An In-Depth Security Evaluation of the Nintendo DSi Gaming Console

This repository contains the source code written as part of the research into the Nintendo DSi. It mainly consists of C code that can be compiled using the supplied Makefiles, though you need an arm-none-eabi toolchain to compile it (preferably devkitARM r61). The dumphi folder contains C and assembly payload code used to dump the ARM7 and ARM9 boot ROMs. The unicorn folder contains Python scripts that use the Unicorn engine to test the behavior of certain snippets of the ARM9 boot ROM code. The haxboardfw folder, finally, contains all code related to the modchip exploit: RP2040 microcontroller code in the rp2040 subfolder, DSi payload (incl. ROP chain) in payload, and auxiliary test code in faketwl.