translations: clean up leftover files
This commit is contained in:
parent
69eb6d7416
commit
476bdc50da
488 changed files with 0 additions and 30729 deletions
|
@ -1,102 +0,0 @@
|
|||
---
|
||||
title: "Installing Boot9strap (Fredtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (such as the one on SD root from [BannerBomb3](bannerbomb3) or [DSiWare Dumper](dsidumper))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest)
|
||||
* The latest release of [Luma3DS](https://github.com/AuroraWright/Luma3DS/releases/latest)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - Fredtool
|
||||
|
||||
1. Open [Fredtool](https://fredtool.bruteforcemovable.com/) on your computer
|
||||
1. Select your `movable.sed` file for the "Your movable.sed" field
|
||||
1. Select your DSiWare Backup (`<8-character-id>.bin`) file for the "Your dsiware.bin" field
|
||||
1. Complete the "I'm not a robot" captcha
|
||||
1. Select "Start"
|
||||
1. Wait for the process to complete
|
||||
1. When the process has completed, download your modified DSiWare archive from the site
|
||||
+ This file contains 2 dsiware backup files, one clean (unmodified) and one hax (exploited)
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ This `<ID1>` folder will be another 32 letter/number folder inside the `<ID0>` folder
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside the `<ID1>` folder
|
||||
1. Copy the `42383841.bin` file from the `output/hax/` folder of the downloaded DSiWare archive (`fredtool_output.zip`) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section III - Flipnote Exploit
|
||||
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
1. Once the menu loads, select the face icon, then the bottom right icon to continue
|
||||
1. Press (X) or (UP) on the D-Pad depending on which is shown on the top screen
|
||||
1. Select the second button along the top with a film-reel icon
|
||||
1. Scroll right until reel "3/3" is selected
|
||||
1. Tap the third box with the letter "A" in it
|
||||
1. Scroll left until reel "1/3" is selected
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to home menu instead of installing boot9strap and you will need to open Nintendo DS Connections and start over from the beginning of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
+ If you see the Luma Configuration screen, continue with the guide without powering off
|
||||
|
||||
#### Section IV - Configuring Luma3DS
|
||||
|
||||
1. Boot your device while holding (Select) to launch the Luma configuration menu
|
||||
+ If you encounter issues launching the Luma configuration menu, [follow this troubleshooting guide](https://github.com/zoogie/b9sTool/blob/master/TROUBLESHOOTING.md)
|
||||
1. Use the (A) button and the D-Pad to turn on the following:
|
||||
+ **"Show NAND or user string in System Settings"**
|
||||
1. Press (Start) to save and reboot
|
||||
+ Your device should load the Home Menu after a short delay. If you get a black screen lasting longer than 5 minutes, [follow this troubleshooting guide](troubleshooting#black-screen-on-sysnand-boot-after-installing-boot9strap)
|
||||
|
||||
#### Section V - Restoring DS Connection Settings
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the `42383841.bin` file from the `output/clean/` folder of the downloaded DSiWare archive (`fredtool_output.zip`) to the `Nintendo 3DS/<ID0>/<32-character-id>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,92 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile to your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, you will need to use a [Legacy Method](legacy-methods). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release archive for [Luma3DS](https://github.com/AuroraWright/Luma3DS/releases/latest)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Open [unSAFE_MODE-bb3 tool](https://usm.bruteforcemovable.com/) on your computer
|
||||
+ If this site is nonfunctional, try using [this one](https://3ds.nhnarwhal.com/3dstools/unsafemode.php)
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Download unSAFE_MODE-bb3 archive"
|
||||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a SAFE_MODE exploit data file called `usm.bin` inside of a zip folder (`unSAFE_MODE-bb3.zip`)
|
||||
1. If your console is powered on, power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from the USM archive (`unSAFE_MODE-bb3.zip`) to the root of your SD card
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ If `Nintendo DSiWare` does not exist, create it
|
||||
1. If there are any existing DSiWare backup files (`<8-character-id>.bin`) in this folder, move them to your PC
|
||||
+ This will leave you with an empty Nintendo DSiWare folder. Moving the files to your PC ensures you don't delete any intentional backups
|
||||
1. Copy the `F00D43D5.bin` file from the USM archive (`unSAFE_MODE-bb3.zip`) to the `Nintendo DSiWare` folder
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your bottom screen should flash Red and then the system will reboot to home menu a few seconds later. This means the exploit profile was successfully copied
|
||||
+ If the bottom screen does not flash Red, the exploit profile was not copied and you will not be able to complete the next section. Ensure that your files are properly placed, then try again
|
||||
1. Power off your device
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
1. With your system still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), then press (Power)
|
||||
+ Release the buttons after a few seconds. Your console will boot into Safe Mode
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
1. Once you see `B9S install SUCCESS` on the top screen, press any button to reboot to Luma Configuration
|
||||
|
||||
#### Section IV - Configuring Luma3DS
|
||||
|
||||
1. Your device should automatically show the Luma Configuration menu
|
||||
1. Use the (A) button and the D-Pad to turn on the following:
|
||||
+ **"Show NAND or user string in System Settings"**
|
||||
1. Press (Start) to save and reboot
|
||||
+ Your device should load the Home Menu after a short delay. If you get a black screen lasting longer than 5 minutes, [follow this troubleshooting guide](troubleshooting#black-screen-on-sysnand-boot-after-installing-boot9strap)
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your bottom screen should flash Green and then the system will reboot to home menu a few seconds later. This means your WiFi configuration profiles were successfully restored
|
||||
1. Power your system off
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Continue to Finalizing Setup
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,47 +0,0 @@
|
|||
---
|
||||
title: "Dumping Movable (nimhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To install boot9strap on your console, we derive your console's unique encryption key. To accomplish this, we use the Homebrew Launcher to launch nimhax and dump the data encryption key (movable.sed) from your console.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/luigoalma/nimhax/) for information about the nimhax exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [nimhax](https://github.com/luigoalma/nimhax/releases/latest) (the nimhax `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the `nimhax` folder from the nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/nimhax-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - nimhax
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch nimhax from the list of homebrew
|
||||
1. If the exploit was successful, a `movable.sed` file will appear on the root of your SD card
|
||||
|
||||
### Next step: Frogtool
|
||||
|
||||
Once you have your console's encryption key (`movable.sed`), you can use it in conjunction with Frogtool, which uses your `movable.sed` file to inject and take advantage of JPN Flipnote Studio. \
|
||||
While this method is faster, it requires downloading a file with a torrent client. Do not follow this method if you're unable to use a torrent client.
|
||||
|
||||
Continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--primary}
|
|
@ -1,57 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (freakyhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[freakyhax](https://plutooo.github.io/freakyhax/) is an exploit for the game Freakyforms Deluxe discovered and released by [plutooo](https://github.com/plutooo). It works on versions 9.0.0 through 11.17.0 on EUR, USA and JPN region consoles.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ A EUR/USA/JPN copy of Freakyforms Deluxe (eShop or cartridge)
|
||||
+ The latest release of [freakyhax](https://github.com/plutooo/freakyhax/releases/latest)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy all files and folders inside the `/build/<your console and region>/exploit/` folder from the freakyhax `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - freakyhax
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch Freakyforms Deluxe
|
||||
1. In the game menu, select `Play -> Camera -> Load a QR code`
|
||||
1. Select the QR code
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (ninjhax2-dx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[Ninjhax2](https://github.com/smealum/ninjhax2.x) is an exploit for the game "Cubic Ninja" made by [smealum](https://github.com/smealum). This page uses an updated version of ninjhax by [zoogie](https://github.com/zoogie) called [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx), which supports 11.17.0.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Cubic Ninja save file, if you have one.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
* The game "Cubic Ninja"
|
||||
* The latest release of [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx/releases)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `Launcher.dat` from the folder appropriate for your console from the ninjhax2-dx `.zip` file to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - ninjhax2-dx
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Cubic Ninja" once and select "Create"
|
||||
+ If prompted, delete all data
|
||||
1. Select "QR Code"
|
||||
1. Select "Scan QR Code"
|
||||
1. On your PC, open the browser and go to [ninjhax2-dx website](https://zoogie.github.io/web/nh2dx/)
|
||||
1. Select your console's region and hardware
|
||||
1. On your console, scan the QR code
|
||||
+ If the game exits to the HOME Menu, then the exploit has installed correctly
|
||||
1. Launch "Cubic Ninja" again
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (PicHaxx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[PicHaxx](https://github.com/zoogie/pichaxx) is an exploit for the game Pokémon Picross released by [zoogie](https://github.com/zoogie), originally discovered and [demonstrated](https://twitter.com/mrnbayoh/status/744899681663258624) by [MrNbaYoh](https://github.com/MrNbaYoh).
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Pokémon Picross" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Pokémon Picross
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when loaded, will run the Homebrew Launcher on your console.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3dstools.nhnarwhal.com/#/pichaxx) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `0017c100` -> `data` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in Seedminer
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
|
||||
![]({{ "/images/screenshots/pichaxx-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Pokémon Picross"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
+ If you get an error message, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-pichaxx)
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,70 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (smilehax-IIe)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
This set of instructions does not support the Japanese version of SmileBASIC.
|
||||
{: .notice--warning}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[smilehax-IIe](https://github.com/zoogie/smilehax-IIe) is an exploit for the game "SmileBASIC" made by zoogie, compatible with system versions 9.0.0 through 11.17.0 for USA/EUR/JPN region consoles.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
+ The game "SmileBASIC" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install SmileBASIC
|
||||
+ The latest release of [smilehax-IIe](https://github.com/zoogie/smilehax-IIe/releases/download/v1.1/Release_sh2e_v1.1.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Transfer the `.wav` for your region from the Release_sh2e `.zip` to a device that can play `.wav` files, for example a phone
|
||||
1. Copy the petitcom `.icn` for your region to the root of your SD card
|
||||
|
||||
#### Section II - smilehax
|
||||
|
||||
1. Launch SmileBASIC
|
||||
+ Update the game if prompted
|
||||
1. Select the "Publish/Download Projects" option
|
||||
1. Select the "Download (Receive) using Public Key" option
|
||||
1. Press the "Yes" button
|
||||
1. Enter the Public Key "NJEQK3A4" using the on-screen keyboard
|
||||
1. Press the "Yes" button to confirm the download of PMODEM141
|
||||
1. Press "OK", then "Back", then "Browse Projects"
|
||||
1. Select PMODEM141, then press "Select File"
|
||||
1. Select PMODEM141.PRG, then press "OK", then "Yes" to execute it
|
||||
1. Select RECEIVE FILE SIMPLEX
|
||||
1. Prepare the device you use to play the `.wav` file
|
||||
1. Keep your console about a foot from the `.wav` file playing devices' speaker and use a reasonable (not loud) volume to play the `.wav`
|
||||
1. Now select 300BPS, then play the `.wav` file
|
||||
1. When it finishes, press "Yes", then press "OK"
|
||||
1. Press the START button
|
||||
1. Select the SH2E-xxx.TXT file, then press OK, then "Yes" to execute it
|
||||
+ If you get kicked back into menu, make sure you're using the latest version of SmileBASIC
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (Steelhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Steel Diver: Sub Wars, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Steel Diver: Sub Wars save file, if you have one. If you wish to preserve your Steel Diver: Sub Wars game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Steel Diver: Sub Wars" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Steel Diver: Sub Wars
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Steelhax](/assets/steelhax-release.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the `steelhax` folder from the `Steelhax-release.zip` to the root of your SD card
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - Steelminer
|
||||
|
||||
In this section, you will create a hacked Steel Diver: Sub Wars save file that, when used, will load the Homebrew Launcher on your console.
|
||||
|
||||
1. Launch "Steel Diver: Sub Wars" once and select a Mii to initialize your save file
|
||||
+ Decline the game update when prompted
|
||||
+ If you have already updated the game, use the Data Management menu of the System Settings to delete the update
|
||||
1. Exit "Steel Diver: Sub Wars"
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Open [the SteelHax Save Tool website](https://3dstools.nhnarwhal.com/#/steelhax) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select your region based on your console
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `<8-character-region>` -> `data` on your SD card
|
||||
+ **EUR Region**: `000d7e00`
|
||||
+ **JPN Region**: `000d7c00`
|
||||
+ **USA Region**: `000d7d00`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Steel Diver: Sub Wars"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,80 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (super-skaterhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see [here](https://github.com/zoogie/super-skaterhax).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Super-skaterhax (when used to launch the Homebrew Launcher) is compatible with New models on version 11.16.0 in all regions, and 11.17.0 in the EUR, JPN and USA regions.
|
||||
|
||||
The instructions provided only apply to the New 3DS, New 3DS XL, and New 2DS XL. Please ensure that the console you are modding is a New 3DS, New 3DS XL, or New 2DS XL before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* The latest release of [super-skaterhax](https://github.com/zoogie/super-skaterhax/releases) (the release `.zip` file)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both super-skaterhax and the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy everything inside the folder for your console's region (and also system version if the region is USA) in the super-skaterhax `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/skater-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - super-skaterhax
|
||||
|
||||
In this section, you will visit the browser exploit webpage, which will launch the Homebrew Launcher.
|
||||
|
||||
If you haven't already, make sure you have a working Internet connection set up on your console.
|
||||
{: .notice--info}
|
||||
|
||||
1. On the HOME Menu, press the Left and Right shoulder buttons at the same time to open the camera
|
||||
+ If you are unable to open the camera, open the Internet Browser and manually type the URL instead (`https://zoogie.github.io/web/super/` for EUR/USA/JPN, `https://zoogie.github.io/web/korea` for KOR)
|
||||
1. Tap the QR code button and scan one of the following QR codes for your console's region [here](https://user-images.githubusercontent.com/28328903/226086338-585bfdac-0aac-44c0-b413-89206d2815d8.png)
|
||||
+ If you get a security certificate warning, press (A) to allow the connection
|
||||
1. Press the (Select) button to open the bookmark tab
|
||||
+ If your (Select) button does not respond, tap the star icon on the bottom-left corner of the screen
|
||||
1. Tap "Bookmark this page"
|
||||
1. Press (B) once to return to the browser
|
||||
1. Press (Start) to open the context menu
|
||||
+ If your (Start) button does not respond, tap the 3-line menu on the bottom-right corner of the screen
|
||||
1. Tap on "Settings"
|
||||
1. Tap on "Delete Cookies"
|
||||
1. Press (A) to continue
|
||||
1. Press (Home) to return to the HOME Menu, then immediately press (A) to launch the browser again
|
||||
1. Select the "GO GO!" button on the top screen
|
||||
+ If any prompts appear, approve all of them
|
||||
+ If your console freezes on a yellow screen, hold the POWER button until it turns off, then retry this section
|
||||
+ If your console freezes on a red screen, hold the POWER button until it turns off, redo step 3 of Section II, then retry this section
|
||||
+ If you get another error, try again up to 5 times, and if it still doesn't work, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-super-skaterhax)
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,29 +0,0 @@
|
|||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
1. Under the "DSiBin" field, upload your DSiWare backup file (e.g. 42383841.bin) from the root of your SD card using the first "Browse..." option
|
||||
1. Under the "MovableSed" field, upload your `movable.sed` file using the second "Browse..." option
|
||||
1. Under the "InjectionTarget" field, set the injection target to `DSinternet` (NOT memorypit)
|
||||
1. Click "Build"
|
||||
+ Wait a few seconds for the build process to complete
|
||||
1. In the Build History section on the left, type the Username into the "Filter Builds" field
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) from the release `.zip` to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,73 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.16.0. If you are on any firmware other than 11.17.0 or 11.16.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.16.0 or 11.17.0 users**: The v6.1.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/download/v6.1.1/release_6.1.1.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,77 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool, Legacy)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system to dump the DSi Internet Settings application to the SD root.
|
||||
|
||||
Once we have a DSiWare backup, we can inject it into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.15.0 or 11.14.0. If you are on any firmware other than 11.15.0 or 11.14.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer (Mii)](seedminer-(mii))
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.15.0 and 11.14.0 users only**: The v6.0.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/tag/v6.0.1) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,88 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Frogtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see "DSiWare_Exports CTCert verification" and "FIRM partitions known-plaintext" [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) link for `frogcert.bin` on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* <i class="fa fa-magnet" aria-hidden="true" title="This is a magnet link. Use a torrent client to download the file."></i> [frogcert.bin](magnet:?xt=urn:btih:d12278ea50bb3574f1fbd327f3d0e2292c70941f&dn=frogcert.bin&tr=https%3a%2f%2ftracker.fastdownload.xyz%3a443%2fannounce&tr=https%3a%2f%2fopentracker.xyz%3a443%2fannounce&tr=http%3a%2f%2fopen.trackerlist.xyz%3a80%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.tiny-vps.com%3a6969%2fannounce&tr=udp%3a%2f%2fopen.demonii.si%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.port443.xyz%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.vanitycore.co%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.torrent.eu.org%3a451%2fannounce&tr=udp%3a%2f%2fretracker.lanta-net.ru%3a2710%2fannounce&tr=udp%3a%2f%2fthetracker.org%3a80%2fannounce&tr=http%3a%2f%2ftorrent.nwps.ws%3a80%2fannounce&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.iamhansen.xyz%3a2000%2fannounce&tr=udp%3a%2f%2fbt.xxx-tracker.com%3a2710%2fannounce&tr=http%3a%2f%2f0d.kebhana.mx%3a443%2fannounce&tr=udp%3a%2f%2fexodus.desync.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=udp%3a%2f%2ftracker4.itzmx.com%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.justseed.it%3a1337%2fannounce&tr=http%3a%2f%2ftherightsize.net%3a1337%2fannounce&tr=udp%3a%2f%2fretracker.hotplug.ru%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.internetwarriors.net%3a1337%2fannounce&tr=udp%3a%2f%2f9.rarbg.com%3a2800%2fannounce&tr=https%3a%2f%2f2.track.ga%3a443%2fannounce&tr=udp%3a%2f%2fbigfoot1942.sektori.org%3a6969%2fannounce) (magnet link)
|
||||
* The latest release of [Frogtool-nimhax](https://github.com/lifehackerhansol/Frogtool/releases/download/v2.3-nimhaxb6/Frogtool-nimhax.zip) (direct download)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `boot.nds` (b9sTool) from the b9sTool release `.zip` to the root of your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy the `Frogtool` folder from the Frogtool-nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `frogcert.bin` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section III - Patching DS Download Play
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "INJECT patched DS Download Play" option
|
||||
1. Frogtool will automatically run and inject the JPN version of Flipnote Studio into your DS Download Play
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
1. Tap the touch screen, then select "BOOT patched DS Download Play"
|
||||
1. If the exploit was successful, your console will have loaded the JPN version of Flipnote Studio
|
||||
+ If you get stuck on a black screen, follow [this](https://wiki.hacks.guide/wiki/3DS:TWLFix#Userland_(PicHaxx,_Steelhax,_etc.)-0) page, then try again
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsdlp" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Download Play
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Switch the hb. title to the current app."
|
||||
1. Press (B) to continue
|
||||
1. Press (B) to return to the Rosalina main menu
|
||||
1. Press (B) to exit the Rosalina menu
|
||||
1. Press (Home), then close Download Play
|
||||
1. Relaunch the Download Play application
|
||||
1. Your console should load the Homebrew Launcher
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "RESTORE clean DS Download Play" option
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
+ If there are any errors or missing files, correct the problem and try again
|
||||
1. If the process was successful, tap the touch screen, then press START to exit
|
||||
1. Power off your console
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,76 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (HBL-USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/zoogie/unSAFE_MODE/) for information about the unSAFE_MODE exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/RELEASE_v1.3.zip) (direct download)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card. Then, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `usm.bin` from the RELEASE `.zip` to the root folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
+ You will see some on-screen text and then your system will shut down
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
{% include_relative include/remove-usm-slottool.txt %}
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,105 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: [BannerBomb3](https://github.com/zoogie/Bannerbomb3), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [an alternate branch of Seedminer](installing-boot9strap-(fredtool)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* [usm.bin](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) (direct download)
|
||||
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card.
|
||||
|
||||
1. Your SD card should be inserted in your computer
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If the BB3 multihax menu doesn't open, [follow this troubleshooting guide](troubleshooting#bannerbomb3)
|
||||
+ If the BB3 multihax menu says "cfw installed already", you already have custom firmware and should continue from [here](checking-for-cfw)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Install unSAFE_MODE"
|
||||
+ Your console will automatically power off
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Internet Settings` -> `Connection Settings`
|
||||
1. Ensure that all three connections are named "Haaaaaaaxxxxxxxxx..."
|
||||
+ Do NOT change these settings!
|
||||
+ If all three connections are NOT all named "Haaaaaaaxxxxxxxxx...", STOP! Something went wrong in this section and MUST be fixed before you can continue
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Uninstall unSAFE_MODE"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,47 +0,0 @@
|
|||
---
|
||||
title: "Dumping Movable (nimhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To install boot9strap on your console, we derive your console's unique encryption key. To accomplish this, we use the Homebrew Launcher to launch nimhax and dump the data encryption key (movable.sed) from your console.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/luigoalma/nimhax/) for information about the nimhax exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [nimhax](https://github.com/luigoalma/nimhax/releases/latest) (the nimhax `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the `nimhax` folder from the nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/nimhax-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - nimhax
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch nimhax from the list of homebrew
|
||||
1. If the exploit was successful, a `movable.sed` file will appear on the root of your SD card
|
||||
|
||||
### Next step: Frogtool
|
||||
|
||||
Once you have your console's encryption key (`movable.sed`), you can use it in conjunction with Frogtool, which uses your `movable.sed` file to inject and take advantage of JPN Flipnote Studio. \
|
||||
While this method is faster, it requires downloading a file with a torrent client. Do not follow this method if you're unable to use a torrent client.
|
||||
|
||||
Continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--primary}
|
|
@ -1,57 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (freakyhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[freakyhax](https://plutooo.github.io/freakyhax/) is an exploit for the game Freakyforms Deluxe discovered and released by [plutooo](https://github.com/plutooo). It works on versions 9.0.0 through 11.17.0 on EUR, USA and JPN region consoles.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ A EUR/USA/JPN copy of Freakyforms Deluxe (eShop or cartridge)
|
||||
+ The latest release of [freakyhax](https://github.com/plutooo/freakyhax/releases/latest)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy all files and folders inside the `/build/<your console and region>/exploit/` folder from the freakyhax `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - freakyhax
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch Freakyforms Deluxe
|
||||
1. In the game menu, select `Play -> Camera -> Load a QR code`
|
||||
1. Select the QR code
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (ninjhax2-dx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[Ninjhax2](https://github.com/smealum/ninjhax2.x) is an exploit for the game "Cubic Ninja" made by [smealum](https://github.com/smealum). This page uses an updated version of ninjhax by [zoogie](https://github.com/zoogie) called [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx), which supports 11.17.0.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Cubic Ninja save file, if you have one.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
* The game "Cubic Ninja"
|
||||
* The latest release of [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx/releases)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `Launcher.dat` from the folder appropriate for your console from the ninjhax2-dx `.zip` file to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - ninjhax2-dx
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Cubic Ninja" once and select "Create"
|
||||
+ If prompted, delete all data
|
||||
1. Select "QR Code"
|
||||
1. Select "Scan QR Code"
|
||||
1. On your PC, open the browser and go to [ninjhax2-dx website](https://zoogie.github.io/web/nh2dx/)
|
||||
1. Select your console's region and hardware
|
||||
1. On your console, scan the QR code
|
||||
+ If the game exits to the HOME Menu, then the exploit has installed correctly
|
||||
1. Launch "Cubic Ninja" again
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (PicHaxx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[PicHaxx](https://github.com/zoogie/pichaxx) is an exploit for the game Pokémon Picross released by [zoogie](https://github.com/zoogie), originally discovered and [demonstrated](https://twitter.com/mrnbayoh/status/744899681663258624) by [MrNbaYoh](https://github.com/MrNbaYoh).
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Pokémon Picross" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Pokémon Picross
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when loaded, will run the Homebrew Launcher on your console.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3dstools.nhnarwhal.com/#/pichaxx) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `0017c100` -> `data` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in Seedminer
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
|
||||
![]({{ "/images/screenshots/pichaxx-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Pokémon Picross"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
+ If you get an error message, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-pichaxx)
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,70 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (smilehax-IIe)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
This set of instructions does not support the Japanese version of SmileBASIC.
|
||||
{: .notice--warning}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[smilehax-IIe](https://github.com/zoogie/smilehax-IIe) is an exploit for the game "SmileBASIC" made by zoogie, compatible with system versions 9.0.0 through 11.17.0 for USA/EUR/JPN region consoles.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
+ The game "SmileBASIC" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install SmileBASIC
|
||||
+ The latest release of [smilehax-IIe](https://github.com/zoogie/smilehax-IIe/releases/download/v1.1/Release_sh2e_v1.1.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Transfer the `.wav` for your region from the Release_sh2e `.zip` to a device that can play `.wav` files, for example a phone
|
||||
1. Copy the petitcom `.icn` for your region to the root of your SD card
|
||||
|
||||
#### Section II - smilehax
|
||||
|
||||
1. Launch SmileBASIC
|
||||
+ Update the game if prompted
|
||||
1. Select the "Publish/Download Projects" option
|
||||
1. Select the "Download (Receive) using Public Key" option
|
||||
1. Press the "Yes" button
|
||||
1. Enter the Public Key "NJEQK3A4" using the on-screen keyboard
|
||||
1. Press the "Yes" button to confirm the download of PMODEM141
|
||||
1. Press "OK", then "Back", then "Browse Projects"
|
||||
1. Select PMODEM141, then press "Select File"
|
||||
1. Select PMODEM141.PRG, then press "OK", then "Yes" to execute it
|
||||
1. Select RECEIVE FILE SIMPLEX
|
||||
1. Prepare the device you use to play the `.wav` file
|
||||
1. Keep your console about a foot from the `.wav` file playing devices' speaker and use a reasonable (not loud) volume to play the `.wav`
|
||||
1. Now select 300BPS, then play the `.wav` file
|
||||
1. When it finishes, press "Yes", then press "OK"
|
||||
1. Press the START button
|
||||
1. Select the SH2E-xxx.TXT file, then press OK, then "Yes" to execute it
|
||||
+ If you get kicked back into menu, make sure you're using the latest version of SmileBASIC
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (Steelhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Steel Diver: Sub Wars, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Steel Diver: Sub Wars save file, if you have one. If you wish to preserve your Steel Diver: Sub Wars game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Steel Diver: Sub Wars" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Steel Diver: Sub Wars
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Steelhax](/assets/steelhax-release.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the `steelhax` folder from the `Steelhax-release.zip` to the root of your SD card
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - Steelminer
|
||||
|
||||
In this section, you will create a hacked Steel Diver: Sub Wars save file that, when used, will load the Homebrew Launcher on your console.
|
||||
|
||||
1. Launch "Steel Diver: Sub Wars" once and select a Mii to initialize your save file
|
||||
+ Decline the game update when prompted
|
||||
+ If you have already updated the game, use the Data Management menu of the System Settings to delete the update
|
||||
1. Exit "Steel Diver: Sub Wars"
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Open [the SteelHax Save Tool website](https://3dstools.nhnarwhal.com/#/steelhax) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select your region based on your console
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `<8-character-region>` -> `data` on your SD card
|
||||
+ **EUR Region**: `000d7e00`
|
||||
+ **JPN Region**: `000d7c00`
|
||||
+ **USA Region**: `000d7d00`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Steel Diver: Sub Wars"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,80 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (super-skaterhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see [here](https://github.com/zoogie/super-skaterhax).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Super-skaterhax (when used to launch the Homebrew Launcher) is compatible with New models on version 11.16.0 in all regions, and 11.17.0 in the EUR, JPN and USA regions.
|
||||
|
||||
The instructions provided only apply to the New 3DS, New 3DS XL, and New 2DS XL. Please ensure that the console you are modding is a New 3DS, New 3DS XL, or New 2DS XL before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* The latest release of [super-skaterhax](https://github.com/zoogie/super-skaterhax/releases) (the release `.zip` file)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both super-skaterhax and the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy everything inside the folder for your console's region (and also system version if the region is USA) in the super-skaterhax `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/skater-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - super-skaterhax
|
||||
|
||||
In this section, you will visit the browser exploit webpage, which will launch the Homebrew Launcher.
|
||||
|
||||
If you haven't already, make sure you have a working Internet connection set up on your console.
|
||||
{: .notice--info}
|
||||
|
||||
1. On the HOME Menu, press the Left and Right shoulder buttons at the same time to open the camera
|
||||
+ If you are unable to open the camera, open the Internet Browser and manually type the URL instead (`https://zoogie.github.io/web/super/` for EUR/USA/JPN, `https://zoogie.github.io/web/korea` for KOR)
|
||||
1. Tap the QR code button and scan one of the following QR codes for your console's region [here](https://user-images.githubusercontent.com/28328903/226086338-585bfdac-0aac-44c0-b413-89206d2815d8.png)
|
||||
+ If you get a security certificate warning, press (A) to allow the connection
|
||||
1. Press the (Select) button to open the bookmark tab
|
||||
+ If your (Select) button does not respond, tap the star icon on the bottom-left corner of the screen
|
||||
1. Tap "Bookmark this page"
|
||||
1. Press (B) once to return to the browser
|
||||
1. Press (Start) to open the context menu
|
||||
+ If your (Start) button does not respond, tap the 3-line menu on the bottom-right corner of the screen
|
||||
1. Tap on "Settings"
|
||||
1. Tap on "Delete Cookies"
|
||||
1. Press (A) to continue
|
||||
1. Press (Home) to return to the HOME Menu, then immediately press (A) to launch the browser again
|
||||
1. Select the "GO GO!" button on the top screen
|
||||
+ If any prompts appear, approve all of them
|
||||
+ If your console freezes on a yellow screen, hold the POWER button until it turns off, then retry this section
|
||||
+ If your console freezes on a red screen, hold the POWER button until it turns off, redo step 3 of Section II, then retry this section
|
||||
+ If you get another error, try again up to 5 times, and if it still doesn't work, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-super-skaterhax)
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,29 +0,0 @@
|
|||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
1. Under the "DSiBin" field, upload your DSiWare backup file (e.g. 42383841.bin) from the root of your SD card using the first "Browse..." option
|
||||
1. Under the "MovableSed" field, upload your `movable.sed` file using the second "Browse..." option
|
||||
1. Under the "InjectionTarget" field, set the injection target to `DSinternet` (NOT memorypit)
|
||||
1. Click "Build"
|
||||
+ Wait a few seconds for the build process to complete
|
||||
1. In the Build History section on the left, type the Username into the "Filter Builds" field
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) from the release `.zip` to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,73 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.16.0. If you are on any firmware other than 11.17.0 or 11.16.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.16.0 or 11.17.0 users**: The v6.1.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/download/v6.1.1/release_6.1.1.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,77 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool, Legacy)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system to dump the DSi Internet Settings application to the SD root.
|
||||
|
||||
Once we have a DSiWare backup, we can inject it into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.15.0 or 11.14.0. If you are on any firmware other than 11.15.0 or 11.14.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer (Mii)](seedminer-(mii))
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.15.0 and 11.14.0 users only**: The v6.0.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/tag/v6.0.1) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,88 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Frogtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see "DSiWare_Exports CTCert verification" and "FIRM partitions known-plaintext" [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) link for `frogcert.bin` on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* <i class="fa fa-magnet" aria-hidden="true" title="This is a magnet link. Use a torrent client to download the file."></i> [frogcert.bin](magnet:?xt=urn:btih:d12278ea50bb3574f1fbd327f3d0e2292c70941f&dn=frogcert.bin&tr=https%3a%2f%2ftracker.fastdownload.xyz%3a443%2fannounce&tr=https%3a%2f%2fopentracker.xyz%3a443%2fannounce&tr=http%3a%2f%2fopen.trackerlist.xyz%3a80%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.tiny-vps.com%3a6969%2fannounce&tr=udp%3a%2f%2fopen.demonii.si%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.port443.xyz%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.vanitycore.co%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.torrent.eu.org%3a451%2fannounce&tr=udp%3a%2f%2fretracker.lanta-net.ru%3a2710%2fannounce&tr=udp%3a%2f%2fthetracker.org%3a80%2fannounce&tr=http%3a%2f%2ftorrent.nwps.ws%3a80%2fannounce&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.iamhansen.xyz%3a2000%2fannounce&tr=udp%3a%2f%2fbt.xxx-tracker.com%3a2710%2fannounce&tr=http%3a%2f%2f0d.kebhana.mx%3a443%2fannounce&tr=udp%3a%2f%2fexodus.desync.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=udp%3a%2f%2ftracker4.itzmx.com%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.justseed.it%3a1337%2fannounce&tr=http%3a%2f%2ftherightsize.net%3a1337%2fannounce&tr=udp%3a%2f%2fretracker.hotplug.ru%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.internetwarriors.net%3a1337%2fannounce&tr=udp%3a%2f%2f9.rarbg.com%3a2800%2fannounce&tr=https%3a%2f%2f2.track.ga%3a443%2fannounce&tr=udp%3a%2f%2fbigfoot1942.sektori.org%3a6969%2fannounce) (magnet link)
|
||||
* The latest release of [Frogtool-nimhax](https://github.com/lifehackerhansol/Frogtool/releases/download/v2.3-nimhaxb6/Frogtool-nimhax.zip) (direct download)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `boot.nds` (b9sTool) from the b9sTool release `.zip` to the root of your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy the `Frogtool` folder from the Frogtool-nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `frogcert.bin` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section III - Patching DS Download Play
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "INJECT patched DS Download Play" option
|
||||
1. Frogtool will automatically run and inject the JPN version of Flipnote Studio into your DS Download Play
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
1. Tap the touch screen, then select "BOOT patched DS Download Play"
|
||||
1. If the exploit was successful, your console will have loaded the JPN version of Flipnote Studio
|
||||
+ If you get stuck on a black screen, follow [this](https://wiki.hacks.guide/wiki/3DS:TWLFix#Userland_(PicHaxx,_Steelhax,_etc.)-0) page, then try again
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsdlp" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Download Play
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Switch the hb. title to the current app."
|
||||
1. Press (B) to continue
|
||||
1. Press (B) to return to the Rosalina main menu
|
||||
1. Press (B) to exit the Rosalina menu
|
||||
1. Press (Home), then close Download Play
|
||||
1. Relaunch the Download Play application
|
||||
1. Your console should load the Homebrew Launcher
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "RESTORE clean DS Download Play" option
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
+ If there are any errors or missing files, correct the problem and try again
|
||||
1. If the process was successful, tap the touch screen, then press START to exit
|
||||
1. Power off your console
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,76 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (HBL-USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/zoogie/unSAFE_MODE/) for information about the unSAFE_MODE exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/RELEASE_v1.3.zip) (direct download)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card. Then, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `usm.bin` from the RELEASE `.zip` to the root folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
+ You will see some on-screen text and then your system will shut down
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
{% include_relative include/remove-usm-slottool.txt %}
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,105 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: [BannerBomb3](https://github.com/zoogie/Bannerbomb3), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [an alternate branch of Seedminer](installing-boot9strap-(fredtool)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* [usm.bin](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) (direct download)
|
||||
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card.
|
||||
|
||||
1. Your SD card should be inserted in your computer
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If the BB3 multihax menu doesn't open, [follow this troubleshooting guide](troubleshooting#bannerbomb3)
|
||||
+ If the BB3 multihax menu says "cfw installed already", you already have custom firmware and should continue from [here](checking-for-cfw)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Install unSAFE_MODE"
|
||||
+ Your console will automatically power off
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Internet Settings` -> `Connection Settings`
|
||||
1. Ensure that all three connections are named "Haaaaaaaxxxxxxxxx..."
|
||||
+ Do NOT change these settings!
|
||||
+ If all three connections are NOT all named "Haaaaaaaxxxxxxxxx...", STOP! Something went wrong in this section and MUST be fixed before you can continue
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Uninstall unSAFE_MODE"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,47 +0,0 @@
|
|||
---
|
||||
title: "Dumping Movable (nimhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To install boot9strap on your console, we derive your console's unique encryption key. To accomplish this, we use the Homebrew Launcher to launch nimhax and dump the data encryption key (movable.sed) from your console.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/luigoalma/nimhax/) for information about the nimhax exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [nimhax](https://github.com/luigoalma/nimhax/releases/latest) (the nimhax `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the `nimhax` folder from the nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/nimhax-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - nimhax
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch nimhax from the list of homebrew
|
||||
1. If the exploit was successful, a `movable.sed` file will appear on the root of your SD card
|
||||
|
||||
### Next step: Frogtool
|
||||
|
||||
Once you have your console's encryption key (`movable.sed`), you can use it in conjunction with Frogtool, which uses your `movable.sed` file to inject and take advantage of JPN Flipnote Studio. \
|
||||
While this method is faster, it requires downloading a file with a torrent client. Do not follow this method if you're unable to use a torrent client.
|
||||
|
||||
Continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--primary}
|
|
@ -1,57 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (freakyhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[freakyhax](https://plutooo.github.io/freakyhax/) is an exploit for the game Freakyforms Deluxe discovered and released by [plutooo](https://github.com/plutooo). It works on versions 9.0.0 through 11.17.0 on EUR, USA and JPN region consoles.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ A EUR/USA/JPN copy of Freakyforms Deluxe (eShop or cartridge)
|
||||
+ The latest release of [freakyhax](https://github.com/plutooo/freakyhax/releases/latest)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy all files and folders inside the `/build/<your console and region>/exploit/` folder from the freakyhax `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - freakyhax
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch Freakyforms Deluxe
|
||||
1. In the game menu, select `Play -> Camera -> Load a QR code`
|
||||
1. Select the QR code
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (ninjhax2-dx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[Ninjhax2](https://github.com/smealum/ninjhax2.x) is an exploit for the game "Cubic Ninja" made by [smealum](https://github.com/smealum). This page uses an updated version of ninjhax by [zoogie](https://github.com/zoogie) called [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx), which supports 11.17.0.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Cubic Ninja save file, if you have one.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
* The game "Cubic Ninja"
|
||||
* The latest release of [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx/releases)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `Launcher.dat` from the folder appropriate for your console from the ninjhax2-dx `.zip` file to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - ninjhax2-dx
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Cubic Ninja" once and select "Create"
|
||||
+ If prompted, delete all data
|
||||
1. Select "QR Code"
|
||||
1. Select "Scan QR Code"
|
||||
1. On your PC, open the browser and go to [ninjhax2-dx website](https://zoogie.github.io/web/nh2dx/)
|
||||
1. Select your console's region and hardware
|
||||
1. On your console, scan the QR code
|
||||
+ If the game exits to the HOME Menu, then the exploit has installed correctly
|
||||
1. Launch "Cubic Ninja" again
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (PicHaxx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[PicHaxx](https://github.com/zoogie/pichaxx) is an exploit for the game Pokémon Picross released by [zoogie](https://github.com/zoogie), originally discovered and [demonstrated](https://twitter.com/mrnbayoh/status/744899681663258624) by [MrNbaYoh](https://github.com/MrNbaYoh).
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Pokémon Picross" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Pokémon Picross
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when loaded, will run the Homebrew Launcher on your console.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3dstools.nhnarwhal.com/#/pichaxx) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `0017c100` -> `data` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in Seedminer
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
|
||||
![]({{ "/images/screenshots/pichaxx-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Pokémon Picross"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
+ If you get an error message, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-pichaxx)
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,70 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (smilehax-IIe)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
This set of instructions does not support the Japanese version of SmileBASIC.
|
||||
{: .notice--warning}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[smilehax-IIe](https://github.com/zoogie/smilehax-IIe) is an exploit for the game "SmileBASIC" made by zoogie, compatible with system versions 9.0.0 through 11.17.0 for USA/EUR/JPN region consoles.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
+ The game "SmileBASIC" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install SmileBASIC
|
||||
+ The latest release of [smilehax-IIe](https://github.com/zoogie/smilehax-IIe/releases/download/v1.1/Release_sh2e_v1.1.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Transfer the `.wav` for your region from the Release_sh2e `.zip` to a device that can play `.wav` files, for example a phone
|
||||
1. Copy the petitcom `.icn` for your region to the root of your SD card
|
||||
|
||||
#### Section II - smilehax
|
||||
|
||||
1. Launch SmileBASIC
|
||||
+ Update the game if prompted
|
||||
1. Select the "Publish/Download Projects" option
|
||||
1. Select the "Download (Receive) using Public Key" option
|
||||
1. Press the "Yes" button
|
||||
1. Enter the Public Key "NJEQK3A4" using the on-screen keyboard
|
||||
1. Press the "Yes" button to confirm the download of PMODEM141
|
||||
1. Press "OK", then "Back", then "Browse Projects"
|
||||
1. Select PMODEM141, then press "Select File"
|
||||
1. Select PMODEM141.PRG, then press "OK", then "Yes" to execute it
|
||||
1. Select RECEIVE FILE SIMPLEX
|
||||
1. Prepare the device you use to play the `.wav` file
|
||||
1. Keep your console about a foot from the `.wav` file playing devices' speaker and use a reasonable (not loud) volume to play the `.wav`
|
||||
1. Now select 300BPS, then play the `.wav` file
|
||||
1. When it finishes, press "Yes", then press "OK"
|
||||
1. Press the START button
|
||||
1. Select the SH2E-xxx.TXT file, then press OK, then "Yes" to execute it
|
||||
+ If you get kicked back into menu, make sure you're using the latest version of SmileBASIC
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (Steelhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Steel Diver: Sub Wars, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Steel Diver: Sub Wars save file, if you have one. If you wish to preserve your Steel Diver: Sub Wars game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Steel Diver: Sub Wars" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Steel Diver: Sub Wars
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Steelhax](/assets/steelhax-release.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the `steelhax` folder from the `Steelhax-release.zip` to the root of your SD card
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - Steelminer
|
||||
|
||||
In this section, you will create a hacked Steel Diver: Sub Wars save file that, when used, will load the Homebrew Launcher on your console.
|
||||
|
||||
1. Launch "Steel Diver: Sub Wars" once and select a Mii to initialize your save file
|
||||
+ Decline the game update when prompted
|
||||
+ If you have already updated the game, use the Data Management menu of the System Settings to delete the update
|
||||
1. Exit "Steel Diver: Sub Wars"
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Open [the SteelHax Save Tool website](https://3dstools.nhnarwhal.com/#/steelhax) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select your region based on your console
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `<8-character-region>` -> `data` on your SD card
|
||||
+ **EUR Region**: `000d7e00`
|
||||
+ **JPN Region**: `000d7c00`
|
||||
+ **USA Region**: `000d7d00`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Steel Diver: Sub Wars"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,80 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (super-skaterhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see [here](https://github.com/zoogie/super-skaterhax).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Super-skaterhax (when used to launch the Homebrew Launcher) is compatible with New models on version 11.16.0 in all regions, and 11.17.0 in the EUR, JPN and USA regions.
|
||||
|
||||
The instructions provided only apply to the New 3DS, New 3DS XL, and New 2DS XL. Please ensure that the console you are modding is a New 3DS, New 3DS XL, or New 2DS XL before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* The latest release of [super-skaterhax](https://github.com/zoogie/super-skaterhax/releases) (the release `.zip` file)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both super-skaterhax and the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy everything inside the folder for your console's region (and also system version if the region is USA) in the super-skaterhax `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/skater-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - super-skaterhax
|
||||
|
||||
In this section, you will visit the browser exploit webpage, which will launch the Homebrew Launcher.
|
||||
|
||||
If you haven't already, make sure you have a working Internet connection set up on your console.
|
||||
{: .notice--info}
|
||||
|
||||
1. On the HOME Menu, press the Left and Right shoulder buttons at the same time to open the camera
|
||||
+ If you are unable to open the camera, open the Internet Browser and manually type the URL instead (`https://zoogie.github.io/web/super/` for EUR/USA/JPN, `https://zoogie.github.io/web/korea` for KOR)
|
||||
1. Tap the QR code button and scan one of the following QR codes for your console's region [here](https://user-images.githubusercontent.com/28328903/226086338-585bfdac-0aac-44c0-b413-89206d2815d8.png)
|
||||
+ If you get a security certificate warning, press (A) to allow the connection
|
||||
1. Press the (Select) button to open the bookmark tab
|
||||
+ If your (Select) button does not respond, tap the star icon on the bottom-left corner of the screen
|
||||
1. Tap "Bookmark this page"
|
||||
1. Press (B) once to return to the browser
|
||||
1. Press (Start) to open the context menu
|
||||
+ If your (Start) button does not respond, tap the 3-line menu on the bottom-right corner of the screen
|
||||
1. Tap on "Settings"
|
||||
1. Tap on "Delete Cookies"
|
||||
1. Press (A) to continue
|
||||
1. Press (Home) to return to the HOME Menu, then immediately press (A) to launch the browser again
|
||||
1. Select the "GO GO!" button on the top screen
|
||||
+ If any prompts appear, approve all of them
|
||||
+ If your console freezes on a yellow screen, hold the POWER button until it turns off, then retry this section
|
||||
+ If your console freezes on a red screen, hold the POWER button until it turns off, redo step 3 of Section II, then retry this section
|
||||
+ If you get another error, try again up to 5 times, and if it still doesn't work, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-super-skaterhax)
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,29 +0,0 @@
|
|||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
1. Under the "DSiBin" field, upload your DSiWare backup file (e.g. 42383841.bin) from the root of your SD card using the first "Browse..." option
|
||||
1. Under the "MovableSed" field, upload your `movable.sed` file using the second "Browse..." option
|
||||
1. Under the "InjectionTarget" field, set the injection target to `DSinternet` (NOT memorypit)
|
||||
1. Click "Build"
|
||||
+ Wait a few seconds for the build process to complete
|
||||
1. In the Build History section on the left, type the Username into the "Filter Builds" field
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) from the release `.zip` to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,73 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.16.0. If you are on any firmware other than 11.17.0 or 11.16.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.16.0 or 11.17.0 users**: The v6.1.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/download/v6.1.1/release_6.1.1.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,77 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool, Legacy)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system to dump the DSi Internet Settings application to the SD root.
|
||||
|
||||
Once we have a DSiWare backup, we can inject it into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.15.0 or 11.14.0. If you are on any firmware other than 11.15.0 or 11.14.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer (Mii)](seedminer-(mii))
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.15.0 and 11.14.0 users only**: The v6.0.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/tag/v6.0.1) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,88 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Frogtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see "DSiWare_Exports CTCert verification" and "FIRM partitions known-plaintext" [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) link for `frogcert.bin` on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* <i class="fa fa-magnet" aria-hidden="true" title="This is a magnet link. Use a torrent client to download the file."></i> [frogcert.bin](magnet:?xt=urn:btih:d12278ea50bb3574f1fbd327f3d0e2292c70941f&dn=frogcert.bin&tr=https%3a%2f%2ftracker.fastdownload.xyz%3a443%2fannounce&tr=https%3a%2f%2fopentracker.xyz%3a443%2fannounce&tr=http%3a%2f%2fopen.trackerlist.xyz%3a80%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.tiny-vps.com%3a6969%2fannounce&tr=udp%3a%2f%2fopen.demonii.si%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.port443.xyz%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.vanitycore.co%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.torrent.eu.org%3a451%2fannounce&tr=udp%3a%2f%2fretracker.lanta-net.ru%3a2710%2fannounce&tr=udp%3a%2f%2fthetracker.org%3a80%2fannounce&tr=http%3a%2f%2ftorrent.nwps.ws%3a80%2fannounce&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.iamhansen.xyz%3a2000%2fannounce&tr=udp%3a%2f%2fbt.xxx-tracker.com%3a2710%2fannounce&tr=http%3a%2f%2f0d.kebhana.mx%3a443%2fannounce&tr=udp%3a%2f%2fexodus.desync.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=udp%3a%2f%2ftracker4.itzmx.com%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.justseed.it%3a1337%2fannounce&tr=http%3a%2f%2ftherightsize.net%3a1337%2fannounce&tr=udp%3a%2f%2fretracker.hotplug.ru%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.internetwarriors.net%3a1337%2fannounce&tr=udp%3a%2f%2f9.rarbg.com%3a2800%2fannounce&tr=https%3a%2f%2f2.track.ga%3a443%2fannounce&tr=udp%3a%2f%2fbigfoot1942.sektori.org%3a6969%2fannounce) (magnet link)
|
||||
* The latest release of [Frogtool-nimhax](https://github.com/lifehackerhansol/Frogtool/releases/download/v2.3-nimhaxb6/Frogtool-nimhax.zip) (direct download)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `boot.nds` (b9sTool) from the b9sTool release `.zip` to the root of your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy the `Frogtool` folder from the Frogtool-nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `frogcert.bin` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section III - Patching DS Download Play
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "INJECT patched DS Download Play" option
|
||||
1. Frogtool will automatically run and inject the JPN version of Flipnote Studio into your DS Download Play
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
1. Tap the touch screen, then select "BOOT patched DS Download Play"
|
||||
1. If the exploit was successful, your console will have loaded the JPN version of Flipnote Studio
|
||||
+ If you get stuck on a black screen, follow [this](https://wiki.hacks.guide/wiki/3DS:TWLFix#Userland_(PicHaxx,_Steelhax,_etc.)-0) page, then try again
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsdlp" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Download Play
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Switch the hb. title to the current app."
|
||||
1. Press (B) to continue
|
||||
1. Press (B) to return to the Rosalina main menu
|
||||
1. Press (B) to exit the Rosalina menu
|
||||
1. Press (Home), then close Download Play
|
||||
1. Relaunch the Download Play application
|
||||
1. Your console should load the Homebrew Launcher
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "RESTORE clean DS Download Play" option
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
+ If there are any errors or missing files, correct the problem and try again
|
||||
1. If the process was successful, tap the touch screen, then press START to exit
|
||||
1. Power off your console
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,76 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (HBL-USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/zoogie/unSAFE_MODE/) for information about the unSAFE_MODE exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/RELEASE_v1.3.zip) (direct download)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card. Then, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `usm.bin` from the RELEASE `.zip` to the root folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
+ You will see some on-screen text and then your system will shut down
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
{% include_relative include/remove-usm-slottool.txt %}
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,105 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: [BannerBomb3](https://github.com/zoogie/Bannerbomb3), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [an alternate branch of Seedminer](installing-boot9strap-(fredtool)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* [usm.bin](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) (direct download)
|
||||
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card.
|
||||
|
||||
1. Your SD card should be inserted in your computer
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If the BB3 multihax menu doesn't open, [follow this troubleshooting guide](troubleshooting#bannerbomb3)
|
||||
+ If the BB3 multihax menu says "cfw installed already", you already have custom firmware and should continue from [here](checking-for-cfw)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Install unSAFE_MODE"
|
||||
+ Your console will automatically power off
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Internet Settings` -> `Connection Settings`
|
||||
1. Ensure that all three connections are named "Haaaaaaaxxxxxxxxx..."
|
||||
+ Do NOT change these settings!
|
||||
+ If all three connections are NOT all named "Haaaaaaaxxxxxxxxx...", STOP! Something went wrong in this section and MUST be fixed before you can continue
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Uninstall unSAFE_MODE"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,47 +0,0 @@
|
|||
---
|
||||
title: "Dumping Movable (nimhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To install boot9strap on your console, we derive your console's unique encryption key. To accomplish this, we use the Homebrew Launcher to launch nimhax and dump the data encryption key (movable.sed) from your console.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/luigoalma/nimhax/) for information about the nimhax exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [nimhax](https://github.com/luigoalma/nimhax/releases/latest) (the nimhax `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the `nimhax` folder from the nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/nimhax-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - nimhax
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch nimhax from the list of homebrew
|
||||
1. If the exploit was successful, a `movable.sed` file will appear on the root of your SD card
|
||||
|
||||
### Next step: Frogtool
|
||||
|
||||
Once you have your console's encryption key (`movable.sed`), you can use it in conjunction with Frogtool, which uses your `movable.sed` file to inject and take advantage of JPN Flipnote Studio. \
|
||||
While this method is faster, it requires downloading a file with a torrent client. Do not follow this method if you're unable to use a torrent client.
|
||||
|
||||
Continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--primary}
|
|
@ -1,57 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (freakyhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[freakyhax](https://plutooo.github.io/freakyhax/) is an exploit for the game Freakyforms Deluxe discovered and released by [plutooo](https://github.com/plutooo). It works on versions 9.0.0 through 11.17.0 on EUR, USA and JPN region consoles.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ A EUR/USA/JPN copy of Freakyforms Deluxe (eShop or cartridge)
|
||||
+ The latest release of [freakyhax](https://github.com/plutooo/freakyhax/releases/latest)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy all files and folders inside the `/build/<your console and region>/exploit/` folder from the freakyhax `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - freakyhax
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch Freakyforms Deluxe
|
||||
1. In the game menu, select `Play -> Camera -> Load a QR code`
|
||||
1. Select the QR code
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (ninjhax2-dx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[Ninjhax2](https://github.com/smealum/ninjhax2.x) is an exploit for the game "Cubic Ninja" made by [smealum](https://github.com/smealum). This page uses an updated version of ninjhax by [zoogie](https://github.com/zoogie) called [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx), which supports 11.17.0.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Cubic Ninja save file, if you have one.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
* The game "Cubic Ninja"
|
||||
* The latest release of [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx/releases)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `Launcher.dat` from the folder appropriate for your console from the ninjhax2-dx `.zip` file to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - ninjhax2-dx
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Cubic Ninja" once and select "Create"
|
||||
+ If prompted, delete all data
|
||||
1. Select "QR Code"
|
||||
1. Select "Scan QR Code"
|
||||
1. On your PC, open the browser and go to [ninjhax2-dx website](https://zoogie.github.io/web/nh2dx/)
|
||||
1. Select your console's region and hardware
|
||||
1. On your console, scan the QR code
|
||||
+ If the game exits to the HOME Menu, then the exploit has installed correctly
|
||||
1. Launch "Cubic Ninja" again
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (PicHaxx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[PicHaxx](https://github.com/zoogie/pichaxx) is an exploit for the game Pokémon Picross released by [zoogie](https://github.com/zoogie), originally discovered and [demonstrated](https://twitter.com/mrnbayoh/status/744899681663258624) by [MrNbaYoh](https://github.com/MrNbaYoh).
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Pokémon Picross" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Pokémon Picross
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when loaded, will run the Homebrew Launcher on your console.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3dstools.nhnarwhal.com/#/pichaxx) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `0017c100` -> `data` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in Seedminer
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
|
||||
![]({{ "/images/screenshots/pichaxx-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Pokémon Picross"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
+ If you get an error message, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-pichaxx)
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,70 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (smilehax-IIe)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
This set of instructions does not support the Japanese version of SmileBASIC.
|
||||
{: .notice--warning}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[smilehax-IIe](https://github.com/zoogie/smilehax-IIe) is an exploit for the game "SmileBASIC" made by zoogie, compatible with system versions 9.0.0 through 11.17.0 for USA/EUR/JPN region consoles.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
+ The game "SmileBASIC" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install SmileBASIC
|
||||
+ The latest release of [smilehax-IIe](https://github.com/zoogie/smilehax-IIe/releases/download/v1.1/Release_sh2e_v1.1.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Transfer the `.wav` for your region from the Release_sh2e `.zip` to a device that can play `.wav` files, for example a phone
|
||||
1. Copy the petitcom `.icn` for your region to the root of your SD card
|
||||
|
||||
#### Section II - smilehax
|
||||
|
||||
1. Launch SmileBASIC
|
||||
+ Update the game if prompted
|
||||
1. Select the "Publish/Download Projects" option
|
||||
1. Select the "Download (Receive) using Public Key" option
|
||||
1. Press the "Yes" button
|
||||
1. Enter the Public Key "NJEQK3A4" using the on-screen keyboard
|
||||
1. Press the "Yes" button to confirm the download of PMODEM141
|
||||
1. Press "OK", then "Back", then "Browse Projects"
|
||||
1. Select PMODEM141, then press "Select File"
|
||||
1. Select PMODEM141.PRG, then press "OK", then "Yes" to execute it
|
||||
1. Select RECEIVE FILE SIMPLEX
|
||||
1. Prepare the device you use to play the `.wav` file
|
||||
1. Keep your console about a foot from the `.wav` file playing devices' speaker and use a reasonable (not loud) volume to play the `.wav`
|
||||
1. Now select 300BPS, then play the `.wav` file
|
||||
1. When it finishes, press "Yes", then press "OK"
|
||||
1. Press the START button
|
||||
1. Select the SH2E-xxx.TXT file, then press OK, then "Yes" to execute it
|
||||
+ If you get kicked back into menu, make sure you're using the latest version of SmileBASIC
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (Steelhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Steel Diver: Sub Wars, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Steel Diver: Sub Wars save file, if you have one. If you wish to preserve your Steel Diver: Sub Wars game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Steel Diver: Sub Wars" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Steel Diver: Sub Wars
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Steelhax](/assets/steelhax-release.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the `steelhax` folder from the `Steelhax-release.zip` to the root of your SD card
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - Steelminer
|
||||
|
||||
In this section, you will create a hacked Steel Diver: Sub Wars save file that, when used, will load the Homebrew Launcher on your console.
|
||||
|
||||
1. Launch "Steel Diver: Sub Wars" once and select a Mii to initialize your save file
|
||||
+ Decline the game update when prompted
|
||||
+ If you have already updated the game, use the Data Management menu of the System Settings to delete the update
|
||||
1. Exit "Steel Diver: Sub Wars"
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Open [the SteelHax Save Tool website](https://3dstools.nhnarwhal.com/#/steelhax) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select your region based on your console
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `<8-character-region>` -> `data` on your SD card
|
||||
+ **EUR Region**: `000d7e00`
|
||||
+ **JPN Region**: `000d7c00`
|
||||
+ **USA Region**: `000d7d00`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Steel Diver: Sub Wars"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,80 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (super-skaterhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see [here](https://github.com/zoogie/super-skaterhax).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Super-skaterhax (when used to launch the Homebrew Launcher) is compatible with New models on version 11.16.0 in all regions, and 11.17.0 in the EUR, JPN and USA regions.
|
||||
|
||||
The instructions provided only apply to the New 3DS, New 3DS XL, and New 2DS XL. Please ensure that the console you are modding is a New 3DS, New 3DS XL, or New 2DS XL before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* The latest release of [super-skaterhax](https://github.com/zoogie/super-skaterhax/releases) (the release `.zip` file)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both super-skaterhax and the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy everything inside the folder for your console's region (and also system version if the region is USA) in the super-skaterhax `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/skater-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - super-skaterhax
|
||||
|
||||
In this section, you will visit the browser exploit webpage, which will launch the Homebrew Launcher.
|
||||
|
||||
If you haven't already, make sure you have a working Internet connection set up on your console.
|
||||
{: .notice--info}
|
||||
|
||||
1. On the HOME Menu, press the Left and Right shoulder buttons at the same time to open the camera
|
||||
+ If you are unable to open the camera, open the Internet Browser and manually type the URL instead (`https://zoogie.github.io/web/super/` for EUR/USA/JPN, `https://zoogie.github.io/web/korea` for KOR)
|
||||
1. Tap the QR code button and scan one of the following QR codes for your console's region [here](https://user-images.githubusercontent.com/28328903/226086338-585bfdac-0aac-44c0-b413-89206d2815d8.png)
|
||||
+ If you get a security certificate warning, press (A) to allow the connection
|
||||
1. Press the (Select) button to open the bookmark tab
|
||||
+ If your (Select) button does not respond, tap the star icon on the bottom-left corner of the screen
|
||||
1. Tap "Bookmark this page"
|
||||
1. Press (B) once to return to the browser
|
||||
1. Press (Start) to open the context menu
|
||||
+ If your (Start) button does not respond, tap the 3-line menu on the bottom-right corner of the screen
|
||||
1. Tap on "Settings"
|
||||
1. Tap on "Delete Cookies"
|
||||
1. Press (A) to continue
|
||||
1. Press (Home) to return to the HOME Menu, then immediately press (A) to launch the browser again
|
||||
1. Select the "GO GO!" button on the top screen
|
||||
+ If any prompts appear, approve all of them
|
||||
+ If your console freezes on a yellow screen, hold the POWER button until it turns off, then retry this section
|
||||
+ If your console freezes on a red screen, hold the POWER button until it turns off, redo step 3 of Section II, then retry this section
|
||||
+ If you get another error, try again up to 5 times, and if it still doesn't work, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-super-skaterhax)
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,29 +0,0 @@
|
|||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
1. Under the "DSiBin" field, upload your DSiWare backup file (e.g. 42383841.bin) from the root of your SD card using the first "Browse..." option
|
||||
1. Under the "MovableSed" field, upload your `movable.sed` file using the second "Browse..." option
|
||||
1. Under the "InjectionTarget" field, set the injection target to `DSinternet` (NOT memorypit)
|
||||
1. Click "Build"
|
||||
+ Wait a few seconds for the build process to complete
|
||||
1. In the Build History section on the left, type the Username into the "Filter Builds" field
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) from the release `.zip` to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,73 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.16.0. If you are on any firmware other than 11.17.0 or 11.16.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.16.0 or 11.17.0 users**: The v6.1.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/download/v6.1.1/release_6.1.1.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,77 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool, Legacy)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system to dump the DSi Internet Settings application to the SD root.
|
||||
|
||||
Once we have a DSiWare backup, we can inject it into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.15.0 or 11.14.0. If you are on any firmware other than 11.15.0 or 11.14.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer (Mii)](seedminer-(mii))
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.15.0 and 11.14.0 users only**: The v6.0.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/tag/v6.0.1) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,88 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Frogtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see "DSiWare_Exports CTCert verification" and "FIRM partitions known-plaintext" [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) link for `frogcert.bin` on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* <i class="fa fa-magnet" aria-hidden="true" title="This is a magnet link. Use a torrent client to download the file."></i> [frogcert.bin](magnet:?xt=urn:btih:d12278ea50bb3574f1fbd327f3d0e2292c70941f&dn=frogcert.bin&tr=https%3a%2f%2ftracker.fastdownload.xyz%3a443%2fannounce&tr=https%3a%2f%2fopentracker.xyz%3a443%2fannounce&tr=http%3a%2f%2fopen.trackerlist.xyz%3a80%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.tiny-vps.com%3a6969%2fannounce&tr=udp%3a%2f%2fopen.demonii.si%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.port443.xyz%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.vanitycore.co%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.torrent.eu.org%3a451%2fannounce&tr=udp%3a%2f%2fretracker.lanta-net.ru%3a2710%2fannounce&tr=udp%3a%2f%2fthetracker.org%3a80%2fannounce&tr=http%3a%2f%2ftorrent.nwps.ws%3a80%2fannounce&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.iamhansen.xyz%3a2000%2fannounce&tr=udp%3a%2f%2fbt.xxx-tracker.com%3a2710%2fannounce&tr=http%3a%2f%2f0d.kebhana.mx%3a443%2fannounce&tr=udp%3a%2f%2fexodus.desync.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=udp%3a%2f%2ftracker4.itzmx.com%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.justseed.it%3a1337%2fannounce&tr=http%3a%2f%2ftherightsize.net%3a1337%2fannounce&tr=udp%3a%2f%2fretracker.hotplug.ru%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.internetwarriors.net%3a1337%2fannounce&tr=udp%3a%2f%2f9.rarbg.com%3a2800%2fannounce&tr=https%3a%2f%2f2.track.ga%3a443%2fannounce&tr=udp%3a%2f%2fbigfoot1942.sektori.org%3a6969%2fannounce) (magnet link)
|
||||
* The latest release of [Frogtool-nimhax](https://github.com/lifehackerhansol/Frogtool/releases/download/v2.3-nimhaxb6/Frogtool-nimhax.zip) (direct download)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `boot.nds` (b9sTool) from the b9sTool release `.zip` to the root of your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy the `Frogtool` folder from the Frogtool-nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `frogcert.bin` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section III - Patching DS Download Play
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "INJECT patched DS Download Play" option
|
||||
1. Frogtool will automatically run and inject the JPN version of Flipnote Studio into your DS Download Play
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
1. Tap the touch screen, then select "BOOT patched DS Download Play"
|
||||
1. If the exploit was successful, your console will have loaded the JPN version of Flipnote Studio
|
||||
+ If you get stuck on a black screen, follow [this](https://wiki.hacks.guide/wiki/3DS:TWLFix#Userland_(PicHaxx,_Steelhax,_etc.)-0) page, then try again
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsdlp" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Download Play
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Switch the hb. title to the current app."
|
||||
1. Press (B) to continue
|
||||
1. Press (B) to return to the Rosalina main menu
|
||||
1. Press (B) to exit the Rosalina menu
|
||||
1. Press (Home), then close Download Play
|
||||
1. Relaunch the Download Play application
|
||||
1. Your console should load the Homebrew Launcher
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "RESTORE clean DS Download Play" option
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
+ If there are any errors or missing files, correct the problem and try again
|
||||
1. If the process was successful, tap the touch screen, then press START to exit
|
||||
1. Power off your console
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,76 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (HBL-USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/zoogie/unSAFE_MODE/) for information about the unSAFE_MODE exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/RELEASE_v1.3.zip) (direct download)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card. Then, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Insert your SD card into your computer
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `usm.bin` from the RELEASE `.zip` to the root folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
+ You will see some on-screen text and then your system will shut down
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
{% include_relative include/remove-usm-slottool.txt %}
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,105 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: [BannerBomb3](https://github.com/zoogie/Bannerbomb3), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [an alternate branch of Seedminer](installing-boot9strap-(fredtool)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* [usm.bin](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) (direct download)
|
||||
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card.
|
||||
|
||||
1. Your SD card should be inserted in your computer
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If the BB3 multihax menu doesn't open, [follow this troubleshooting guide](troubleshooting#bannerbomb3)
|
||||
+ If the BB3 multihax menu says "cfw installed already", you already have custom firmware and should continue from [here](checking-for-cfw)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Install unSAFE_MODE"
|
||||
+ Your console will automatically power off
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Internet Settings` -> `Connection Settings`
|
||||
1. Ensure that all three connections are named "Haaaaaaaxxxxxxxxx..."
|
||||
+ Do NOT change these settings!
|
||||
+ If all three connections are NOT all named "Haaaaaaaxxxxxxxxx...", STOP! Something went wrong in this section and MUST be fixed before you can continue
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Uninstall unSAFE_MODE"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,102 +0,0 @@
|
|||
---
|
||||
title: "Installing Boot9strap (Fredtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, for example from BannerBomb or the DSiWare Dumper tool.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
### What You Need
|
||||
|
||||
* A DSiWare Backup (such as the one on SD root from [BannerBomb3](bannerbomb3) or [DSiWare Dumper](dsidumper))
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest)
|
||||
* The latest release of [Luma3DS](https://github.com/AuroraWright/Luma3DS/releases/latest)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - Fredtool
|
||||
|
||||
1. Open [Fredtool](https://fredtool.bruteforcemovable.com/) on your computer
|
||||
1. Select your `movable.sed` file for the "Your movable.sed" field
|
||||
1. Select your DSiWare Backup (`<8-character-id>.bin`) file for the "Your dsiware.bin" field
|
||||
1. Complete the "I'm not a robot" captcha
|
||||
1. Select "Start"
|
||||
1. Wait for the process to complete
|
||||
1. When the process has completed, download your modified DSiWare archive from the site
|
||||
+ This file contains 2 dsiware backup files, one clean (unmodified) and one hax (exploited)
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ This `<ID1>` folder will be another 32 letter/number folder inside the `<ID0>` folder
|
||||
+ If the `Nintendo DSiWare` folder does not exist, create it inside the `<ID1>` folder
|
||||
1. Copy the `42383841.bin` file from the `output/hax/` folder of the downloaded DSiWare archive (`fredtool_output.zip`) to the `Nintendo DSiWare` folder
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Haxxxxxxxxx!" title
|
||||
1. Select "Copy", then select "OK"
|
||||
1. Return to main menu of the System Settings
|
||||
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK"
|
||||
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
|
||||
|
||||
#### Section III - Flipnote Exploit
|
||||
|
||||
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
|
||||
{: .notice--info}
|
||||
|
||||
1. Complete the initial setup process for the launched game until you reach the main menu
|
||||
+ Select the left option whenever prompted during the setup process
|
||||
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
|
||||
1. Once the menu loads, select the face icon, then the bottom right icon to continue
|
||||
1. Press (X) or (UP) on the D-Pad depending on which is shown on the top screen
|
||||
1. Select the second button along the top with a film-reel icon
|
||||
1. Scroll right until reel "3/3" is selected
|
||||
1. Tap the third box with the letter "A" in it
|
||||
1. Scroll left until reel "1/3" is selected
|
||||
1. Tap the fourth box with the letter "A" in it
|
||||
1. If the exploit was successful, your device will have loaded b9sTool
|
||||
1. Using the D-Pad, move to "Install boot9strap"
|
||||
+ If you miss this step, the system will exit to home menu instead of installing boot9strap and you will need to open Nintendo DS Connections and start over from the beginning of Section III
|
||||
1. Press (A), then press START and SELECT at the same time to begin the process
|
||||
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
|
||||
+ You may have to force power off by holding the power button
|
||||
+ If you see the Luma Configuration screen, continue with the guide without powering off
|
||||
|
||||
#### Section IV - Configuring Luma3DS
|
||||
|
||||
1. Boot your device while holding (Select) to launch the Luma configuration menu
|
||||
+ If you encounter issues launching the Luma configuration menu, [follow this troubleshooting guide](https://github.com/zoogie/b9sTool/blob/master/TROUBLESHOOTING.md)
|
||||
1. Use the (A) button and the D-Pad to turn on the following:
|
||||
+ **"Show NAND or user string in System Settings"**
|
||||
1. Press (Start) to save and reboot
|
||||
+ Your device should load the Home Menu after a short delay. If you get a black screen lasting longer than 5 minutes, [follow this troubleshooting guide](troubleshooting#black-screen-on-sysnand-boot-after-installing-boot9strap)
|
||||
|
||||
#### Section V - Restoring DS Connection Settings
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy the `42383841.bin` file from the `output/clean/` folder of the downloaded DSiWare archive (`fredtool_output.zip`) to the `Nintendo 3DS/<ID0>/<32-character-id>/Nintendo DSiWare/` folder on your SD card
|
||||
+ Replace the existing `42383841.bin` file
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Under the "SD Card" section, select the "Nintendo DSi™" title
|
||||
1. Select "Copy", then select "OK"
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,92 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile to your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, you will need to use a [Legacy Method](legacy-methods). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release archive for [Luma3DS](https://github.com/AuroraWright/Luma3DS/releases/latest)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Open [unSAFE_MODE-bb3 tool](https://usm.bruteforcemovable.com/) on your computer
|
||||
+ If this site is nonfunctional, try using [this one](https://3ds.nhnarwhal.com/3dstools/unsafemode.php)
|
||||
1. Upload your movable.sed using the "Choose File" option
|
||||
1. Click "Download unSAFE_MODE-bb3 archive"
|
||||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a SAFE_MODE exploit data file called `usm.bin` inside of a zip folder (`unSAFE_MODE-bb3.zip`)
|
||||
1. If your console is powered on, power off your console
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` from the USM archive (`unSAFE_MODE-bb3.zip`) to the root of your SD card
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
+ If `Nintendo DSiWare` does not exist, create it
|
||||
1. If there are any existing DSiWare backup files (`<8-character-id>.bin`) in this folder, move them to your PC
|
||||
+ This will leave you with an empty Nintendo DSiWare folder. Moving the files to your PC ensures you don't delete any intentional backups
|
||||
1. Copy the `F00D43D5.bin` file from the USM archive (`unSAFE_MODE-bb3.zip`) to the `Nintendo DSiWare` folder
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
1. Reinsert your SD card into your device
|
||||
1. Power on your device
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your bottom screen should flash Red and then the system will reboot to home menu a few seconds later. This means the exploit profile was successfully copied
|
||||
+ If the bottom screen does not flash Red, the exploit profile was not copied and you will not be able to complete the next section. Ensure that your files are properly placed, then try again
|
||||
1. Power off your device
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
1. With your system still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), then press (Power)
|
||||
+ Release the buttons after a few seconds. Your console will boot into Safe Mode
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
1. Once you see `B9S install SUCCESS` on the top screen, press any button to reboot to Luma Configuration
|
||||
|
||||
#### Section IV - Configuring Luma3DS
|
||||
|
||||
1. Your device should automatically show the Luma Configuration menu
|
||||
1. Use the (A) button and the D-Pad to turn on the following:
|
||||
+ **"Show NAND or user string in System Settings"**
|
||||
1. Press (Start) to save and reboot
|
||||
+ Your device should load the Home Menu after a short delay. If you get a black screen lasting longer than 5 minutes, [follow this troubleshooting guide](troubleshooting#black-screen-on-sysnand-boot-after-installing-boot9strap)
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
1. Launch System Settings on your device
|
||||
1. Navigate to `Data Management` -> `DSiWare`
|
||||
1. Click on the SD Card section
|
||||
+ Your bottom screen should flash Green and then the system will reboot to home menu a few seconds later. This means your WiFi configuration profiles were successfully restored
|
||||
1. Power your system off
|
||||
1. Insert your SD card into your computer
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<32-character-id>` -> `Nintendo DSiWare` on your SD card
|
||||
+ This `<ID0>` will be the same one that you used in [Seedminer](seedminer)
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Continue to Finalizing Setup
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,47 +0,0 @@
|
|||
---
|
||||
title: "Movable dumpen (nimhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
|
||||
To install boot9strap on your console, we derive your console's unique encryption key. To accomplish this, we use the Homebrew Launcher to launch nimhax and dump the data encryption key (movable.sed) from your console.
|
||||
|
||||
Für eine technischere Erklärung, siehe [hier](https://github.com/luigoalma/nimhax/) für mehr Informationen über den nimhax Exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
* Die neueste Version von [nimhax](https://github.com/luigoalma/nimhax/releases/latest) (die nimhax `.zip` Datei)
|
||||
|
||||
### Anleitung
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Kopiere den `nimhax` Ordner aus der nimhax `.zip` in den `3ds` Ordner auf deiner SD-Karte
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/nimhax-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - nimhax
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch nimhax from the list of homebrew
|
||||
1. If the exploit was successful, a `movable.sed` file will appear on the root of your SD card
|
||||
|
||||
### Next step: Frogtool
|
||||
|
||||
Once you have your console's encryption key (`movable.sed`), you can use it in conjunction with Frogtool, which uses your `movable.sed` file to inject and take advantage of JPN Flipnote Studio. \
|
||||
While this method is faster, it requires downloading a file with a torrent client. Do not follow this method if you're unable to use a torrent client.
|
||||
|
||||
Continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--primary}
|
|
@ -1,57 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (freakyhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
[freakyhax](https://plutooo.github.io/freakyhax/) is an exploit for the game Freakyforms Deluxe discovered and released by [plutooo](https://github.com/plutooo). It works on versions 9.0.0 through 11.17.0 on EUR, USA and JPN region consoles.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
+ A EUR/USA/JPN copy of Freakyforms Deluxe (eShop or cartridge)
|
||||
+ The latest release of [freakyhax](https://github.com/plutooo/freakyhax/releases/latest)
|
||||
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Anleitung
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy all files and folders inside the `/build/<your console and region>/exploit/` folder from the freakyhax `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - freakyhax
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch Freakyforms Deluxe
|
||||
1. In the game menu, select `Play -> Camera -> Load a QR code`
|
||||
1. Select the QR code
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (ninjhax2-dx)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
[Ninjhax2](https://github.com/smealum/ninjhax2.x) is an exploit for the game "Cubic Ninja" made by [smealum](https://github.com/smealum). This page uses an updated version of ninjhax by [zoogie](https://github.com/zoogie) called [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx), which supports 11.17.0.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Cubic Ninja save file, if you have one.
|
||||
{: .notice--warning}
|
||||
|
||||
### Was du brauchst
|
||||
* The game "Cubic Ninja"
|
||||
* The latest release of [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx/releases)
|
||||
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)
|
||||
|
||||
### Anleitung
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `Launcher.dat` from the folder appropriate for your console from the ninjhax2-dx `.zip` file to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - ninjhax2-dx
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Cubic Ninja" once and select "Create"
|
||||
+ If prompted, delete all data
|
||||
1. Select "QR Code"
|
||||
1. Select "Scan QR Code"
|
||||
1. On your PC, open the browser and go to [ninjhax2-dx website](https://zoogie.github.io/web/nh2dx/)
|
||||
1. Select your console's region and hardware
|
||||
1. On your console, scan the QR code
|
||||
+ If the game exits to the HOME Menu, then the exploit has installed correctly
|
||||
1. Launch "Cubic Ninja" again
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (PicHaxx)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
[PicHaxx](https://github.com/zoogie/pichaxx) is an exploit for the game Pokémon Picross released by [zoogie](https://github.com/zoogie), originally discovered and [demonstrated](https://twitter.com/mrnbayoh/status/744899681663258624) by [MrNbaYoh](https://github.com/MrNbaYoh).
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
+ The game "Pokémon Picross" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Pokémon Picross
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Anleitung
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when loaded, will run the Homebrew Launcher on your console.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3dstools.nhnarwhal.com/#/pichaxx) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `0017c100` -> `data` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in Seedminer
|
||||
+ Die `<ID1>` ist ein 32 Zeichen langer Ordner innerhalb der `<ID0>`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
|
||||
![]({{ "/images/screenshots/pichaxx-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Pokémon Picross"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
+ If you get an error message, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-pichaxx)
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,70 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (smilehax-IIe)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
This set of instructions does not support the Japanese version of SmileBASIC.
|
||||
{: .notice--warning}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
[smilehax-IIe](https://github.com/zoogie/smilehax-IIe) is an exploit for the game "SmileBASIC" made by zoogie, compatible with system versions 9.0.0 through 11.17.0 for USA/EUR/JPN region consoles.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Was du brauchst
|
||||
+ The game "SmileBASIC" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install SmileBASIC
|
||||
+ The latest release of [smilehax-IIe](https://github.com/zoogie/smilehax-IIe/releases/download/v1.1/Release_sh2e_v1.1.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Anleitung
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Transfer the `.wav` for your region from the Release_sh2e `.zip` to a device that can play `.wav` files, for example a phone
|
||||
1. Copy the petitcom `.icn` for your region to the root of your SD card
|
||||
|
||||
#### Section II - smilehax
|
||||
|
||||
1. Launch SmileBASIC
|
||||
+ Update the game if prompted
|
||||
1. Select the "Publish/Download Projects" option
|
||||
1. Select the "Download (Receive) using Public Key" option
|
||||
1. Press the "Yes" button
|
||||
1. Enter the Public Key "NJEQK3A4" using the on-screen keyboard
|
||||
1. Press the "Yes" button to confirm the download of PMODEM141
|
||||
1. Press "OK", then "Back", then "Browse Projects"
|
||||
1. Select PMODEM141, then press "Select File"
|
||||
1. Select PMODEM141.PRG, then press "OK", then "Yes" to execute it
|
||||
1. Select RECEIVE FILE SIMPLEX
|
||||
1. Prepare the device you use to play the `.wav` file
|
||||
1. Keep your console about a foot from the `.wav` file playing devices' speaker and use a reasonable (not loud) volume to play the `.wav`
|
||||
1. Now select 300BPS, then play the `.wav` file
|
||||
1. When it finishes, press "Yes", then press "OK"
|
||||
1. Press the START button
|
||||
1. Select the SH2E-xxx.TXT file, then press OK, then "Yes" to execute it
|
||||
+ If you get kicked back into menu, make sure you're using the latest version of SmileBASIC
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (Steelhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Steel Diver: Sub Wars, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Steel Diver: Sub Wars save file, if you have one. If you wish to preserve your Steel Diver: Sub Wars game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
+ The game "Steel Diver: Sub Wars" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Steel Diver: Sub Wars
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Steelhax](/assets/steelhax-release.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Anleitung
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the `steelhax` folder from the `Steelhax-release.zip` to the root of your SD card
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - Steelminer
|
||||
|
||||
In this section, you will create a hacked Steel Diver: Sub Wars save file that, when used, will load the Homebrew Launcher on your console.
|
||||
|
||||
1. Launch "Steel Diver: Sub Wars" once and select a Mii to initialize your save file
|
||||
+ Decline the game update when prompted
|
||||
+ If you have already updated the game, use the Data Management menu of the System Settings to delete the update
|
||||
1. Exit "Steel Diver: Sub Wars"
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Open [the SteelHax Save Tool website](https://3dstools.nhnarwhal.com/#/steelhax) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select your region based on your console
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `<8-character-region>` -> `data` on your SD card
|
||||
+ **EUR Region**: `000d7e00`
|
||||
+ **JPN Region**: `000d7c00`
|
||||
+ **USA Region**: `000d7d00`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Steel Diver: Sub Wars"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,80 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (super-skaterhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see [here](https://github.com/zoogie/super-skaterhax).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Kompatibilitätshinweise
|
||||
|
||||
Super-skaterhax (when used to launch the Homebrew Launcher) is compatible with New models on version 11.16.0 in all regions, and 11.17.0 in the EUR, JPN and USA regions.
|
||||
|
||||
The instructions provided only apply to the New 3DS, New 3DS XL, and New 2DS XL. Please ensure that the console you are modding is a New 3DS, New 3DS XL, or New 2DS XL before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)
|
||||
* The latest release of [super-skaterhax](https://github.com/zoogie/super-skaterhax/releases) (the release `.zip` file)
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy the files needed to trigger both super-skaterhax and the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy everything inside the folder for your console's region (and also system version if the region is USA) in the super-skaterhax `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/skater-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - super-skaterhax
|
||||
|
||||
In this section, you will visit the browser exploit webpage, which will launch the Homebrew Launcher.
|
||||
|
||||
If you haven't already, make sure you have a working Internet connection set up on your console.
|
||||
{: .notice--info}
|
||||
|
||||
1. On the HOME Menu, press the Left and Right shoulder buttons at the same time to open the camera
|
||||
+ If you are unable to open the camera, open the Internet Browser and manually type the URL instead (`https://zoogie.github.io/web/super/` for EUR/USA/JPN, `https://zoogie.github.io/web/korea` for KOR)
|
||||
1. Tap the QR code button and scan one of the following QR codes for your console's region [here](https://user-images.githubusercontent.com/28328903/226086338-585bfdac-0aac-44c0-b413-89206d2815d8.png)
|
||||
+ If you get a security certificate warning, press (A) to allow the connection
|
||||
1. Press the (Select) button to open the bookmark tab
|
||||
+ If your (Select) button does not respond, tap the star icon on the bottom-left corner of the screen
|
||||
1. Tap "Bookmark this page"
|
||||
1. Press (B) once to return to the browser
|
||||
1. Press (Start) to open the context menu
|
||||
+ If your (Start) button does not respond, tap the 3-line menu on the bottom-right corner of the screen
|
||||
1. Tap on "Settings"
|
||||
1. Tap on "Delete Cookies"
|
||||
1. Drücke (A), um fortzufahren
|
||||
1. Press (Home) to return to the HOME Menu, then immediately press (A) to launch the browser again
|
||||
1. Select the "GO GO!" button on the top screen
|
||||
+ If any prompts appear, approve all of them
|
||||
+ If your console freezes on a yellow screen, hold the POWER button until it turns off, then retry this section
|
||||
+ If your console freezes on a red screen, hold the POWER button until it turns off, redo step 3 of Section II, then retry this section
|
||||
+ If you get another error, try again up to 5 times, and if it still doesn't work, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-super-skaterhax)
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,29 +0,0 @@
|
|||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Öffne die [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) Webseite auf deinem Computer
|
||||
1. Bei dem "Username" Feld, gib irgendeinen normalen Namen (keine Leerzeichen oder Sonderzeichen) an
|
||||
1. Under the "DSiBin" field, upload your DSiWare backup file (e.g. 42383841.bin) from the root of your SD card using the first "Browse..." option
|
||||
1. Wähle beim "MovableSed" Feld deine `movable.sed` Datei mit der "Browse..." Option aus
|
||||
1. Under the "InjectionTarget" field, set the injection target to `DSinternet` (NOT memorypit)
|
||||
1. Drücke auf "Build"
|
||||
+ Warte ein paar Sekunden, bis der Erstellungsprozess abgeschlossen ist
|
||||
1. Gib im Abschnitt Build-Verlauf links den Benutzernamen in das "suchen" Feld ein
|
||||
1. Klicke das erste Suchergebnis
|
||||
+ Dieses Ergebnis sollte das neuste sein
|
||||
1. Drücke auf den "output_(name).zip" Link
|
||||
1. Navigiere zu `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` auf deiner SD-Karte
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) from the release `.zip` to the root of your SD card
|
||||
1. Kopiere den `private` Ordner von der Frogminer_save `.zip` in das Stammverzeichnis deiner SD-Karte
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,73 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.16.0. If you are on any firmware other than 11.17.0 or 11.16.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
* Deine `movable.sed` Datei vom [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.16.0 or 11.17.0 users**: The v6.1.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/download/v6.1.1/release_6.1.1.zip) (direct download)
|
||||
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)
|
||||
|
||||
#### Abschnitt I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Abschnitt V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Fortfahren mit [Setup fertigstellen](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,77 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool, Legacy)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
|
||||
Um ein DSiWare-Backup erstellen zu können, nutzen wir eine Schwachstelle im DSiWare-Datenverwaltungs-Fenster der Systemeinstellungen aus.
|
||||
|
||||
Um das zu erreichen, werden wir die Verschlüsselung (movable.sed) nutzen, um ein DSiWare-Backup zu erstellen, das das System dazu bringen wird, die DSi Internet Einstellungs-Software zur SD-Karte zu kopieren.
|
||||
|
||||
Once we have a DSiWare backup, we can inject it into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.15.0 or 11.14.0. If you are on any firmware other than 11.15.0 or 11.14.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer (Mii)](seedminer-(mii))
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.15.0 and 11.14.0 users only**: The v6.0.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/tag/v6.0.1) (direct download)
|
||||
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)
|
||||
|
||||
#### Abschnitt I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Abschnitt V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Fortfahren mit [Setup fertigstellen](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,88 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Frogtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see "DSiWare_Exports CTCert verification" and "FIRM partitions known-plaintext" [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) link for `frogcert.bin` on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
{: .notice--warning}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
* <i class="fa fa-magnet" aria-hidden="true" title="Dies ist ein Magnetlink. Use a torrent client to download the file."></i> [frogcert.bin](magnet:?xt=urn:btih:d12278ea50bb3574f1fbd327f3d0e2292c70941f&dn=frogcert.bin&tr=https%3a%2f%2ftracker.fastdownload.xyz%3a443%2fannounce&tr=https%3a%2f%2fopentracker.xyz%3a443%2fannounce&tr=http%3a%2f%2fopen.trackerlist.xyz%3a80%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.tiny-vps.com%3a6969%2fannounce&tr=udp%3a%2f%2fopen.demonii.si%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.port443.xyz%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.vanitycore.co%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.torrent.eu.org%3a451%2fannounce&tr=udp%3a%2f%2fretracker.lanta-net.ru%3a2710%2fannounce&tr=udp%3a%2f%2fthetracker.org%3a80%2fannounce&tr=http%3a%2f%2ftorrent.nwps.ws%3a80%2fannounce&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.iamhansen.xyz%3a2000%2fannounce&tr=udp%3a%2f%2fbt.xxx-tracker.com%3a2710%2fannounce&tr=http%3a%2f%2f0d.kebhana.mx%3a443%2fannounce&tr=udp%3a%2f%2fexodus.desync.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=udp%3a%2f%2ftracker4.itzmx.com%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.justseed.it%3a1337%2fannounce&tr=http%3a%2f%2ftherightsize.net%3a1337%2fannounce&tr=udp%3a%2f%2fretracker.hotplug.ru%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.internetwarriors.net%3a1337%2fannounce&tr=udp%3a%2f%2f9.rarbg.com%3a2800%2fannounce&tr=https%3a%2f%2f2.track.ga%3a443%2fannounce&tr=udp%3a%2f%2fbigfoot1942.sektori.org%3a6969%2fannounce) (magnet link)
|
||||
* The latest release of [Frogtool-nimhax](https://github.com/lifehackerhansol/Frogtool/releases/download/v2.3-nimhaxb6/Frogtool-nimhax.zip) (direct download)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest)
|
||||
|
||||
#### Abschnitt I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Abschnitt II - Vorbereitungen
|
||||
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `boot.nds` (b9sTool) from the b9sTool release `.zip` to the root of your SD card
|
||||
1. Erstelle einen Ordner namens `3ds` im Stammverzeichnis deiner SD-Karte falls er noch nicht existiert
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy the `Frogtool` folder from the Frogtool-nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `frogcert.bin` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section III - Patching DS Download Play
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "INJECT patched DS Download Play" option
|
||||
1. Frogtool will automatically run and inject the JPN version of Flipnote Studio into your DS Download Play
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
1. Tap the touch screen, then select "BOOT patched DS Download Play"
|
||||
1. If the exploit was successful, your console will have loaded the JPN version of Flipnote Studio
|
||||
+ If you get stuck on a black screen, follow [this](https://wiki.hacks.guide/wiki/3DS:TWLFix#Userland_(PicHaxx,_Steelhax,_etc.)-0) page, then try again
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsdlp" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Abschnitt VII - DS Download-Spiel wiederherstellen
|
||||
|
||||
1. Starte die Download-Spiel Anwendung
|
||||
1. Warte bis du die zwei Knöpfe siehst
|
||||
+ Drücke keine der Tasten
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Wähle "Miscellaneous options"
|
||||
1. Wähle "Switch the hb. title to the current app."
|
||||
1. Drücke (B) um fortzufahren
|
||||
1. Drücke (B), um zum Rosalina-Hauptmenü zurückzukehren
|
||||
1. Drücke (B), um das Rosalina-Menü zu schließen
|
||||
1. Drücke (Home) und schließe die Download-Spiel Anwendung
|
||||
1. Starte die Download-Spiel Anwendung erneut
|
||||
1. Your console should load the Homebrew Launcher
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "RESTORE clean DS Download Play" option
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
+ If there are any errors or missing files, correct the problem and try again
|
||||
1. If the process was successful, tap the touch screen, then press START to exit
|
||||
1. Power off your console
|
||||
|
||||
___
|
||||
|
||||
### Fortfahren mit [Setup fertigstellen](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,76 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (HBL-USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/zoogie/unSAFE_MODE/) for information about the unSAFE_MODE exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Kompatibilitätshinweise
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
|
||||
### Was du brauchst
|
||||
|
||||
* Die neueste Version vom [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (Direkter Download)
|
||||
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/RELEASE_v1.3.zip) (direct download)
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card. Then, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Erstelle einen Ordner namens `boot9strap` im Stammverzeichnis deiner SD-Karte
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Erstelle einen Ordner namens `3ds` im Stammverzeichnis deiner SD-Karte falls er noch nicht existiert
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `usm.bin` from the RELEASE `.zip` to the root folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Starte slotTool aus der Liste der Homebrew-Anwendungen
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
+ You will see some on-screen text and then your system will shut down
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Schritt III - boot9strap installieren
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
{% include_relative include/remove-usm-slottool.txt %}
|
||||
|
||||
___
|
||||
|
||||
### Fortfahren mit [Setup fertigstellen](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,105 +0,0 @@
|
|||
---
|
||||
title: "boot9strap installieren (USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technische Details (optional)</em></summary>
|
||||
|
||||
Um die SAFE_MODE Firmware unseres Systems auszunutzen, müssen wir ein präpariertes WiFi-Profil einfügen.
|
||||
|
||||
Wir können dies mit einem bestehenden Exploit, BannerBomb3, tun.
|
||||
|
||||
Um dies zu erreichen, verwenden wir den Verschlüsselungsschlüssel deines Systems (movable.sed). Dieser Key wird benötigt, um ein DSiWare-Backup zu erstellen, welches das System ausnutzt, um das ausgenutzte WiFi-Profil in deine Verbindungsliste zu injizieren.
|
||||
|
||||
Wenn das WiFi-Profil injiziert wurde, nutzen wir SAFE_MODE, ein Recovery-Feature, welches auf allen 3DS Konsolen existiert, um das präperierte WiFi-Profil zu aktivieren.
|
||||
|
||||
Für eine mehr technische Erklärung, lies die folgenden Links für Informationen zu den BannerBomb3 und unSAFE_MODE Exploits: [BannerBomb3](https://github.com/zoogie/Bannerbomb3), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Kompatibilitätshinweise
|
||||
|
||||
Diese Anleitung funktioniert mit den folgenden Konsolenregionen: USA, Europa, Japan und Korea, welche anhand den Buchstaben U, E, J oder K nach der Systemversion erkennbar sind.
|
||||
|
||||
Wenn deine (Rechts/Links-Schulter), (Steuerkreuz oben) oder (A) Tasten nicht funktionieren, musst du [einem alternativen Zweig von Seedminer](installing-boot9strap-(fredtool)) folgen. Um Hilfe in dieser Angelegenheit zu erhalten, trete dem [Nintendo Homebrew auf Discord](https://discord.gg/MWxPgEp) bei und frage in Englisch nach Hilfe.
|
||||
{: .notice--warning}
|
||||
|
||||
### Was du benötigst
|
||||
|
||||
* Die neueste Version vom [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (Direkter Download)
|
||||
* Die neueste Version von [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (Direkter Download)
|
||||
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)
|
||||
* [usm.bin](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) (direkter Download)
|
||||
|
||||
|
||||
#### Abschnitt I - Vorbereitungen
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card.
|
||||
|
||||
1. Deine SD-Karte sollte in deinem Computer eingesteckt sein
|
||||
1. Kopiere `usm.bin` in das Stammverzeichnis deiner SD-Karte
|
||||
1. Kopiere `boot.firm` und `boot.3dsx` von der Luma3DS `.zip` in das Stammverzeichnis deiner SD-Karte
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Erstelle einen Ordner namens `boot9strap` im Stammverzeichnis deiner SD-Karte
|
||||
1. Kopiere `boot9strap.firm` und `boot9strap.firm.sha` aus der boot9strap `.zip` in den `/boot9strap/`-Ordner auf deiner SD-Karte
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If the BB3 multihax menu doesn't open, [follow this troubleshooting guide](troubleshooting#bannerbomb3)
|
||||
+ If the BB3 multihax menu says "cfw installed already", you already have custom firmware and should continue from [here](checking-for-cfw)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Install unSAFE_MODE"
|
||||
+ Your console will automatically power off
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Internet Settings` -> `Connection Settings`
|
||||
1. Ensure that all three connections are named "Haaaaaaaxxxxxxxxx..."
|
||||
+ Do NOT change these settings!
|
||||
+ If all three connections are NOT all named "Haaaaaaaxxxxxxxxx...", STOP! Something went wrong in this section and MUST be fixed before you can continue
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Uninstall unSAFE_MODE"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Navigiere zu `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` auf deiner SD-Karte
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
### Fortfahren mit [Setup fertigstellen](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,47 +0,0 @@
|
|||
---
|
||||
title: "Dumping Movable (nimhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To install boot9strap on your console, we derive your console's unique encryption key. To accomplish this, we use the Homebrew Launcher to launch nimhax and dump the data encryption key (movable.sed) from your console.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/luigoalma/nimhax/) for information about the nimhax exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [nimhax](https://github.com/luigoalma/nimhax/releases/latest) (the nimhax `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy the `nimhax` folder from the nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/nimhax-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - nimhax
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch nimhax from the list of homebrew
|
||||
1. If the exploit was successful, a `movable.sed` file will appear on the root of your SD card
|
||||
|
||||
### Next step: Frogtool
|
||||
|
||||
Once you have your console's encryption key (`movable.sed`), you can use it in conjunction with Frogtool, which uses your `movable.sed` file to inject and take advantage of JPN Flipnote Studio. \
|
||||
While this method is faster, it requires downloading a file with a torrent client. Do not follow this method if you're unable to use a torrent client.
|
||||
|
||||
Continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--primary}
|
|
@ -1,57 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (freakyhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[freakyhax](https://plutooo.github.io/freakyhax/) is an exploit for the game Freakyforms Deluxe discovered and released by [plutooo](https://github.com/plutooo). It works on versions 9.0.0 through 11.17.0 on EUR, USA and JPN region consoles.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ A EUR/USA/JPN copy of Freakyforms Deluxe (eShop or cartridge)
|
||||
+ The latest release of [freakyhax](https://github.com/plutooo/freakyhax/releases/latest)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy all files and folders inside the `/build/<your console and region>/exploit/` folder from the freakyhax `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - freakyhax
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch Freakyforms Deluxe
|
||||
1. In the game menu, select `Play -> Camera -> Load a QR code`
|
||||
1. Select the QR code
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (ninjhax2-dx)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[Ninjhax2](https://github.com/smealum/ninjhax2.x) is an exploit for the game "Cubic Ninja" made by [smealum](https://github.com/smealum). This page uses an updated version of ninjhax by [zoogie](https://github.com/zoogie) called [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx), which supports 11.17.0.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Cubic Ninja save file, if you have one.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
* The game "Cubic Ninja"
|
||||
* The latest release of [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx/releases)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `Launcher.dat` from the folder appropriate for your console from the ninjhax2-dx `.zip` file to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - ninjhax2-dx
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Cubic Ninja" once and select "Create"
|
||||
+ If prompted, delete all data
|
||||
1. Select "QR Code"
|
||||
1. Select "Scan QR Code"
|
||||
1. On your PC, open the browser and go to [ninjhax2-dx website](https://zoogie.github.io/web/nh2dx/)
|
||||
1. Select your console's region and hardware
|
||||
1. On your console, scan the QR code
|
||||
+ If the game exits to the HOME Menu, then the exploit has installed correctly
|
||||
1. Launch "Cubic Ninja" again
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (PicHaxx)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[PicHaxx](https://github.com/zoogie/pichaxx) is an exploit for the game Pokémon Picross released by [zoogie](https://github.com/zoogie), originally discovered and [demonstrated](https://twitter.com/mrnbayoh/status/744899681663258624) by [MrNbaYoh](https://github.com/MrNbaYoh).
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Pokémon Picross" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Pokémon Picross
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when loaded, will run the Homebrew Launcher on your console.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3dstools.nhnarwhal.com/#/pichaxx) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `0017c100` -> `data` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in Seedminer
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
|
||||
![]({{ "/images/screenshots/pichaxx-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Pokémon Picross"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
+ If you get an error message, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-pichaxx)
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,70 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (smilehax-IIe)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
This set of instructions does not support the Japanese version of SmileBASIC.
|
||||
{: .notice--warning}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[smilehax-IIe](https://github.com/zoogie/smilehax-IIe) is an exploit for the game "SmileBASIC" made by zoogie, compatible with system versions 9.0.0 through 11.17.0 for USA/EUR/JPN region consoles.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
+ The game "SmileBASIC" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install SmileBASIC
|
||||
+ The latest release of [smilehax-IIe](https://github.com/zoogie/smilehax-IIe/releases/download/v1.1/Release_sh2e_v1.1.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Transfer the `.wav` for your region from the Release_sh2e `.zip` to a device that can play `.wav` files, for example a phone
|
||||
1. Copy the petitcom `.icn` for your region to the root of your SD card
|
||||
|
||||
#### Section II - smilehax
|
||||
|
||||
1. Launch SmileBASIC
|
||||
+ Update the game if prompted
|
||||
1. Select the "Publish/Download Projects" option
|
||||
1. Select the "Download (Receive) using Public Key" option
|
||||
1. Press the "Yes" button
|
||||
1. Enter the Public Key "NJEQK3A4" using the on-screen keyboard
|
||||
1. Press the "Yes" button to confirm the download of PMODEM141
|
||||
1. Press "OK", then "Back", then "Browse Projects"
|
||||
1. Select PMODEM141, then press "Select File"
|
||||
1. Select PMODEM141.PRG, then press "OK", then "Yes" to execute it
|
||||
1. Select RECEIVE FILE SIMPLEX
|
||||
1. Prepare the device you use to play the `.wav` file
|
||||
1. Keep your console about a foot from the `.wav` file playing devices' speaker and use a reasonable (not loud) volume to play the `.wav`
|
||||
1. Now select 300BPS, then play the `.wav` file
|
||||
1. When it finishes, press "Yes", then press "OK"
|
||||
1. Press the START button
|
||||
1. Select the SH2E-xxx.TXT file, then press OK, then "Yes" to execute it
|
||||
+ If you get kicked back into menu, make sure you're using the latest version of SmileBASIC
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (Steelhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Steel Diver: Sub Wars, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Steel Diver: Sub Wars save file, if you have one. If you wish to preserve your Steel Diver: Sub Wars game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Steel Diver: Sub Wars" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Steel Diver: Sub Wars
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Steelhax](/assets/steelhax-release.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the `steelhax` folder from the `Steelhax-release.zip` to the root of your SD card
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - Steelminer
|
||||
|
||||
In this section, you will create a hacked Steel Diver: Sub Wars save file that, when used, will load the Homebrew Launcher on your console.
|
||||
|
||||
1. Launch "Steel Diver: Sub Wars" once and select a Mii to initialize your save file
|
||||
+ Decline the game update when prompted
|
||||
+ If you have already updated the game, use the Data Management menu of the System Settings to delete the update
|
||||
1. Exit "Steel Diver: Sub Wars"
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Open [the SteelHax Save Tool website](https://3dstools.nhnarwhal.com/#/steelhax) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select your region based on your console
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `<8-character-region>` -> `data` on your SD card
|
||||
+ **EUR Region**: `000d7e00`
|
||||
+ **JPN Region**: `000d7c00`
|
||||
+ **USA Region**: `000d7d00`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Steel Diver: Sub Wars"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,80 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (super-skaterhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see [here](https://github.com/zoogie/super-skaterhax).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
Super-skaterhax (when used to launch the Homebrew Launcher) is compatible with New models on version 11.16.0 in all regions, and 11.17.0 in the EUR, JPN and USA regions.
|
||||
|
||||
The instructions provided only apply to the New 3DS, New 3DS XL, and New 2DS XL. Please ensure that the console you are modding is a New 3DS, New 3DS XL, or New 2DS XL before continuing.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* The latest release of [super-skaterhax](https://github.com/zoogie/super-skaterhax/releases) (the release `.zip` file)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger both super-skaterhax and the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy everything inside the folder for your console's region (and also system version if the region is USA) in the super-skaterhax `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/skater-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - super-skaterhax
|
||||
|
||||
In this section, you will visit the browser exploit webpage, which will launch the Homebrew Launcher.
|
||||
|
||||
If you haven't already, make sure you have a working Internet connection set up on your console.
|
||||
{: .notice--info}
|
||||
|
||||
1. On the HOME Menu, press the Left and Right shoulder buttons at the same time to open the camera
|
||||
+ If you are unable to open the camera, open the Internet Browser and manually type the URL instead (`https://zoogie.github.io/web/super/` for EUR/USA/JPN, `https://zoogie.github.io/web/korea` for KOR)
|
||||
1. Tap the QR code button and scan one of the following QR codes for your console's region [here](https://user-images.githubusercontent.com/28328903/226086338-585bfdac-0aac-44c0-b413-89206d2815d8.png)
|
||||
+ If you get a security certificate warning, press (A) to allow the connection
|
||||
1. Press the (Select) button to open the bookmark tab
|
||||
+ If your (Select) button does not respond, tap the star icon on the bottom-left corner of the screen
|
||||
1. Tap "Bookmark this page"
|
||||
1. Press (B) once to return to the browser
|
||||
1. Press (Start) to open the context menu
|
||||
+ If your (Start) button does not respond, tap the 3-line menu on the bottom-right corner of the screen
|
||||
1. Tap on "Settings"
|
||||
1. Tap on "Delete Cookies"
|
||||
1. Press (A) to continue
|
||||
1. Press (Home) to return to the HOME Menu, then immediately press (A) to launch the browser again
|
||||
1. Select the "GO GO!" button on the top screen
|
||||
+ If any prompts appear, approve all of them
|
||||
+ If your console freezes on a yellow screen, hold the POWER button until it turns off, then retry this section
|
||||
+ If your console freezes on a red screen, hold the POWER button until it turns off, redo step 3 of Section II, then retry this section
|
||||
+ If you get another error, try again up to 5 times, and if it still doesn't work, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-super-skaterhax)
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,29 +0,0 @@
|
|||
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
|
||||
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
|
||||
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
|
||||
1. Under the "DSiBin" field, upload your DSiWare backup file (e.g. 42383841.bin) from the root of your SD card using the first "Browse..." option
|
||||
1. Under the "MovableSed" field, upload your `movable.sed` file using the second "Browse..." option
|
||||
1. Under the "InjectionTarget" field, set the injection target to `DSinternet` (NOT memorypit)
|
||||
1. Click "Build"
|
||||
+ Wait a few seconds for the build process to complete
|
||||
1. In the Build History section on the left, type the Username into the "Filter Builds" field
|
||||
1. Click on the first search result
|
||||
+ This result should have the latest timestamp
|
||||
1. Click the "output_(name).zip" link
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
|
||||
1. Copy the `42383841.bin` file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
|
||||
![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info}
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.nds` (B9STool) from the release `.zip` to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,9 +0,0 @@
|
|||
### Next step: Choose an exploit
|
||||
|
||||
If the camera appeared in the previous section, Safe Mode is likely to be working on your console.
|
||||
|
||||
If the camera appeared, continue to [Installing boot9strap (HBL-USM)](installing-boot9strap-(hbl-usm))
|
||||
{: .notice--primary}
|
||||
|
||||
If the camera did NOT appear, continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--info}
|
|
@ -1,73 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.16.0. If you are on any firmware other than 11.17.0 or 11.16.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer](seedminer)
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.16.0 or 11.17.0 users**: The v6.1.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/download/v6.1.1/release_6.1.1.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,77 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Fredtool, Legacy)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system to dump the DSi Internet Settings application to the SD root.
|
||||
|
||||
Once we have a DSiWare backup, we can inject it into the DS Internet Settings application.
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
You should only be able to get to this page if you are running version 11.15.0 or 11.14.0. If you are on any firmware other than 11.15.0 or 11.14.0, STOP as these instructions WILL LEAD TO A BRICK on other firmwares!!
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* Your `movable.sed` file from completing [Seedminer (Mii)](seedminer-(mii))
|
||||
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
|
||||
* **11.15.0 and 11.14.0 users only**: The v6.0.1 release of [b9sTool](https://github.com/zoogie/b9sTool/releases/tag/v6.0.1) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If this step causes your console to crash, [follow this troubleshooting guide](troubleshooting#installing-boot9strap-fredtool)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Prep Work
|
||||
|
||||
{% include_relative include/fredtool-prep.txt %}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-write-flipnote.txt %}
|
||||
|
||||
#### Section V - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsinternet" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Connection Settings
|
||||
|
||||
{% include_relative include/fredtool-restore-dsconn.txt %}
|
||||
|
||||
___
|
||||
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,88 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (Frogtool)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
For technical details on the exploits that you will be using on this page, see "DSiWare_Exports CTCert verification" and "FIRM partitions known-plaintext" [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) link for `frogcert.bin` on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* <i class="fa fa-magnet" aria-hidden="true" title="This is a magnet link. Use a torrent client to download the file."></i> [frogcert.bin](magnet:?xt=urn:btih:d12278ea50bb3574f1fbd327f3d0e2292c70941f&dn=frogcert.bin&tr=https%3a%2f%2ftracker.fastdownload.xyz%3a443%2fannounce&tr=https%3a%2f%2fopentracker.xyz%3a443%2fannounce&tr=http%3a%2f%2fopen.trackerlist.xyz%3a80%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.tiny-vps.com%3a6969%2fannounce&tr=udp%3a%2f%2fopen.demonii.si%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.port443.xyz%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.vanitycore.co%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.torrent.eu.org%3a451%2fannounce&tr=udp%3a%2f%2fretracker.lanta-net.ru%3a2710%2fannounce&tr=udp%3a%2f%2fthetracker.org%3a80%2fannounce&tr=http%3a%2f%2ftorrent.nwps.ws%3a80%2fannounce&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.iamhansen.xyz%3a2000%2fannounce&tr=udp%3a%2f%2fbt.xxx-tracker.com%3a2710%2fannounce&tr=http%3a%2f%2f0d.kebhana.mx%3a443%2fannounce&tr=udp%3a%2f%2fexodus.desync.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=udp%3a%2f%2ftracker4.itzmx.com%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.justseed.it%3a1337%2fannounce&tr=http%3a%2f%2ftherightsize.net%3a1337%2fannounce&tr=udp%3a%2f%2fretracker.hotplug.ru%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.internetwarriors.net%3a1337%2fannounce&tr=udp%3a%2f%2f9.rarbg.com%3a2800%2fannounce&tr=https%3a%2f%2f2.track.ga%3a443%2fannounce&tr=udp%3a%2f%2fbigfoot1942.sektori.org%3a6969%2fannounce) (magnet link)
|
||||
* The latest release of [Frogtool-nimhax](https://github.com/lifehackerhansol/Frogtool/releases/download/v2.3-nimhaxb6/Frogtool-nimhax.zip) (direct download)
|
||||
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest)
|
||||
|
||||
#### Section I - CFW Check
|
||||
|
||||
{% include_relative include/cfw-check-fredtool.txt %}
|
||||
|
||||
#### Section II - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Copy `boot.nds` (b9sTool) from the b9sTool release `.zip` to the root of your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy the `Frogtool` folder from the Frogtool-nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `frogcert.bin` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section III - Patching DS Download Play
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "INJECT patched DS Download Play" option
|
||||
1. Frogtool will automatically run and inject the JPN version of Flipnote Studio into your DS Download Play
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
1. Tap the touch screen, then select "BOOT patched DS Download Play"
|
||||
1. If the exploit was successful, your console will have loaded the JPN version of Flipnote Studio
|
||||
+ If you get stuck on a black screen, follow [this](https://wiki.hacks.guide/wiki/3DS:TWLFix#Userland_(PicHaxx,_Steelhax,_etc.)-0) page, then try again
|
||||
|
||||
#### Section IV - Flipnote Exploit
|
||||
|
||||
{% include_relative include/install-boot9strap-b9stool.txt method="dsdlp" %}
|
||||
|
||||
#### Section VI - Luma3DS Configuration
|
||||
|
||||
1. Press and hold (Select), and while holding (Select), power on your console
|
||||
{% include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section VII - Restoring DS Download Play
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
1. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
|
||||
1. Select "Miscellaneous options"
|
||||
1. Select "Switch the hb. title to the current app."
|
||||
1. Press (B) to continue
|
||||
1. Press (B) to return to the Rosalina main menu
|
||||
1. Press (B) to exit the Rosalina menu
|
||||
1. Press (Home), then close Download Play
|
||||
1. Relaunch the Download Play application
|
||||
1. Your console should load the Homebrew Launcher
|
||||
1. Launch Frogtool from the list of homebrew
|
||||
1. Select the "RESTORE clean DS Download Play" option
|
||||
1. Once this operation has finished, read the screens and check if the process was successful
|
||||
+ If there are any errors or missing files, correct the problem and try again
|
||||
1. If the process was successful, tap the touch screen, then press START to exit
|
||||
1. Power off your console
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,76 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (HBL-USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
As we already have Homebrew access, we can use slotTool to do this.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/zoogie/unSAFE_MODE/) for information about the unSAFE_MODE exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up) or (A) buttons do not work, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--danger}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/RELEASE_v1.3.zip) (direct download)
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card. Then, you will use Homebrew Launcher to launch slotTool, which will overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the RELEASE `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Create a folder named `3ds` on the root of your SD card if it does not already exist
|
||||
+ This folder stores homebrew applications and data; it is different from the `Nintendo 3DS` folder that the console automatically generates
|
||||
1. Copy `slotTool.3dsx` from the `slotTool` folder inside the RELEASE `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Copy `usm.bin` from the RELEASE `.zip` to the root folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch slotTool from the list of homebrew
|
||||
+ If you get stuck on a red screen, forcefully power off the console by holding the power button for fifteen seconds, then retry this section
|
||||
1. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
|
||||
+ You will see some on-screen text and then your system will shut down
|
||||
|
||||
![]({{ "/images/screenshots/hblusm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section IV - Restoring WiFi Configuration Profiles
|
||||
|
||||
{% include_relative include/remove-usm-slottool.txt %}
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,105 +0,0 @@
|
|||
---
|
||||
title: "Installing boot9strap (USM)"
|
||||
---
|
||||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
||||
|
||||
We can do this using an existing exploit, BannerBomb3.
|
||||
|
||||
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
||||
|
||||
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
||||
|
||||
For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: [BannerBomb3](https://github.com/zoogie/Bannerbomb3), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
||||
|
||||
If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [an alternate branch of Seedminer](installing-boot9strap-(fredtool)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
||||
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
* [usm.bin](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) (direct download)
|
||||
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console's SD card.
|
||||
|
||||
1. Your SD card should be inserted in your computer
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
||||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
+ Your console should show the BB3 multihax menu
|
||||
+ If the BB3 multihax menu doesn't open, [follow this troubleshooting guide](troubleshooting#bannerbomb3)
|
||||
+ If the BB3 multihax menu says "cfw installed already", you already have custom firmware and should continue from [here](checking-for-cfw)
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Install unSAFE_MODE"
|
||||
+ Your console will automatically power off
|
||||
1. Power on your console
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Internet Settings` -> `Connection Settings`
|
||||
1. Ensure that all three connections are named "Haaaaaaaxxxxxxxxx..."
|
||||
+ Do NOT change these settings!
|
||||
+ If all three connections are NOT all named "Haaaaaaaxxxxxxxxx...", STOP! Something went wrong in this section and MUST be fixed before you can continue
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - unSAFE_MODE
|
||||
|
||||
{% include_relative include/exploit-usm.txt %}
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
||||
{%- include_relative include/configure-luma3ds.txt %}
|
||||
|
||||
{% include_relative include/luma3ds-installed-note.txt %}
|
||||
|
||||
#### Section V - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
||||
|
||||
1. Launch System Settings on your console
|
||||
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
||||
1. Use the D-Pad to navigate and press the (A) button to select "Uninstall unSAFE_MODE"
|
||||
+ Your console will automatically reboot
|
||||
1. Power off your console
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
||||
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
||||
|
||||
___
|
||||
|
||||
### Continue to [Finalizing Setup](finalizing-setup)
|
||||
{: .notice--primary}
|
|
@ -1,47 +0,0 @@
|
|||
---
|
||||
title: "Dumping Movable (nimhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
|
||||
To install boot9strap on your console, we derive your console's unique encryption key. To accomplish this, we use the Homebrew Launcher to launch nimhax and dump the data encryption key (movable.sed) from your console.
|
||||
|
||||
For a more technical explanation, see [here](https://github.com/luigoalma/nimhax/) for information about the nimhax exploit.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
* The latest release of [nimhax](https://github.com/luigoalma/nimhax/releases/latest) (the nimhax `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy the `nimhax` folder from the nimhax `.zip` to the `/3ds/` folder on your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
![]({{ "/images/screenshots/nimhax-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - nimhax
|
||||
|
||||
1. Open the Homebrew Launcher through your method of choice (likely the Internet Browser)
|
||||
1. Launch nimhax from the list of homebrew
|
||||
1. If the exploit was successful, a `movable.sed` file will appear on the root of your SD card
|
||||
|
||||
### Next step: Frogtool
|
||||
|
||||
Once you have your console's encryption key (`movable.sed`), you can use it in conjunction with Frogtool, which uses your `movable.sed` file to inject and take advantage of JPN Flipnote Studio. \
|
||||
While this method is faster, it requires downloading a file with a torrent client. Do not follow this method if you're unable to use a torrent client.
|
||||
|
||||
Continue to [Installing boot9strap (Frogtool)](installing-boot9strap-(frogtool))
|
||||
{: .notice--primary}
|
|
@ -1,57 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (freakyhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[freakyhax](https://plutooo.github.io/freakyhax/) is an exploit for the game Freakyforms Deluxe discovered and released by [plutooo](https://github.com/plutooo). It works on versions 9.0.0 through 11.17.0 on EUR, USA and JPN region consoles.
|
||||
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ A EUR/USA/JPN copy of Freakyforms Deluxe (eShop or cartridge)
|
||||
+ The latest release of [freakyhax](https://github.com/plutooo/freakyhax/releases/latest)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy all files and folders inside the `/build/<your console and region>/exploit/` folder from the freakyhax `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - freakyhax
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch Freakyforms Deluxe
|
||||
1. In the game menu, select `Play -> Camera -> Load a QR code`
|
||||
1. Select the QR code
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (ninjhax2-dx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[Ninjhax2](https://github.com/smealum/ninjhax2.x) is an exploit for the game "Cubic Ninja" made by [smealum](https://github.com/smealum). This page uses an updated version of ninjhax by [zoogie](https://github.com/zoogie) called [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx), which supports 11.17.0.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This method requires a working 3DS camera.
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Cubic Ninja save file, if you have one.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
* The game "Cubic Ninja"
|
||||
* The latest release of [ninjhax2-dx](https://github.com/zoogie/ninjhax2-dx/releases)
|
||||
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy `Launcher.dat` from the folder appropriate for your console from the ninjhax2-dx `.zip` file to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
||||
#### Section II - ninjhax2-dx
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Cubic Ninja" once and select "Create"
|
||||
+ If prompted, delete all data
|
||||
1. Select "QR Code"
|
||||
1. Select "Scan QR Code"
|
||||
1. On your PC, open the browser and go to [ninjhax2-dx website](https://zoogie.github.io/web/nh2dx/)
|
||||
1. Select your console's region and hardware
|
||||
1. On your console, scan the QR code
|
||||
+ If the game exits to the HOME Menu, then the exploit has installed correctly
|
||||
1. Launch "Cubic Ninja" again
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (PicHaxx)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[PicHaxx](https://github.com/zoogie/pichaxx) is an exploit for the game Pokémon Picross released by [zoogie](https://github.com/zoogie), originally discovered and [demonstrated](https://twitter.com/mrnbayoh/status/744899681663258624) by [MrNbaYoh](https://github.com/MrNbaYoh).
|
||||
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Pokémon Picross, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Pokémon Picross save file, if you have one. If you wish to preserve your Pokémon Picross game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Pokémon Picross" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Pokémon Picross
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/hblpichaxx-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
|
||||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when loaded, will run the Homebrew Launcher on your console.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3dstools.nhnarwhal.com/#/pichaxx) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `0017c100` -> `data` on your SD card
|
||||
+ The `<ID0>` will be the same one that you used in Seedminer
|
||||
+ The `<ID1>` is a 32 character long folder inside of the `<ID0>`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
|
||||
![]({{ "/images/screenshots/pichaxx-save-location.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Pokémon Picross"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
+ If you get an error message, [follow this troubleshooting guide](troubleshooting#homebrew-launcher-pichaxx)
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,70 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (smilehax-IIe)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
This set of instructions does not support the Japanese version of SmileBASIC.
|
||||
{: .notice--warning}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
[smilehax-IIe](https://github.com/zoogie/smilehax-IIe) is an exploit for the game "SmileBASIC" made by zoogie, compatible with system versions 9.0.0 through 11.17.0 for USA/EUR/JPN region consoles.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
### What You Need
|
||||
+ The game "SmileBASIC" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install SmileBASIC
|
||||
+ The latest release of [smilehax-IIe](https://github.com/zoogie/smilehax-IIe/releases/download/v1.1/Release_sh2e_v1.1.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
1. Power off your console
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Transfer the `.wav` for your region from the Release_sh2e `.zip` to a device that can play `.wav` files, for example a phone
|
||||
1. Copy the petitcom `.icn` for your region to the root of your SD card
|
||||
|
||||
#### Section II - smilehax
|
||||
|
||||
1. Launch SmileBASIC
|
||||
+ Update the game if prompted
|
||||
1. Select the "Publish/Download Projects" option
|
||||
1. Select the "Download (Receive) using Public Key" option
|
||||
1. Press the "Yes" button
|
||||
1. Enter the Public Key "NJEQK3A4" using the on-screen keyboard
|
||||
1. Press the "Yes" button to confirm the download of PMODEM141
|
||||
1. Press "OK", then "Back", then "Browse Projects"
|
||||
1. Select PMODEM141, then press "Select File"
|
||||
1. Select PMODEM141.PRG, then press "OK", then "Yes" to execute it
|
||||
1. Select RECEIVE FILE SIMPLEX
|
||||
1. Prepare the device you use to play the `.wav` file
|
||||
1. Keep your console about a foot from the `.wav` file playing devices' speaker and use a reasonable (not loud) volume to play the `.wav`
|
||||
1. Now select 300BPS, then play the `.wav` file
|
||||
1. When it finishes, press "Yes", then press "OK"
|
||||
1. Press the START button
|
||||
1. Select the SH2E-xxx.TXT file, then press OK, then "Yes" to execute it
|
||||
+ If you get kicked back into menu, make sure you're using the latest version of SmileBASIC
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
|
@ -1,79 +0,0 @@
|
|||
---
|
||||
title: "Homebrew Launcher (Steelhax)"
|
||||
---
|
||||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
{% capture technical_info %}
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
This method of using Seedminer for further exploitation uses your `movable.sed` file to write a custom save file for Steel Diver: Sub Wars, which can then be used to launch the Homebrew Launcher.
|
||||
{% endcapture %}
|
||||
<details>{{ technical_info | markdownify }}</details>
|
||||
{: .notice--info}
|
||||
|
||||
This process will overwrite your Steel Diver: Sub Wars save file, if you have one. If you wish to preserve your Steel Diver: Sub Wars game data, you should make a backup of your `00000001.sav` file before overwriting it.
|
||||
{: .notice--warning}
|
||||
|
||||
### What You Need
|
||||
|
||||
+ The game "Steel Diver: Sub Wars" installed on your console
|
||||
+ If you have downloaded it before, you can [redownload it](https://en-americas-support.nintendo.com/app/answers/detail/a_id/607/~/how-to-download-or-redownload-content-in-nintendo-3ds-eshop)
|
||||
+ Your SD card must be inserted in your console to install Steel Diver: Sub Wars
|
||||
+ Your `movable.sed` file from completing [Seedminer](seedminer-(alternate))
|
||||
+ The latest release of [Steelhax](/assets/steelhax-release.zip) (direct download)
|
||||
+ The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
||||
+ [otherapps.zip]({{ base_path }}/assets/otherapps.zip) (direct download)
|
||||
|
||||
### Instructions
|
||||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will copy some of the files that will be used to launch the Homebrew Launcher.
|
||||
|
||||
1. Power off your console
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
1. Copy the `steelhax` folder from the `Steelhax-release.zip` to the root of your SD card
|
||||
1. Copy the otherapp payload for your model/region/version from `otherapps.zip` to the root of your SD card, then rename the payload to `otherapp.bin`
|
||||
+ Do not add the `.bin` extension if you do not already see it
|
||||
1. Copy `movable.sed` from your computer to the root of your SD card
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
|
||||
#### Section II - Steelminer
|
||||
|
||||
In this section, you will create a hacked Steel Diver: Sub Wars save file that, when used, will load the Homebrew Launcher on your console.
|
||||
|
||||
1. Launch "Steel Diver: Sub Wars" once and select a Mii to initialize your save file
|
||||
+ Decline the game update when prompted
|
||||
+ If you have already updated the game, use the Data Management menu of the System Settings to delete the update
|
||||
1. Exit "Steel Diver: Sub Wars"
|
||||
1. Power off your console
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Open [the SteelHax Save Tool website](https://3dstools.nhnarwhal.com/#/steelhax) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select your region based on your console
|
||||
1. Select "Build and Download"
|
||||
1. Wait for the process to complete
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `title` -> `00040000` -> `<8-character-region>` -> `data` on your SD card
|
||||
+ **EUR Region**: `000d7e00`
|
||||
+ **JPN Region**: `000d7c00`
|
||||
+ **USA Region**: `000d7d00`
|
||||
1. Copy the newly downloaded `00000001.sav` file to the `data` folder on your SD card
|
||||
+ Overwrite the old save file when prompted
|
||||
1. Reinsert your SD card into your console
|
||||
1. Power on your console
|
||||
1. Launch "Steel Diver: Sub Wars"
|
||||
1. If the exploit was successful, your console will have booted into the Homebrew Launcher
|
||||
1. Power off your console
|
||||
|
||||
#### Section III - Hardware Button Check
|
||||
|
||||
In this section, you will see whether you can access Safe Mode on your console. This will determine which method you will follow on the next page.
|
||||
|
||||
{% include_relative include/safemodecheck.txt %}
|
||||
|
||||
___
|
||||
|
||||
{% include_relative include/hbl-common-exploits.txt %}
|
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue