"message": "This website uses cookies to display the current guide progress on the sidebar and otherwise enhance the site."
}
})});
</script>
<!-- end custom head snippets -->
</head>
<bodyclass="layout--single">
<navclass="skip-links">
<ul>
<li><ahref="#site-nav"class="screen-reader-shortcut">Skip to primary navigation</a></li>
<li><ahref="#main"class="screen-reader-shortcut">Skip to content</a></li>
<li><ahref="#footer"class="screen-reader-shortcut">Skip to footer</a></li>
</ul>
</nav>
<!--[if lt IE 9]>
<divclass="notice--danger align-center"style="margin: 0;">You are using an <strong>outdated</strong> browser. Please <ahref="https://browsehappy.com/">upgrade your browser</a> to improve your experience.</div>
<![endif]-->
<divclass="masthead">
<divclass="masthead__inner-wrap">
<divclass="masthead__menu">
<navid="site-nav"class="greedy-nav">
<!-- <a class="site-title" href="/">
3DS Hacks Guide
</a>
-->
<ulclass="visible-links">
<!-- modified to use multilang, guide-specific -->
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>We can do this using an existing exploit, BannerBomb3.</p>
<p>To accomplish this, we use your system’s encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: <ahref="https://github.com/zoogie/Bannerbomb3">BannerBomb3</a>, <ahref="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
<p>These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.</p>
<pclass="notice--warning">If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow <ahref="installing-boot9strap-(fredtool)">an alternate branch of Seedminer</a>. For assistance with this matter, join <ahref="https://discord.gg/MWxPgEp">Nintendo Homebrew on Discord</a> and ask, in English, for help.</p>
<h3id="what-you-need">What You Need</h3>
<ul>
<li>The latest release of <ahref="https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip">SafeB9SInstaller</a> (direct download)</li>
<li>The latest release of <ahref="https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip">boot9strap</a> (direct download)</li>
<li>The latest release of <ahref="https://github.com/LumaTeam/Luma3DS/releases/latest">Luma3DS</a> (the Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> file)</li>
<h4id="section-i---prep-work">Section I - Prep Work</h4>
<p>In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device’s SD card.</p>
<ol>
<li>Your SD card should be inserted in your computer</li>
<li>Copy <codeclass="language-plaintext highlighter-rouge">usm.bin</code> to the root of your SD card</li>
<li>Copy <codeclass="language-plaintext highlighter-rouge">boot.firm</code> and <codeclass="language-plaintext highlighter-rouge">boot.3dsx</code> from the Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card
<ul>
<li>The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it</li>
</ul>
</li>
<li>Create a folder named <codeclass="language-plaintext highlighter-rouge">boot9strap</code> on the root of your SD card</li>
<li>Copy <codeclass="language-plaintext highlighter-rouge">boot9strap.firm</code> and <codeclass="language-plaintext highlighter-rouge">boot9strap.firm.sha</code> from the boot9strap <codeclass="language-plaintext highlighter-rouge">.zip</code> to the <codeclass="language-plaintext highlighter-rouge">/boot9strap/</code> folder on your SD card</li>
<li>Copy <codeclass="language-plaintext highlighter-rouge">SafeB9SInstaller.bin</code> from the SafeB9SInstaller <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
<h4id="section-ii---bannerbomb3">Section II - BannerBomb3</h4>
<p>In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.</p>
<ol>
<li>Reinsert your SD card into your device</li>
<li>Power on your device</li>
<li>Launch System Settings on your device</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Data Management</code> -><codeclass="language-plaintext highlighter-rouge">DSiWare</code>-><codeclass="language-plaintext highlighter-rouge">SD Card</code> (<ahref="/images/screenshots/bb3/dsiware-management.png">image</a>)
<ul>
<li>Your device should show the BB3 multihax menu</li>
<li>If this step causes your device to crash, <ahref="troubleshooting#bannerbomb3">follow this troubleshooting guide</a></li>
<li>If the BB3 multihax menu says “cfw installed already”, you already have custom firmware and should continue from <ahref="checking-for-cfw">here</a></li>
</ul>
</li>
<li>Use the D-Pad to navigate and press the (A) button to select “Install unSAFE_MODE”
<ul>
<li>Your device will automatically power off</li>
</ul>
</li>
</ol>
<h4id="section-iii---unsafe_mode">Section III - unSAFE_MODE</h4>
<p>In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.</p>
<ol>
<li>With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
<ul>
<li>Keep holding the buttons until the device boots into Safe Mode (a “system update” menu)</li>
</ul>
</li>
<li>Press “OK” to accept the update
<ul>
<li>There is no update. This is part of the exploit</li>
</ul>
</li>
<li>Press “I accept” to accept the terms and conditions</li>
<li>The update will eventually fail, with the error code <codeclass="language-plaintext highlighter-rouge">003-1099</code>. This is intended behaviour</li>
<li>When asked “Would you like to configure Internet settings?”, select “Yes”</li>
<li>On the following menu, navigate to <codeclass="language-plaintext highlighter-rouge">Connection 1</code> -><codeclass="language-plaintext highlighter-rouge">Change Settings</code> -><codeclass="language-plaintext highlighter-rouge">Next Page (right arrow)</code> -><codeclass="language-plaintext highlighter-rouge">Proxy Settings</code> -><codeclass="language-plaintext highlighter-rouge">Detailed Setup</code> (<ahref="/images/screenshots/usm/safemode_highlighted.png">image</a>)</li>
<li>If the exploit was successful, your device will have booted into SafeB9SInstaller
<ul>
<li>If your device instead freezes on a white screen, hold the POWER button until it turns off, then retry this section</li>
<li>If your device instead freezes on a red screen, you are missing <codeclass="language-plaintext highlighter-rouge">usm.bin</code> from the root of your SD card</li>
<h4id="section-iv---installing-boot9strap">Section IV - Installing boot9strap</h4>
<p>In this section, you will install custom firmware onto your device.</p>
<ol>
<li>When prompted, input the key combo given on the top screen to install boot9strap</li>
<li>Once it is complete, press (A) to reboot your device</li>
<li>Your device should have booted into the Luma3DS configuration menu
<ul>
<li>Luma3DS configuration menu are settings for the Luma3DS custom firmware. Many of these settings may be useful for customization or debugging</li>
<li>For the purpose of this guide, <strong>leave these options on the default settings</strong> (do not check or uncheck anything)</li>
<li>If your device shuts down when you try to power it on, ensure that you have copied <codeclass="language-plaintext highlighter-rouge">boot.firm</code> from the Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
</ul>
</li>
<li>Press (Start) to save and reboot</li>
</ol>
<p>At this point, your console will boot to Luma3DS by default.</p>
<ul>
<li>Luma3DS does not look any different from the normal HOME Menu. If your console has booted into the HOME Menu, it is running custom firmware.</li>
<li>On the next page, you will install useful homebrew applications to complete your setup.</li>
</ul>
<h4id="section-v---restoring-wifi-configuration-profiles">Section V - Restoring WiFi Configuration Profiles</h4>
<p>In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.</p>
<ol>
<li>Launch System Settings on your device</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Data Management</code> -><codeclass="language-plaintext highlighter-rouge">DSiWare</code>-><codeclass="language-plaintext highlighter-rouge">SD Card</code> (<ahref="/images/screenshots/bb3/dsiware-management.png">image</a>)</li>
<li>Use the D-Pad to navigate and press the (A) button to select “Uninstall unSAFE_MODE”
<ul>
<li>Your device will automatically reboot</li>
</ul>
</li>
<li>Power off your device</li>
<li>Insert your SD card into your computer</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Nintendo 3DS</code> -><codeclass="language-plaintext highlighter-rouge"><ID0></code> -><codeclass="language-plaintext highlighter-rouge"><ID1></code> -><codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> on your SD card</li>
<li>Delete <codeclass="language-plaintext highlighter-rouge">F00D43D5.bin</code> from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore</li>
</ol>
<hr/>
<h3class="notice--primary"id="continue-to-finalizing-setup">Continue to <ahref="finalizing-setup">Finalizing Setup</a></h3>
