PassMe Nintendo DS Mod Chip
 PassMe is a device designed by Natrium42 based off of the first DS passthrough made by DarkFader using an FPGA dev kit. It redirects the DS to a GBA Flash cart, so you can run your own program (roms) on the Nintendo DS. For PassMe to work it requires the use of a commercial NDS cart (for authentication) and a GBA Flash cart to hold your DS programs.
PassMe gives you the ability to test your programs on the DS hardware, not just in an emulator and allows you to download demo's from the internet and play them on your DS. Initially
PassMe DID NOT work with Commercial ROM dumps, but only until Golden Sun Team (GST) released specially patched NDS roms that DO work with Pass Me and NeoFlash Magic Key (passme clone). Some sites that sell PassMe still say that commercial nds roms will not work with it just to get NINTENDO and theESA off their back. PassMe and commercial NDS ROMs 
 |
 |
PassMe with Metroid Demo Cart sticking
out on the back of Nintendo DS |
PassMe size compared to a penny.
(showing the back side of the board)
|
 SuperPass DS at Jandaman - Price: $19.95 USD (Fast shipping from USA)
Buy NDS SuperPass KEY at Linker4U.com - Price: $20.64 USD
Buy SuperPass & G6 PassKey at Flashlinker-Store.com - best for EU
(Super Pass Key is a manufactured not-homemade Pass Me)
GBA Flash Card tested to work with PassMe
(some info taken from DsPassMe.com)
GBA FlashCard |
Compatibility |
| X-Rom 512 |
Disable the Menu and write nds roms in SINGLE ROM mode. X-ROM with NDS roms |
| NeoFlash 521M & 1Gb |
Run NDS_mode.exe and it will set the Neo Power Kit to nds mode. For commercial roms use Magic Key. |
EZ-Flash II Power Star
EZ-Cart 512mb |
From the menus verify that the card manager app won't load a multiboot loader or try to remove intros. |
| EZF-Advance 128mb |
Uncheck Multirom under Options. |
| EZ-Flash 3 1gb |
DarkFader and Davr to the rescue. Get a working loader Here. |
| XG1 128 Mbit |
Uncheck "Use Loader" in menu. |
| EZF-Advance III 256mb |
Disable boot menu and it works fine. |
| Flash2Advance 256mb |
Disable boot menu and it works fine. |
| Flash2Advance Ultra 256mb |
Disable boot menu and it works fine. |
| EZ-Flash II Power Star 256mb |
Disable boot menu and it works fine. |
| Flash Advance 2 128mb |
Disable boot menu and it works fine. |
| Extreme Flash Advance 512mb |
Disable boot menu and it works fine. |
| Extreme Flash Advance 256mb |
Disable boot menu and it works fine. |
| Visoly Flash Advance Pro 256mb |
Disable boot menu and it works fine. |
| Visoly Parallel Port 128mb |
Need to hack case to fit into DS, but works fine. |
| Visoly Xtreme Linker + 256 |
1) Using Configuration Menu. need to make sure that menu is not written for a single file
2) Must use Write to Cart tab, and not Drag+Drop into Cart View |
SuperCard
GBA Movie Player
Play Yan |
DO NOT work with PassMe |
GBA Flash Cards
Compatible with
Nintendo DS
Results and Details at Nintendo DS Flash Card page
Neo Flash - Magic Key
Factory made analog to PassMe. NeoFlash team has worked on the original Pass Me design an come out with a factory manufactured analog. Sold together with NeoFlash GBA cartridge for holding your gba and nds roms it is the first kit to run commercial nds roms.
Our Neo Flash page
PassMe is a compact passthrough that fits into the DS slot (with the DS cart sticking out).
About Passthrough from DSTech WiKi
The primary (read: only) means of running homebrew code on the Nintendo DS is currently via a passthrough mechanism in the DS card port and a traditional GBA flash cart in the GBA cartridge port. A passthrough technique is required, since the DS BIOS enables encryption after reading the header, and the encryption is not fully understood.
The passthrough operates in protocol mode most of the time, transparently directing commands to the card and data back to the DS (see DS protocol. However, for the first transfer after a card reset (always the header fetch during boot), it feeds a modified header back to the DS instead of the data that would have come from the card.
This modified header is the same as the original header, with the exception of the ARM7 execute address and the header CRC16. The ARM7 execute address points to 0x080000C0 (GBA cartridge ROM), and the header CRC16 is recomputed to account for the modifications. You can't do this trick to run ARM9 directly, because the BIOS gives the ARM7 priority on the cartridge space during bootup. That's why ARM9 is put into a small waiting loop. ARM9 execution can then be continued by the following C instruction:
*(volatile uint32 *) 0x027FFE24 = 0x02004000;
Once you select the game in the firmware menu (or it auto-loads, depending on your settings), the code on the GBA cartridge will be executed. Unlike running code directly off of a GBA cartridge, it is executed in DS mode, not GBA mode! At this point, you're free to do what you want, but typically the ARM7 boot loader code on the cartridge copies a pair of ARM binaries to RAM, one for the ARM7 and the other for the ARM9.
All of the hardware constructed so far consists of a FPGA between the DS and a DS cartridge, and either a GBA flash cart or GBA cartridge emulator also running on the FPGA.
sgstair and Ampz built protocol sniffers. DarkFader found out he could change the execution entry point in the header and built the first passthrough using an FPGA and documented it. Natrium and Dovoto are making passthroughs out of CPLDs, which should be significantly smaller than the existing FPGA boards, but the only current idea for eliminating the passthrough entirely involves replacing a BGA chip inside the DS... or by cracking the encryption which DarkFader is trying to do.
|
