mirror of
https://github.com/hacks-guide/Guide_3DS.git
synced 2024-11-23 09:29:51 +00:00
New Crowdin updates (#2104)
* New translations homebrew-launcher-(pichaxx).txt (French) * New translations bannerbomb3-fredtool-(twn).txt (French) * New translations finalizing-setup.txt (Spanish) * New translations finalizing-setup.txt (Romanian) * New translations seedminer.txt (French) * New translations finalizing-setup.txt (Korean) * New translations installing-boot9strap-(usm).txt (Korean) * New translations seedminer.txt (Spanish) * New translations seedminer.txt (Bulgarian) * New translations installing-boot9strap-(usm).txt (Bulgarian) * New translations homebrew-launcher-(pichaxx).txt (Bulgarian) * New translations installing-boot9strap-(usm).txt (Spanish) * New translations finalizing-setup.txt (Bulgarian) * New translations finalizing-setup.txt (Catalan) * New translations installing-boot9strap-(fredtool).txt (Catalan) * New translations seedminer.txt (Catalan) * New translations installing-boot9strap-(usm).txt (Catalan) * New translations homebrew-launcher-(pichaxx).txt (Catalan) * New translations installing-boot9strap-(fredtool).txt (Bulgarian) * New translations finalizing-setup.txt (Arabic) * New translations homebrew-launcher-(pichaxx).txt (Spanish) * New translations installing-boot9strap-(fredtool).txt (Arabic) * New translations installing-boot9strap-(usm).txt (Arabic) * New translations homebrew-launcher-(pichaxx).txt (Arabic) * New translations seedminer.txt (Arabic) * New translations seedminer.txt (Czech) * New translations homebrew-launcher-(pichaxx).txt (Czech) * New translations installing-boot9strap-(usm).txt (Czech) * New translations installing-boot9strap-(fredtool).txt (Czech) * New translations finalizing-setup.txt (Czech) * New translations installing-boot9strap-(fredtool).txt (Hebrew) * New translations installing-boot9strap-(usm).txt (Finnish) * New translations homebrew-launcher-(pichaxx).txt (Finnish) * New translations finalizing-setup.txt (Hebrew) * New translations seedminer.txt (Hebrew) * New translations installing-boot9strap-(fredtool).txt (Finnish) * New translations installing-boot9strap-(usm).txt (Hebrew) * New translations homebrew-launcher-(pichaxx).txt (Hebrew) * New translations finalizing-setup.txt (Hungarian) * New translations installing-boot9strap-(fredtool).txt (Hungarian) * New translations seedminer.txt (Finnish) * New translations finalizing-setup.txt (Finnish) * New translations finalizing-setup.txt (German) * New translations installing-boot9strap-(fredtool).txt (German) * New translations seedminer.txt (German) * New translations installing-boot9strap-(usm).txt (German) * New translations homebrew-launcher-(pichaxx).txt (German) * New translations finalizing-setup.txt (Greek) * New translations installing-boot9strap-(fredtool).txt (Greek) * New translations seedminer.txt (Greek) * New translations installing-boot9strap-(usm).txt (Greek) * New translations homebrew-launcher-(pichaxx).txt (Greek) * New translations seedminer.txt (Hungarian) * New translations installing-boot9strap-(usm).txt (Hungarian) * New translations seedminer.txt (Korean) * New translations homebrew-launcher-(pichaxx).txt (Hungarian) * New translations bannerbomb3-fredtool-(twn).txt (Japanese) * New translations installing-boot9strap-(fredtool).txt (Korean) * New translations homebrew-launcher-(pichaxx).txt (Korean) * New translations installing-boot9strap-(usm).txt (Japanese) * New translations finalizing-setup.txt (Dutch) * New translations installing-boot9strap-(fredtool).txt (Dutch) * New translations seedminer.txt (Dutch) * New translations homebrew-launcher-(pichaxx).txt (Japanese) * New translations seedminer.txt (Japanese) * New translations seedminer.txt (Italian) * New translations installing-boot9strap-(fredtool).txt (Japanese) * New translations finalizing-setup.txt (Italian) * New translations installing-boot9strap-(fredtool).txt (Italian) * New translations installing-boot9strap-(usm).txt (Italian) * New translations finalizing-setup.txt (Japanese) * New translations homebrew-launcher-(pichaxx).txt (Italian) * New translations installing-boot9strap-(usm).txt (Dutch) * New translations homebrew-launcher-(pichaxx).txt (Dutch) * New translations finalizing-setup.txt (Norwegian) * New translations installing-boot9strap-(fredtool).txt (Norwegian) * New translations finalizing-setup.txt (Russian) * New translations installing-boot9strap-(fredtool).txt (Russian) * New translations seedminer.txt (Russian) * New translations installing-boot9strap-(usm).txt (Russian) * New translations homebrew-launcher-(pichaxx).txt (Russian) * New translations finalizing-setup.txt (Swedish) * New translations installing-boot9strap-(fredtool).txt (Swedish) * New translations seedminer.txt (Swedish) * New translations installing-boot9strap-(usm).txt (Swedish) * New translations homebrew-launcher-(pichaxx).txt (Swedish) * New translations homebrew-launcher-(pichaxx).txt (Portuguese) * New translations seedminer.txt (Norwegian) * New translations seedminer.txt (Polish) * New translations installing-boot9strap-(usm).txt (Norwegian) * New translations homebrew-launcher-(pichaxx).txt (Norwegian) * New translations finalizing-setup.txt (Polish) * New translations installing-boot9strap-(fredtool).txt (Polish) * New translations installing-boot9strap-(usm).txt (Polish) * New translations installing-boot9strap-(usm).txt (Portuguese) * New translations homebrew-launcher-(pichaxx).txt (Polish) * New translations finalizing-setup.txt (Portuguese) * New translations installing-boot9strap-(fredtool).txt (Portuguese) * New translations seedminer.txt (Portuguese) * New translations finalizing-setup.txt (Chinese Simplified) * New translations installing-boot9strap-(fredtool).txt (Chinese Simplified) * New translations seedminer.txt (Chinese Simplified) * New translations installing-boot9strap-(usm).txt (Chinese Simplified) * New translations homebrew-launcher-(pichaxx).txt (Chinese Simplified) * New translations finalizing-setup.txt (Chinese Traditional) * New translations installing-boot9strap-(fredtool).txt (Chinese Traditional) * New translations seedminer.txt (Chinese Traditional) * New translations installing-boot9strap-(usm).txt (Chinese Traditional) * New translations homebrew-launcher-(pichaxx).txt (Chinese Traditional) * New translations finalizing-setup.txt (Turkish) * New translations installing-boot9strap-(fredtool).txt (Turkish) * New translations seedminer.txt (Turkish) * New translations installing-boot9strap-(usm).txt (Turkish) * New translations homebrew-launcher-(pichaxx).txt (Turkish) * New translations finalizing-setup.txt (Ukrainian) * New translations installing-boot9strap-(fredtool).txt (Ukrainian) * New translations seedminer.txt (Ukrainian) * New translations installing-boot9strap-(usm).txt (Ukrainian) * New translations homebrew-launcher-(pichaxx).txt (Ukrainian) * New translations finalizing-setup.txt (Vietnamese) * New translations installing-boot9strap-(fredtool).txt (Vietnamese) * New translations seedminer.txt (Vietnamese) * New translations finalizing-setup.txt (Thai) * New translations installing-boot9strap-(fredtool).txt (Thai) * New translations seedminer.txt (Thai) * New translations installing-boot9strap-(usm).txt (Thai) * New translations homebrew-launcher-(pichaxx).txt (Thai) * New translations finalizing-setup.txt (Croatian) * New translations installing-boot9strap-(fredtool).txt (Croatian) * New translations seedminer.txt (Croatian) * New translations installing-boot9strap-(usm).txt (Croatian) * New translations homebrew-launcher-(pichaxx).txt (Croatian) * New translations installing-boot9strap-(usm).txt (Vietnamese) * New translations installing-boot9strap-(usm).txt (Portuguese, Brazilian) * New translations homebrew-launcher-(pichaxx).txt (Vietnamese) * New translations finalizing-setup.txt (Portuguese, Brazilian) * New translations installing-boot9strap-(fredtool).txt (Portuguese, Brazilian) * New translations seedminer.txt (Portuguese, Brazilian) * New translations homebrew-launcher-(pichaxx).txt (Portuguese, Brazilian) * New translations homebrew-launcher-(pichaxx).txt (Indonesian) * New translations finalizing-setup.txt (Indonesian) * New translations installing-boot9strap-(fredtool).txt (Indonesian) * New translations seedminer.txt (Indonesian) * New translations installing-boot9strap-(usm).txt (Indonesian) * New translations installing-boot9strap-(soundhax).txt (Romanian) * New translations bannerbomb3.txt (Romanian) * New translations finalizing-setup.txt (Malay) * New translations installing-boot9strap-(fredtool).txt (Malay) * New translations seedminer.txt (Malay) * New translations installing-boot9strap-(usm).txt (Malay) * New translations homebrew-launcher-(pichaxx).txt (Malay) * New translations finalizing-setup.txt (Pirate English) * New translations installing-boot9strap-(fredtool).txt (Pirate English) * New translations seedminer.txt (Pirate English) * New translations installing-boot9strap-(usm).txt (Pirate English) * New translations homebrew-launcher-(pichaxx).txt (Pirate English) * New translations bannerbomb3.txt (Spanish) * New translations installing-boot9strap-(soundhax).txt (Arabic) * New translations bannerbomb3.txt (Arabic) * New translations installing-boot9strap-(soundhax).txt (Spanish) * New translations installing-boot9strap-(soundhax).txt (French) * New translations bannerbomb3.txt (French) * New translations installing-boot9strap-(soundhax).txt (Catalan) * New translations bannerbomb3.txt (Catalan) * New translations installing-boot9strap-(soundhax).txt (Bulgarian) * New translations bannerbomb3.txt (Bulgarian) * New translations installing-boot9strap-(soundhax).txt (Greek) * New translations bannerbomb3.txt (Greek) * New translations installing-boot9strap-(soundhax).txt (Czech) * New translations bannerbomb3.txt (Czech) * New translations installing-boot9strap-(soundhax).txt (German) * New translations bannerbomb3.txt (German) * New translations bannerbomb3.txt (Hebrew) * New translations installing-boot9strap-(soundhax).txt (Hungarian) * New translations bannerbomb3.txt (Hungarian) * New translations installing-boot9strap-(soundhax).txt (Hebrew) * New translations installing-boot9strap-(soundhax).txt (Finnish) * New translations bannerbomb3.txt (Finnish) * New translations installing-boot9strap-(soundhax).txt (Japanese) * New translations bannerbomb3.txt (Japanese) * New translations installing-boot9strap-(soundhax).txt (Korean) * New translations bannerbomb3.txt (Korean) * New translations installing-boot9strap-(soundhax).txt (Italian) * New translations bannerbomb3.txt (Italian) * New translations installing-boot9strap-(soundhax).txt (Dutch) * New translations bannerbomb3.txt (Dutch) * New translations installing-boot9strap-(soundhax).txt (Polish) * New translations bannerbomb3.txt (Polish) * New translations bannerbomb3.txt (Norwegian) * New translations installing-boot9strap-(soundhax).txt (Norwegian) * New translations installing-boot9strap-(soundhax).txt (Russian) * New translations bannerbomb3.txt (Russian) * New translations installing-boot9strap-(soundhax).txt (Portuguese) * New translations bannerbomb3.txt (Portuguese) * New translations installing-boot9strap-(soundhax).txt (Ukrainian) * New translations bannerbomb3.txt (Ukrainian) * New translations installing-boot9strap-(soundhax).txt (Swedish) * New translations bannerbomb3.txt (Swedish) * New translations installing-boot9strap-(soundhax).txt (Turkish) * New translations bannerbomb3.txt (Turkish) * New translations installing-boot9strap-(soundhax).txt (Chinese Traditional) * New translations bannerbomb3.txt (Chinese Traditional) * New translations installing-boot9strap-(soundhax).txt (Chinese Simplified) * New translations bannerbomb3.txt (Chinese Simplified) * New translations installing-boot9strap-(soundhax).txt (Vietnamese) * New translations bannerbomb3.txt (Vietnamese) * New translations bannerbomb3.txt (Indonesian) * New translations installing-boot9strap-(soundhax).txt (Indonesian) * New translations installing-boot9strap-(soundhax).txt (Portuguese, Brazilian) * New translations bannerbomb3.txt (Portuguese, Brazilian) * New translations installing-boot9strap-(soundhax).txt (Malay) * New translations bannerbomb3.txt (Malay) * New translations bannerbomb3.txt (Croatian) * New translations installing-boot9strap-(soundhax).txt (Thai) * New translations bannerbomb3.txt (Thai) * New translations installing-boot9strap-(soundhax).txt (Croatian) * New translations bannerbomb3.txt (Pirate English) * New translations installing-boot9strap-(soundhax).txt (Pirate English) * New translations installing-boot9strap-(hbl-usm).txt (Romanian) * New translations installing-boot9strap-(hbl-usm).txt (Bulgarian) * New translations installing-boot9strap-(hbl-usm).txt (Arabic) * New translations installing-boot9strap-(hbl-usm).txt (Spanish) * New translations installing-boot9strap-(hbl-usm).txt (French) * New translations installing-boot9strap-(hbl-usm).txt (Korean) * New translations installing-boot9strap-(hbl-usm).txt (Japanese) * New translations installing-boot9strap-(hbl-usm).txt (Italian) * New translations installing-boot9strap-(hbl-usm).txt (Hungarian) * New translations installing-boot9strap-(hbl-usm).txt (Hebrew) * New translations installing-boot9strap-(hbl-usm).txt (Greek) * New translations installing-boot9strap-(hbl-usm).txt (German) * New translations installing-boot9strap-(hbl-usm).txt (Czech) * New translations installing-boot9strap-(hbl-usm).txt (Catalan) * New translations installing-boot9strap-(hbl-usm).txt (Finnish) * New translations installing-boot9strap-(hbl-usm).txt (Polish) * New translations installing-boot9strap-(hbl-usm).txt (Chinese Traditional) * New translations installing-boot9strap-(hbl-usm).txt (Swedish) * New translations installing-boot9strap-(hbl-usm).txt (Norwegian) * New translations installing-boot9strap-(hbl-usm).txt (Dutch) * New translations installing-boot9strap-(hbl-usm).txt (Turkish) * New translations installing-boot9strap-(hbl-usm).txt (Ukrainian) * New translations installing-boot9strap-(hbl-usm).txt (Chinese Simplified) * New translations installing-boot9strap-(hbl-usm).txt (Portuguese) * New translations installing-boot9strap-(hbl-usm).txt (Russian) * New translations installing-boot9strap-(hbl-usm).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(hbl-usm).txt (Indonesian) * New translations installing-boot9strap-(hbl-usm).txt (Thai) * New translations installing-boot9strap-(hbl-usm).txt (Croatian) * New translations installing-boot9strap-(hbl-usm).txt (Malay) * New translations installing-boot9strap-(hbl-usm).txt (Pirate English) * New translations installing-boot9strap-(hbl-usm).txt (Vietnamese)
This commit is contained in:
ihaveahax
GitHub
parent
6f84293ff3
commit
1fa045d62a
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `cias` on the root of your SD card if it does not already exist
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Section II - Updating the System
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Update your device by going to System Settings, then "Other Settings", then going all the way to the right and using "System Update"
|
||||
+ Updates while using B9S + Luma (what you have) are safe
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Launch FBI from the list of homebrew
|
||||
1. Navigate to `SD` -> `cias`
|
||||
1. Select "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Power off your device
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. When prompted, press (A) to proceed
|
||||
1. Press (A) to continue
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Press (A) to confirm
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power on your device
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Power off your device
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ This is a currently working implementation of the "FIRM partitions known-plainte
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Power off your device
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert your SD card into your device
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the Soundhax `.m4a` to the root of your SD card
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - Launching SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Power on your device
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `cias` on the root of your SD card if it does not already exist
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Section II - Updating the System
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Update your device by going to System Settings, then "Other Settings", then going all the way to the right and using "System Update"
|
||||
+ Updates while using B9S + Luma (what you have) are safe
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Launch FBI from the list of homebrew
|
||||
1. Navigate to `SD` -> `cias`
|
||||
1. Select "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Power off your device
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. When prompted, press (A) to proceed
|
||||
1. Press (A) to continue
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Press (A) to confirm
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power on your device
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Power off your device
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ This is a currently working implementation of the "FIRM partitions known-plainte
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Power off your device
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert your SD card into your device
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the Soundhax `.m4a` to the root of your SD card
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - Launching SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Power on your device
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `cias` on the root of your SD card if it does not already exist
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Section II - Updating the System
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Update your device by going to System Settings, then "Other Settings", then going all the way to the right and using "System Update"
|
||||
+ Updates while using B9S + Luma (what you have) are safe
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Launch FBI from the list of homebrew
|
||||
1. Navigate to `SD` -> `cias`
|
||||
1. Select "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Power off your device
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. When prompted, press (A) to proceed
|
||||
1. Press (A) to continue
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Premeu (A) per confirmar
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power on your device
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Power off your device
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ This is a currently working implementation of the "FIRM partitions known-plainte
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Power off your device
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert your SD card into your device
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the Soundhax `.m4a` to the root of your SD card
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - Launching SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Power on your device
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `cias` on the root of your SD card if it does not already exist
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Section II - Updating the System
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Update your device by going to System Settings, then "Other Settings", then going all the way to the right and using "System Update"
|
||||
+ Updates while using B9S + Luma (what you have) are safe
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Launch FBI from the list of homebrew
|
||||
1. Navigate to `SD` -> `cias`
|
||||
1. Select "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Power off your device
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. When prompted, press (A) to proceed
|
||||
1. Press (A) to continue
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Press (A) to confirm
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power on your device
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Power off your device
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ This is a currently working implementation of the "FIRM partitions known-plainte
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Power off your device
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert your SD card into your device
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the Soundhax `.m4a` to the root of your SD card
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - Launching SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Power on your device
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Schritt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Stecke deine SD-Karte nun wieder in deinen 3DS
|
||||
1. Schalte deine Konsole an
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Schalte deinen 3DS aus
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Schritt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Schalte dein Gerät aus
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Erstelle einen Ordner namens `cias` im Stammverzeichnis deiner SD-Karte falls er noch nicht existiert
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Stecke deine SD-Karte wieder in dein Gerät
|
||||
1. Schalte deine Konsole an
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Schritt II - Aktualisierung des Systems
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Aktualisiere deine Konsole indem du zu den Systemeinstellungen wechselst, danach "Allgemeine Einstellungen" auswählst, ganz nach rechts navigierst (letzter Punkt im unteren Bildschirm) und dann das "System-Update" startest
|
||||
+ Updates mit B9S + Luma (welches du hast) sind sicher
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Wähle "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Starte FBI aus der Liste des Homebrews
|
||||
1. Navigiere zu `SD` -> `cias`
|
||||
1. Wähle "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Schritt VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Schalte deinen 3DS aus
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. Drücke (A), wenn du dazu aufgefordert wirst, um fortzufahren
|
||||
1. Drücke (A) um fortzufahren
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Drücke (A) zum bestätigen
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Schritt I - Vorbereitungen
|
||||
|
||||
1. Schalte deine Konsole an
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Schalte deinen 3DS aus
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
Dies ist eine zurzeit funktionierende Implementation des "FIRM Partitions Known-Plaintext"-Exploits. Details findest du [hier](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ Dies ist eine zurzeit funktionierende Implementation des "FIRM Partitions Known-
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Schalte deinen 3DS aus
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Schalte deinen 3DS aus
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Stecke deine SD-Karte nun wieder in deinen 3DS
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Schalte deine Konsole an
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ Unter Umständen musst du das Ausschalten der Konsole erzwingen indem du den Power-Knopf gedrückt hälst
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Schalte deinen 3DS aus
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Stecke deine SD-Karte nun wieder in deinen 3DS
|
||||
1. Schalte deine Konsole an
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Schritt I - Vorbereitungen
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Schritt III - boot9strap installieren
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Starte die Download-Spiel Anwendung
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installation von boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Schritt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Schalte deinen 3DS aus
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Kopiere die Soundhax`.m4a` in das Stammverzeichnis der SD-Karte
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Stecke deine SD-Karte nun wieder in deinen 3DS
|
||||
1. Schalte deine Konsole an
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Schritt II - Starten von SafeBS9Installer
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Stecke deine SD-Karte nun wieder in deinen 3DS
|
||||
1. Schalte deine Konsole an
|
||||
1. Starte die Nintendo 3DS Sound App
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Schritt III - boot9strap installieren
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Dein Gerät sollte neu starten und die Luma3DS Konfiguration anzeigen
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Schritt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Kopiere `boot9strap.firm` und `boot9strap.firm.sha` aus der boot9strap `.zip` in den `/boot9strap/`-Ordner auf deiner SD-Karte
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Stecke deine SD-Karte nun wieder in deinen 3DS
|
||||
1. Schalte deine Konsole an
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Schalte deinen 3DS aus
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Anleitung
|
||||
|
||||
#### Schritt I - Vorbereitungen
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Schalte deine Konsole an
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Power off your device
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Power off your device
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Δημιουργήστε έναν φάκελο με το όνομα `cias` στην ρίζα της κάρτας SD, σε περίπτωση που δεν υπάρχει ήδη
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Section II - Updating the System
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Update your device by going to System Settings, then "Other Settings", then going all the way to the right and using "System Update"
|
||||
+ Updates while using B9S + Luma (what you have) are safe
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Launch FBI from the list of homebrew
|
||||
1. Navigate to `SD` -> `cias`
|
||||
1. Επιλέξτε "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Power off your device
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. When prompted, press (A) to proceed
|
||||
1. Πατήστε (A) για να συνεχίσετε
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Πατήστε (A) για επιβεβαίωση
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power on your device
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Power off your device
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ This is a currently working implementation of the "FIRM partitions known-plainte
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Power off your device
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your device
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert your SD card into your device
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Power off your device
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Power off your device
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy the Soundhax `.m4a` to the root of your SD card
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - Launching SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Εκκινήστε την εφαρμογή Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Power off your device
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Power on your device
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Reinsert ye SD card into ye device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Power off ye device
|
||||
1. Insert ye SD card into ye computer
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Power off ye device
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Create a folder named `cias` on th' root 'o ye SD card if it does not already exist
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Reinsert ye SD card into ye device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Section II - Updating the System
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Update ye device by settin' off to System Settin's, then "Other Settings", then goin' all th' way to th' right 'n usin' "System Update"
|
||||
+ Updates while usin' B9S + Luma (what ye have) be safe
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Launch FBI from th' list 'o homebrew
|
||||
1. Navigate to `SD` -> `cias`
|
||||
1. Select "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Power off ye device
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. When prompted, push (A) to proceed
|
||||
1. Press (A) to continue
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Press (A) to confirm
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power on your device
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Power off ye device
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ This is a currently working implementation of the "FIRM partitions known-plainte
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Power off ye device
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off ye device
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert ye SD card into ye device
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Power off ye device
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Reinsert ye SD card into ye device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Power off ye device
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy the Soundhax `.m4a` to the root of your SD card
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Reinsert ye SD card into ye device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - Launching SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Reinsert ye SD card into ye device
|
||||
1. Power on your device
|
||||
1. Launch Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Ye device should have rebooted into th' Luma3DS configuration menu
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copy `boot9strap.firm` 'n `boot9strap.firm.sha` from th' boot9strap `.zip` to th' `/boot9strap/` folder on ye SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Reinsert ye SD card into ye device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Power off ye device
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Power on your device
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Para volcar una aplicación DSiWare del sistema, aprovecharemos un fallo en la ventana de Gestión de datos DSiWare de la aplicación Configuración.
|
||||
|
||||
Para lograrlo, usamos la clave de cifrado de tu sistema (movable.sed) para crear una copia de seguridad DSiWare que se aproveche del fallo del sistema para volcar la aplicación de Configuración de internet de DSi a la raíz de la SD.
|
||||
### Compatibility Notes
|
||||
|
||||
Estas instrucciones funcionan en consolas de las regiones USA, Europa, Japón y Corea, indicado por las letras U, E, J o K después de la versión del sistema.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Tu archivo `movable.sed` proveniente de haber completado [Seedminer](seedminer)
|
||||
|
||||
#### Sección I - Preparativos
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Abre [BannerBomb3 Tool](https://bb3.nhnarwhal.com/3dstools/bannerbomb3.php) en tu computadora
|
||||
1. Carga tu movable.sed usando la opción "Choose File"
|
||||
1. Haz click en "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. Si tu consola está encendida, apagala
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ La `<ID0>` en cuestión es la misma que usaste en [Seedminer](seedminer)
|
||||
+ El `<ID1>` es una carpeta con un nombre compuesto por 32 caracteres, dentro de `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copia el archivo `F00D43D5.bin` del `.zip` de BannerBomb3 a la carpeta `Nintendo DSiWare`
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Sección II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Vuelve a insertar tu tarjeta SD en tu consola
|
||||
1. Enciende tu consola
|
||||
1. Entra a Configuración de la consola
|
||||
1. Ve a `Data Management` -> `DSiWare`
|
||||
1. Haz click en la sección de tarjeta SD
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Tu sistema debería parpadear el color magenta (rosa/púrpura) y luego crashear unos segundos después. Esto significa que funcionó
|
||||
1. Apaga tu consola
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Ahora deberías tener `42383841.bin` en la raíz de la SD. Esta es la copia de seguridad de DSiWare que usarás después en esta guía
|
||||
1. Ve a `Nintendo 3DS` -> `<ID0>` -> `<ID-de-32-caracteres>` -> `Nintendo DSiWare` en tu tarjeta SD
|
||||
+ La `<ID0>` en cuestión es la misma que usaste en [Seedminer](seedminer)
|
||||
1. Elimina `F00D43D5.bin` de la carpeta Nintendo DSiWare y de tu computadora. Este archivo ya no será necesario
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Ve a `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` en tu tarjeta SD
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. Este archivo ya no será necesario
|
||||
|
||||
|
||||
Continúa en [Instalar boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Sección I - Preparativos
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Apaga tu consola
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Crea una carpeta llamada `cias` en la raíz de tu tarjeta SD, si aún no existe
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Vuelve a insertar tu tarjeta SD en tu consola
|
||||
1. Enciende tu consola
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Sección II - Actualizar el sistema
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Actualiza tu 3DS dirigiéndote a la Configuración de la consola, después a "Otras opciones", luego ve al último menú de la derecha y pulsa en "Actualización"
|
||||
+ Actualizar la consola teniendo B9S y Luma (lo que acabas de instalar) es seguro
|
||||
+ El actualizador podría mostrar un mensaje diciendo "La consola ya está actualizada" en lugar de actualizar. Esto es normal si tu consola ya está actualizada; continúa con la siguiente sección
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Sección III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Ejecuta la aplicación Modo Descarga (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Espera hasta ver las opciones que dicen `Nintendo 3DS` y `Nintendo DS`
|
||||
1. Presiona (Left Shoulder) + (Abajo) + (Select) a la vez para abrir el menú de Rosalina
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Presiona (Left Shoulder) + (Abajo) + (Select) a la vez para abrir el menú de Rosalina
|
||||
1. Selecciona "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Inicia FBI desde la lista de homebrew
|
||||
1. Ve a `SD` -> `cias`
|
||||
1. Selecciona "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Sección VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Apaga tu consola
|
||||
1. Presiona y mantén el botón (Start), y mientras lo mantienes presionado, enciende tu consola. Esto abrirá GodMode9
|
||||
+ Si GodMode9 no inicia, asegúrate de que `GodMode9.firm` esté en `/luma/payloads/` y que `payloads` esté escrito correctamente
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Sección VII - Limpieza de la tarjeta SD
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Selecciona "Cleanup SD Card"
|
||||
1. Presiona (A) para continuar cuando se te pida
|
||||
1. Presiona (A) para continuar
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Sección VIII - Copia de Seguridad de Archivos Esenciales
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Selecciona "Backup Options"
|
||||
1. Selecciona "SysNAND Backup"
|
||||
1. Presiona (A) para confirmar
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Información y notas
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Sección I - Preparativos
|
||||
|
||||
1. Enciende tu consola
|
||||
1. Entra a Nintendo eShop
|
||||
1. Toca el ícono de búsqueda (la lupa pequeña)
|
||||
1. Busca `picross`
|
||||
1. Abre la página de Pokémon Picross
|
||||
1. Descarga Pokémon Picross
|
||||
+ Puedes escanear [este código QR](http://api.qrserver.com/v1/create-qr-code/?color=0000&bgcolor=FFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) usando la Cámara de Nintendo 3DS para ir directamente a la página de la eShop del juego
|
||||
+ Tu tarjeta SD debe estar insertada en tu consola para instalar Pokémon Picross
|
||||
1. Apaga tu consola
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Copia los archivos `boot.firm` y `boot.3dsx` desde el `.zip` de Luma3DS a la raíz de tu tarjeta SD
|
||||
+ La raíz de tu tarjeta SD se refiere al primer directorio de la tarjeta, donde puedes ver la carpeta Nintendo 3DS pero no estás dentro de ella
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Sección II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Abre [la página de PicHaxx Injector](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) en tu computadora
|
||||
1. Selecciona tu archivo `movable.sed`
|
||||
1. Selecciona "Build and Download" (Construir y Descargar)
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
|
||||
Este método de uso de Seedminer, para hacer un mejor exploit, utiliza tu archivo `movable.sed` para desencriptar cualquier título de DSiWare con el objetivo de inyectar un título de DSiWare vulnerable en la aplicación de Configuración de Internet de DS. Esto requiere que tengas una copia de seguridad de un título de DSiWare, por ejemplo, el proveniente de BannerBomb o la herramienta DSiWare Dumper.
|
||||
|
||||
Todo esto son implementaciones funcionales del exploit "Particiones FIRM de texto plano conocido" detallado [aquí](https://www.3dbrew.org/wiki/3DS_System_Flaws) (*en inglés*).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Qué necesitas
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Tu archivo `movable.sed` proveniente de haber completado [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ Todo esto son implementaciones funcionales del exploit "Particiones FIRM de text
|
||||
|
||||
#### Sección I - Verificación de CFW
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Apaga tu consola
|
||||
1. Mantén pulsado el botón (Select)
|
||||
1. Enciende la consola mientras mantienes presionado (Select)
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Sección II - Preparativos
|
||||
|
||||
1. Apaga tu consola
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Copia los archivos `boot.firm` y `boot.3dsx` desde el `.zip` de Luma3DS a la raíz de tu tarjeta SD
|
||||
+ La raíz de tu tarjeta SD se refiere al primer directorio de la tarjeta, donde puedes ver la carpeta Nintendo 3DS pero no estás dentro de ella
|
||||
1. Copia `boot.nds` (B9STool) a la raíz de tu tarjeta SD
|
||||
1. Copia la carpeta `private` contenida en el `.zip` de Frogminer_save a la raíz de tu tarjeta SD
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Sección III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Ve a `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` en tu tarjeta SD
|
||||
+ La `<ID0>` en cuestión es la misma que usaste en [Seedminer](seedminer)
|
||||
+ El `<ID1>` es una carpeta con un nombre compuesto por 32 caracteres, dentro de `<ID0>`
|
||||
+ Si no existe la carpeta `Nintendo DSiWare`, créala dentro de la carpeta `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Vuelve a insertar tu tarjeta SD en tu consola
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copia los archivos `boot.firm` y `boot.3dsx` desde el `.zip` de Luma3DS a la raíz de tu tarjeta SD
|
||||
+ La raíz de tu tarjeta SD se refiere al primer directorio de la tarjeta, donde puedes ver la carpeta Nintendo 3DS pero no estás dentro de ella
|
||||
1. Copia `boot.nds` (B9STool) a la raíz de tu tarjeta SD
|
||||
1. Copia la carpeta `private` contenida en el `.zip` de Frogminer_save a la raíz de tu tarjeta SD
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Enciende tu consola
|
||||
1. Entra a Configuración de la consola
|
||||
1. Ve a `Data Management` -> `DSiWare`
|
||||
1. En la sección "Tarjeta SD", elige el título "Haxxxxxxxxx!"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Selecciona "Copiar", luego "OK"
|
||||
1. Regresa al menú principal de Configuración de la Consola
|
||||
1. Ve a `Configuraciones de Internet` -> `Conexiones de Nintendo DS`, luego elige "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. Si el exploit fue exitoso, tu consola habrá cargado la versión japonesa de Flipnote Studio
|
||||
|
||||
#### Sección IV - Exploit de Flipnote
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
Si prefieres una guía visual para esta parte, hay una disponible [aquí](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Completa la configuración del juego hasta que llegues al menú principal
|
||||
+ Selecciona la opción de la izquierda cuando te lo pida durante la configuración inicial
|
||||
1. Utilizando la pantalla táctil, selecciona el cuadrado grande de la izquierda, luego selecciona el cuadrado con el ícono de una tarjeta SD
|
||||
@ -85,7 +92,7 @@ Si prefieres una guía visual para esta parte, hay una disponible [aquí](https:
|
||||
1. Toca el cuarto cuadrado con una letra "A" en él
|
||||
1. Si el exploit fue exitoso, tu consola habrá cargado b9sTool
|
||||
1. Usando el D-Pad, selecciona "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Presiona (A), luego presiona START y SELECT al mismo tiempo para iniciar el proceso
|
||||
1. Una vez completado y con la pantalla inferior diciendo "done.", sal de b9sTool, y luego apaga tu consola
|
||||
+ Puede que tengas que forzar el apagado manteniendo pulsado el botón de encendido
|
||||
@ -94,6 +101,8 @@ Si prefieres una guía visual para esta parte, hay una disponible [aquí](https:
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Apaga tu consola
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Sección VI - Restaurar Conexiones de Nintendo DS
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Reemplaza el archivo `42383841.bin` ya existente
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Ve a `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` en tu tarjeta SD
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Vuelve a insertar tu tarjeta SD en tu consola
|
||||
1. Enciende tu consola
|
||||
1. Entra a Configuración de la consola
|
||||
1. Ve a `Data Management` -> `DSiWare`
|
||||
1. En la sección "Tarjeta SD", elige el título "Nintendo DSi™"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Selecciona "Copiar", luego "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Para pode aprovechar el exploit del firmware SAFE_MODE de nuestro sistema, necesitamos inyectar un perfil de WiFi con el exploit.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Una vez que el perfil de WiFi ha sido inyectado, usaremos SAFE_MODE, que consiste en una función de recuperación presente en todas las consolas, para activar el perfil de WiFi con el exploit.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Sección I - Preparativos
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Mantén pulsados los botones hasta que la consola encienda en modo seguro
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Presiona "OK" para aceptar la actualización
|
||||
+ No hay actualización. Esto es parte del exploit
|
||||
1. Presiona sobre "Acepto" para aceptar los términos y condiciones
|
||||
1. The update will eventually fail, with the error code `003-1099`. Este comportamiento es el esperado
|
||||
1. Cuando se te pregunte "¿Quieres configurar tu conexión a internet?", selecciona "Aceptar"
|
||||
1. En el menú siguiente, navega a `Conexión 1` -> `Modificar ajustes` -> `Siguiente página (flecha derecha)` -> `Servidor proxy` -> `Ajustes avanzados`
|
||||
+ Esto es una [representación visual](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. Si el exploit ha funcionado, la consola habrá iniciado SafeB9SInstaller
|
||||
|
||||
#### Sección III - Instalar boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. Cuando se te pida, introduce la combinación de botones mostrada para instalar boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Inicia la aplicación de Modo Descarga
|
||||
1. Espera hasta que veas los dos botones
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Instalar boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (en combinación con universal-otherapp) es compatible con las versiones 1.0.0 hasta la 11.3.0 en todas las regiones.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (en combinación con universal-otherapp) es compatible con las versione
|
||||
|
||||
#### Sección I - Preparativos
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Apaga tu consola
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Copia el archivo `.m4a` de Soundhax a la raíz de tu tarjeta SD
|
||||
@ -33,11 +41,16 @@ Soundhax (en combinación con universal-otherapp) es compatible con las versione
|
||||
1. Vuelve a insertar tu tarjeta SD en tu consola
|
||||
1. Enciende tu consola
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Sección II - Ejecutar SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Vuelve a insertar tu tarjeta SD en tu consola
|
||||
1. Enciende tu consola
|
||||
1. Inicia Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (en combinación con universal-otherapp) es compatible con las versione
|
||||
|
||||
#### Sección III - Instalar boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. Cuando se te pida, introduce la combinación de botones mostrada para instalar boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Tu consola debería haber reiniciado en el menú de configuración de Luma3DS
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Instalar boot9strap (USM)"
|
||||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Para pode aprovechar el exploit del firmware SAFE_MODE de nuestro sistema, necesitamos inyectar un perfil de WiFi con el exploit.
|
||||
|
||||
Podemos hacer esto utilizando un exploit existente, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Una vez que el perfil de WiFi ha sido inyectado, usaremos SAFE_MODE, que consiste en una función de recuperación presente en todas las consolas, para activar el perfil de WiFi con el exploit.
|
||||
### Compatibility Notes
|
||||
|
||||
Estas instrucciones funcionan en consolas de las regiones USA, Europa, Japón y Corea, indicado por las letras U, E, J o K después de la versión del sistema.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Sección I - Preparativos
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. Si tu consola está encendida, apágala
|
||||
1. Abre [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) en tu computadora
|
||||
1. Carga tu movable.sed usando la opción "Choose File"
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copia `boot9strap.firm` y `boot9strap.firm.sha` desde el `.zip` de `boot9strap` a la carpeta `/boot9strap/` en tu tarjeta SD
|
||||
1. Copia `SafeB9SInstaller.bin` desde el `.zip` de SafeB9SInstaller a la raíz de tu tarjeta SD
|
||||
1. Copia el archivo `usm.bin` desde `unSAFE_MODE.zip` a la raíz de tu tarjeta SD
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ La `<ID0>` en cuestión es la misma que usaste en [Seedminer](seedminer)
|
||||
+ El `<ID1>` es una carpeta con un nombre compuesto por 32 caracteres, dentro de `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copia el archivo `F00D43D5.bin` desde `unSAFE_MODE.zip` a la carpeta `Nintendo DSiWare`
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Sección II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Vuelve a insertar tu tarjeta SD en tu consola
|
||||
1. Enciende tu consola
|
||||
1. Entra a Configuración de la consola
|
||||
1. Ve a `Data Management` -> `DSiWare`
|
||||
1. Haz click en la sección de tarjeta SD
|
||||
+ La consola debería mostrar un menú con algo de texto
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Selecciona "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Tu consola se apagará automáticamente
|
||||
|
||||
#### Sección III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Mantén pulsados los botones hasta que la consola encienda en modo seguro
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Presiona "OK" para aceptar la actualización
|
||||
+ No hay actualización. Esto es parte del exploit
|
||||
1. Presiona sobre "Acepto" para aceptar los términos y condiciones
|
||||
1. The update will eventually fail, with the error code `003-1099`. Este comportamiento es el esperado
|
||||
1. Cuando se te pregunte "¿Quieres configurar tu conexión a internet?", selecciona "Aceptar"
|
||||
1. En el menú siguiente, navega a `Conexión 1` -> `Modificar ajustes` -> `Siguiente página (flecha derecha)` -> `Servidor proxy` -> `Ajustes avanzados`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. Si el exploit ha funcionado, la consola habrá iniciado SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. Cuando se te pida, introduce la combinación de botones mostrada para instalar boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Entra a Configuración de la consola
|
||||
1. Ve a `Data Management` -> `DSiWare`
|
||||
1. Haz click en la sección de tarjeta SD
|
||||
+ La consola debería mostrar un menú con algo de texto
|
||||
1. Selecciona "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Apaga tu consola
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Ve a `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` en tu tarjeta SD
|
||||
1. Elimina `F00D43D5.bin` de la carpeta Nintendo DSiWare
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. Este archivo ya no será necesario
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Para instalar boot9strap en tu consola, obtenemos la clave de encriptación exclusiva de la misma. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
Este método utiliza una tarjeta gráfica potente para realizar los cálculos necesarios. Para ayudarte con este método se utiliza un sitio web mantenido por voluntarios.
|
||||
|
||||
### Instrucciones
|
||||
|
||||
#### Sección I - Preparativos
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Ve a la carpeta `Nintendo 3DS` en tu tarjeta SD
|
||||
1. Copia el nombre de 32 caracteres de la carpeta que hay dentro de Nintendo 3DS
|
||||
+ No abras más carpetas dentro de ésta
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Pega el nombre de 32 caracteres en un documento que puedas tener a mano más tarde
|
||||
+ Este nombre se conoce también como el "ID0" de tu consola
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Enciende tu consola
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ Si recibes un error y eres expulsado del menú, es posible que debas crear un nuevo Mii o que tu consola no se pueda conectar a los servidores de Nintendo (debido a un ban o problemas de conexión)
|
||||
1. Encuentra el perfil de tu Mii, luego busca donde dice "Código de amigo" en la pantalla superior
|
||||
|
||||
#### Sección II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ Este método utiliza una tarjeta gráfica potente para realizar los cálculos ne
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Vaihe I – Valmistelut
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Aseta SD-korttisi takaisin konsoliisi
|
||||
1. Käynnistä konsolisi
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Sammuta konsolisi
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Vaihe I – Valmistelut
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Sammuta konsolisi
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Luo `cias`‑niminen kansio SD‑korttisi juureen, jos sitä ei jo ole olemassa
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Aseta SD-korttisi takaisin konsoliisi
|
||||
1. Käynnistä konsolisi
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Vaihe II – Järjestelmän päivittäminen
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Päivitä konsolisi menemällä järjestelmäasetuksiin (System Settings), valitse muut asetukset (Other Settings) ja sitten järjestelmäpäivitys (System Update) viimeiseltä sivulta
|
||||
+ Päivitykset B9S + Luma -kokoonpanolla (joka sinulla on) ovat turvallisia
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Valitse "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Avaa FBI homebrew-listasta
|
||||
1. Mene hakemistoon `SD` → `cias`
|
||||
1. Valitse "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Vaihe VI – Luma3DS:n asentaminen CTRNANDiin
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Sammuta konsolisi
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. Paina kehotettaessa (A):ta jatkaaksesi
|
||||
1. Paina (A):ta jatkaaksesi
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Paina (A):ta vahvistaaksesi
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Vaihe I – Valmistelut
|
||||
|
||||
1. Käynnistä konsolisi
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Sammuta konsolisi
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
Tämä menetelmä käyttää FIRM-osioiden salaamatonta muotoa (known-plaintext, selitetty [täällä](https://www.3dbrew.org/wiki/3DS_System_Flaws)) hyödyntävää haavoittuvuutta.
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Tarpeet
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ Tämä menetelmä käyttää FIRM-osioiden salaamatonta muotoa (known-plaintext,
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Sammuta konsolisi
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Sammuta konsolisi
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Aseta SD-korttisi takaisin konsoliisi
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Käynnistä konsolisi
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ Voit joutua pakottamaan konsolin sammuksiin pitämällä virtapainiketta pohjassa
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Sammuta konsolisi
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Aseta SD-korttisi takaisin konsoliisi
|
||||
1. Käynnistä konsolisi
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Vaihe I – Valmistelut
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Vaihe III – Boot9strapin asentaminen
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Avaa Download Play -sovellus
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Vaihe I – Valmistelut
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Sammuta konsolisi
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Kopioi SoundHax-`.m4a`-tiedosto SD-korttisi juureen
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Aseta SD-korttisi takaisin konsoliisi
|
||||
1. Käynnistä konsolisi
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Vaihe II – SafeB9SInstallerin avaaminen
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Aseta SD-korttisi takaisin konsoliisi
|
||||
1. Käynnistä konsolisi
|
||||
1. Avaa Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Vaihe III – Boot9strapin asentaminen
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Konsolisi pitäisi uudelleenkäynnistyä suoraan Luma3DS:n määritysvalikkoon
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Vaihe I – Valmistelut
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Kopioi boot9strap-`.zip`-pakkauksesta `boot9strap.firm` ja `boot9strap.firm.sha` SD-korttisi `/boot9strap/`-kansioon
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Aseta SD-korttisi takaisin konsoliisi
|
||||
1. Käynnistä konsolisi
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Sammuta konsolisi
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Ohjeet
|
||||
|
||||
#### Vaihe I – Valmistelut
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Käynnistä konsolisi
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -58,7 +58,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ L'`<ID0>` sera le même que celui que vous avez utilisé dans [Seedminer](seedminer)
|
||||
+ L'`<ID1>` est un dossier de 32 caractères à l'intérieur du `<ID0>`
|
||||
+ L'`<ID1>` est un dossier de 32 caractères à l'intérieur du dossier `<ID0>`
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Open the output_(name) `.zip` file and navigate to `China_Taiwan` -> `output_setup`
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Table des matières" %}
|
||||
|
||||
### Lecture requise
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Pour extraire un DSiWare système, nous exploitons une faille dans l'onglet de gestion des données DSiWare présent dans les paramètres système.
|
||||
|
||||
Pour accomplir cela, nous utilisons la clé de chiffrement de votre console (movable.sed) pour construire une copie de DSiWare qui exploite le système afin d'en extraire l'application Paramètres Internet DSi à la racine de la carte SD.
|
||||
### Compatibility Notes
|
||||
|
||||
Ces instructions fonctionnent dans les régions USA, Europe, Japon et Corée indiquées par les lettres U, E, J ou K après le numéro de version de la console.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Votre fichier `movable.sed` obtenu grâce à [Seedminer](seedminer)
|
||||
|
||||
#### Section I - Préparatifs
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Ouvrez [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) sur votre ordinateur
|
||||
1. Téléchargez votre movable.sed en utilisant l'option "Choisir le fichier"
|
||||
1. Sélectionnez "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. Si votre console est allumée, éteignez-la
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ L'`<ID0>` sera le même que celui que vous avez utilisé dans [Seedminer](seedminer)
|
||||
+ L'`<ID1>` est un dossier de 32 caractères à l'intérieur du `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copiez le fichier `F00D43D5.bin` depuis l'archive `.zip` de BannerBomb3 vers le dossier `Nintendo DSiWare`
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Réinsérez votre carte SD dans votre 3DS
|
||||
1. Allumez votre console
|
||||
1. Lancez les Paramètres de la console
|
||||
1. Naviguez vers `Gestion des données` -> `DSiWare`
|
||||
1. Cliquez sur l'onglet Carte SD
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Votre console devrait clignoter en magenta (rose/violet) et puis planter quelques secondes plus tard. Cela signifie que ça a fonctionné
|
||||
1. Éteignez votre 3DS
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Vous devriez maintenant avoir le fichier `42383841.bin` à la racine de votre carte SD. Ceci est la copie de DSiWare que vous utiliserez plus tard dans le guide
|
||||
1. Naviguez vers `Nintendo 3DS` -> `<ID0>` -> `<id-de-32-caractères>` -> `Nintendo DSiWare` sur votre carte SD
|
||||
+ Cet `<ID0>` sera le même que celui que vous avez utilisé dans [Seedminer](seedminer)
|
||||
1. Supprimez `F00D43D5.bin` du dossier Nintendo DSiWare et de votre ordinateur. Ce fichier ne sera plus nécessaire
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Naviguez vers `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` sur votre carte SD
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. Ce fichier ne sera plus nécessaire
|
||||
|
||||
|
||||
Continuez vers [Installation de boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Section I - Préparatifs
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Éteignez votre 3DS
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Créez un dossier nommé `cias` à la racine de votre carte SD si celui ci n'existe pas
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Réinsérez votre carte SD dans votre 3DS
|
||||
1. Allumez votre console
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Section II - Mise à jour du système
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Mettez à jour votre console en vous rendant dans les Paramètres de la console, puis "Autres paramètres", puis tout à droite sur l'option "Mise à jour"
|
||||
+ Mettre à jour tout en ayant B9S + Luma (ce que vous avez) est sans danger
|
||||
+ La console peut afficher un message disant "Aucune mise à jour nécessaire" au lieu de faire une mise à jour. Ceci est normal si vous êtes déjà à jour ; continuez vers la section suivante
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Lancez l'application Mode Téléchargement (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Attendez jusqu'à ce que vous voyiez les boutons `Nintendo 3DS` et `Nintendo DS`
|
||||
1. Appuyez simultanément sur (L) + (Bas sur la croix directionnelle) + (Select) pour ouvrir le menu Rosalina
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Appuyez simultanément sur (L) + (Bas sur la croix directionnelle) + (Select) pour ouvrir le menu Rosalina
|
||||
1. Sélectionnez "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Lancez FBI que vous trouverez dans la liste des homebrews
|
||||
1. Naviguez vers `SD` -> `cias`
|
||||
1. Sélectionnez "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Éteignez votre 3DS
|
||||
1. Appuyez sur le bouton (START) et maintenez le enfoncé tout en allumant votre console. Ceci lancera GodMode9
|
||||
+ Si votre console ne démarre pas sur GodMode9, assurez-vous que le fichier `GodMode9.firm` est présent dans `/luma/payloads/` et que `payloads` est correctement écrit
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Nettoyage de la carte SD
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Sélectionnez "Cleanup SD Card"
|
||||
1. Lorsque vous êtes invité, appuyez sur (A)
|
||||
1. Appuyez sur (A) pour continuer
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Sauvegarde des fichiers essentiels
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Sélectionnez "Backup Options"
|
||||
1. Sélectionnez "SysNAND Backup"
|
||||
1. Appuyez sur (A) pour confirmer
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Informations et notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Table des matières" %}
|
||||
|
||||
### Lecture requise
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Section I - Préparatifs
|
||||
|
||||
1. Allumez votre console
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ Vous pouvez scanner [ce QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) en utilisant l'Appareil photo Nintendo 3DS pour un lien direct vers l'application eShop
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Éteignez votre 3DS
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Copiez `boot.firm` et `boot.3dsx` depuis Luma3DS `.zip`vers la racine de votre carte SD
|
||||
+ La racine de la carte SD représente le répertoire initial de la carte SD où vous pouvez voir le dossier Nintendo 3DS, mais ce n'est pas à l'intérieur de ce dernier
|
||||
@ -40,15 +41,23 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Ouvrez [le site Web de PicHaxx Injector](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) sur votre ordinateur
|
||||
1. Sélectionnez votre fichier `movable.sed`
|
||||
1. Sélectionnez "Build and Download"
|
||||
1. Attendez la fin de l'opération
|
||||
1. Accédez à `Nintendo 3DS` ->`<ID0>`->`<ID1>`->`title` -> `00040000` ->` 0017c100` -> `data` sur votre carte SD
|
||||
+ L'`<ID0>` sera le même que celui que vous avez utilisé dans [Seedminer](seedminer)
|
||||
+ L'`<ID1>` est un dossier de 32 caractères à l'intérieur du `<ID0>`
|
||||
+ L'`<ID1>` est un dossier de 32 caractères à l'intérieur du dossier `<ID0>`
|
||||
1. Copiez le fichier fraîchement téléchargé `00000001.sav` vers le dossier `data` sur votre carte SD
|
||||
+ Remplacez l'ancien fichier de sauvegarde lorsque cela vous sera demandé
|
||||
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Table des matières" %}
|
||||
|
||||
### Lecture requise
|
||||
|
||||
Cette méthode d'utilisation de Seedminer pour une exploitation ultérieure utilise votre fichier `movable.sed` pour déchiffrer n'importe quel titre DSiWare afin d'injecter un titre DSiWare exploitable dans l'application Connexions Nintendo DS. Cela nécessite d'avoir une sauvegarde d'un DSiWare, par exemple à partir de BannerBomb ou de l'outil DSiWare Dumper.
|
||||
|
||||
Ceci est une implémentation de l'exploit "FIRM partitions known-plaintext" qui est décrit [ici](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
## Ce dont vous avez besoin
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Votre fichier `movable.sed` obtenu grâce à [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ Ceci est une implémentation de l'exploit "FIRM partitions known-plaintext" qui
|
||||
|
||||
#### Section I - Vérification de la présence d’un CFW
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Éteignez votre 3DS
|
||||
1. Maintenez le bouton (Select) enfoncé
|
||||
1. Allumez votre console tout en maintenant le bouton (Select) enfoncé
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Préparatifs
|
||||
|
||||
1. Éteignez votre 3DS
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Copiez `boot.firm` et `boot.3dsx` depuis Luma3DS `.zip`vers la racine de votre carte SD
|
||||
+ La racine de la carte SD représente le répertoire initial de la carte SD où vous pouvez voir le dossier Nintendo 3DS, mais ce n'est pas à l'intérieur de ce dernier
|
||||
1. Copiez le fichier `boot.nds`(B9STool) vers la racine de votre carte SD
|
||||
1. Copiez le dossier `private` du fichier `.zip` de Frogminer_save vers la racine de votre carte SD
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Naviguez vers `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` sur votre carte SD
|
||||
+ L'`<ID0>` sera le même que celui que vous avez utilisé dans [Seedminer](seedminer)
|
||||
+ L'`<ID1>` est un dossier de 32 caractères à l'intérieur du `<ID0>`
|
||||
+ Si le dossier `Nintendo DSiWare` n'existe pas, créez-le à l'intérieur de `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Réinsérez votre carte SD dans votre 3DS
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copiez `boot.firm` et `boot.3dsx` depuis Luma3DS `.zip`vers la racine de votre carte SD
|
||||
+ La racine de la carte SD représente le répertoire initial de la carte SD où vous pouvez voir le dossier Nintendo 3DS, mais ce n'est pas à l'intérieur de ce dernier
|
||||
1. Copiez le fichier `boot.nds`(B9STool) vers la racine de votre carte SD
|
||||
1. Copiez le dossier `private` du fichier `.zip` de Frogminer_save vers la racine de votre carte SD
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Allumez votre console
|
||||
1. Lancez les Paramètres de la console
|
||||
1. Naviguez vers`Gestion des données` -> `DSiWare`
|
||||
1. Sous la section "Carte SD", sélectionnez le titre "Haxxxxxxxxx !"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Sélectionnez "Copier", puis sélectionnez "OK"
|
||||
1. Retournez au menu principal des Paramètres de la console
|
||||
1. Naviguez vers `Paramètres Internet` -> `Connexions Nintendo DS`, puis sélectionnez "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. Si l'exploit a réussi, votre console devrait avoir démarré la version japonaise de Flipnote Studio
|
||||
|
||||
#### Section IV - Exploit Flipnote
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
Si vous préférez un guide visuel pour cette section, un tel guide est disponible [ici](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Terminez le processus de configuration initial pour le jeu lancé jusqu'à ce que vous atteigniez le menu principal
|
||||
+ Sélectionnez l'option de gauche chaque fois que vous y êtes invité durant le processus de configuration
|
||||
1. En utilisant l'écran tactile, sélectionnez la grande case à gauche, puis sélectionnez la boîte avec une icône de carte SD
|
||||
@ -85,7 +92,7 @@ Si vous préférez un guide visuel pour cette section, un tel guide est disponib
|
||||
1. Touchez la quatrième case contenant la lettre "A"
|
||||
1. Si l'exploit a réussi, votre console devrait avoir démarré b9sTool
|
||||
1. Séléctionnez "Install boot9strap" en utilisant la croix directionnelle
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Appuyez sur (A), puis appuyez sur START et SELECT en même temps pour démarrer le processus
|
||||
1. Une fois que le processus est terminé et que vous voyez le message "done." s'afficher sur l'écran du bas, quittez b9sTool, puis éteignez votre console
|
||||
+ Vous allez peut-être devoir forcer la fermeture en maintenant le bouton d’alimentation enfoncé
|
||||
@ -94,6 +101,8 @@ Si vous préférez un guide visuel pour cette section, un tel guide est disponib
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Éteignez votre 3DS
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restauration des paramètres de Connexions Nintendo DS
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Remplacez le fichier `42383841.bin` existant
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Naviguez vers `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` sur votre carte SD
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Réinsérez votre carte SD dans votre 3DS
|
||||
1. Allumez votre console
|
||||
1. Lancez les Paramètres de la console
|
||||
1. Naviguez vers`Gestion des données` -> `DSiWare`
|
||||
1. Sous la section "Carte SD", sélectionnez le titre "Nintendo DSi™"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Sélectionnez "Copier", puis sélectionnez "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Table des matières" %}
|
||||
|
||||
### Lecture requise
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Afin d'exploiter le firmware SAFE_MODE de notre console, nous devons injecter un profil Wi-Fi exploité.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Une fois le profil WiFi injecté, nous utiliserons SAFE_MODE, qui est une fonctionnalité de récupération présente sur toutes les consoles 3DS, pour activer le profil WiFi exploité.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Section I - Préparatifs
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Maintenez les boutons enfoncés jusqu'à ce que la console démarre en mode sans échec
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Appuyez sur "OK" pour accepter la mise à jour
|
||||
+ Aucune mise à jour nécessaire. Ceci fait partie de l'exploit
|
||||
1. Appuyez sur « J'accepte » pour accepter les termes et conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. Ne vous inquiétez pas, c'est normal
|
||||
1. Lorsque votre console vous demande "Paramétrer la connexion Internet de la console ?", sélectionnez "Paramétrer"
|
||||
1. Dans le menu suivant, accédez à `Connexion 1` -> `Modifier` -> `Page suivante (flèche de droite)` -> `Serveur proxy` -> `Paramètres avancés`
|
||||
+ Voici une [représentation visuelle](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. Si l'exploit a réussi, votre console devrait avoir démarré sur SafeB9SInstaller
|
||||
|
||||
#### Section III - Installation de boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. Lorsque vous y êtes invité, entrez la combinaison de touches indiquée sur l'écran supérieur pour installer boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Lancez l’application Mode téléchargement
|
||||
1. Attendez jusqu'à ce que vous voyiez les deux boutons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installer boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Table des matières" %}
|
||||
|
||||
### Lecture requise
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (quand combiné avec pre9otherapp) est compatible avec les versions comprises entre 1.0.0 et 11.3.0 de toutes les régions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (quand combiné avec pre9otherapp) est compatible avec les versions com
|
||||
|
||||
#### Section I - Préparatifs
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Éteignez votre 3DS
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Copiez le fichier SoundHax `.m4a` à la racine de votre carte SD
|
||||
@ -33,11 +41,16 @@ Soundhax (quand combiné avec pre9otherapp) est compatible avec les versions com
|
||||
1. Réinsérez votre carte SD dans votre 3DS
|
||||
1. Allumez votre console
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - Lancer SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Réinsérez votre carte SD dans votre 3DS
|
||||
1. Allumez votre console
|
||||
1. Lancez l'application Studio Son Nintendo 3DS
|
||||
@ -58,6 +71,8 @@ Soundhax (quand combiné avec pre9otherapp) est compatible avec les versions com
|
||||
|
||||
#### Section III - Installation de boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. Lorsque vous y êtes invité, entrez la combinaison de touches indiquée sur l'écran supérieur pour installer boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Votre console va redémarrer dans la configuration de Luma3DS
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installation de boot9strap (USM)"
|
||||
|
||||
{% include toc title="Table des matières" %}
|
||||
|
||||
### Lecture requise
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Afin d'exploiter le firmware SAFE_MODE de notre console, nous devons injecter un profil Wi-Fi exploité.
|
||||
|
||||
Nous pouvons le faire en utilisant un exploit existant, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Une fois le profil WiFi injecté, nous utiliserons SAFE_MODE, qui est une fonctionnalité de récupération présente sur toutes les consoles 3DS, pour activer le profil WiFi exploité.
|
||||
### Compatibility Notes
|
||||
|
||||
Ces instructions fonctionnent dans les régions USA, Europe, Japon et Corée indiquées par les lettres U, E, J ou K après le numéro de version de la console.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Section I - Préparatifs
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. Si votre console est allumée, éteignez la
|
||||
1. Ouvrez [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) sur votre ordinateur
|
||||
1. Téléchargez votre movable.sed en utilisant l'option "Choisir le fichier"
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copiez `boot9strap.firm` et `boot9strap.firm.sha` depuis le fichier ".zip" de boot9strap vers le dossier `/boot9strap/` sur votre carte SD
|
||||
1. Copiez `SafeB9SInstaller.bin` depuis le fichier `.zip` de SafeB9SInstaller à la racine de votre carte SD
|
||||
1. Copiez `usm.bin` depuis l'archive `unSAFE_MODE.zip` vers la racine de votre carte SD
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ L'`<ID0>` sera le même que celui que vous avez utilisé dans [Seedminer](seedminer)
|
||||
+ L'`<ID1>` est un dossier de 32 caractères à l'intérieur du dossier `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copiez le fichier `F00D43D5.bin` depuis `unSAFE_MODE.zip` vers le dossier `Nintendo DSiWare`
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Réinsérez votre carte SD dans votre 3DS
|
||||
1. Allumez votre console
|
||||
1. Lancez les Paramètres de la console
|
||||
1. Naviguez vers`Gestion des données` -> `DSiWare`
|
||||
1. Cliquez sur l'onglet Carte SD
|
||||
+ Votre console devrait afficher un menu avec du texte
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Sélectionnez "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Votre console s'éteindra automatiquement
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Maintenez les boutons enfoncés jusqu'à ce que la console démarre en mode sans échec
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Appuyez sur "OK" pour accepter la mise à jour
|
||||
+ Aucune mise à jour nécessaire. Ceci fait partie de l'exploit
|
||||
1. Appuyez sur « J'accepte » pour accepter les termes et conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. Ne vous inquiétez pas, c'est normal
|
||||
1. Lorsque votre console vous demande "Paramétrer la connexion Internet de la console ?", sélectionnez "Paramétrer"
|
||||
1. Dans le menu suivant, accédez à `Connexion 1` -> `Modifier` -> `Page suivante (flèche de droite)` -> `Serveur proxy` -> `Paramètres avancés`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. Si l'exploit a réussi, votre console devrait avoir démarré sur SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. Lorsque vous y êtes invité, entrez la combinaison de touches indiquée sur l'écran supérieur pour installer boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Lancez les Paramètres de la console
|
||||
1. Naviguez vers`Gestion des données` -> `DSiWare`
|
||||
1. Cliquez sur l'onglet Carte SD
|
||||
+ Votre console devrait afficher un menu avec du texte
|
||||
1. Sélectionnez "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Éteignez votre 3DS
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Naviguez vers `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` sur votre carte SD
|
||||
1. Supprimez `F00D43D5.bin` de votre dossier Nintendo DSiWare
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. Ce fichier ne sera plus nécessaire
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Table des matières" %}
|
||||
|
||||
### Lecture requise
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Pour installer boot9strap sur votre 3DS, nous dérivons la clé de chiffrement unique de votre console. Pour y parvenir, nous allons utiliser un outil nommé Seedminer pour calculer la clé de chiffrement de données (movable.sed) de votre console.
|
||||
### Section I - Prep Work
|
||||
|
||||
Pour plus d'informations sur le fonctionnement de Seedminer, regardez [cette présentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
Cette méthode utilise une carte graphique puissante pour effectuer les calculs nécessaires. Un site web géré par des bénévoles est utilisé dans le but de vous aider avec cette méthode.
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Préparatifs
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Naviguez vers le dossier `Nintendo 3DS` de votre carte SD
|
||||
1. Copiez le nom du dossier qui fait 32 caractères de long que vous voyez dans Nintendo 3DS
|
||||
+ N'allez plus dans aucun dossier
|
||||
+ Si vous voyez plusieurs dossiers de 32 caractères, suivez [ces instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ Vous pouvez ignorer le dossier `private` si vous l'avez
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Collez le nom du dossier (qui fait 32 caractères de long) dans un document pour pouvoir le récupérer plus tard
|
||||
+ Ce nom de dossier est aussi appelé votre "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Allumez votre console
|
||||
+ Votre carte SD n'a pas besoin d'être insérée à ce stade
|
||||
1. Accédez à votre Liste d’amis (l'[icône avec un visage orange]({{"/images/friend-list-icon.png" | absolute_url}}) dans la rangée du haut de votre Menu HOME)
|
||||
+ Si vous obtenez une erreur et que vous êtes renvoyé vers le Menu HOME, vous devez soit créer un nouveau Mii, soit votre console ne peut pas se connecter aux serveurs de Nintendo (en raison d'un bannissement ou de problèmes de connexion)
|
||||
1. Trouvez le profil de votre Mii, puis trouvez le champ "Code ami" sur l'écran supérieur
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ Cette méthode utilise une carte graphique puissante pour effectuer les calculs
|
||||
|
||||
___
|
||||
|
||||
### Prochaînes étapes
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Une fois que vous avez la clé de chiffrement de votre console (`movable.sed`), vous l'utiliserez en conjonction avec d'autres exploits pour installer un custom firmware sur votre 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### חלק I - הכנות
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. תכניסו מחדש את כרטיס הSD שלכם לתוך המכשיר שלכם
|
||||
1. תפעילו את המכשיר
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. תכבו את המכשיר
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### חלק I - הכנות
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. תכבו את המכשיר
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. צרו תיקייה בשם `cias` בתיקיית האם של כרטיס ה- SD שלכם אם לא קיימת תיקייה כזו
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. תכניסו מחדש את כרטיס הSD שלכם לתוך המכשיר שלכם
|
||||
1. תפעילו את המכשיר
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### חלק II - עדכון המערכת
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. עדכנו את המכשיר שלכם על ידי לחיצה על System Sttings, לאחר מכן "Other Settings", לכו ימינה עד הסוף ואז לחצו על "System Update"
|
||||
+ עדכונים שתבצעו תוך שימוש ב-B9S+Luma (במידה שיש לכם את שניהם) הם בטוחים לחלוטין
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. תבחרו ב "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. תפעילו את FBI מרשימת הhomebrew שלכם
|
||||
1. נווטו אל `SD` ושם אל `cias`
|
||||
1. לחצו על "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### חלק VI - Luma3DS על ה- CTRNAND
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. תכבו את המכשיר
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. כשתתבקשו, תלחצו (A) כדי להמשיך
|
||||
1. תלחצו (A) כדי להמשיך
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. תלחצו (A) כדי לאשר
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### חלק I - הכנות
|
||||
|
||||
1. תפעילו את המכשיר
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. תכבו את המכשיר
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
זה כרגע יישום עובד של הפירצה "PLAINTEXT ידוע למחיצת הFIRM" עם הסבר [כאן](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ This method of using Seedminer for further exploitation uses your `movable.sed`
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. תכבו את המכשיר
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. תכבו את המכשיר
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. תכניסו מחדש את כרטיס הSD שלכם לתוך המכשיר שלכם
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. תפעילו את המכשיר
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ אולי תצטרכו לאלץ כיבוי על ידי החזקת כפתור ההפעלה
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. תכבו את המכשיר
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. תכניסו מחדש את כרטיס הSD שלכם לתוך המכשיר שלכם
|
||||
1. תפעילו את המכשיר
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### חלק I - הכנות
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### חלק III - התקנת boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. תפעילו את Download Play
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### חלק I - הכנות
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. תכבו את המכשיר
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. תעתיקו את קובץ האודיו עם סיומת "M4A" שמתאים לקונסולה שלכם ל-SD
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. תכניסו מחדש את כרטיס הSD שלכם לתוך המכשיר שלכם
|
||||
1. תפעילו את המכשיר
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### חלק II - הפעלת SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. תכניסו מחדש את כרטיס הSD שלכם לתוך המכשיר שלכם
|
||||
1. תפעילו את המכשיר
|
||||
1. כנסו לנגן המוזיקה
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### חלק III - התקנת boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. הקןנסולה שלכם צריכה לאתחל לתפריט ההגדרות של Luma3DS
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### חלק I - הכנות
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. תעתיקו את`boot9strap.firm` ואת `boot9strap.firm.sha` מה `.zip` של boot9strap אל תיקיית `/boot9strap/`על כרטיס הSD שלכם
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. תכניסו מחדש את כרטיס הSD שלכם לתוך המכשיר שלכם
|
||||
1. תפעילו את המכשיר
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. תכבו את המכשיר
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### הנחיות
|
||||
|
||||
#### חלק I - הכנות
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. תפעילו את המכשיר
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -20,6 +24,9 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Build and Download"
|
||||
@ -27,28 +34,31 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
|
||||
1. If your console is powered on, power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from the BannerBomb3 `.zip` to the `Nintendo DSiWare` folder
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. You should now have `42383841.bin` in SD root. This is the DSiWare backup you will use later in the guide
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from the Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
|
||||
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ On this page, we will make critical system file backups and install the followin
|
||||
It is not recommended to skip downloading any of these applications, as many of them will be used later on this page. At the end of this page, your SD card will be cleaned up by removing unnecessary installation files.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your **New 3DS** was on version 2.1.0 before following this guide, you should [restore your NAND backup](godmode9-usage#restoring-a-nand-backup) before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `cias` on the root of your SD card if it does not already exist
|
||||
@ -52,15 +56,20 @@ If your previous CFW setup was EmuNAND-based and you wish to move the contents o
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
These screenshots indicate the minimum SD card layout that is required to follow this page. You may have extra files or folders on your SD card, depending on your previous setup or the method that you followed.
|
||||
|
||||
#### Section II - Updating the System
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Update your device by going to System Settings, then "Other Settings", then going all the way to the right and using "System Update"
|
||||
+ Updates while using B9S + Luma (what you have) are safe
|
||||
+ The updater may display a message saying "Your system is up to date" instead of updating. This is normal if you are already up to date; continue with the next section
|
||||
@ -69,6 +78,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section III - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Launch the Download Play application (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Wait until you see the `Nintendo 3DS` and `Nintendo DS` buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
@ -83,6 +94,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section IV - RTC and DSP Setup
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Dump DSP firmware"
|
||||
@ -94,6 +107,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section V - Installing CIAs
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Launch FBI from the list of homebrew
|
||||
1. Navigate to `SD` -> `cias`
|
||||
1. Select "\<current directory>"
|
||||
@ -102,6 +117,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VI - CTRNAND Luma3DS
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Power off your device
|
||||
1. Press and hold (Start), and while holding (Start), power on your device. This will launch GodMode9
|
||||
+ If you do not boot into GodMode9, ensure that `GodMode9.firm` is in `/luma/payloads/` and that `payloads` is correctly spelled
|
||||
@ -118,6 +135,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VII - Cleanup SD Card
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Select "Cleanup SD Card"
|
||||
1. When prompted, press (A) to proceed
|
||||
1. Press (A) to continue
|
||||
@ -125,6 +144,8 @@ These screenshots indicate the minimum SD card layout that is required to follow
|
||||
|
||||
#### Section VIII - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Select "Backup Options"
|
||||
1. Select "SysNAND Backup"
|
||||
1. Press (A) to confirm
|
||||
@ -159,7 +180,7 @@ You're done! Custom firmware is now fully configured on your device.
|
||||
Hello! We're looking for feedback on the overall experience of following our guide. If you'd like to help out, check out the survey [here](https://forms.gle/vZNoc4QLCz5MEXCK7) (only available in English). Thanks!
|
||||
{: .notice--info}
|
||||
|
||||
#### Information and Notes
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Here are some key combos that you should know:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE to run SafeB9SInstaller.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power on your device
|
||||
1. Open the Nintendo eShop
|
||||
1. Tap the Search icon (small magnifying glass)
|
||||
1. Search for `picross`
|
||||
1. Open the store page for Pokémon Picross
|
||||
1. Download Pokémon Picross
|
||||
+ You can scan [this QR code](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) using the Nintendo 3DS Camera for a direct link to the eShop app
|
||||
+ Your SD card must be inserted in your device to install Pokémon Picross
|
||||
1. Power off your device
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
@ -40,8 +41,16 @@ This process will overwrite your Pokémon Picross save file, if you have one. If
|
||||
1. Copy the `slotTool` folder from the unSAFE_MODE `.zip` to the `3ds` folder on your SD card
|
||||
1. Copy the otherapp payload for your region/version from the unSAFE_MODE `.zip`'s `otherapps_with_CfgS` folder to the root of your SD card and rename it to `otherapp.bin`
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
||||
@ -4,15 +4,16 @@ title: "Installing boot9strap (Fredtool)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
|
||||
@ -20,6 +21,8 @@ This is a currently working implementation of the "FIRM partitions known-plainte
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).
|
||||
|
||||
1. Power off your device
|
||||
1. Hold the (Select) button
|
||||
1. Power on your device while still holding the (Select) button
|
||||
@ -30,17 +33,7 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Fredtool
|
||||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
@ -53,19 +46,31 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside of the `<ID1>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert your SD card into your device
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section III - Overwriting DS Connection Settings
|
||||
|
||||
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
|
||||
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
@ -73,6 +78,8 @@ If you see a configuration menu, you already have CFW, and continuing with these
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
@ -85,7 +92,7 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from Step 12 of Section III
|
||||
+ If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 7 of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
@ -94,6 +101,8 @@ If you would prefer a visual guide to this section, one is available [here](http
|
||||
|
||||
#### Section V - Luma3DS Verification
|
||||
|
||||
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
|
||||
@ -106,13 +115,15 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section VI - Restoring DS Connection Settings
|
||||
|
||||
1. Copy the `42383841.bin` file from the `clean/` folder of the downloaded DSiWare archive (`output_(name).zip`) to the `Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
|
||||
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
@ -4,13 +4,16 @@ title: "Installing boot9strap (HBL-USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>As we already have Homebrew access, we can use slotTool to do this.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/unSAFE_MODE/">here</a> for information about the unSAFE_MODE exploit.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
@ -24,7 +27,10 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Then, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Your console should be powered on and showing the Homebrew Launcher from the previous part of the guide
|
||||
+ If not, power on your console and enter Homebrew Launcher through your method of choice (likely Pokémon Picross)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
@ -36,22 +42,31 @@ If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nint
|
||||
1. Copy `usm.bin` from the unSAFE_MODE `.zip` to the root of your SD card
|
||||
1. Put your SD card back into your console
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](https://uwuu.ca/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -65,6 +80,8 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher (this time using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
||||
@ -4,7 +4,13 @@ title: "Installing boot9strap (Soundhax)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>For technical details on the exploits that you will be using on this page, see <a href="https://github.com/nedwill/soundhax">here</a> (Soundhax) and <a href="https://github.com/TuxSH/universal-otherapp/">here</a> (universal-otherapp).</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Soundhax (when combined with universal-otherapp) is compatible with versions 1.0.0 through 11.3.0 in all regions.
|
||||
|
||||
@ -21,6 +27,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both Soundhax and universal-otherapp.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the Soundhax `.m4a` to the root of your SD card
|
||||
@ -33,11 +41,16 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/uosoundhax-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - Launching SafeB9SInstaller
|
||||
|
||||
In this section, you will launch Soundhax through the Nintendo 3DS Sound app, which will use universal-otherapp to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch Nintendo 3DS Sound
|
||||
@ -58,6 +71,8 @@ Soundhax (when combined with universal-otherapp) is compatible with versions 1.0
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
|
||||
@ -4,15 +4,17 @@ title: "Installing boot9strap (USM)"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>We can do this using an existing exploit, BannerBomb3.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <a href="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
@ -29,6 +31,8 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
|
||||
|
||||
1. If your device is powered on, power off your device
|
||||
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
@ -41,47 +45,51 @@ If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
|
||||
+ ![]({{ "/images/screenshots/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
|
||||
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
|
||||
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
|
||||
1. Select "Inject haxx"
|
||||
1. Press (A) to select "Inject haxx"
|
||||
+ Your device will automatically power off
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
@ -95,16 +103,17 @@ At this point, your console will boot to Luma3DS by default.
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your device should show a menu with some text
|
||||
1. Select "Restore slots"
|
||||
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
|
||||
+ Your device will automatically reboot
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
|
||||
@ -4,52 +4,54 @@ title: "Seedminer"
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.</p>
|
||||
<p>For information on how Seedminer works, see <a href="https://zoogie.github.io/web/34⅕c3">this presentation</a>.</p>
|
||||
<p>This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
|
||||
### Section I - Prep Work
|
||||
|
||||
For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3).
|
||||
|
||||
This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
In this section, you will get the necessary details from your 3DS that are required to figure out your device's encryption key.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to the `Nintendo 3DS` folder on your SD card
|
||||
1. Copy the 32 character long name of the folder you see inside Nintendo 3DS
|
||||
+ Do not go inside any more folders
|
||||
+ If you see multiple 32 character long folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ If you don't have a `Nintendo 3DS` folder, put your SD card into your 3DS and power it on so that the folder can be created
|
||||
1. Copy the name of the 32-letter folder you see directly inside Nintendo 3DS
|
||||
+ This 32-letter name is system-specific and will be different for each console
|
||||
+ If you see multiple 32-letter folders, follow [these instructions](troubleshooting#multiple-long-folder-names-in-nintendo-3ds-folder)
|
||||
+ You can ignore the `private` folder if you have it
|
||||
|
||||
![]({{ "/images/screenshots/id0-example.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/seedminer/id0-example.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
1. Paste your 32 character long folder name into a document you can reference later
|
||||
+ This folder name is also known as your "ID0"
|
||||
1. Paste your 32 character long folder name into [a document](/images/screenshots/seedminer/text-document.png) you can reference later
|
||||
+ This folder is known as your "ID0". Take note of this as this guide will refer to it as such later
|
||||
1. Power on your device
|
||||
+ Your SD card does not need to be inserted at this point
|
||||
1. Go to your Friend List (the [orange Face Icon]({{ "/images/friend-list-icon.png" | absolute_url }}) in the top row of your HOME Menu)
|
||||
+ If you receive an error and are kicked out of the menu, you either must create a new Mii or your device cannot connect to Nintendo's servers (due to a ban or connection issues)
|
||||
1. Find your Mii profile, then find the "Friend Code" field on the top screen
|
||||
|
||||
#### Section II - Seedminer
|
||||
### Section II - Seedminer
|
||||
|
||||
In this section, you will use the Bruteforce Movable website to retrieve your device's encryption key in the form of `movable.sed`.
|
||||
|
||||
1. Open [Bruteforce Movable](https://seedminer.hacks.guide/) on your computer
|
||||
+ This site can automate the retrieval of `movable_part1.sed` (using a bot 3DS console) and the breaking of your device's DSiWare encryption (using a volunteer's computer to run Seedminer)
|
||||
+ If the site isn't working, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. Enter your device's Friend Code (with no spaces or dashes) into the "Your friend code" field
|
||||
1. Paste your device's 32 character long folder name into the "Your ID0" field
|
||||
+ Do not attempt to enter the ID0 by hand. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
+ Do not attempt to enter the ID0 manually, as it is easy to make a mistake. Ensure the ID0 is entered correctly by copying and pasting it from where you saved it in the previous section
|
||||
1. Select "Go"
|
||||
+ If the site immediately goes to step 4, the website has already correctly processed your bruteforce request. You can download your `movable.sed` file and continue to the next section. You do not need to re-add the bot
|
||||
1. Use the "Register Friend" button on your device to add the bot's friend code as given by the website
|
||||
1. Use the ["Register Friend" button](/images/screenshots/seedminer/register-friend.png) on your device to add the bot's friend code as given by the website
|
||||
+ If prompted, the name that you give to the friend does not matter
|
||||
1. Wait for the site to update
|
||||
+ If it does not, wait a few minutes before refreshing the page once
|
||||
1. Once the site processes your information, the site will continue to `Step 2: Bruteforce` automatically
|
||||
1. Wait for the remainder of the process to complete
|
||||
+ This is usually fast (1-5 minutes) but in some cases, can take up to half an hour
|
||||
+ This is usually fast (1-5 minutes)
|
||||
+ During this process, the bot you added may not show up on your 3DS. As long as the website updates, this is not an issue
|
||||
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
|
||||
1. When the process is completed, download your `movable.sed` file from the site
|
||||
@ -57,7 +59,7 @@ This method uses a powerful graphics card to perform the calculations needed. A
|
||||
|
||||
___
|
||||
|
||||
### Next Steps
|
||||
### Next steps: Choose an exploit
|
||||
|
||||
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
|
||||
|
||||
|
||||
@ -4,11 +4,15 @@ title: "BannerBomb3"
|
||||
|
||||
{% include toc title="Tartalomjegyzék" %}
|
||||
|
||||
### Fontos tudnivalók
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
|
||||
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
|
||||
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Ahhoz, hogy a rendszerből kinyerjük a DSiWare adatokat, egy hibát használunk ki a DSiWare adat kezelési ablakában, a rendszer beállításokban.
|
||||
|
||||
Hogy ezt elérjük, szükségünk van a rendszer titkosítási kulcsára (movable.sed), hogy újra építsünk egy DSiWare mentést, aminek segítségével ki tudjuk nyerni a DSi Internet beállítások alkalmazást az SD kártyára.
|
||||
### Compatibility Notes
|
||||
|
||||
Az utasítások az Amerikai, Európai, Japán és Koreai régiójú konzolokon működnek, amik a rendszer verzió mögött egy U, E, J vagy K betű jelöl.
|
||||
|
||||
@ -20,6 +24,9 @@ Ha tajvani konzolod van (amit T betű jelez a rendszer verzió mögött), akkor
|
||||
* A `movable.sed` fájl a [Seedminer](seedminer)-ből
|
||||
|
||||
#### I. rész - Előkészületek
|
||||
|
||||
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
|
||||
|
||||
1. Nyisd meg a [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) oldalt a számítógépeden
|
||||
1. Töltsd fel a `movable.sed` fájlod a "Choose File" opcióval
|
||||
1. Kattints a "Build and Download"-ra
|
||||
@ -27,28 +34,31 @@ Ha tajvani konzolod van (amit T betű jelez a rendszer verzió mögött), akkor
|
||||
1. Ha a konzolod be van kapcsolva, most kapcsold ki
|
||||
1. Helyezd az SD kártyád a számítógépbe
|
||||
1. Navigálj a `Nintendo 3DS` -> `<ID0>` -> `<ID1>` mappába az SD kártyádon
|
||||
+ Az `<ID0>` ugyanaz, mint amit a [Seedminer](seedminer)-nél használtál
|
||||
+ Az `<ID1>` egy 32 karakter hosszú nevű mappa az `<ID0>` mappában
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
|
||||
1. Hozz létre egy `Nintendo DSiWare` nevű mappát az `<ID1>` mappában
|
||||
+ Ha már van mappád *és* van benne DSiWare mentés fájl (`<8-character-id>.bin`), másold őket a számítógépedre és töröld őket az SD kártyáról
|
||||
1. Másold az `F00D43D5.bin` fájlt a `BannerBomb3.zip`-ből a `Nintendo DSiWare` mappába
|
||||
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
|
||||
|
||||
![]({{ "/images/screenshots/dsiware-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### II. rész - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
|
||||
|
||||
1. Helyezd vissza az SD kártyát a készülékedbe
|
||||
1. Kapcsold be a készüléked
|
||||
1. Lépj be a "System Settings"-be a készülékeden
|
||||
1. Navigálj ide: `Data Management` -> `DSiWare`
|
||||
1. Kattints az SD kártya részre
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ A rendszer most Magenta (rózsaszín/lila) színen fog világítani, és össze fog omlani. Ez azt jelenti, hogy működött
|
||||
1. Kapcsold ki a készüléked
|
||||
1. Helyezd az SD kártyád a számítógépbe
|
||||
1. Most egy `42383841.bin` fájlnak kell lennie az SD kártya legfelső mappájában. Ez az a DSiWare mentés, amire később még szükséged lesz
|
||||
1. Navigálj a `Nintendo 3DS` -> `<ID0>` -> `<32 karakter hosszú azonosító>` -> `Nintendo DSiWare` mappába az SD kártyádon
|
||||
+ ez az `<ID0>` ugyanaz, mint amit a [Seedminer](seedminer)-hez használtál
|
||||
1. Töröld ki a `F00D43D5.bin` fájlt a DSiWare mappából és a számítógépedről. Ez nem fog kelleni többet
|
||||
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
|
||||
1. Navigálj a `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` mappába az SD kártyán
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. Ez nem fog kelleni többet
|
||||
|
||||
|
||||
Továbblépés a [Boot9strap telepítésére (Fredtool)](installing-boot9strap-(fredtool))
|
||||
{: .notice--primary}
|
||||
|
||||
@ -20,6 +20,8 @@ Ezen az oldalon kritikus rendszer mentéseket fogunk csinálni és a következő
|
||||
Nem ajánlott ezeket az alkalmazásokat nem letölteni, mert mindegyik még használva lesz ezen az oldalon. Ennek az oldalnak a végén az SD kártyádról el lesznek távolítva a felesleges telepítő fájlok.
|
||||
{: .notice--warning}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Ha az **új 3DS** konzolod a 2.1.0 verzión volt, a [NAND-ról készült bizonsági másolatot állítsd vissza](godmode9-usage#nand-ról-készült-bizonsági-másolat-visszaállítása) mielőtt tovább mennél.
|
||||
{: .notice--warning}
|
||||
|
||||
@ -39,6 +41,8 @@ Ha az előző egyedi firmware rendszered EmuNAND alapú volt és szeretnéd az E
|
||||
|
||||
#### I. rész - Előkészületek
|
||||
|
||||
In this section, you will copy the files necessary to follow the rest of the instructions on this page.
|
||||
|
||||
1. Kapcsold ki a készüléked
|
||||
1. Helyezd az SD kártyád a számítógépbe
|
||||
1. Hozz létre egy mappát `cias` néven az SD kártyád gyökerében, ha még nem létezik ilyen
|
||||
@ -52,15 +56,20 @@ Ha az előző egyedi firmware rendszered EmuNAND alapú volt és szeretnéd az E
|
||||
1. Tedd vissza az SD kártyád a készülékedbe
|
||||
1. Kapcsold be a készülékedet
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
The screenshots below indicate the minimum SD card layout that is required to follow this page. Lehetnek extra fájljaid és mappáid az SD kártyádon, függően a korábbi telepítésedtől vagy metódustól, amit követtél.
|
||||
|
||||
![]({{ "/images/screenshots/finalizing-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/godmode9-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
Ezek a képernyőképek mutatják az SD kártya minimális elrendezését ahhoz, hogy ezt az útmutatót követni tudd. Lehetnek extra fájljaid és mappáid az SD kártyádon, függően a korábbi telepítésedtől vagy metódustól, amit követtél.
|
||||
|
||||
#### II. rész - A rendszer frissítése
|
||||
|
||||
In this section, you will update your system to the latest version, which is safe to do with custom firmware.
|
||||
|
||||
1. Frissítsd az eszközödet következőképp. Lépj be a System Settings-be, majd az "Other settings"-be, ahol addig lépkedj jobbra, amíg a végére nem érsz. Itt válaszd a "System Update" opciót.
|
||||
+ B9S és Luma használatakor (mint esetedben) biztonságosak a rendszerfrissítések
|
||||
+ A frissítő elképzelhető, hogy megjeleníti a "Your system is up to date" üzenetet a frissítés helyett. Ez normális, ha már frissítettél; folytasd a következő szakasszal
|
||||
@ -69,6 +78,8 @@ Ezek a képernyőképek mutatják az SD kártya minimális elrendezését ahhoz,
|
||||
|
||||
#### III. rész - Homebrew Launcher
|
||||
|
||||
In this section, you will temporarily replace Download Play with Homebrew Launcher (which we need to launch FBI). Download Play will automatically go back to normal once you reboot your device.
|
||||
|
||||
1. Indítsd el a Download Play alkalmazást (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Várj, amíg `Nintendo 3DS` és `Nintendo DS` gombokat nem látsz
|
||||
1. Nyomd le az (L) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
|
||||
@ -83,6 +94,8 @@ Ezek a képernyőképek mutatják az SD kártya minimális elrendezését ahhoz,
|
||||
|
||||
#### IV. rész - RTC és DSP telepítése
|
||||
|
||||
In this section, you will sync your 3DS internal clock with the actual time and dump the sound firmware (which is necesssary for some homebrew software to use sound properly).
|
||||
|
||||
1. Nyomd le az (L) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
|
||||
1. Válaszd ki a "Miscellaneous options"-t
|
||||
1. Válaszd a "Dump DSP firmware" opciót
|
||||
@ -94,6 +107,8 @@ Ezek a képernyőképek mutatják az SD kártya minimális elrendezését ahhoz,
|
||||
|
||||
#### V. rész - CIA fájlok telepítése
|
||||
|
||||
In this section, you will install several useful homebrew applications to HOME Menu.
|
||||
|
||||
1. Indítsd el az FBI-t a homebrew listából
|
||||
1. Menj ide: `SD` -> `cias`
|
||||
1. Válaszd ezt: "\<current directory>"
|
||||
@ -102,6 +117,8 @@ Ezek a képernyőképek mutatják az SD kártya minimális elrendezését ahhoz,
|
||||
|
||||
#### VI. rész - Luma3DS telepítése CTRNAND-ba
|
||||
|
||||
In this section, you will use a script to copy some of Luma3DS's files to internal memory so that they can be accessed, even without an SD card inserted.
|
||||
|
||||
1. Kapcsold ki a készüléked
|
||||
1. Nyomd le és tartsd nyomva a (Start) gombot, és a (Start) nyomva tartása mellett kapcsold be az eszközödet. Ez elindítja a GodMode9-et
|
||||
+ Ha nem bootolsz be GodMode9 módba, ellenőrizd, hogy, a `GodMode9.firm` megtalálható a `/luma/payloads/` könyvtárban és hogy a `payloads` helyesen van írva
|
||||
@ -118,6 +135,8 @@ Ezek a képernyőképek mutatják az SD kártya minimális elrendezését ahhoz,
|
||||
|
||||
#### VII. rész - Takarítás az SD kártyán
|
||||
|
||||
In this section, you will use a script to remove some unnecessary files from your SD card.
|
||||
|
||||
1. Válaszd ezt: "Cleanup SD Card"
|
||||
1. Amikor kéri, nyomd meg az (A) gombot a folytatáshoz
|
||||
1. Nyomd meg az (A) gombot a folytatáshoz
|
||||
@ -125,6 +144,8 @@ Ezek a képernyőképek mutatják az SD kártya minimális elrendezését ahhoz,
|
||||
|
||||
#### VIII. rész - Backup Essential Files
|
||||
|
||||
In this section, you will make backups of flies that can be used to recover from softwaer bricks or to recover data.
|
||||
|
||||
1. Válaszd ezt: "Backup Options"
|
||||
1. Válaszd ezt: "SysNAND Backup"
|
||||
1. Nyomd meg az (A) gombot a megerősítéshez
|
||||
@ -159,7 +180,7 @@ Kész vagy! Az egyedi firmware most már teljesen be van állítva az eszközöd
|
||||
Szia! Szívesen veszünk visszajelzéseket az útmutatónk követéséről. Ha szeretnél segíteni, töltsd ki a kérdőívünket [itt](https://forms.gle/vZNoc4QLCz5MEXCK7) (csak angolul elérhető). Köszönjük!
|
||||
{: .notice--info}
|
||||
|
||||
#### Információk és jegyzetek
|
||||
### Information and Notes
|
||||
|
||||
{% capture notice-6 %}
|
||||
Néhány billentyű kombináció amit ismerned kell:
|
||||
|
||||
@ -4,9 +4,17 @@ title: "Homebrew Launcher (PicHaxx)"
|
||||
|
||||
{% include toc title="Tartalomjegyzék" %}
|
||||
|
||||
### Fontos tudnivalók
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller. For information on PicHaxx itself, see <a href="https://github.com/zoogie/pichaxx">here</a>.
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
Ez a metódusa Seedminer használatának további exploitolás céljából használja a `movable.sed` fájlt, hogy egy egyedi Pokémon Picross mentés fájlt írjon, amit már használhat az unSAFE_MODE a SafeB9Installer futtatására.
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, and Japan consoles as indicated by the letters U, E, or J after the system version.
|
||||
|
||||
You will need a Nintendo Network ID to download Pokémon Picross.
|
||||
|
||||
Ennek a folyamatnak a során a Pokémon Picross mentése felülírásra kerül, ha rendelkezel ilyennel. Ha szeretnéd megőrizni a Pokémon Picross játék adatod, készítened kell egy mentést a `00000001.sav` fájlról, mielőtt felülírnád.
|
||||
{: .notice--warning}
|
||||
@ -24,15 +32,8 @@ Ennek a folyamatnak a során a Pokémon Picross mentése felülírásra kerül,
|
||||
|
||||
#### I. rész - Előkészületek
|
||||
|
||||
1. Kapcsold be a készülékedet
|
||||
1. Nyisd meg a Nintendo eShop-ot
|
||||
1. Koppints a Search ikonra (kis nagyító)
|
||||
1. Keress a `picross`-ra
|
||||
1. Nyisd meg a Pokémon Picross áruház oldalát
|
||||
1. Töltsd le a Pokémon Picross-t
|
||||
+ Beolvashatod [ezt a QR kódot](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=ESHOP://50010000037815&margin=0&qzone=1&size=400x400&ecc=L) a Nintendo 3DS Camera appal egy közvetlen linkért az eShop app-ra
|
||||
+ Az SD kártyád be kell legyen helyezve az eszközödbe a Pokémon Picross telepítéséhez
|
||||
1. Kapcsold ki a készüléked
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Helyezd az SD kártyád a számítógépbe
|
||||
1. Másold át a `boot.firm` és `boot.3dsx` fájlt a Luma3DS `.zip`-ből az SD kártya gyökerébe
|
||||
+ Az SD kártya gyökere a kezdőkönyvtárt jelenti az SD kártyán, ahol látható a Nintendo 3DS könyvtár, de nem vagyunk benne
|
||||
@ -40,8 +41,16 @@ Ennek a folyamatnak a során a Pokémon Picross mentése felülírásra kerül,
|
||||
1. Másold át a `slotTool` mappát az unSAFE_MODE `.zip`-ből az SD kártya gyökerében található `3ds` mappába
|
||||
1. Másold a régiódhoz tartozó otherapp payloadot az unSAFE_MODE `.zip` `otherapps_with_CfgS` mappájából az SD kártya gyökerébe, majd nevezd át `otherapp.bin` névre
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/slottool-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### II. rész - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
1. Nyisd meg [a PicHaxx Injector weboldalát](nhnarwhal.com/3dstools/pichaxx.php/) a számítógépen
|
||||
1. Válaszd ki a `movable.sed` fájlod
|
||||
1. Válaszd a "Build and Download" menüpontot
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user