{"action":"created","issue":{"url":"https://api.github.com/repos/dekuNukem/Nintendo_Switch_Reverse_Engineering/issues/41","repository_url":"https://api.github.com/repos/dekuNukem/Nintendo_Switch_Reverse_Engineering","labels_url":"https://api.github.com/repos/dekuNukem/Nintendo_Switch_Reverse_Engineering/issues/41/labels{/name}","comments_url":"https://api.github.com/repos/dekuNukem/Nintendo_Switch_Reverse_Engineering/issues/41/comments","events_url":"https://api.github.com/repos/dekuNukem/Nintendo_Switch_Reverse_Engineering/issues/41/events","html_url":"https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering/issues/41","id":260950939,"number":41,"title":"Firmware analysis (ROM + Patch RAM) + RAM","user":{"login":"CTCaer","id":3665130,"avatar_url":"https://avatars1.githubusercontent.com/u/3665130?v=4","gravatar_id":"","url":"https://api.github.com/users/CTCaer","html_url":"https://github.com/CTCaer","followers_url":"https://api.github.com/users/CTCaer/followers","following_url":"https://api.github.com/users/CTCaer/following{/other_user}","gists_url":"https://api.github.com/users/CTCaer/gists{/gist_id}","starred_url":"https://api.github.com/users/CTCaer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CTCaer/subscriptions","organizations_url":"https://api.github.com/users/CTCaer/orgs","repos_url":"https://api.github.com/users/CTCaer/repos","events_url":"https://api.github.com/users/CTCaer/events{/privacy}","received_events_url":"https://api.github.com/users/CTCaer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-09-27T12:12:05Z","updated_at":"2017-09-29T02:20:58Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"@shuffle2\r\nSo I found time to play with the OTA FW commands on the Joy-Con.\r\n\r\nIt seems that RAM is partitioned to 2 regions: `0x0D0000-0x0DFFFF` and `0x200000-0x247FFF` which match the 353KB RAM of Bcm20734.\r\n\r\nI did 2 consecutive ram dumps with controller reboot in-between. I also added some extra that may help you.\r\n\r\nYou can find them [here](https://mega.nz/#!AB8AWZ5I!PyVnClKfb83hqbSIF1GEWdGtgJEJhBBNnw0t-TLIoTw).\r\n\r\n--------\r\n\r\nAlso, I have difficulties loading the rom vanilla style or with your script in IDA.\r\nAddresses and other stuff do not match in the disassembly..\r\n\r\nAs I understand, 1st uint32LE (0x200400) is stack pointer and 2nd (0x201 THUMB) is reset vector.\r\nSo I used many combinations in rom address offset and loading addres with 0x200 (because thumb), 0x0 and 0x4 (offset to remove the 1st uint32) but nothing solid.\r\n\r\nI also tried your script and then loaded additional binary (rom) with various loading offset and file offset but I could not find anything familiar in the .c file produced.\r\n\r\nCan you help me on what to input on the various fields in IDA (\"Disassembly memory organization\", \"Load additional binary file\")?\r\n\r\nI will also try to load the ram dumps to fill the RAM voids. BTW, If I do this, it will override the patched addresses?"},"comment":{"url":"https://api.github.com/repos/dekuNukem/Nintendo_Switch_Reverse_Engineering/issues/comments/333013519","html_url":"https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering/issues/41#issuecomment-333013519","issue_url":"https://api.github.com/repos/dekuNukem/Nintendo_Switch_Reverse_Engineering/issues/41","id":333013519,"user":{"login":"CTCaer","id":3665130,"avatar_url":"https://avatars1.githubusercontent.com/u/3665130?v=4","gravatar_id":"","url":"https://api.github.com/users/CTCaer","html_url":"https://github.com/CTCaer","followers_url":"https://api.github.com/users/CTCaer/followers","following_url":"https://api.github.com/users/CTCaer/following{/other_user}","gists_url":"https://api.github.com/users/CTCaer/gists{/gist_id}","starred_url":"https://api.github.com/users/CTCaer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CTCaer/subscriptions","organizations_url":"https://api.github.com/users/CTCaer/orgs","repos_url":"https://api.github.com/users/CTCaer/repos","events_url":"https://api.github.com/users/CTCaer/events{/privacy}","received_events_url":"https://api.github.com/users/CTCaer/received_events","type":"User","site_admin":false},"created_at":"2017-09-29T02:20:58Z","updated_at":"2017-09-29T02:20:58Z","author_association":"CONTRIBUTOR","body":"@shuffle2 \r\n[Here](https://mega.nz/#!oQESWIrD!yun8sdLamyjZRJFYD9NV5V9kJcGCQFQEfYzn-7FkCX8) are some more dumps from the right joy-con. It includes RAM and some memory regions I found in the code (0x260000, 0x310000-0x360000,0x600000, 0x640000, 0x650000, 0xE0001000-0xE0042000).\r\n\r\nSome are missing. Either the device hangs on read or they are zeroed.\r\n\r\nIf you missed the previous files (JC L ram and ram patches):\r\nHere's the [MEGA folder](https://mega.nz/#F!AYNTwLTZ!RcatsfDxdmmVp2OfubOhOA).\r\n"}}
{"actor":{"display_login":"CTCaer"}}