First off, neither Matt or myself condone piracy. Not a single commercial DS game has gone anywhere near the microSD that I use with my R4. I’ve even gone to the extent of banning Google ads from advertisers who have advertised such products with phrases such as “Download Nintendo games for free!” (when I’ve been able to determine the domain without clicking on the ad, that is). My R4 and EZ-Flash 3-in-1 are used solely for DS and GBA homebrew (such as the oh-so-addictive tetattds and luminesweeper), but the details of that are deserving of a whole different article.
Now, with that out of the way, on to the core of this post: recovering semi-bricked DSs. If you’ve come to this post from a search engine, then you probably already know what FlashMe is. For those who don’t, it’s a replacement firmware for the DS (or DS Lite) that does a number of things like let you boot DS code directly from the front slot (normally you’d need a slot 1 device such as a PassMe or NoPass, as well as a slot 2 cart), boot unsigned code via the Download and Play option, strip out the health and safety screen, and add a failsafe recovery mode. Obviously installing this completely and utterly voids your warranty.
Flashing a DS is normally a fairly painless process. With DS Lites it’s a bit harder, due to being more compact, but still fairly simple. Unfortunately, if your DS chooses to turn off during the flashing process (like mine did), you can’t boot. Thankfully, FlashMe writes a failsafe bootloader that’s just able to boot DS code from slot 1 or 2 (accessed by holding start and select at poweron), so as long as this was successfully written, you can at least use your DS for more than just a paperweight. Unfortunately, trying to run FlashMe (or, in fact, any .nds files) from an R4DS (or M3 Simply, since they’re the same hardware) when in this recovery mode results in the following:
Oh dear. Not good. Thankfully, chishm, a well-known developer in the DS homebrew community, recently reverse engineered the R4’s encryption system, producing the r4crypt tool. Now, you know the _DS_MENU.DAT files you get in the R4 updates? They’re just encrypted NDS files. Can you see where this is going? Yup, you guessed it, encrypt flashme.nds, and save it as _DS_MENU.DAT in the root of your microSD card.
To make it easier for those who just want the instructions, here’s a step-by-step guide (obviously I accept NO responsibility for anyone damaging their DS further):
- Download r4crypt.
- Encrypt your FlashMe file, with r4crypt -e flashme.nds _DS_MENU.DAT.
- Copy _DS_MENU.DAT to the root of your microSD card.
- Power on with start and select held.
- Follow the FlashMe instructions as before (note: be sure to plug your DS in, for security.)
- Enjoy your un-bricked DS!
You will, of course, have to put the R4/M3 Simply _DS_MENU.DAT back on to be able to use it properly again.
I hope this information will be of use to some people, and I would like to thank chishm so very much for both writing r4crypt, and for telling me how to do this on IRC.