From e5d85dd5cdb84e8a62dfd7ddfbf12028af77700e Mon Sep 17 00:00:00 2001
From: RocketRobz <bobesh8@gmail.com>
Date: Thu, 25 Apr 2024 12:44:03 -0600
Subject: [PATCH] Read ConsoleID register, if available

---
 arm7/source/main.c   | 49 +++++++++++++++++++++++++-------------------
 arm9/source/nandio.c |  9 ++++++++
 2 files changed, 37 insertions(+), 21 deletions(-)

diff --git a/arm7/source/main.c b/arm7/source/main.c
index 43fb069..c17215e 100644
--- a/arm7/source/main.c
+++ b/arm7/source/main.c
@@ -145,31 +145,38 @@ int main() {
 	}
 
 	if (isDSiMode() || ((REG_SCFG_EXT & BIT(17)) && (REG_SCFG_EXT & BIT(18)))) {
-		/*for (int i = 0; i < 8; i++) {
-			*(u8*)(0x2FFFD00+i) = *(u8*)(0x4004D07-i);	// Get ConsoleID
-		}*/
 
 		// For getting ConsoleID without reading from 0x4004D00...
 
-		u8 base[16]={0};
-		u8 in[16]={0};
-		u8 iv[16]={0};
-		u8 *scratch=(u8*)0x02F00200; 
 		u8 *out=(u8*)0x02F00000;
-		u8 *key3=(u8*)0x40044D0;
-		
-		aes(in, base, iv, 2);
-
-		//write consecutive 0-255 values to any byte in key3 until we get the same aes output as "base" above - this reveals the hidden byte. this way we can uncover all 16 bytes of the key3 normalkey pretty easily.
-		//greets to Martin Korth for this trick https://problemkaputt.de/gbatek.htm#dsiaesioports (Reading Write-Only Values)
-		for(int i=0;i<16;i++){  
-			for(int j=0;j<256;j++){
-				*(key3+i)=j & 0xFF;
-				aes(in, scratch, iv, 2);
-				if(!memcmp(scratch, base, 16)){
-					out[i]=j;
-					//hit++;
-					break;
+		memset(out, 0, 16);
+
+		// first check whether we can read the console ID directly and it was not hidden by SCFG
+		if (((*(vu16*)0x04004000) & (1u << 10)) == 0 && ((*(vu8*)0x04004D08) & 0x1) == 0)
+		{
+			// The console id registers are readable, so use them!
+			memcpy(out, (u8*)0x04004D00, 8);
+		}
+		if(out[0] == 0 || out[1] == 0) {
+			u8 base[16]={0};
+			u8 in[16]={0};
+			u8 iv[16]={0};
+			u8 *scratch=(u8*)0x02F00200; 
+			u8 *key3=(u8*)0x40044D0;
+			
+			aes(in, base, iv, 2);
+
+			//write consecutive 0-255 values to any byte in key3 until we get the same aes output as "base" above - this reveals the hidden byte. this way we can uncover all 16 bytes of the key3 normalkey pretty easily.
+			//greets to Martin Korth for this trick https://problemkaputt.de/gbatek.htm#dsiaesioports (Reading Write-Only Values)
+			for(int i=0;i<16;i++){  
+				for(int j=0;j<256;j++){
+					*(key3+i)=j & 0xFF;
+					aes(in, scratch, iv, 2);
+					if(!memcmp(scratch, base, 16)){
+						out[i]=j;
+						//hit++;
+						break;
+					}
 				}
 			}
 		}
diff --git a/arm9/source/nandio.c b/arm9/source/nandio.c
index 3e952a8..43f5a0f 100644
--- a/arm9/source/nandio.c
+++ b/arm9/source/nandio.c
@@ -31,8 +31,17 @@ void getConsoleID(u8 *consoleID){
 	u8 key_x[16];////key3_x - contains a DSi console id (which just happens to be the LFCS on 3ds)
 	u8 key_y[16] = {0x76, 0xDC, 0xB9, 0x0A, 0xD3, 0xC4, 0x4D, 0xBD, 0x1D, 0xDD, 0x2D, 0x20, 0x05, 0x00, 0xA0, 0xE1}; //key3_y NAND constant
 	
+	u8 empty_buff[8] = {0};
+
 	tonccpy(key, fifo, 16);  //receive the goods from arm7
 
+	if(memcmp(key + 8, empty_buff, 8) == 0)
+	{
+		//we got the consoleid directly or nothing at all, don't treat this as key3 output
+		tonccpy(consoleID, key, 8);
+		return;
+	}
+
 	F_XY_reverse((uint32_t*)key, (uint32_t*)key_xy); //work backwards from the normalkey to get key_x that has the consoleID
 
 	for(int i=0;i<16;i++){