Gateway 3DS patcher - psudocode

// Read/write from DS serial SPI
extern void read_firmware(void *dest, uint32_t start, size_t size);
extern void write_firmware(void *src, uint32_t start, size_t size);

// CRC16 and related hash functions
extern uint16_t do_hash1(const char *firm, size_t size);
extern uint16_t do_hash2(const char *firm, size_t size);
extern uint32_t do_hash3(const char *firm, size_t size);
extern uint16_t do_hash4(const char *firm, size_t size);

const char patch1[] = {0xB9, 0xF2, 0x10, 0x00, 0xAE, 0x2B, 0x27, 0x00, 0xED, 0x0D, 0xDC, 0xBA, 0x9C, 0xF1, 0x18, 0x00, 0x90, 0xB6, 0x10, 0x00, 0x00, 0xB0, 0xFA, 0x00, 0x00, 0x02, 0x20, 0x00, 0xB9, 0xF2, 0x10, 0x00, 0x00, 0x90, 0x27, 0x00, 0x01, 0x00, 0x00, 0x00, 0xE1, 0x49, 0x15, 0x00, 0x38, 0x6F, 0x27, 0x00, 0xAC, 0x82, 0x1B, 0x00, 0xDC, 0xD5, 0x18, 0x00, 0x40, 0x83, 0x27, 0x00, 0x00, 0x02, 0x10, 0x00, 0xCC, 0x48, 0x00, 0x00, 0x60, 0x3D, 0x14, 0x00, 0xB9, 0xF2, 0x10, 0x00, 0x00, 0x90, 0x27, 0x00, 0x00, 0x00, 0x2B, 0x00, 0xF9, 0x02, 0x10, 0x00, 0xF9, 0x02, 0x10, 0x00, 0xF9, 0x02, 0x10, 0x00, 0xF9, 0x02, 0x10, 0x00, 0xF9, 0x02, 0x10, 0x00, 0xF9, 0x02, 0x10, 0x00, 0xE1, 0x49, 0x15, 0x00, 0x51, 0x00, 0xCD, 0xC2, 0xE1, 0x49, 0x15, 0x00, 0x20, 0x90, 0x27, 0x00, 0x8C, 0x53, 0x10, 0x00, 0x00, 0x90, 0x00, 0x00, 0x58, 0x39, 0x1B, 0x00, 0xE5, 0x04, 0x21, 0x00, 0x00, 0xDA, 0x19, 0x00, 0x00, 0x75, 0x01, 0x00, 0x86, 0xDF, 0x21, 0x00, 0x00, 0xC1, 0x1A, 0x00, 0x22, 0xDA, 0x1D, 0x00, 0x91, 0xFE, 0x16, 0x00, 0x00, 0x01, 0x10, 0x00, 0xBC, 0x4C, 0x14, 0x00, 0x00, 0x00, 0x2B, 0x00, 0x00, 0x90, 0x00, 0x00, 0xE1, 0x49, 0x15, 0x00, 0xAC, 0xEF, 0x22, 0x00, 0x88, 0x5C, 0x10, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x90, 0x03, 0x25, 0x00, 0xC0, 0xFA, 0x1E, 0x00, 0x91, 0xFE, 0x16, 0x00, 0x8C, 0x53, 0x10, 0x00, 0x24, 0x6B, 0x03, 0x00, 0x60, 0x3D, 0x14, 0x00};

const char patch2[] = {0xB9, 0xF2, 0x10, 0x00, 0x00, 0xFE, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0xE1, 0x49, 0x15, 0x00, 0x00, 0x94, 0x27, 0x00, 0xFC, 0x34, 0x13, 0x00, 0xD0, 0x8C, 0x1E, 0x00, 0x8C, 0x53, 0x10, 0x00, 0x9C, 0x94, 0x27, 0xF0, 0x60, 0x3D, 0x14, 0x00};

void do_patches(char *firm)
{
    memcpy(firm+0x1FE00, patch1, sizeof(patch1));
    memcpy(firm+0x1FFB4, patch2, sizeof(patch2));
    *(uint16_t)(firm+0x1FEFE) = do_hash1(firm, 0x1FFFF);
    *(uint16_t)(firm+0x1FF50) = do_hash2(firm, 0x1FFFF);
    *(uint32_t)(firm+0x1FF70) = do_hash3(firm, 0x1FFFF);
    *(uint16_t)(firm+0x1FFFE) = do_hash4(firm, 0x1FFFF);
}

void program()
{
    char *firm = malloc(0x1FFFF);
    char data[0x1D];
    uint16_t unk1;

    // Read first 0x0001FFFF bytes of firmware
    read_firmware(firm, 0x0, 0x1FFFF);
    do_patches(firm);

    // Writes first 0x300 bytes back (same data)
    write_firmware(firm, 0x0, 0x300);

    // Gets a pointer of uint16_t at 0x300
    unk1 = *(uint16_t*)(firm+0x300);

    // Read 0x1D bytes at that location
    read_firmware(data, unk1, 0x1D);

    // Writes 0x300 - 0x9FF bytes back (same data)
    write_firmware(firm+0x300, 0x300, 0x6FF);

    // Writes the 0x1D bytes of data from 0xA00 at #3's location
    write_firmware(data, unk1, 0x1D);

    // Writes 0xA00 - 0x1FFF, mostly same data except 6 patches
    write_firmware(firm+0xA00, 0xA00, 0x15FF);
}

void verify()
{
    // not much, just read back all 0x1FFFF bytes again and compare it with patched data
}