Hacking DEAD [Shutdown]DragonInjector - Game Cart Payload Injector (Trinket M0 Clone)

[Degga]

Great Concept, the idea is very smart, hope you can manage to get it like you want.i would like see something like that for sale!

 

[guily6669]

This looks pretty good.

But gave the idea, what if we could mod the cartridge slot in some kind of way to work as internal trinket with every wire soldered in the right place and then a modchip made to fit the gamecard slot that would inject the payload and make some kind of way to remove it and still be able to read game cards.

Maybe a modded card reader with a button to chose payload way or gamecard way would work (one would use the solder points for the modchip and the other would use normal pins to read game cards).

 

[methamz]

There's unfortunately no chance to fit a Trinket M0 along with the other needed components into the space of a switch cart.

This is a fully custom board based on the open-source Trinket M0 schematics with a bunch of tweaks. The power regulator and the DotStar LED have been removed as well as unneeded i/o pins and some protocol pads like SPI. Digital pin 0 is used for the status LED, USB goes to the Type C plug and the flash access pins have pads and that's it for i/o.

The chip is exactly the same though, so any code that runs on a Trinket M0 will run on this.

You made this board yourself?

 

[pandavova]

if the price is right, (and it will ship to germany without expensive shipping), i will buy it.
it looks beautiful.

 

[MatinatorX]

You made this board yourself?

Of course! I used the latest version of Eagle and will be uploading the gerbers as soon as the final board is tested and working. For anyone looking to make their own spin on the Trinket M0, the schematics are free on Adafruit's website. You can find my (now out of date) schematic a few posts back.

it looks beautiful.

Thanks! Don't get too attached to the renders in the first post though, as stated before the tiny wall thicknesses made it pretty much impossible to print. I'm working hard on a new revision which I'll hopefully finish tonight. I'll post new renders when it's done.

 

[Av4x]

Would also buy one if you ever going to sell those!

 

[NO_ob]

I thought about this while I was designing the board, but ultimately decided against it as you would end up needing a cable to go from the injector to the switch USB port (sadly the game cart socket does not break out the USB pins, thus payload injection this way will sadly never happen...) and that cable would never be able to fit into the space freed up by the removal of the battery. The cable would also have to have a non-standard end on the DragonInjector side, as there's no way you could fit the end of a USB cable inside the top of the card slot to plug it in. If you have to remember to bring that cable with you, you might as well opt for one of the larger injector solutions and just bring that.

However, the idea isn't a complete dead-end. I've been doing a lot of research on super capacitors lately, especially after learning the SX dongle uses them. We already know the game card slot has pins for +3.3v and GND. If the slot is energized when the Switch is in RCM mode and it can supply enough current then this would be an ideal excuse to swap the battery for a supercap. Technically, having no power to the game card when in RCM is still plausible, but only for jig users; with AutoRCM, a depleted DragonInjector would leave you with no way to charge it and a Switch that can't boot without a working dongle.

There's unfortunately no public datasheet for the flash chip Nintendo uses for Switch game carts, but a quick search on the manufacturer's site for high capacity flash chips (8gbit or higher) yeilds only 3 models, all of which can pull as much as 30mA. I'd be really surprised if the Switch game carts use less, especially since the chip they're using is 40% larger than the other ones I mentioned above.

Based on some quick fuzzy math, 20-30mA would be enough to charge the cap and power the trinket if I used a 3.3v 0.22F supercap. With sleep mode drawing a paltry 90uA it should last a few days out of the slot if you forget to turn the power off and charging would be under an hour. When I get some more time, I'll rig something up to test for voltage in the card slot during RCM, and if that works I'll see how much current a Switch cart pulls. Currently slimming down the board even more since, after getting my hands on a real cart, I found out the dimensions are actually 21.4mm x 31.2mm x 3.4mm.


I've been thinking about this a bit too - what to do if there's lots of interest, since the feedback so far has been really positive (thanks everyone!). I know for sure I want to release the gerbers and parts list and maybe the model too for free so that anyone who wants to can make their own. That said, while it's far too early to plan anything, I get that SMD soldering is a rare hobby. So, if this thing turns out well enough I'm open to making more to sell to the community. If I remember right, there's a license for this kind of stuff that allows me to give out the designs and stuff so you can use them for anything short of selling them yourself.

Would be cool to have it launching from the cart reader, it's probably not hard to add jumpers from the cart slot to the usb data test pads

 

[fragged]

Would be cool to have it launching from the cart reader, it's probably not hard to add jumpers from the cart slot to the usb data test pads

I suspect that would lead to short Circuit City.

 

[MatinatorX]

I suspect that would lead to short Circuit City.

More or less, yeah. You'd likely end up sending too much voltage to something and frying it. All the cart pins besides VCC and ground operate at a 1.8V logic level, so sending 3V or above might let out some magic blue smoke. It's possible the data lines are 3.3V or even 5V tolerant, but with no public datasheets available and Nintendo going with a proprietary interface it's impossible to know for sure.

You might be able to get around it with a couple of TTL converters but you'd still need a 2 pole switch to turn off whatever data pins you choose to use before you insert the payload cart. It's possible the Switch might ignore the garbage data if only 2 of the 8 pads were in use, but it's also possible the Switch will go berserk trying to interpret the data and throw out error codes, shut itself down or write your entire NAND over with lolcats.

If you're modifying your Switch for automatic payload injection there's no real reason to use a payload cart over the already released internal Trinket M0 mod. If you're using real game carts and want somewhere to store an injector cart when not in use, just use a free slot in whatever you keep your carts in.

 

[guily6669]

Yeah but imagine we could have a modded Card reader port with a built in button that changes the pinout from original to read game cards and the other function would use the pins for injecting the payload and we would use a gamecard modchip, this would be AWESOME and better than having to have a modchip soldered all the time inside the switch eating up its battery with no use as I sometime throw things for months and not use them .

 

[DeadlyFoez]

Hey man. Amazing work. Just too bad someone is going to steal the design and sell it like crazy.

I think this is the best solution out there.

 

[weatMod]

Update time.

While the PCB designing and fab went well and I have a bunch on the way here right now, getting the case prototyped has so far been... unsuccessful. The issue is the miniscule amount of space and the details the case requires. I only had ~1mm extra to work with for length and width when designing the case, which meant a wall thickness of 0.5mm. This is fine (albeit just barely) for injection molded parts made of strong plastic, but for the prototype I've been poking local makers on 3DHubs who have SLA printers (UV cured liquid resin), since FDM printers like mine (that shmoo out hot plastic) aren't accurate enough for this. So far every attempt has resulted in a failure printing either the cover or the case due to that itty bitty wall thickness, and getting the board even this small was like playing entropy bingo for a day. Moving stuff a few mil at a time and seeing what that broke and then moving that new broken thing. Rinse, repeat. The board just isn't getting any smaller at this point with it's current assortment of components.

HOWEVER. Last night I committed the sin of dissecting the most revered game on the Switch, as currently as it's the only cart I own. I'm talking of course about the wonderful Aqua Motor Racing Utopia. I know this hurts us all, but remember, it was for science.

Anyways, I soldered up some magnet wire onto the 3.3V and GND pins, routed them out of the back of the cart, stuck the other ends across my multimeter and wrote down the behavior of the card slot under a variety of circumstances:

1) When the system is in sleep/standby mode, the 3.3V supply is OFF.
2) The slot is powered immediately when resuming from sleep mode. I measured a constant 3.06v.
3) When entering sleep mode, the game slot is powered down for around two seconds, then receives power again for around ten seconds for some reason. It then powers down for good until woken from sleep.
4) When turning off the console, the slot is powered down once the screen backlight turns off, with no resumption of power until the console is booted once more.
5) The card slot is NOT powered in RCM mode. The slot does not receive power until Horizon is loaded and you see the lockscreen appear.

So, there's good news and bad news here. The good news is that I can hijack the 3.3v for stuff when the Switch is on without fear of draining the battery when it's in standby mode or off. This means I can ditch the battery for a supercapacitor! The bad news is that there's no power in RCM mode. This means that AutoRCM would be a Really Bad Idea™, because if your dongle died you would have no way to boot the console to charge your dongle so you could boot the console to charge your dongle. My angle is that if your RCM jig is built into your dongle, you don't need RCM anyways. If I'm missing an important use case however please let me know.

Moving forward, it turns out that supercapacitors are actually pretty easy to charge and implement if you know your supply voltage will always be consistent. A simple resistor and a diode are all that are needed to limit the charging current and protect against reverse voltage discharge when your input voltage goes low. If anyone would like, I can break out the math, but the short of it is a cap that's about 2/3 the size of the CR1616 I'm using in the first board will work just as well. On a full charge it will last for over an hour with the dongle in sleep mode and be good for a couple dozen payload injections. I'm limiting the current the dongle can get from the Switch to 25mA and even at that miniscule amperage the cap should charge in just a few minutes. This should be well below the current a normal Switch cart needs. If you're wondering what effect 25mA will have on your battery life (remember that the card slot only gives power when the system running, current drain is 0 when in standby or off), the Switch has a 4310mAh battery pack @ 3.7v. 25 / 4310 is 0.058, or about half a percent of your battery life for every hour the Switch is running on battery.

So that leaves me where I am now, which is making a new PCB. The schematic is already done. Thanks to the supercap being substantially smaller than the battery, I should be able to add enough meat to make the case printable on an SLA (and possibly even FDM) printer. Day job runs long this week so it will likely be late Friday I'm back here with shiny renders of the new design.

Attached is the current WIP schematic for those interested as well as a picture of me violating my switch with magnet wire.

View attachment 137140 View attachment 137141

"So, there's good news and bad news here. The good news is that I can hijack the 3.3v for stuff when the Switch is on without fear of draining the battery when it's in standby mode or off. This means I can ditch the battery for a supercapacitor!"

yeah when i 1st saw this i was going to suggest you crack open and RE a SX pro dongle and use super caps
but from you post it looks like you are over complicating it by trying to add pins to your cart case to charge the super caps
i mean why not just do it the way that TX does and use the power from the USB C to charge the super caps ,this way less battery drainage while the switch is on and the card is in the slot.

Also i notice SW1 and SW 2, what is SW2 for exactly? is it like reset button for the board like on an arduino?
i get SW1 is for disconnecting the CR2032
of course TX dongle uses no switches and with supercaps there is no need for SW1 to disconnect the battery anyways so that frees up more precious real estate right there
guess SW2 would still be needed ,but seems like it would be easier to just charge the caps through the USB C and not from the cart slot IMHO

 

[Testo90]

Amazing! Would buy

 

[MatinatorX]

but from you post it looks like you are over complicating it by trying to add pins to your cart case to charge the super caps
i mean why not just do it the way that TX does and use the power from the USB C to charge the super caps ,this way less battery drainage while the switch is on and the card is in the slot.

This would require you to have the dongle plugged into the USB Type C port on your Switch while gaming if you needed to charge the dongle on the go, which is not ideal. It would also mean you would have to charge it in a different piece of equipment while the Switch is docked, and then remember to take it with you each time you went out. It's actually quite simple to get the dongle to charge via the card slot so I see no reason not to. The pinout of the slot was known months ago and 30mA is more than enough to charge a small supercap.

That said, with the updated case I'm finishing up I had a good bit more room to work with and a rechargeable power source makes a higher current draw less of an issue. I've added the DotStar LED and the LDO back in as a result. This means we can charge from either the USB Type C port or the card slot, and it also means I don't have to fork the firmware already available.

The main reason I did this is because I realized it would be a pain to have a small window to update the dongle when plugged into your PC, as the supercap would drain in well under an hour with the MCU at full power. Now you can take your time updating the payload and it will charge at the same time. I will be posting another update tonight with the details of the new design.

Also i notice SW1 and SW 2, what is SW2 for exactly? is it like reset button for the board like on an arduino?
i get SW1 is for disconnecting the CR2032
of course TX dongle uses no switches and with supercaps there is no need for SW1 to disconnect the battery anyways so that frees up more precious real estate right there
guess SW2 would still be needed ,but seems like it would be easier to just charge the caps through the USB C and not from the cart slot IMHO

SW2 is indeed a reset button, required to put the device into bootloader mode so you can load your payload or whatever code you wish. I don't have a TX dongle to reverse engineer, but the caps in the photos look significantly larger than would fit in a cartridge form factor so I doubt power is much of a concern for them. Based on the dimensions of the TX dongle, it's probably a pair of 1F 2.7v caps, which would have about 10x more life than the 0.22F cap I'm using. (Entertainingly, the press render they put out states the caps are 500F caps, which would make the dongle bigger than your Switch!) Most likely they are extending the life even more with a sleep cycle - something along the lines of powering up every few seconds and looking for an RCM Switch, then going back to sleep. I'd be interested to hear about the battery life of the SX dongle from anyone who has one, as well as if you notice a delay sometimes after you plug it in for the payload to go through.

 

[isoboy]

I will say I'd laugh pretty good if TX all of a sudden announce their own clone. I think they should go for it. Money to be made.

 

[DKB]

That would be pretty crazy if TX did announce a clone. Anyways, I bought the SX Pro..but this looks a lot more appealing. Please make this a reality.

 

[MatinatorX]

I will say I'd laugh pretty good if TX all of a sudden announce their own clone. I think they should go for it. Money to be made.

That'd sure save me the trouble of building mine! Although I still would because this stuff is fun, and having an open-source alternative is never a bad thing.

I really don't think there's enough demand to warrant mass-production, though if somehow you all abuse my tindie page with 10K in preorders I'll make a commercial release happen.

 

[isoboy]

If it's reliable and don't mess up the cartridge slot I will surrender my wallet. Simple as that.

 

[weatMod]

This would require you to have the dongle plugged into the USB Type C port on your Switch while gaming if you needed to charge the dongle on the go, which is not ideal. It would also mean you would have to charge it in a different piece of equipment while the Switch is docked, and then remember to take it with you each time you went out. It's actually quite simple to get the dongle to charge via the card slot so I see no reason not to. The pinout of the slot was known months ago and 30mA is more than enough to charge a small supercap.

That said, with the updated case I'm finishing up I had a good bit more room to work with and a rechargeable power source makes a higher current draw less of an issue. I've added the DotStar LED and the LDO back in as a result. This means we can charge from either the USB Type C port or the card slot, and it also means I don't have to fork the firmware already available.

The main reason I did this is because I realized it would be a pain to have a small window to update the dongle when plugged into your PC, as the supercap would drain in well under an hour with the MCU at full power. Now you can take your time updating the payload and it will charge at the same time. I will be posting another update tonight with the details of the new design.



SW2 is indeed a reset button, required to put the device into bootloader mode so you can load your payload or whatever code you wish. I don't have a TX dongle to reverse engineer, but the caps in the photos look significantly larger than would fit in a cartridge form factor so I doubt power is much of a concern for them. Based on the dimensions of the TX dongle, it's probably a pair of 1F 2.7v caps, which would have about 10x more life than the 0.22F cap I'm using. (Entertainingly, the press render they put out states the caps are 500F caps, which would make the dongle bigger than your Switch!) Most likely they are extending the life even more with a sleep cycle - something along the lines of powering up every few seconds and looking for an RCM Switch, then going back to sleep. I'd be interested to hear about the battery life of the SX dongle from anyone who has one, as well as if you notice a delay sometimes after you plug it in for the payload to go through.

"This would require you to have the dongle plugged into the USB Type C port on your Switch while gaming if you needed to charge the dongle on the go, which is not ideal. It would also mean you would have to charge it in a different piece of equipment while the Switch is docked,"

well i have a SX pro dongle but i have not even set it up yet
but from what i understand that is not how it works at all ,i thought that the dongle can charge itself through the switches USB C port
and that it can also be charged with the micro USB female connector on the dongle but that that is not really necessary since the dongle can charge itself through the switches USB C port in something like just under 3 seconds and have enough juice to dump the payload
i though i read that you can charge it from the female micro USB on the dongle and that will get you like 10 payload injections with having to wait the 2 or 3 seconds to charge the dongle from the USB C port on the switch
maybe i am wrong but i could swear this s what i read if anyone else who uses their can chime in and let us know
but i am almost positive that is how it works
so even if your caps are smaller that TX , TX caps and hold like 10 or 12 payload dumps worth of juice
you really only need enough for one , i mean who is really impatient enough to not be able to wait a few second upon rebooting their switch
didn't you say the cart slot delivers 3.3v ? the USB C will deliver 5v so wouldn't that get the caps charges faster? or rewqire more circuitry to lower the voltage?
Also i those pics of the SX pro donlge are only mockups so i would not put too much stock in them we dn't know what they are using in there
and the dongle is really small it fits in a game card pouch in my switch case
maybe there are actual photos now and maybe even tear down video i haven't checked lately

 

[TR_mahmutpek]

Amazing project, good work but when warmboot or coldboot found, your work will be forgotten..