<li><ahref="#site-nav"class="screen-reader-shortcut">Skip to primary navigation</a></li>
<li><ahref="#main"class="screen-reader-shortcut">Skip to content</a></li>
<li><ahref="#footer"class="screen-reader-shortcut">Skip to footer</a></li>
</ul>
</nav>
<!--[if lt IE 9]>
<divclass="notice--danger align-center"style="margin: 0;">You are using an <strong>outdated</strong> browser. Please <ahref="https://browsehappy.com/">upgrade your browser</a> to improve your experience.</div>
<li><ahref="#continue-to-finalizing-setup"id="markdown-toc-continue-to-finalizing-setup">Continue to Finalizing Setup</a></li>
</ul>
</nav>
</aside>
<h3id="required-reading">Required Reading</h3>
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
<p>To accomplish this, we use your system’s encryption key (movable.sed) to build a DSiWare backup that exploits the system to dump the DSi Internet Settings application to the SD root.</p>
<p>Once you have a DSiWare backup, an exploitable DSiWare title can be injected into DS Download Play, which can be used to install custom firmware.</p>
<pclass="notice--warning">These instructions are for Taiwanese consoles ONLY (as indicated by a T at the end of the system version, e.g. 11.16.0-39T)! If your console is from any other region, <ahref="bannerbomb3">choose the other method</a>.</p>
<li>The latest release of <ahref="https://github.com/LumaTeam/Luma3DS/releases/latest">Luma3DS</a> (the Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> file)</li>
<li>The latest release of <ahref="https://github.com/zoogie/Frogminer/releases/latest">Frogminer_save</a> (<codeclass="language-plaintext highlighter-rouge">Frogminer_save.zip</code>)</li>
</ul>
<h4id="section-i---cfw-check">Section I - CFW Check</h4>
<p>As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like <ahref="ntrboot">ntrboot</a>).</p>
<pclass="notice--danger">If you see a configuration menu or the console immediately powers off, you already have CFW, and continuing with these instructions may BRICK your console! Follow <ahref="checking-for-cfw">Checking for CFW</a> to upgrade your existing CFW.</p>
<li>Copy <codeclass="language-plaintext highlighter-rouge">boot.firm</code> and <codeclass="language-plaintext highlighter-rouge">boot.3dsx</code> from the Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card
<ul>
<li>The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it</li>
<li>Copy <codeclass="language-plaintext highlighter-rouge">boot.nds</code> (B9STool) from the release <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
<li>Copy the <codeclass="language-plaintext highlighter-rouge">private</code> folder from the Frogminer_save <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
<li>Keep your SD card in your computer - there are more things to do in the next section</li>
<h4id="section-iii---bannerbomb3">Section III - BannerBomb3</h4>
<ol>
<li>Open the <ahref="https://jenkins.nelthorya.net/job/DSIHaxInjector%20v2/build?delay=0sec">DSIHaxInjector V2</a> website on your computer</li>
<li>Under the “Username” field, enter any alphanumeric name (no spaces or special characters)</li>
<li>Under the “MovableSed” field, upload your <codeclass="language-plaintext highlighter-rouge">movable.sed</code>using the “Browse…” option</li>
<li>Click “Build”
<ul>
<li>Wait a few seconds for the build process to complete</li>
</ul>
</li>
<li>In the Build History section on the left, type the Username into the “Filter Builds” field</li>
<li>Click on the first search result
<ul>
<li>This result should have the latest timestamp</li>
</ul>
</li>
<li>Click the “output_(name).zip” link</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Nintendo 3DS</code> -><codeclass="language-plaintext highlighter-rouge"><ID0></code> -><codeclass="language-plaintext highlighter-rouge"><ID1></code> on your SD card
<li><codeclass="language-plaintext highlighter-rouge"><ID0></code> is the 32-letter folder name that you copied in <ahref="seedminer">Seedminer</a></li>
<li><codeclass="language-plaintext highlighter-rouge"><ID1></code> is a 32-letter folder inside of the <codeclass="language-plaintext highlighter-rouge"><ID0></code></li>
<li>If you have multiple <codeclass="language-plaintext highlighter-rouge"><ID1></code> folders, follow the instructions <ahref="troubleshooting#bannerbomb3">here</a></li>
<li>Create a folder named <codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> inside of the <codeclass="language-plaintext highlighter-rouge"><ID1></code>
<li>If you already had the folder <em>and</em> there are any existing DSiWare backup files (<codeclass="language-plaintext highlighter-rouge"><8-character-id>.bin</code>) inside, copy them to your computer and remove them from your SD card</li>
<li>Open the output_(name) <codeclass="language-plaintext highlighter-rouge">.zip</code> file and navigate to <codeclass="language-plaintext highlighter-rouge">China_Taiwan</code> -><codeclass="language-plaintext highlighter-rouge">output_setup</code></li>
<li>Copy all six <codeclass="language-plaintext highlighter-rouge">.bin</code> files to the <codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> folder</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Nintendo 3DS</code> -><codeclass="language-plaintext highlighter-rouge"><ID0></code> -><codeclass="language-plaintext highlighter-rouge"><ID1></code> -><codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> on your SD card</li>
<li>Open the output_(name) <codeclass="language-plaintext highlighter-rouge">.zip</code> file and navigate to <codeclass="language-plaintext highlighter-rouge">China_Taiwan</code> -><codeclass="language-plaintext highlighter-rouge">output_hax</code></li>
<li>Copy the <codeclass="language-plaintext highlighter-rouge">.bin</code> file that is the same number as the one that was on the second page of the DSiWare Management menu to the <codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> folder, and overwrite when prompted</li>
<li>The following should happen, in this order: A progress swirl, a short freeze, the bottom screen turning purple, the music stopping, then the console showing an error message and rebooting</li>
<li>If you did not see the purple screen, then something went wrong</li>
</ul>
</li>
<li>You should now have the file <codeclass="language-plaintext highlighter-rouge">42383821.bin</code> on the root of your SD card</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Nintendo 3DS</code> -><codeclass="language-plaintext highlighter-rouge"><ID0></code> -><codeclass="language-plaintext highlighter-rouge"><ID1></code> -><codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> on your SD card</li>
<li>Delete all of the <codeclass="language-plaintext highlighter-rouge">.bin</code> files in the <codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> folder</li>
</ol>
<h4id="section-iv---fredtool">Section IV - Fredtool</h4>
<ol>
<li>Open the <ahref="https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec">DSIHaxInjector_new</a> website on your computer</li>
<li>Under the “Username” field, enter any alphanumeric name (no spaces or special characters)
<ul>
<li>You might want to put in a different name to differentiate it from BannerBomb3’s output</li>
</ul>
</li>
<li>Under the “DSiBin” field, upload your <codeclass="language-plaintext highlighter-rouge">42383821.bin</code> file using the first “Browse…” option</li>
<li>Under the “MovableSed” field, upload your <codeclass="language-plaintext highlighter-rouge">movable.sed</code> file using the second “Browse…” option</li>
<li>Under the “InjectionTarget” field, set the injection target to <codeclass="language-plaintext highlighter-rouge">DSdownloadplay</code>(NOT memorypit)</li>
<li>Click “Build”
<ul>
<li>Wait a few seconds for the build process to complete</li>
</ul>
</li>
<li>In the Build History section on the left, type the Username into the “Filter Builds” field</li>
<li>Click on the first search result
<ul>
<li>This result should have the latest timestamp</li>
</ul>
</li>
<li>Click the “output_(name).zip” link</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Nintendo 3DS</code> -><codeclass="language-plaintext highlighter-rouge"><ID0></code> -><codeclass="language-plaintext highlighter-rouge"><ID1></code> -><codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> on your SD card</li>
<li>Copy the <codeclass="language-plaintext highlighter-rouge">484E4441.bin</code> file from the <codeclass="language-plaintext highlighter-rouge">hax</code> folder of the downloaded DSiWare archive (output_(name).zip) to the <codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> folder</li>
<p>In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch b9sTool, the boot9strap (custom firmware) installer.</p>
<pclass="notice--info">If you would prefer a visual guide to this section, one is available <ahref="https://zoogie.github.io/web/flipnote_directions/">here</a>.</p>
<li>If you encounter an issue while doing this section, <ahref="troubleshooting#installing-boot9strap-fredtool-inject">check this troubleshooting guide</a> for your issue</li>
<li>If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to start over from the previous section</li>
<li>If your console shuts down when you try to power it on, ensure that you have copied <codeclass="language-plaintext highlighter-rouge">boot.firm</code> from the Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
<li>If you see the Luma Configuration screen, power off your console and continue to the next section</li>
<li>If your console shuts down when you try to power it on, ensure that you have copied <codeclass="language-plaintext highlighter-rouge">boot.firm</code> from the Luma3DS <codeclass="language-plaintext highlighter-rouge">.zip</code> to the root of your SD card</li>
<li>Navigate to <codeclass="language-plaintext highlighter-rouge">Nintendo 3DS</code> -><codeclass="language-plaintext highlighter-rouge"><ID0></code> -><codeclass="language-plaintext highlighter-rouge"><ID1></code> -><codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> on your SD card</li>
<li>Copy the <codeclass="language-plaintext highlighter-rouge">484E4441.bin</code> file from the <codeclass="language-plaintext highlighter-rouge">clean</code> folder of the downloaded DSiWare archive (output_(name).zip) to the <codeclass="language-plaintext highlighter-rouge">Nintendo DSiWare</code> folder</li>
