"message": "Diese Website verwendet Cookies, um den aktuellen Anleitungsfortschritt auf der Seitenansicht anzuzeigen und um die Seite zu verbessern."
}
})});
</script>
<!-- end custom head snippets -->
</head>
<bodyclass="layout--single">
<navclass="skip-links">
<ul>
<li><ahref="#site-nav"class="screen-reader-shortcut">Skip to primary navigation</a></li>
<li><ahref="#main"class="screen-reader-shortcut">Skip to content</a></li>
<li><ahref="#footer"class="screen-reader-shortcut">Skip to footer</a></li>
</ul>
</nav>
<!--[if lt IE 9]>
<divclass="notice--danger align-center"style="margin: 0;">You are using an <strong>outdated</strong> browser. Please <ahref="https://browsehappy.com/">upgrade your browser</a> to improve your experience.</div>
<![endif]-->
<divclass="masthead">
<divclass="masthead__inner-wrap">
<divclass="masthead__menu">
<navid="site-nav"class="greedy-nav">
<!-- <a class="site-title" href="/">
3DS Hacks Guide
</a>
-->
<ulclass="visible-links">
<!-- modified to use multilang, guide-specific -->
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <ahref="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <ahref="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
<p>In order to follow these instructions, you will need the following:</p>
<ul>
<li>A second 3DS with custom firmware (the <strong>source 3DS</strong>) that is the same region as the 3DS you are trying to modify (the <strong>target 3DS</strong>)
<ul>
<li>The consoles must be USA, JPN, or EUR region consoles</li>
</ul>
</li>
<li>A physical or digital copy of Mario Kart 7 that is the same region as both consoles</li>
<li>An SD card for both devices</li>
</ul>
<h3id="was-du-brauchst">Was du brauchst</h3>
<p>On the <strong>source 3DS</strong> (the 3DS with custom firmware):</p>
<ul>
<li>The latest release of <ahref="https://github.com/PabloMK7/kartdlphax/releases/latest">kartdlphax</a> (<codeclass="language-plaintext highlighter-rouge">plugin.3gx</code>)</li>
<p>On the <strong>target 3DS</strong> (the 3DS that you are trying to modify):</p>
<ul>
<li>Die neueste Version vom <ahref="https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip">SafeB9SInstaller</a> (Direkter Download)</li>
<li>Die neueste Version von <ahref="https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip">boot9strap</a> (Direkter Download)</li>
<li>The latest release of <ahref="https://github.com/LumaTeam/Luma3DS/releases/latest">standard Luma3DS</a> (the Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> file)</li>
<li>The latest release of <ahref="https://github.com/zoogie/unSAFE_MODE/releases/latest">unSAFE_MODE</a> (the RELEASE <codeclass="language-plaintext highlighter-rouge">.zip</code> file)</li>
<pclass="notice--warning">If you do not boot into Safe Mode, the system update menu after multiple attempts, you cannot follow this method. Wenn das der Fall ist, trete dem <ahref="https://discord.gg/MWxPgEp">Nintendo Homebrew on Discord</a> Server bei und frage, auf Englisch, nach Hilfe.</p>
<h4id="section-ii---prep-work-source-3ds">Section II - Prep Work (source 3DS)</h4>
<p>In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.</p>
<ol>
<li>Insert the SD card of your <strong>source 3DS</strong> in your computer</li>
<li>Copy Luma 3GX Loader Edition’s <codeclass="language-plaintext highlighter-rouge">boot.firm</code> to the root of the <strong>source 3DS</strong>’s SD card, replacing any existing file
<ul>
<li>The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it</li>
</ul>
</li>
<li>Copy kartdlphax’s <codeclass="language-plaintext highlighter-rouge">plugin.3gx</code> to the following directory on the <strong>source 3DS</strong>’s SD card, depending on the <strong>region of your copy of Mario Kart 7</strong>:
<li>Create the <codeclass="language-plaintext highlighter-rouge">plugins</code> and <codeclass="language-plaintext highlighter-rouge">00040000...</code> folders if they do not already exist</li>
</ul>
</li>
<li>Eject the SD card and put it in the <strong>source 3DS</strong></li>
<p>In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)’s SD card.</p>
<ol>
<li>Insert the SD card of your <strong>target 3DS</strong> in your computer</li>
<li>Copy <codeclass="language-plaintext highlighter-rouge">boot.firm</code> and <codeclass="language-plaintext highlighter-rouge">boot.3dsx</code> from the standard Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
<li>Erstelle einen Ordner namens <codeclass="language-plaintext highlighter-rouge">boot9strap</code> im Stammverzeichnis deiner SD-Karte</li>
<li>Kopiere <codeclass="language-plaintext highlighter-rouge">boot9strap.firm</code> und <codeclass="language-plaintext highlighter-rouge">boot9strap.firm.sha</code> aus der boot9strap <codeclass="language-plaintext highlighter-rouge">.zip</code> in den <codeclass="language-plaintext highlighter-rouge">/boot9strap/</code>-Ordner auf deiner SD-Karte</li>
<li>Copy <codeclass="language-plaintext highlighter-rouge">SafeB9SInstaller.bin</code> from the SafeB9SInstaller <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
<li>Copy <codeclass="language-plaintext highlighter-rouge">usm.bin</code> from the unSAFE_MODE <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
<li>Create a folder called <codeclass="language-plaintext highlighter-rouge">3ds</code> on the root of your SD card</li>
<li>Copy the <codeclass="language-plaintext highlighter-rouge">slotTool</code> folder from the unSAFE_MODE <codeclass="language-plaintext highlighter-rouge">.zip</code> to the <codeclass="language-plaintext highlighter-rouge">3ds</code> folder on your SD card</li>
<li>Eject the SD card and put it in the <strong>target 3DS</strong></li>
<p>In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.</p>
<ol>
<li>Power on the <strong>source 3DS</strong>
<ul>
<li>If you are prompted to set up Luma3DS, just press START to save the configuration</li>
</ul>
</li>
<li>Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu</li>
<li>Select “Enable plugin loader”</li>
<li>Drücke (B), um das Rosalina-Menü zu schließen</li>
<li>Launch Mario Kart 7
<ul>
<li>Ensure that wireless connectivity is enabled</li>
</ul>
</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Local Multiplayer</code>. A menu should pop up
<ul>
<li>If the screen freezes, hold the power button for fifteen seconds to force power off your device, then try again</li>
<li>If you have launched kartdlphax previously, the last selected settings will be loaded. If they are correct, select <codeclass="language-plaintext highlighter-rouge">Use settings</code> and skip the next 3 steps. If they are incorrect, select <codeclass="language-plaintext highlighter-rouge">Change settings</code> and proceed.</li>
</ul>
</li>
<li>Select your <strong>target 3DS</strong> device type (Old 3DS family or New 3DS family)</li>
<li>Select the exploit type <codeclass="language-plaintext highlighter-rouge">3DS ROP xPloit Injector</code></li>
<li>A confirmation menu will show up. If the settings shown on the top screen are correct, select <codeclass="language-plaintext highlighter-rouge">Use settings</code>
<ul>
<li>If the settings are not correct, press <codeclass="language-plaintext highlighter-rouge">Change settings</code> and modify them accordingly</li>
<li>If the source 3DS freezes at this point and you are using a cartridge, try <ahref="dumping-titles-and-game-cartridges#installing-a-game-cartridge-directly-to-the-system">installing the cartridge to the system</a></li>
</ul>
</li>
<li>Power on the <strong>target 3DS</strong>
<ul>
<li>Ensure that wireless connectivity is enabled</li>
</ul>
</li>
<li>On the <strong>target 3DS</strong>, open the Download Play application (<imgsrc="https://3ds.hacks.guide/images/download-play-icon.png"alt=""height="24px"width="24px"/>), then select “Nintendo 3DS”</li>
<li>Join the group created by the <strong>source 3DS</strong></li>
<li>Select “Start” on the <strong>source 3DS</strong> once it has detected the <strong>target 3DS</strong></li>
<li>Once multiplayer has loaded, navigate to <codeclass="language-plaintext highlighter-rouge">Grand Prix</code> -><codeclass="language-plaintext highlighter-rouge">50cc</code> -> (any driver) -><codeclass="language-plaintext highlighter-rouge">Mushroom Cup</code> -><codeclass="language-plaintext highlighter-rouge">OK</code></li>
<li>Wait a while (a percentage should be displayed on the <strong>source 3DS</strong>)</li>
<li>If the exploit was successful, the <strong>target 3DS</strong> will have booted into the 3DS ROP xPloit Injector
<ul>
<li>If the exploit was not successful, power off the <strong>source 3DS</strong> and <strong>target 3DS</strong> and start again from the beginning of <codeclass="language-plaintext highlighter-rouge">Section III - kartdlphax</code></li>
</ul>
</li>
<li>Press (X) to inject unSAFE_MODE</li>
<li>If the injection was successful, the screen will turn green and the <strong>target 3DS</strong> will automatically power off
<ul>
<li>If the screen turns red, power off the target 3DS and start again from the beginning of <codeclass="language-plaintext highlighter-rouge">Section III - kartdlphax</code>. If this doesn’t work, ask for help at <ahref="https://discord.gg/MWxPgEp">Nintendo Homebrew on Discord</a>)</li>
</ul>
</li>
</ol>
<pclass="notice--info">You will <strong>not</strong> need to use your <strong>source 3DS</strong> to complete any further steps on this guide. Any further steps should only be completed on the <strong>target 3DS</strong>.</p>
<p>In diesem Abschnitt du wirst in den Safe Mode (eine Funktion, die auf allen 3DS Geräten verfügbar ist) starten und zu einem Menü navigieren, in dem unSAFE_MODE ausgelöst wird, die deine Konsole in den boot9strap (Custom Firmware) Installer starten wird.</p>
<ol>
<li>Während deine Konsole noch ausgeschalten ist, halte die folgenden Tasten: (L) + (R) + (Steuerkreuz oben) + (A), und während du all diese Tasten zusammen gedrückt hältst, schalte deine Konsole an
<ul>
<li>Halte die Tastengedrückt, bis deine Konsole den Safe Mode startet (ein “System Update” Menü)</li>
</ul>
</li>
<li>Drücke “OK” um das System-Update zu bestätigen
<ul>
<li>Es gibt kein Update. Dies ist ein Teil des Exploits</li>
</ul>
</li>
<li>Drücke “Akzeptieren”, um die Nutzungsbedingungen und Warnhinweise zu akzeptieren</li>
<li>Das Update wird irgendwann mit dem Fehlercode <codeclass="language-plaintext highlighter-rouge">003-1099</code> fehlschlagen. Dies ist so vorgesehen</li>
<li>Wenn du gefragt wirst, ob die Internet Einstellungen festgelegt werden möchtest, wähle “Festlegen”</li>
<li>Öffne im folgenden Menü <codeclass="language-plaintext highlighter-rouge">Verbindung 1</code> -><codeclass="language-plaintext highlighter-rouge">Einstellungen ändern</code> -><codeclass="language-plaintext highlighter-rouge">Nächste Seite (rechter Pfeil)</code> -><codeclass="language-plaintext highlighter-rouge">Proxy-Einstellungen</code> -><codeclass="language-plaintext highlighter-rouge">Detailliertes Setup</code> (<ahref="/images/screenshots/usm/safemode_highlighted.png">Bild</a>)</li>
<li>Wenn der Exploit erfolgreich war, wird deine Konsole den SafeBS9Installer gestartet haben
<ul>
<li>If your device instead freezes on a white screen, hold the POWER button until it turns off, then retry this section</li>
<li>If your device instead freezes on a red screen, you are missing <codeclass="language-plaintext highlighter-rouge">usm.bin</code> from the root of your SD card</li>
<li>Wenn du gebeten wirst, eine Tastenkombination einzugeben, gib die Tastenkombination auf dem oberen Bildschirm ein, um boot9strap zu installieren
<ul>
<li>If a step on the lower screen has red-colored text, and you are not prompted to input a key combo, <ahref="troublshooting#issues-with-safeb9sinstaller">follow this troubleshooting guide</a></li>
<li>Sobald es abgeschlossen ist, drücke (A) um die Konsole neuzustarten</li>
<li>Your device should have booted into the Luma3DS configuration menu
<ul>
<li>Das Luma3DS Konfigurations-Menü enthält Einstellungen für die Luma3DS Custom Firmware. Viele dieser Einstellungen sind nützlich für Personalisierung und Debugging</li>
<li>For the purpose of this guide, <strong>leave these options on the default settings</strong> (do not check or uncheck anything)</li>
<li>Wenn sich deine Konsole beim Starten direkt wieder ausschaltet, solltest du sicherstellen, dass du die <codeclass="language-plaintext highlighter-rouge">boot.firm</code> Datei aus der Luma3DS.<codeclass="language-plaintext highlighter-rouge">zip</code> Datei in das Stammverzeichnis deiner SD-Karte kopiert hast</li>
</ul>
</li>
<li>Drücke (Start) zum Speichern und neustarten</li>
</ol>
<p>Ab diesem Punkt wird deine Konsole standardmäßig Luma3DS starten.</p>
<ul>
<li>Luma3DS sieht nicht anders aus als das normale HOME-Menü. Wenn deine Konsole in das HOME-Menü gestartet ist, läuft Custom Firmware auf ihr.</li>
<li>Auf der nächsten Seite wirst du nützliche Homebrew Apps installieren, um die Installation abzuschließen.</li>
<p>In diesem Abschnitt wirst du den Homebrew Launcher (diesmal mit Custom Firmware) betreten, sodass du die in Abschnitt I überschriebenen Wi-Fi Slots wiederherstellen kannst.</p>
<ol>
<li>Starte die Download-Spiel Anwendung</li>
<li>Warte bis du die zwei Knöpfe siehst
<ul>
<li>Drücke keine der Tasten</li>
</ul>
</li>
<li>Drücke gleichzeitig (L) + (Steuerkreuz unten) + (Select), um das Rosalina-Menü zu öffnen</li>
<li>Wähle “Miscellaneous options”</li>
<li>Wähle “Switch the hb. title to the current app.”</li>
<li>Drücke (B) um fortzufahren</li>
<li>Drücke (B), um zum Rosalina-Hauptmenü zurückzukehren</li>
<li>Drücke (B), um das Rosalina-Menü zu schließen</li>
<li>Drücke (Home) und schließe die Download-Spiel Anwendung</li>
<li>Starte die Download-Spiel Anwendung erneut</li>
<li>Deine Konsole sollte den Homebrew Launcher laden</li>
<li>Starte slotTool aus der Liste der Homebrew-Anwendungen</li>
<li>Wähle “RESTORE original wifi slots 1,2,3”</li>
<li>Dein Gerät wird dann neustarten</li>
</ol>
<hr/>
<h3class="notice--primary"id="fortfahren-mit-setup-fertigstellen">Fortfahren mit <ahref="finalizing-setup">Setup fertigstellen</a></h3>
