New Crowdin updates (#2338)
* New translations ctrtransfer.txt (Korean) * New translations move-emunand.txt (Korean) * New translations region-changing.txt (Korean) * New translations en_US.yml (Korean) * New translations finalizing-setup.txt (Korean) * New translations installing-boot9strap-(soundhax).txt (Korean) * New translations ctrnand-datayeet.txt (Korean) * New translations 404.txt (Korean) * New translations installing-boot9strap-(kartdlphax).txt (Romanian) * New translations installing-boot9strap-(kartdlphax).txt (French) * New translations installing-boot9strap-(kartdlphax).txt (Spanish) * New translations installing-boot9strap-(kartdlphax).txt (Arabic) * New translations installing-boot9strap-(kartdlphax).txt (Bulgarian) * New translations installing-boot9strap-(kartdlphax).txt (Catalan) * New translations installing-boot9strap-(kartdlphax).txt (Czech) * New translations installing-boot9strap-(kartdlphax).txt (German) * New translations installing-boot9strap-(kartdlphax).txt (Greek) * New translations installing-boot9strap-(kartdlphax).txt (Finnish) * New translations installing-boot9strap-(kartdlphax).txt (Hebrew) * New translations installing-boot9strap-(kartdlphax).txt (Hungarian) * New translations installing-boot9strap-(kartdlphax).txt (Italian) * New translations installing-boot9strap-(kartdlphax).txt (Japanese) * New translations installing-boot9strap-(kartdlphax).txt (Korean) * New translations installing-boot9strap-(kartdlphax).txt (Dutch) * New translations installing-boot9strap-(kartdlphax).txt (Norwegian) * New translations installing-boot9strap-(kartdlphax).txt (Polish) * New translations installing-boot9strap-(kartdlphax).txt (Portuguese) * New translations installing-boot9strap-(kartdlphax).txt (Russian) * New translations installing-boot9strap-(kartdlphax).txt (Swedish) * New translations installing-boot9strap-(kartdlphax).txt (Turkish) * New translations installing-boot9strap-(kartdlphax).txt (Ukrainian) * New translations installing-boot9strap-(kartdlphax).txt (Chinese Simplified) * New translations installing-boot9strap-(kartdlphax).txt (Chinese Traditional) * New translations installing-boot9strap-(kartdlphax).txt (Vietnamese) * New translations installing-boot9strap-(kartdlphax).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(kartdlphax).txt (Indonesian) * New translations installing-boot9strap-(kartdlphax).txt (Thai) * New translations installing-boot9strap-(kartdlphax).txt (Croatian) * New translations installing-boot9strap-(kartdlphax).txt (Malay) * New translations installing-boot9strap-(kartdlphax).txt (Pirate English)
This commit is contained in:
ihaveahax
GitHub
parent
ac15f7fc85
commit
239c9a4429
40 changed files with 1565 additions and 1053 deletions
|
|
@ -89,65 +89,65 @@ sidebar_pages:
|
||||||
title: BannerBomb3
|
title: BannerBomb3
|
||||||
url: bannerbomb3
|
url: bannerbomb3
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (ninjhax2-dx)
|
title: boot9strap 설치 (ninjhax2-dx)
|
||||||
url: installing-boot9strap-(ninjhax2-dx)
|
url: installing-boot9strap-(ninjhax2-dx)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (PicHaxx)
|
title: boot9strap 설치 (PicHaxx)
|
||||||
url: installing-boot9strap-(pichaxx)
|
url: installing-boot9strap-(pichaxx)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (smilehax-IIe)
|
title: boot9strap 설치 (smilehax-IIe)
|
||||||
url: installing-boot9strap-(smilehax-iie)
|
url: installing-boot9strap-(smilehax-iie)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (Steelhax)
|
title: boot9strap 설치 (Steelhax)
|
||||||
url: installing-boot9strap-(steelhax)
|
url: installing-boot9strap-(steelhax)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (super-skaterhax)
|
title: boot9strap 설치 (super-skaterhax)
|
||||||
url: installing-boot9strap-(super-skaterhax)
|
url: installing-boot9strap-(super-skaterhax)
|
||||||
-
|
-
|
||||||
title: Dumping eShop DSiWare
|
title: eShop DSiWare 덤프
|
||||||
url: dumping-eshop-dsiware
|
url: dumping-eshop-dsiware
|
||||||
-
|
-
|
||||||
title: Multiple Options
|
title: 다중 옵션
|
||||||
url: multiple-options
|
url: multiple-options
|
||||||
-
|
-
|
||||||
title: Flashing ntrboot (3DS Single System)
|
title: ntrboot 플래싱 (단일 3DS)
|
||||||
url: flashing-ntrboot-(3ds-single-system)
|
url: flashing-ntrboot-(3ds-single-system)
|
||||||
-
|
-
|
||||||
title: Flashing ntrboot (3DS Multi System)
|
title: ntrboot 플래싱 (3DS 두 대)
|
||||||
url: flashing-ntrboot-(3ds-multi-system)
|
url: flashing-ntrboot-(3ds-multi-system)
|
||||||
-
|
-
|
||||||
title: Flashing ntrboot (DSi)
|
title: ntrboot 플래싱 (DSi)
|
||||||
url: flashing-ntrboot-(dsi)
|
url: flashing-ntrboot-(dsi)
|
||||||
-
|
-
|
||||||
title: Flashing ntrboot (NDS)
|
title: ntrboot 플래싱 (NDS)
|
||||||
url: flashing-ntrboot-(nds)
|
url: flashing-ntrboot-(nds)
|
||||||
-
|
-
|
||||||
title: BannerBomb3 + Fredtool (TWN)
|
title: BannerBomb3 + Fredtool (타이완)
|
||||||
url: bannerbomb3-fredtool-(twn)
|
url: bannerbomb3-fredtool-(twn)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (Hardmod)
|
title: boot9strap 설치 (하드모드)
|
||||||
url: installing-boot9strap-(hardmod)
|
url: installing-boot9strap-(hardmod)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (ntrboot)
|
title: boot9strap 설치 (ntrboot)
|
||||||
url: installing-boot9strap-(ntrboot)
|
url: installing-boot9strap-(ntrboot)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (Soundhax)
|
title: boot9strap 설치 (Soundhax)
|
||||||
url: installing-boot9strap-(soundhax)
|
url: installing-boot9strap-(soundhax)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (safecerthax)
|
title: boot9strap 설치 (safecerthax)
|
||||||
url: installing-boot9strap-(safecerthax)
|
url: installing-boot9strap-(safecerthax)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (SSLoth-Browser)
|
title: boot9strap 설치 (SSLoth-Browser)
|
||||||
url: installing-boot9strap-(ssloth-browser)
|
url: installing-boot9strap-(ssloth-browser)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (Fredtool-Inject)
|
title: boot9strap 설치 (Fredtool-Inject)
|
||||||
url: installing-boot9strap-(fredtool-inject)
|
url: installing-boot9strap-(fredtool-inject)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (menuhax)
|
title: boot9strap 설치 (menuhax)
|
||||||
url: installing-boot9strap-(menuhax)
|
url: installing-boot9strap-(menuhax)
|
||||||
-
|
-
|
||||||
title: Installing boot9strap (kartdlphax)
|
title: boot9strap 설치 (kartdlphax)
|
||||||
url: installing-boot9strap-(kartdlphax)
|
url: installing-boot9strap-(kartdlphax)
|
||||||
-
|
-
|
||||||
title: Finalizing Setup
|
title: 마무리 단계
|
||||||
url: finalizing-setup
|
url: finalizing-setup
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technische Details (optional)</em></summary>
|
<summary><em>Technische Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### Was du brauchst
|
### Was du brauchst
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* Die neueste Version von [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (Direkter Download)
|
|
||||||
* Die neueste Version vom [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (Direkter Download)
|
* Die neueste Version vom [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (Direkter Download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)
|
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. Wenn das der Fall ist, trete dem [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) Server bei und frage, auf Englisch, nach Hilfe.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Erstelle einen Ordner namens `boot9strap` im Stammverzeichnis deiner SD-Karte
|
1. Erstelle einen Ordner namens `boot9strap` im Stammverzeichnis deiner SD-Karte
|
||||||
1. Kopiere `boot9strap.firm` und `boot9strap.firm.sha` aus der boot9strap `.zip` in den `/boot9strap/`-Ordner auf deiner SD-Karte
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Erstelle einen Ordner namens `3ds` im Stammverzeichnis deiner SD-Karte falls er noch nicht existiert
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Drücke "OK" um das System-Update zu bestätigen
|
||||||
|
+ Es gibt kein Update. Dies ist ein Teil des Exploits
|
||||||
|
1. Drücke "Akzeptieren", um die Nutzungsbedingungen und Warnhinweise zu akzeptieren
|
||||||
|
1. Das Update wird irgendwann mit dem Fehlercode `003-1099` fehlschlagen. Dies ist so vorgesehen
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on th' root 'o ye SD card
|
1. Create a folder named `boot9strap` on th' root 'o ye SD card
|
||||||
1. Copy `boot9strap.firm` 'n `boot9strap.firm.sha` from th' boot9strap `.zip` to th' `/boot9strap/` folder on ye SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Instalar boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ Para seguir estas instrucciones, necesitarás lo siguiente:
|
||||||
### Qué necesitas
|
### Qué necesitas
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Crea las carpetas `plugins` y `00040000...` si no existen
|
- Crea las carpetas `plugins` y `00040000...` si no existen
|
||||||
1. Saca la tarjeta SD de la computadora y ponla en la **3DS de origen**
|
1. Saca la tarjeta SD de la computadora y ponla en la **3DS de origen**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Inserta la tarjeta SD de la **3DS de destino** en tu computadora
|
1. Inserta la tarjeta SD de la **3DS de destino** en tu computadora
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Crea una carpeta llamada `boot9strap` en la raíz de tu tarjeta SD
|
1. Crea una carpeta llamada `boot9strap` en la raíz de tu tarjeta SD
|
||||||
1. Copia `boot9strap.firm` y `boot9strap.firm.sha` desde el `.zip` de `boot9strap` a la carpeta `/boot9strap/` en tu tarjeta SD
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copia `SafeB9SInstaller.bin` desde el `.zip` de SafeB9SInstaller a la raíz de tu tarjeta SD
|
1. Copia `SafeB9SInstaller.bin` desde el `.zip` de SafeB9SInstaller a la raíz de tu tarjeta SD
|
||||||
1. Crea una carpeta llamada `3ds` en la raíz de tu tarjeta SD, si aún no existe
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Saca la tarjeta SD de la computadora y ponla en la **3DS de destino**
|
1. Saca la tarjeta SD de la computadora y ponla en la **3DS de destino**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Enciende la **3DS de origen**
|
1. Enciende la **3DS de origen**
|
||||||
- Si te le pide que configures Luma3DS, pulsa START para guardar la configuración
|
- Si te le pide que configures Luma3DS, pulsa START para guardar la configuración
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Espera un rato (se debería mostrar un porcentaje en la **3DS de origen**)
|
1. Espera un rato (se debería mostrar un porcentaje en la **3DS de origen**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### Tarpeet
|
### Tarpeet
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Luo `boot9strap`-niminen kansio SD-korttisi juureen
|
1. Luo `boot9strap`-niminen kansio SD-korttisi juureen
|
||||||
1. Kopioi boot9strap-`.zip`-pakkauksesta `boot9strap.firm` ja `boot9strap.firm.sha` SD-korttisi `/boot9strap/`-kansioon
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Luo `3ds`‑niminen kansio SD‑korttisi juureen, jos sitä ei jo ole olemassa
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installation de boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Détails techniques (facultatif)</em></summary>
|
<summary><em>Détails techniques (facultatif)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
Pour cela, nous pouvons utiliser le mode téléchargement du jeu Mario Kart 7 en utilisant une 3DS avec un custom firmware déjà installé avec un plugin de jeu personnalisé.
|
Pour cela, nous pouvons utiliser le mode téléchargement du jeu Mario Kart 7 en utilisant une 3DS avec un custom firmware déjà installé avec un plugin de jeu personnalisé.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ Pour suivre ces instructions, vous aurez besoin de ceci :
|
||||||
## Ce dont vous avez besoin
|
## Ce dont vous avez besoin
|
||||||
|
|
||||||
* La dernière version de [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* La dernière version de [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* La dernière version de [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (téléchargement direct)
|
|
||||||
* La dernière version de [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (téléchargement direct)
|
* La dernière version de [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (téléchargement direct)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* La dernière version de [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (le fichier `.zip' de Luma3DS)
|
* La dernière version de [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (le fichier `.zip' de Luma3DS)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. Si c'est le cas, rejoignez [Nintendo Homebrew sur Discord](https://discord.gg/MWxPgEp) et demandez de l'aide, en anglais.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
Dans cette section, vous allez configurer votre 3DS source (la 3DS avec un custom firmware) pour l'envoi des données d'exploit à la 3DS cible.
|
Dans cette section, vous allez configurer votre 3DS source (la 3DS avec un custom firmware) pour l'envoi des données d'exploit à la 3DS cible.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ Dans cette section, vous allez configurer votre 3DS source (la 3DS avec un custo
|
||||||
- Créez les dossiers `plugins` et `00040000...` s'il n'existent pas déjà
|
- Créez les dossiers `plugins` et `00040000...` s'il n'existent pas déjà
|
||||||
1. Retirez la carte SD de l'ordinateur et réinsérez-la dans la **3DS source**
|
1. Retirez la carte SD de l'ordinateur et réinsérez-la dans la **3DS source**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insérez la carte SD de la **3DS cible** dans votre ordinateur
|
1. Insérez la carte SD de la **3DS cible** dans votre ordinateur
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Créez un dossier nommé `boot9strap` à la racine de votre carte SD
|
1. Créez un dossier nommé `boot9strap` à la racine de votre carte SD
|
||||||
1. Copiez `boot9strap.firm` et `boot9strap.firm.sha` depuis le fichier ".zip" de boot9strap vers le dossier `/boot9strap/` sur votre carte SD
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copiez `SafeB9SInstaller.bin` depuis le fichier `.zip` de SafeB9SInstaller à la racine de votre carte SD
|
1. Copiez `SafeB9SInstaller.bin` depuis le fichier `.zip` de SafeB9SInstaller à la racine de votre carte SD
|
||||||
1. Créez un dossier nommé `3ds` à la racine de votre carte SD si celui ci n'existe pas
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Éjectez la carte SD et réinsérez-la dans la **3DS cible**
|
1. Éjectez la carte SD et réinsérez-la dans la **3DS cible**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Allumez la **3DS source**
|
1. Allumez la **3DS source**
|
||||||
- S'il vous est demandé de configurer Luma3DS, appuyez simplement sur START pour sauvegarder la configuration actuelle
|
- S'il vous est demandé de configurer Luma3DS, appuyez simplement sur START pour sauvegarder la configuration actuelle
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Attendez un moment (un pourcentage devrait s'afficher sur la **3DS source**)
|
1. Attendez un moment (un pourcentage devrait s'afficher sur la **3DS source**)
|
||||||
1. Si l'exploit a réussi, la **3DS cible** aura démarré dans l'injecteur 3DS ROP xPloit
|
1. Si l'exploit a réussi, la **3DS cible** aura démarré dans l'injecteur 3DS ROP xPloit
|
||||||
- Si l'exploit n'a pas réussi, éteignez la **3DS source** et la **3DS cible** et recommencez à partir du début de `Section III - kartdlphax`
|
- Si l'exploit n'a pas réussi, éteignez la **3DS source** et la **3DS cible** et recommencez à partir du début de `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installation de boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Appuyez sur "OK" pour accepter la mise à jour
|
||||||
|
+ Aucune mise à jour n'est nécessaire. Ceci fait partie de l'exploit
|
||||||
|
1. Appuyez sur « J'accepte » pour accepter les conditions
|
||||||
|
1. La mise à jour finira par échouer, avec le code d'erreur `003-1099`. Ne vous inquiétez pas, c'est normal.
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installation de boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. תצרו ב-SD שלכם תיקייה חדשה בשם `boot9strap`
|
1. תצרו ב-SD שלכם תיקייה חדשה בשם `boot9strap`
|
||||||
1. תעתיקו את`boot9strap.firm` ואת `boot9strap.firm.sha` מה `.zip` של boot9strap אל תיקיית `/boot9strap/`על כרטיס הSD שלכם
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Boot9strap telepítése (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technikai részletek (opcionális)</em></summary>
|
<summary><em>Technikai részletek (opcionális)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
Ennek eléréséhez a Download Play funkcionalitását használjuk a Mario Kart 7-nek, egy egyedi firmware-rel, valamint egy egyedi játék pluginnel már telepített 3DS használatával.
|
Ennek eléréséhez a Download Play funkcionalitását használjuk a Mario Kart 7-nek, egy egyedi firmware-rel, valamint egy egyedi játék pluginnel már telepített 3DS használatával.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ Ahhoz, hogy követhesd ezeket a lépéseket, a következőkre van szükséged:
|
||||||
### Amire szükséged lesz
|
### Amire szükséged lesz
|
||||||
|
|
||||||
* A [kartdlphax] legújabb kiadása (https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* A [kartdlphax] legújabb kiadása (https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* A [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) legfrisseb verziója (közvetlen letöltés)
|
|
||||||
* A [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) legfrisseb verziója (közvetlen letöltés)
|
* A [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) legfrisseb verziója (közvetlen letöltés)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* A [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) legújabb kiadása (a Luma3DS `.zip` fájl)
|
* A [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) legújabb kiadása (a Luma3DS `.zip` fájl)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. Ebben az esetben csatlakozz a [Nintendo Homebrew-hoz Discord-on](https://discord.gg/MWxPgEp) és kérj, támogatást angolul.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
Ebben a fejezetben befogod állítani a forrás 3DS-ed (a 3DS egyedi firmware-rel), hogy küldje az exploit adatot a cél 3DS-nek.
|
Ebben a fejezetben befogod állítani a forrás 3DS-ed (a 3DS egyedi firmware-rel), hogy küldje az exploit adatot a cél 3DS-nek.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ Ebben a fejezetben befogod állítani a forrás 3DS-ed (a 3DS egyedi firmware-re
|
||||||
- Hozd létre a `plugins` és `00040000...` mappákat, ha nem léteznek
|
- Hozd létre a `plugins` és `00040000...` mappákat, ha nem léteznek
|
||||||
1. Távolítsd el az SD kártyát és rakd be a **forrás 3DS**-be
|
1. Távolítsd el az SD kártyát és rakd be a **forrás 3DS**-be
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Csatlakoztasd a **cél 3DS** SD kártyáját a számítógépedhez
|
1. Csatlakoztasd a **cél 3DS** SD kártyáját a számítógépedhez
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Hozz létre egy mappát `boot9strap` néven az SD kártya gyökerében
|
1. Hozz létre egy mappát `boot9strap` néven az SD kártya gyökerében
|
||||||
1. Másold át a `boot9strap.firm` fájlt és a `boot9strap.firm.sha` fájlt a boot9strap `.zip` fájlból az SD kártyád `/boot9strap/` mappájába
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Másold át a `SafeB9SInstaller.bin` fájlt a SafeB9SInstaller `.zip`-ből az SD kártyád gyökerébe
|
1. Másold át a `SafeB9SInstaller.bin` fájlt a SafeB9SInstaller `.zip`-ből az SD kártyád gyökerébe
|
||||||
1. Hozz létre egy mappát `3ds` néven az SD kártyád gyökerében, ha még nem létezik ilyen
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Távolítsd el az SD kártyát és rakd be a **cél 3DS**-be
|
1. Távolítsd el az SD kártyát és rakd be a **cél 3DS**-be
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Kapcsold be a **forrás 3DS**-t
|
1. Kapcsold be a **forrás 3DS**-t
|
||||||
- Ha rákérdez arra, hogy állítsd be a Luma3DS-t, csak nyomj START-ot, hogy mentse a konfigurációt
|
- Ha rákérdez arra, hogy állítsd be a Luma3DS-t, csak nyomj START-ot, hogy mentse a konfigurációt
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Várj egy kicsit (egy százalék kell megjelenjen a **forrás 3DS**-en)
|
1. Várj egy kicsit (egy százalék kell megjelenjen a **forrás 3DS**-en)
|
||||||
1. Ha az exploit sikeres volt, akkor a **cél 3DS** be kell bootoljon a 3DS ROP xPloit Injector-ba
|
1. Ha az exploit sikeres volt, akkor a **cél 3DS** be kell bootoljon a 3DS ROP xPloit Injector-ba
|
||||||
- Ha az exploit nem volt sikeres, kapcsold ki a **forrás 3DS**-t és a **cél 3DS**-t, és kezd újra a `III. rész - kartdlphax` kezdetétől
|
- Ha az exploit nem volt sikeres, kapcsold ki a **forrás 3DS**-t és a **cél 3DS**-t, és kezd újra a `III. rész - kartdlphax` kezdetétől
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### V. rész - boot9strap telepítése
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. A konzolod kikapcsolt állapotában tartsd nyomva a következő gombokat: (Bal Váll) + (Jobb Váll) + (D-Pad Fel) + (A), majd ezen gombok nyomva tartása mellett kapcsold be a konzolod
|
||||||
|
+ Tartsd nyomva a gombokat, amíg a konzol be nem bootol a Safe Mode-ba (a "system update" menübe)
|
||||||
|
1. Nyomj "OK"-ot a frissítés elfogadásához
|
||||||
|
+ Nincs frissítés. Ez része az exploitnak
|
||||||
|
1. Nyomj az "I accept"-re a feltételek elfogadásához
|
||||||
|
1. A frissítés sikertelen lesz a `003-1099` hibakóddal. Ez az elvárt viselkedés
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### VI. rész - boot9strap telepítése
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installazione di boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Dettagli Tecnici (opzionale)</em></summary>
|
<summary><em>Dettagli Tecnici (opzionale)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
Per farlo possiamo utilizzare la funzionalità "Modalità download" del gioco Mario Kart 7, utilizzando un 3DS con custom firmware già installato insieme a un plugin di gioco personalizzato.
|
Per farlo possiamo utilizzare la funzionalità "Modalità download" del gioco Mario Kart 7, utilizzando un 3DS con custom firmware già installato insieme a un plugin di gioco personalizzato.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ Per seguire queste istruzioni, avrai bisogno di:
|
||||||
### Cosa serve
|
### Cosa serve
|
||||||
|
|
||||||
* L'ultima versione di [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* L'ultima versione di [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* L'ultima versione di [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (download diretto)
|
|
||||||
* L'ultima versione di [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (download diretto)
|
* L'ultima versione di [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (download diretto)
|
||||||
+ L'ultima versione di [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (download diretto)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* L'ultima versione di [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (il file `.zip` di Luma3DS)
|
* L'ultima versione di [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (il file `.zip` di Luma3DS)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. In tal caso, puoi ricevere assistenza chiedendo, in inglese, nel [canale Discord di Nintendo Homebrew](https://discord.gg/MWxPgEp).
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In questa sezione configurerai il tuo 3DS di partenza (il 3DS con custom firmware) per inviare i dati dell'exploit verso il 3DS di destinazione.
|
In questa sezione configurerai il tuo 3DS di partenza (il 3DS con custom firmware) per inviare i dati dell'exploit verso il 3DS di destinazione.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In questa sezione configurerai il tuo 3DS di partenza (il 3DS con custom firmwar
|
||||||
- Crea le cartelle `plugins` e `00040000...` se non sono già esistenti
|
- Crea le cartelle `plugins` e `00040000...` se non sono già esistenti
|
||||||
1. Rimuovi la scheda SD e inseriscila nel **3DS di partenza**
|
1. Rimuovi la scheda SD e inseriscila nel **3DS di partenza**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Inserisci la scheda SD del tuo **3DS di destinazione** nel computer
|
1. Inserisci la scheda SD del tuo **3DS di destinazione** nel computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Crea una cartella chiamata `boot9strap` nella directory principale della tua scheda SD
|
1. Crea una cartella chiamata `boot9strap` nella directory principale della tua scheda SD
|
||||||
1. Copia i file `boot9strap.firm` e `boot9strap.firm.sha` dall'archivio `.zip` di boot9strap nella cartella `/boot9strap/` della tua scheda SD
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copia il file `SafeB9SInstaller.bin` dall'archivio `.zip` di SafeB9SInstaller nella directory principale della tua scheda SD
|
1. Copia il file `SafeB9SInstaller.bin` dall'archivio `.zip` di SafeB9SInstaller nella directory principale della tua scheda SD
|
||||||
1. Se assente, crea una cartella chiamata `3ds` nella directory principale della tua scheda SD
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Rimuovi la scheda SD e inseriscila nel **3DS di destinazione**
|
1. Rimuovi la scheda SD e inseriscila nel **3DS di destinazione**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Accendi il **3DS di partenza**
|
1. Accendi il **3DS di partenza**
|
||||||
- Se ti viene richiesto di configurare Luma3DS, premi START per salvare la configurazione
|
- Se ti viene richiesto di configurare Luma3DS, premi START per salvare la configurazione
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Attendi un po' (dovresti visualizzare una percentuale sul **3DS di partenza**)
|
1. Attendi un po' (dovresti visualizzare una percentuale sul **3DS di partenza**)
|
||||||
1. Se l'exploit è andato a buon fine, il **3DS di destinazione** avrà avviato 3DS ROP xPloit Injector
|
1. Se l'exploit è andato a buon fine, il **3DS di destinazione** avrà avviato 3DS ROP xPloit Injector
|
||||||
- Se l'exploit non ha avuto successo, spegni il **3DS di partenza** e il **3DS di destinazione** e ricomincia dall'inizio di `Sezione III - kartdlphax`
|
- Se l'exploit non ha avuto successo, spegni il **3DS di partenza** e il **3DS di destinazione** e ricomincia dall'inizio di `Sezione III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Sezione V - Installazione di boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. Con la console ancora spenta, tieni premuto i pulsanti (L) + (R) + (Su) + (A), dopodiché, tenendo premuti i pulsanti, accendi la console
|
||||||
|
+ Mantieni premuti i pulsanti finché la console si avvierà in Modalità Provvisoria (una specie di menu per aggiornare il sistema)
|
||||||
|
1. Premi "OK" per accettare l'aggiornamento
|
||||||
|
+ Non c'è alcun aggiornamento. Fa parte del procedimento
|
||||||
|
1. Premi "Accetto" per accettare i termini e le condizioni
|
||||||
|
1. L'aggiornamento fallirà, con codice di errore `003-1099`. Questo risultato è corretto
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Sezione VI - Installazione di boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### 必要なもの
|
### 必要なもの
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. `boot9strap`という名前のフォルダをSDカードのルート上に作成します。
|
1. `boot9strap`という名前のフォルダをSDカードのルート上に作成します。
|
||||||
1. `boot9strap.firm`と`boot9strap.firm.sha`を boot9strap `.zip` ファイルから解凍し、SD カードのboot9strapフォルダにコピーします。
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. SafeB9SInstaller `.zip` から`SafeB9SInstaller.bin`をSDカードのルートへコピーします
|
1. SafeB9SInstaller `.zip` から`SafeB9SInstaller.bin`をSDカードのルートへコピーします
|
||||||
1. SDカードの直下に`3ds`フォルダがない場合、そのフォルダを作成します
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
---
|
---
|
||||||
title: "Page Not Found" #
|
title: "페이지를 찾을 수 없음" #
|
||||||
sitemap: false
|
sitemap: false
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -21,7 +21,7 @@ As a part of this process, your system settings will be reset to its defaults.
|
||||||
{: .notice--warning}
|
{: .notice--warning}
|
||||||
|
|
||||||
* 최신 버전의 [GodMode9](https://github.com/d0k3/GodMode9/releases/latest) (`.zip` 파일)
|
* 최신 버전의 [GodMode9](https://github.com/d0k3/GodMode9/releases/latest) (`.zip` 파일)
|
||||||
* The latest release of [FBI](https://github.com/Steveice10/FBI/releases/latest) *(the `.3dsx` file)*
|
* 최신 버전의 [FBI](https://github.com/Steveice10/FBI/releases/latest) *(`.3dsx` 파일)*
|
||||||
* The latest release of [faketik](https://github.com/ihaveamac/faketik/releases/latest) *(the `.3dsx` file)*
|
* The latest release of [faketik](https://github.com/ihaveamac/faketik/releases/latest) *(the `.3dsx` file)*
|
||||||
* 콘솔과 지역에 맞는 11.15.0 CTRTransfer 이미지:
|
* 콘솔과 지역에 맞는 11.15.0 CTRTransfer 이미지:
|
||||||
{% include_relative include/ctrtransfer-images.txt %}
|
{% include_relative include/ctrtransfer-images.txt %}
|
||||||
|
|
|
||||||
|
|
@ -35,7 +35,7 @@ If you don't want one of these applications, you can remove them after you have
|
||||||
|
|
||||||
### 준비물
|
### 준비물
|
||||||
|
|
||||||
* [finalizing.zip]({{ base_path }}/assets/finalizing.zip) (direct download)
|
* [finalizing.zip]({{ base_path }}/assets/finalizing.zip) (직접 다운로드)
|
||||||
|
|
||||||
### 진행 방법
|
### 진행 방법
|
||||||
|
|
||||||
|
|
@ -75,7 +75,7 @@ Luma3DS 구성 메뉴로 부팅되지 않았다면 콘솔에 커스텀 펌웨어
|
||||||
|
|
||||||
{% include_relative include/sysupdate.txt cfw="true" %}
|
{% include_relative include/sysupdate.txt cfw="true" %}
|
||||||
|
|
||||||
#### Section IV - RTC and DSP setup
|
#### 섹션 IV - RTC 및 DSP 설정
|
||||||
|
|
||||||
이 섹션에서는 3DS 내부 시계를 실제 시각과 맞추고, 홈브류 소프트웨어에서 음성을 적절하게 이용하기 위해 사운드 펌웨어를 백업합니다.
|
이 섹션에서는 3DS 내부 시계를 실제 시각과 맞추고, 홈브류 소프트웨어에서 음성을 적절하게 이용하기 위해 사운드 펌웨어를 백업합니다.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
This section will reset your system settings to its defaults. **Installed games and their save data will not be affected.** This is **required** to prevent known issues relating to extended memory mode and applets on some consoles.
|
이 섹션에서는 시스템 설정을 기본값으로 복구하게 됩니다. **Installed games and their save data will not be affected.** This is **required** to prevent known issues relating to extended memory mode and applets on some consoles.
|
||||||
|
|
||||||
1. 콘솔의 전원을 꺼 주세요
|
1. 콘솔의 전원을 꺼 주세요
|
||||||
1. (Start) 를 길게 누르고, 이 상태에서 콘솔의 전원을 켜 주세요. GodMode9이 실행될 겁니다
|
1. (Start) 를 길게 누르고, 이 상태에서 콘솔의 전원을 켜 주세요. GodMode9이 실행될 겁니다
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "boot9strap 설치 (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>기술적 상세 정보 (선택 사항)</em></summary>
|
<summary><em>기술적 상세 정보 (선택 사항)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
이 취약점을 사용하기 위해, 마리오 카트 7 게임에 존재하는 다운로드 플레이 기능, 이미 커스텀 펌웨어가 설치되어 있는 콘솔, 그리고 어떤 게임 플러그인을 사용합니다.
|
이 취약점을 사용하기 위해, 마리오 카트 7 게임에 존재하는 다운로드 플레이 기능, 이미 커스텀 펌웨어가 설치되어 있는 콘솔, 그리고 어떤 게임 플러그인을 사용합니다.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlp
|
||||||
### 준비물
|
### 준비물
|
||||||
|
|
||||||
* 최신 버전의 [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest`) (`plugin.3gx`)
|
* 최신 버전의 [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest`) (`plugin.3gx`)
|
||||||
* 최신 버전의 [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (직접 다운로드)
|
|
||||||
* 최신 버전의 [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (직접 다운로드)
|
* 최신 버전의 [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (직접 다운로드)
|
||||||
+ 최신 버전의 [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (직접 다운로드)
|
|
||||||
* 최신 버전의 [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* 최신 버전의 [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (`.zip` 파일)
|
* 최신 버전의 [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (`.zip` 파일)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. 이 경우, [Nintendo Homebrew Discord 서버](https://discord.gg.MWxPgEp)에 오셔서 도움을 요청하세요.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
이 섹션에서는, 소스 3DS (커스텀 펌웨어가 설치 되어 있는 콘솔)을 익스플로잇 데이터를 타겟 3DS로 전송할 수 있도록 설정합니다.
|
이 섹션에서는, 소스 3DS (커스텀 펌웨어가 설치 되어 있는 콘솔)을 익스플로잇 데이터를 타겟 3DS로 전송할 수 있도록 설정합니다.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlp
|
||||||
- `plugins` 폴더와 `00040000...` 폴더가 없으면 만들어 주세요
|
- `plugins` 폴더와 `00040000...` 폴더가 없으면 만들어 주세요
|
||||||
1. SD 카드를 분리해 **소스 3DS**에 장착해 주세요
|
1. SD 카드를 분리해 **소스 3DS**에 장착해 주세요
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. **타겟 3DS**의 SD 카드를 컴퓨터에 삽입해 주세요
|
1. **타겟 3DS**의 SD 카드를 컴퓨터에 삽입해 주세요
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. SD 카드이 루트에 `boot9strap` 라는 이름으로 새 폴더를 생성해 주세요
|
1. SD 카드이 루트에 `boot9strap` 라는 이름으로 새 폴더를 생성해 주세요
|
||||||
1. SD 카드에 있는 `/boot9strap/` 폴더에 boot9strap `.zip` 파일 안에 압축되있는 `boot9strap.firm`과 `boot9strap.firm.sha`을 복사해 주세요
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. SafeB9SInstaller `.zip`의 `SafeB9SInstaller.bin`을 SD 카드의 루트로 복사해 주세요
|
1. SafeB9SInstaller `.zip`의 `SafeB9SInstaller.bin`을 SD 카드의 루트로 복사해 주세요
|
||||||
1. SD 카드의 루트에 `3ds` 폴더가 없을 경우 폴더를 만들어 주세요
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. SD 카드를 분리해 **타겟 3DS**에 장착해 주세요
|
1. SD 카드를 분리해 **타겟 3DS**에 장착해 주세요
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### 섹션 III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. **소스 3DS**의 전원을 켜 주세요
|
1. **소스 3DS**의 전원을 켜 주세요
|
||||||
+ Luma3DS를 설정하는 창이 표시되면, START를 눌러 저장해 주세요
|
+ Luma3DS를 설정하는 창이 표시되면, START를 눌러 저장해 주세요
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. 잠시 기다려 주세요 (**소스 3DS**에 진행도가 표시됩니다)
|
1. 잠시 기다려 주세요 (**소스 3DS**에 진행도가 표시됩니다)
|
||||||
1. 익스플로잇이 성공했다면, **타겟 3DS**가 3DS ROP xPloit Injector로 부팅됩니다
|
1. 익스플로잇이 성공했다면, **타겟 3DS**가 3DS ROP xPloit Injector로 부팅됩니다
|
||||||
- 익스플로잇이 실패했다면, 두 3DS 콘솔 모두 종료한 후 `섹션 III - kartdlphax`의 처음부터 다시 시작해 주세요
|
- 익스플로잇이 실패했다면, 두 3DS 콘솔 모두 종료한 후 `섹션 III - kartdlphax`의 처음부터 다시 시작해 주세요
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### 섹션 IV - menuhax67 설치
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### 섹션 V - boot9strap 설치
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. 전원이 꺼져 있는 상태에서 (L 어깨) + (R 어깨) + (십자 Up) + (A) 를 길게 눌르고, 누르는 상태에서 전원을 켜 주세요
|
||||||
|
+ 안전 모드로 부팅 될 때 까지 버튼들을 눌러 주세요 ("본체 업데이트" 메뉴)
|
||||||
|
1. "OK"를 선택해서 업데이트를 확인해 주세요
|
||||||
|
+ 실제로 업데이트를 하는 것은 아닙니다. 이것은 익스플로잇의 일부입니다
|
||||||
|
1. "동의함"를 눌러서 이용 약관에 동의해 주세요
|
||||||
|
1. 이 업데이트는 에러 코드 `003-1099` 와 같이 실패를 할 겁니다. 이것은 의도적 행동입니다
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### 섹션 VI - boot9strap 설치
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### 섹션 VI - menuhax67 제거
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -22,7 +22,7 @@ Soundhax는 (universal-otherapp과 사용할 때) 모든 지역의 1.0.0 이상
|
||||||
+ 만약 Soundhax가 브라우저에서 실행 불가능한 비디오로 나오면, Ctrl+S 또는 Cmd+S를 눌러 컴퓨터로 저장해 주세요.
|
+ 만약 Soundhax가 브라우저에서 실행 불가능한 비디오로 나오면, Ctrl+S 또는 Cmd+S를 눌러 컴퓨터로 저장해 주세요.
|
||||||
* 최신 버전의 [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (직접 다운로드)
|
* 최신 버전의 [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (직접 다운로드)
|
||||||
* 최신 버전의 [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (직접 다운로드)
|
* 최신 버전의 [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (직접 다운로드)
|
||||||
* The v12.0.1 release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/download/v12.0.1/Luma3DSv12.0.1.zip) (direct download)
|
* v12.0.1 버전의 [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/download/v12.0.1/Luma3DSv12.0.1.zip) (직접 다운로드)
|
||||||
* 최신 버전의 [universal-otherapp](https://github.com/TuxSH/universal-otherapp/releases/latest`) (`otherapp.bin`)
|
* 최신 버전의 [universal-otherapp](https://github.com/TuxSH/universal-otherapp/releases/latest`) (`otherapp.bin`)
|
||||||
|
|
||||||
### 진행 방법
|
### 진행 방법
|
||||||
|
|
|
||||||
|
|
@ -17,7 +17,7 @@ title: "EmuNAND 이동"
|
||||||
|
|
||||||
* 설치된 EmuNAND
|
* 설치된 EmuNAND
|
||||||
* 최신 버전의 [GodMode9](https://github.com/d0k3/GodMode9/releases/latest) (`.zip` 파일)
|
* 최신 버전의 [GodMode9](https://github.com/d0k3/GodMode9/releases/latest) (`.zip` 파일)
|
||||||
* The latest release of [FBI](https://github.com/Steveice10/FBI/releases/latest) *(the `.3dsx` file)*
|
* 최신 버전의 [FBI](https://github.com/Steveice10/FBI/releases/latest) *(`.3dsx` 파일)*
|
||||||
|
|
||||||
### 진행 방법
|
### 진행 방법
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -36,7 +36,7 @@ As a part of this process, your system settings will be reset to its defaults.
|
||||||
{: .notice--warning}
|
{: .notice--warning}
|
||||||
|
|
||||||
* 최신 버전의 [GodMode9](https://github.com/d0k3/GodMode9/releases/latest) (`.zip` 파일)
|
* 최신 버전의 [GodMode9](https://github.com/d0k3/GodMode9/releases/latest) (`.zip` 파일)
|
||||||
* The latest release of [FBI](https://github.com/Steveice10/FBI/releases/latest) *(the `.3dsx` file)*
|
* 최신 버전의 [FBI](https://github.com/Steveice10/FBI/releases/latest) *(`.3dsx` 파일)*
|
||||||
* The latest release of [faketik](https://github.com/ihaveamac/faketik/releases/latest) *(the `.3dsx` file)*
|
* The latest release of [faketik](https://github.com/ihaveamac/faketik/releases/latest) *(the `.3dsx` file)*
|
||||||
* 변경하고 싶은 지역의 종류에 맞는 11.15.0 CTRTransfer 이미지 (예: New 3DS를 가지고 있고 지역을 미국으로 변경하려면 "New 3DS or 3DS - USA"를 다운로드)
|
* 변경하고 싶은 지역의 종류에 맞는 11.15.0 CTRTransfer 이미지 (예: New 3DS를 가지고 있고 지역을 미국으로 변경하려면 "New 3DS or 3DS - USA"를 다운로드)
|
||||||
{% include_relative include/ctrtransfer-images.txt %}
|
{% include_relative include/ctrtransfer-images.txt %}
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Boot9strap installeren (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ Om deze instructies te volgen, heb je het volgende nodig:
|
||||||
### Wat je nodig hebt
|
### Wat je nodig hebt
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* De nieuwste versie van [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (directe download)
|
|
||||||
* De nieuwste versie van [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (directe download)
|
* De nieuwste versie van [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (directe download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* De nieuwste versie van [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (het Luma3DS `.zip` bestand)
|
* De nieuwste versie van [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (het Luma3DS `.zip` bestand)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Maak de `plugins` en `00040000...` mappen aan als ze nog niet bestaan
|
- Maak de `plugins` en `00040000...` mappen aan als ze nog niet bestaan
|
||||||
1. Haal de SD-kaart uit en stop deze in de **bron 3DS**
|
1. Haal de SD-kaart uit en stop deze in de **bron 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Plaats de SD-kaart van je **doel 3DS** in je computer
|
1. Plaats de SD-kaart van je **doel 3DS** in je computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Maak een map genaamd `boot9strap` op de hoofdmap van je SD-kaart
|
1. Maak een map genaamd `boot9strap` op de hoofdmap van je SD-kaart
|
||||||
1. Kopieer `boot9strap.firm` en `boot9strap.firm.sha` van de boot9strap `.zip` naar de `/boot9strap/` map op je SD-kaart
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Kopieer `SafeB9SInstaller.bin` van de SafeB9SInstaller `.zip` naar de hoofdmap van je SD-kaart
|
1. Kopieer `SafeB9SInstaller.bin` van de SafeB9SInstaller `.zip` naar de hoofdmap van je SD-kaart
|
||||||
1. Maak een map genaamd "3ds" op de hoofdmap van je SD-kaart als die nog niet bestaat
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Haal de SD-kaart uit en stop deze in de **doel 3DS**
|
1. Haal de SD-kaart uit en stop deze in de **doel 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Zet de **bron 3DS** aan
|
1. Zet de **bron 3DS** aan
|
||||||
- Als je gevraagd wordt om Luma3DS in te stellen, druk gewoon op START om de configuratie op te slaan
|
- Als je gevraagd wordt om Luma3DS in te stellen, druk gewoon op START om de configuratie op te slaan
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wacht een tijdje (een percentage moet worden weergegeven op de **bron 3DS**)
|
1. Wacht een tijdje (een percentage moet worden weergegeven op de **bron 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Druk op "OK" om de update te accepteren
|
||||||
|
+ Er is geen update. Dit is deel van de exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. Dit is verwacht gedrag
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### Czego Potrzebujesz
|
### Czego Potrzebujesz
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Stwórz folder o nazwie `boot9strap` w katalogu głównym karty SD
|
1. Stwórz folder o nazwie `boot9strap` w katalogu głównym karty SD
|
||||||
1. Skopiuj `boot9strap.firm` i `boot9strap.firm.sha` z boot9strap `.zip` do folderu `/boot9strap/` na karcie SD
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Stwórz folder o nazwie `3ds` w głównym katalogu twojej karty SD, jeśli jeszcze nie istnieje
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Instalando boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Detalhes técnicos (opcional)</em></summary>
|
<summary><em>Detalhes técnicos (opcional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
Para fazer isso, podemos usar a funcionalidade Download Play do jogo Mario Kart 7, usando um 3DS com custom firmware já instalado junto com um plugin personalizado de jogo.
|
Para fazer isso, podemos usar a funcionalidade Download Play do jogo Mario Kart 7, usando um 3DS com custom firmware já instalado junto com um plugin personalizado de jogo.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ Para poder seguir estas instruções, você precisará do seguinte:
|
||||||
### O que é necessário
|
### O que é necessário
|
||||||
|
|
||||||
* A versão mais recente do [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* A versão mais recente do [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* A versão mais recente do [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (download direto)
|
|
||||||
* A versão mais recente do [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (download direto)
|
* A versão mais recente do [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (download direto)
|
||||||
+ A versão mais recente do [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (download direto)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* A versão mais recente do [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (o arquivo `.zip` do Luma3DS)
|
* A versão mais recente do [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (o arquivo `.zip` do Luma3DS)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. Se for esse o caso, junte-se ao [Discord do Nintendo Homebrew](https://discord.gg/MWxPgEp) e peça ajuda, em Inglês.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
Nesta seção, você irá configurar seu 3DS de origem (o 3DS com custom firmware) para a entrega dos dados do exploit ao 3DS de destino.
|
Nesta seção, você irá configurar seu 3DS de origem (o 3DS com custom firmware) para a entrega dos dados do exploit ao 3DS de destino.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ Nesta seção, você irá configurar seu 3DS de origem (o 3DS com custom firmwar
|
||||||
- Crie as pastas `plugins` e `00040000...` se elas já não existirem
|
- Crie as pastas `plugins` e `00040000...` se elas já não existirem
|
||||||
1. Ejete o cartão SD e coloque-o no **3DS de origem**
|
1. Ejete o cartão SD e coloque-o no **3DS de origem**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insira o cartão SD do seu **3DS de destino** no seu computador
|
1. Insira o cartão SD do seu **3DS de destino** no seu computador
|
||||||
1. Copie o `boot.firm` e `boot.3dsx` do `.zip` do Luma3DS para a raiz do cartão SD do **3DS de destino**
|
1. Copie o `boot.firm` e `boot.3dsx` do `.zip` do Luma3DS para a raiz do cartão SD do **3DS de destino**
|
||||||
1. Crie uma pasta chamada `boot9strap` na raiz do seu cartão SD
|
1. Crie uma pasta chamada `boot9strap` na raiz do seu cartão SD
|
||||||
1. Copie o `boot9strap.firm` e o `boot9strap.firm.sha` do `.zip` do boot9strap para a pasta `/boot9strap/` no seu cartão SD
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copie `SafeB9SInstaller.bin` do `.zip` do SafeB9SInstaller para a raiz do seu cartão SD
|
1. Copie `SafeB9SInstaller.bin` do `.zip` do SafeB9SInstaller para a raiz do seu cartão SD
|
||||||
1. Crie uma pasta chamada `3ds` na raiz do seu cartão SD se ela ainda não existir
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Ejete o cartão SD e coloque-o no **3DS de destino**
|
1. Ejete o cartão SD e coloque-o no **3DS de destino**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Ligue o **3DS de origem**
|
1. Ligue o **3DS de origem**
|
||||||
- Se você for solicitado a configurar o Luma3DS, basta apertar START para salvar a configuração
|
- Se você for solicitado a configurar o Luma3DS, basta apertar START para salvar a configuração
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Aguarde um pouco (um percentual deve ser exibido no **3DS de origem**)
|
1. Aguarde um pouco (um percentual deve ser exibido no **3DS de origem**)
|
||||||
1. Se o exploit foi bem sucedido, o **3DS de destino** terá sido inicializado no 3DS ROP xPloit Injector
|
1. Se o exploit foi bem sucedido, o **3DS de destino** terá sido inicializado no 3DS ROP xPloit Injector
|
||||||
- Se o exploit falhar, desligue o **3DS de origem** e o **3DS de destino** e comece novamente desde o início da `Seção III - kartdlphax`
|
- Se o exploit falhar, desligue o **3DS de origem** e o **3DS de destino** e comece novamente desde o início da `Seção III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Seção V - Instalando boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. Com o seu console ainda desligado, segure os seguintes botões: (Gatilho Esquerdo) + (Gatilho Direito) + (D-Pad para Cima) + (A), e enquanto segura esses botões juntos, ligue seu console
|
||||||
|
+ Continue segurando os botões até o console iniciar no Modo de Segurança (um menu de "atualização do sistema")
|
||||||
|
1. Pressione "OK" para aceitar a atualização
|
||||||
|
+ Não há atualização. Isto faz parte do exploit
|
||||||
|
1. Pressione "Eu aceito" para aceitar os termos e condições
|
||||||
|
1. A atualização eventualmente falhará, com o código de erro `003-1099`. Isto é intencional
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Seção VI - Instalando o boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### Ce aveți nevoie
|
### Ce aveți nevoie
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Creați un folder numit `boot9strap` pe rădăcina cardului SD
|
1. Creați un folder numit `boot9strap` pe rădăcina cardului SD
|
||||||
1. Copiați `boot9strap.firm` și `boot9strap.firm.sha` din arhiva `.zip` boot9strap în folderul `/boot9strap/` de pe cardul SD
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Creați un folder numit `3ds` în rădăcina cardului SD dacă nu există deja
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### Что понадобится
|
### Что понадобится
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Создайте папку `boot9strap` в корне SD-карты
|
1. Создайте папку `boot9strap` в корне SD-карты
|
||||||
1. Скопируйте `boot9strap.firm` и `boot9strap.firm.sha` из `.zip-архива` boot9strap в папку `/boot9strap/` в корне SD-карты
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Создайте папку `3ds` в корне SD-карты, если таковой нет
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Skapa en mapp som heter '3ds' i roten på SD-kortet om det inte redan finns
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "Installing boot9strap (kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ In order to follow these instructions, you will need the following:
|
||||||
### What You Need
|
### What You Need
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. Create a folder named `boot9strap` on the root of your SD card
|
1. Create a folder named `boot9strap` on the root of your SD card
|
||||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### Section V - Installing boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "安装 boot9strap（通过 kartdlphax）"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>技术细节（选看）</em></summary>
|
<summary><em>技术细节（选看）</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
为了做到这一点，我们将用一台已安装了自制固件的 3DS 安装一个插件，然后利用马里奥赛车 7 这个游戏中的下载通信功能进行一些操作。
|
为了做到这一点，我们将用一台已安装了自制固件的 3DS 安装一个插件，然后利用马里奥赛车 7 这个游戏中的下载通信功能进行一些操作。
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlp
|
||||||
### 你需要准备点啥？
|
### 你需要准备点啥？
|
||||||
|
|
||||||
* 最新版本的 [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest)（下载 `plugin.3gx`）
|
* 最新版本的 [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest)（下载 `plugin.3gx`）
|
||||||
* 最新版本的 [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip)（直链）
|
|
||||||
* 最新版本的 [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip)（直链）
|
* 最新版本的 [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip)（直链）
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* 最新版本的 [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest)（下载 Luma3DS `.zip` 文件）
|
* 最新版本的 [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest)（下载 Luma3DS `.zip` 文件）
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
为了向目标 3DS 传输带有漏洞的数据，你将需要按照以下内容配置源 3DS（已安装了自制固件的 3DS）。
|
为了向目标 3DS 传输带有漏洞的数据，你将需要按照以下内容配置源 3DS（已安装了自制固件的 3DS）。
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlp
|
||||||
如果 `plugins` 和 `00040000...` 文件夹不存在，请先创建它们
|
如果 `plugins` 和 `00040000...` 文件夹不存在，请先创建它们
|
||||||
1. 弹出 SD 卡并将其插回**源 3DS**
|
1. 弹出 SD 卡并将其插回**源 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. 在你的电脑中插入你的**目标 3DS** 的 SD 卡
|
1. 在你的电脑中插入你的**目标 3DS** 的 SD 卡
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. 在 SD 卡根目录创建一个名为 `boot9strap` 的文件夹
|
1. 在 SD 卡根目录创建一个名为 `boot9strap` 的文件夹
|
||||||
1. 从boot9strap `.zip` 文件中复制 `boot9strap.firm` 和 `boot9strap.firm.sha` 到你SD卡的 `/boot9strap/` 文件夹中
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. 从 SafeB9SInstaller `.zip` 压缩包中复制 `SafeB9SInstaller.bin` 到 SD 卡根目录下
|
1. 从 SafeB9SInstaller `.zip` 压缩包中复制 `SafeB9SInstaller.bin` 到 SD 卡根目录下
|
||||||
1. 检查 SD 卡的根目录是否存在一个名为 `3ds` 的文件夹，如果没有则手动新建一个
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. 取下 SD 卡并将其插回**目标 3DS**
|
1. 取下 SD 卡并将其插回**目标 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. 启动 **源 3DS **
|
1. 启动 **源 3DS **
|
||||||
- 若主机提示设置 Luma3DS，则你可以直接按下 START 键来保存配置
|
- 若主机提示设置 Luma3DS，则你可以直接按下 START 键来保存配置
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. 稍等一会儿（百分比应该会显示在**源 3DS** 上）
|
1. 稍等一会儿（百分比应该会显示在**源 3DS** 上）
|
||||||
1. 如果漏洞执行成功，**目标 3DS** 将会启动 3DS ROP xPloit Injector
|
1. 如果漏洞执行成功，**目标 3DS** 将会启动 3DS ROP xPloit Injector
|
||||||
- 如果漏洞没有成功触发，则请将**源 3DS** 和 **目标 3DS** 一起关机，然后从 `第三步 — kartdlphax` 重新开始
|
- 如果漏洞没有成功触发，则请将**源 3DS** 和 **目标 3DS** 一起关机，然后从 `第三步 — kartdlphax` 重新开始
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### 第五步 – 安装 boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,15 +7,15 @@ title: "安裝 boot9strap (透過 kartdlphax)"
|
||||||
{% capture technical_info %}
|
{% capture technical_info %}
|
||||||
<summary><em>Technical Details (optional)</em></summary>
|
<summary><em>Technical Details (optional)</em></summary>
|
||||||
|
|
||||||
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||||
|
|
||||||
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
|
||||||
|
|
||||||
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
|
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||||
|
|
||||||
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||||
|
|
||||||
See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlphax, [here](https://github.com/zoogie/menuhax67) for information about menuhax67, and [here](https://github.com/luigoalma/nimdsphax) for information about nimdsphax.
|
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: [kartdlphax](https://github.com/PabloMK7/kartdlphax), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||||
|
|
||||||
{% endcapture %}
|
{% endcapture %}
|
||||||
<details>{{ technical_info | markdownify }}</details>
|
<details>{{ technical_info | markdownify }}</details>
|
||||||
|
|
@ -34,13 +34,18 @@ See [here](https://github.com/PabloMK7/kartdlphax) for information about kartdlp
|
||||||
### 必備項目
|
### 必備項目
|
||||||
|
|
||||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
||||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||||
+ The latest release of [nimdsphax](https://github.com/luigoalma/nimdsphax/releases/download/v1.0/nimdsphax_v1.0.zip) (direct download)
|
|
||||||
* The latest release of [menuhax67](https://github.com/zoogie/menuhax67/releases/latest)
|
|
||||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||||
|
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file)
|
||||||
|
|
||||||
#### Section I - Prep Work (source 3DS)
|
#### Section I - Hardware Button Check (target 3DS)
|
||||||
|
|
||||||
|
{% include_relative include/safemodecheck.txt %}
|
||||||
|
|
||||||
|
If the camera does not open, you cannot follow this method. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||||
|
{: .notice--warning}
|
||||||
|
|
||||||
|
#### Section II - Prep Work (source 3DS)
|
||||||
|
|
||||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||||
|
|
||||||
|
|
@ -54,31 +59,23 @@ In this section, you will set up your source 3DS (the 3DS with custom firmware)
|
||||||
- Create the `plugins` and `00040000...` folders if they do not already exist
|
- Create the `plugins` and `00040000...` folders if they do not already exist
|
||||||
1. Eject the SD card and put it in the **source 3DS**
|
1. Eject the SD card and put it in the **source 3DS**
|
||||||
|
|
||||||
#### Section II - Prep Work (target 3DS)
|
#### Section III - Prep Work (target 3DS)
|
||||||
|
|
||||||
In this section, you will set up the files that the target 3DS will need to install custom firmware.
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||||
|
|
||||||
1. Insert the SD card of your **target 3DS** in your computer
|
1. Insert the SD card of your **target 3DS** in your computer
|
||||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of the **target 3DS's** SD card
|
||||||
1. 在 SD 卡的根目錄底下建立一個新的資料夾 `boot9strap`
|
1. 在 SD 卡的根目錄底下建立一個新的資料夾 `boot9strap`
|
||||||
1. 解壓 boot9strap `.zip` 的 `boot9strap.firm` 及 `boot9strap.firm.sha` 檔案至 SD 卡的 `/boot9strap/` 資料夾中
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||||
1. 將 SafeB9SInstaller `.zip` 中的 `SafeB9SInstaller.bin` 複製到 SD 卡的根目錄
|
1. 將 SafeB9SInstaller `.zip` 中的 `SafeB9SInstaller.bin` 複製到 SD 卡的根目錄
|
||||||
1. 在 SD 卡的根目錄底下建立一個新資料夾 `3ds`
|
1. Copy `usm.bin` from the RELEASE `.zip` to the root of your SD card
|
||||||
* This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
1. Create a folder called `3ds` on the root of your SD card
|
||||||
1. Copy the `nimdsphax` folder from the nimdsphax`.zip` to the `/3ds/` folder on your SD card
|
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||||
1. Copy `menuhax67_installer.3dsx` from the menuhax `.zip` to the `/3ds/` folder on your SD card
|
|
||||||
1. Copy Launcher.dat from the folder for your model and region inside the menuhax `.zip` to the root of your SD card
|
|
||||||
1. Eject the SD card and put it in the **target 3DS**
|
1. Eject the SD card and put it in the **target 3DS**
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-root-layout.png" | absolute_url }})
|
#### Section IV - kartdlphax
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
![]({{ "/images/screenshots/kart-3ds-layout.png" | absolute_url }})
|
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||||
{: .notice--info}
|
|
||||||
|
|
||||||
#### Section III - kartdlphax
|
|
||||||
|
|
||||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
|
|
||||||
|
|
||||||
1. Power on the **source 3DS**
|
1. Power on the **source 3DS**
|
||||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||||
|
|
@ -107,26 +104,45 @@ In this section, you will use Download Play to transfer the exploit data from th
|
||||||
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
1. Wait a while (a percentage should be displayed on the **source 3DS**)
|
||||||
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
1. If the exploit was successful, the **target 3DS** will have booted into the 3DS ROP xPloit Injector
|
||||||
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
- If the exploit was not successful, power off the **source 3DS** and **target 3DS** and start again from the beginning of `Section III - kartdlphax`
|
||||||
|
1. Press (X) to inject unSAFE_MODE
|
||||||
|
1. If the injection was successful, the screen will turn green and the **target 3DS** will automatically power off
|
||||||
|
+ If the screen turns red, power off the target 3DS and start again from the beginning of `Section III - kartdlphax`. If this doesn't work, ask for help at [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp))
|
||||||
|
|
||||||
#### Section IV - Installing menuhax67
|
You will **not** need to use your **source 3DS** to complete any further steps on this guide. Any further steps should only be completed on the **target 3DS**.
|
||||||
|
{: .notice--info}
|
||||||
|
|
||||||
{% include_relative include/menuhax67-install.txt %}
|
#### Section V - unSAFE_MODE
|
||||||
|
|
||||||
#### 第五節 — 安裝 boot9strap
|
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||||
|
|
||||||
|
1. With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
|
||||||
|
+ Keep holding the buttons until the console boots into Safe Mode (a "system update" menu)
|
||||||
|
1. Press "OK" to accept the update
|
||||||
|
+ There is no update. This is part of the exploit
|
||||||
|
1. Press "I accept" to accept the terms and conditions
|
||||||
|
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||||
|
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||||
|
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||||
|
1. If the exploit was successful, your console will have booted into SafeB9SInstaller
|
||||||
|
+ If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
|
||||||
|
+ If your console instead freezes on a red screen, you are missing `usm.bin` from the root of your SD card
|
||||||
|
+ If you get a different error, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-usm)
|
||||||
|
|
||||||
|
#### Section VI - Installing boot9strap
|
||||||
|
|
||||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||||
{%- include_relative include/configure-luma3ds.txt %}
|
{%- include_relative include/configure-luma3ds.txt %}
|
||||||
|
|
||||||
{% include_relative include/luma3ds-installed-note.txt %}
|
{% include_relative include/luma3ds-installed-note.txt %}
|
||||||
|
|
||||||
#### Section VI - Removing menuhax67
|
#### Section VII - Restoring WiFi Configuration Profiles
|
||||||
|
|
||||||
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
|
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
|
||||||
|
|
||||||
{% include_relative include/launch-hbl-dlp.txt %}
|
{% include_relative include/launch-hbl-dlp.txt %}
|
||||||
1. Launch menuhax67_installer from the list of homebrew
|
1. Launch slotTool from the list of homebrew
|
||||||
1. Select REMOVE menuhax67
|
1. Select "RESTORE original wifi slots 1,2,3"
|
||||||
1. When you see "done.", press (A), then press (A) on "EXIT to menu"
|
1. Your console will then reboot
|
||||||
|
|
||||||
___
|
___
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue