To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.
-To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root. +To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.
+ +For a more technical explanation, see here.
+movable.sed file to write a custom save file for Pokémon Picross, which can then be used with unSAFE_MODE (via Homebrew Launcher) to run SafeB9SInstaller.
+This method of using Seedminer for further exploitation uses your movable.sed file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed here.
+In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
-As we already have Homebrew access, we can use slotTool to do this. +As we already have Homebrew access, we can use slotTool to do this.
-Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile. +Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
+ +For a more technical explanation, see here for information about the unSAFE_MODE exploit.
+For technical details on the exploits that you will be using on this page, see here (Soundhax) and here (universal-otherapp).
+In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
-We can do this using an existing exploit, BannerBomb3. +We can do this using an existing exploit, BannerBomb3.
-To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list. +To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
-Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile. +Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
+ +For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: BannerBomb3, unSAFE_MODE.
+ +To install boot9strap on your device, we derive your device's unique encryption key. To accomplish this, we use a tool called Seedminer to calculate the data encryption key (movable.sed) for your device.
-For information on how Seedminer works, see [this presentation](https://zoogie.github.io/web/34⅕c3). +For information on how Seedminer works, see this presentation.
-This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method. +This method uses a powerful graphics card to perform the calculations needed. A volunteer-run website is used for the purpose of assisting you with this method.
+