Gamecards consist of a 2 Part ABS plastic housing with a small PCB within. The PCB only hosts a memory IC and decoupling.
It looks like a ROM chip from Macronix is used. The MX23K series of devices is not listed on the Macronix website. Possibly “Gaming Machine XtraROM®” or “ASIC XtraROM®” with built-in DRM.
Pin | Description |
---|---|
0 | GND |
1 | CLK+ |
2 | CLK- |
3 | CS |
4 | DAT0 |
5 | DAT1 |
6 | VCC 3.3v |
7 | DAT2 |
8 | DAT3 |
9 | VCC 1.8v |
10 | DAT4 |
11 | DAT5 |
12 | DAT6 |
13 | DAT7 |
14 | GND (IRQ?) |
15 | RST |
All IO use 1.8V for logic HIGH and 0V for logic LOW. The CLK+ and CLK- is a differential clock line. CLK- seems to be 180 degrees out of phase in reference to the CLK+ line. The rising edge of the clock is when CLK+ goes HIGH, and falling edge when CLK+ goes LOW.
The Switch gamecard uses a simple (but proprietary) 8-bit bus (DAT0..7) with a clock line (CLK+/CLK-) and a select line (CS). The 8-bit bus data is captured on the rising edge of the clock.
The Switch host starts a transfer by first pulling CS low, followed by clocking a byte each clock cycle. After a fixed number of command bytes are written to the bus, the direction of the bus implicitly changes and the gamecard responds with data. The Switch host keeps clocking while the gamecard responds. After the transfer is ended, the CS line is pulled high again.
The Switch drives the gamecard clock at 25MHz.
The meaning of these commands are currently unknown.
The Switch gamecard at some point switches from plaintext commands to encrypted commands. The encryption algorithm used is currently unknown.