94  /Inserted
  11 GND            12 GND
  13 GND            14 TP96  Cmd
  15 GND            16 TP103 Clk
  17 TP13 VDD       18 TP97  Data3
  19 TP13 VDD       20 TP98  Data2

P15 - 8pin - Right Shoulder button
  1  GND            2  GND
  3  GND            4  TP82 Button R
  5  GND            6  GND
  7  GND            8  GND

P16 - 8pin - Left Shoulder button
  1  GND            2  GND
  3  TP83 Button L  4  GND
  5  GND            6  GND
  7  GND            8  GND

P17 - 3pin - Volume Slider  (on PCB side A)
  1  TP5  Supply 1.8V         (red wire)
  2  TP73 MCU Volume Slider   (white wire)
  3  GND                      (black wire)

P18 - 1pin ;\shield for eMMC
P19 - 1pin ;/
P20 - 1pin ;\shield for MCU
P21 - 1pin ;/
GNDed clips for holding shielding plates.

P22 - N/A
P23 - N/A
None such.

P24 - 12pin - IR daughterboard (I2C Device 2:9Ah)
  1  TP146 I2C Bus2 SDA   2  TP144 I2C Bus2 SCL
  3  GND                  4  GND
  5  TP141 IrDA TX-RC     6  TP239 IrDA /IRQ
  7  GND                  8  GND
  9  GND                  10 TP255 IrDA RXD (IR.led.pin4 and IR.chip.pin24)
  11 TP3 Supply 2.8V      12 TP3 Supply 2.8V       ;<-- or both rather 3.3V ?
TX-RC (Remote Control Transmit) is for sending pulses manually, with higher
signal strength. RXD can be used for manual polling. Anyways, normally bytes
are transferred via I2C and automatically passed from/to transceiver.

P25 - 1pin ;--? antenna cable holder or so?
GNDed clip for holding antenna cable or so?
With the software-side already being quite well rev-engineered and with hardware-side being more or less same as on DSi, I didn't expect any surprise findings. Bt the IrDA daughterboard did hold a couple of surprises:

- it does have it's own crystal (on PCB back side, with unknown frequency)
- receive PWDOWN is wired to UART GPIO0, ie. controlled via bit0 of I2C registers IR[58h] and IR[50h]
- receive RXD can be polled manually, probably via ARM GPIO registers
- transmit TX-RC can be switched manually, probably via ARM GPIO registers

The two manual IR signals seem to have been mentioned on 3dbrew, but it wasn't quite clear what it meant. The IR board can be used in two ways: UART-style transfers via I2C bus, and manual signal pulse transfers. The latter would be useful for remote control pulses that don't have UART-style start/stop/data bits. Accordingly (going by RPM841-H16 datasheet), remote control "TX-RC" seems to have higher signal strength than the short range IrDA "TXD" signal.
homepage - patreon - you can think of a bit as a bottle that is either half full or half empty

Post Reply