New Crowdin updates (#2118)
* New translations installing-boot9strap-(kartdlphax).txt (Dutch) * New translations installing-boot9strap-(kartdlphax).txt (Japanese) * New translations homebrew-launcher-(pichaxx).txt (Hungarian) * New translations homebrew-launcher-(pichaxx).txt (Italian) * New translations installing-boot9strap-(kartdlphax).txt (Hungarian) * New translations installing-boot9strap-(kartdlphax).txt (Italian) * New translations homebrew-launcher-(pichaxx).txt (Japanese) * New translations homebrew-launcher-(pichaxx).txt (Norwegian) * New translations homebrew-launcher-(pichaxx).txt (Russian) * New translations installing-boot9strap-(kartdlphax).txt (Russian) * New translations homebrew-launcher-(pichaxx).txt (Swedish) * New translations homebrew-launcher-(pichaxx).txt (Portuguese) * New translations installing-boot9strap-(kartdlphax).txt (Portuguese) * New translations homebrew-launcher-(pichaxx).txt (Polish) * New translations installing-boot9strap-(kartdlphax).txt (Norwegian) * New translations installing-boot9strap-(kartdlphax).txt (Polish) * New translations installing-boot9strap-(kartdlphax).txt (Swedish) * New translations homebrew-launcher-(pichaxx).txt (Chinese Simplified) * New translations installing-boot9strap-(kartdlphax).txt (Chinese Simplified) * New translations homebrew-launcher-(pichaxx).txt (Chinese Traditional) * New translations installing-boot9strap-(kartdlphax).txt (Chinese Traditional) * New translations homebrew-launcher-(pichaxx).txt (Turkish) * New translations installing-boot9strap-(kartdlphax).txt (Turkish) * New translations homebrew-launcher-(pichaxx).txt (Ukrainian) * New translations installing-boot9strap-(kartdlphax).txt (Ukrainian) * New translations homebrew-launcher-(pichaxx).txt (Thai) * New translations installing-boot9strap-(kartdlphax).txt (Thai) * New translations homebrew-launcher-(pichaxx).txt (Croatian) * New translations installing-boot9strap-(kartdlphax).txt (Croatian) * New translations installing-boot9strap-(kartdlphax).txt (Indonesian) * New translations homebrew-launcher-(pichaxx).txt (Indonesian) * New translations homebrew-launcher-(pichaxx).txt (Vietnamese) * New translations installing-boot9strap-(kartdlphax).txt (Vietnamese) * New translations homebrew-launcher-(pichaxx).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(kartdlphax).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(hardmod).txt (French) * New translations installing-boot9strap-(hardmod).txt (Romanian) * New translations homebrew-launcher-(pichaxx).txt (Malay) * New translations installing-boot9strap-(kartdlphax).txt (Malay) * New translations homebrew-launcher-(pichaxx).txt (Pirate English) * New translations installing-boot9strap-(kartdlphax).txt (Pirate English) * New translations installing-boot9strap-(hardmod).txt (Arabic) * New translations installing-boot9strap-(hardmod).txt (Spanish) * New translations installing-boot9strap-(hardmod).txt (Czech) * New translations installing-boot9strap-(hardmod).txt (Bulgarian) * New translations installing-boot9strap-(hardmod).txt (Catalan) * New translations installing-boot9strap-(hardmod).txt (Finnish) * New translations installing-boot9strap-(hardmod).txt (Greek) * New translations installing-boot9strap-(hardmod).txt (German) * New translations installing-boot9strap-(hardmod).txt (Hungarian) * New translations installing-boot9strap-(hardmod).txt (Hebrew) * New translations installing-boot9strap-(hardmod).txt (Korean) * New translations installing-boot9strap-(soundhax).txt (Korean) * New translations bannerbomb3.txt (Korean) * New translations installing-boot9strap-(hardmod).txt (Dutch) * New translations installing-boot9strap-(hardmod).txt (Italian) * New translations installing-boot9strap-(hardmod).txt (Japanese) * New translations installing-boot9strap-(hardmod).txt (Norwegian) * New translations installing-boot9strap-(hardmod).txt (Polish) * New translations installing-boot9strap-(hardmod).txt (Swedish) * New translations installing-boot9strap-(hardmod).txt (Portuguese) * New translations installing-boot9strap-(hardmod).txt (Russian) * New translations installing-boot9strap-(hardmod).txt (Ukrainian) * New translations installing-boot9strap-(hardmod).txt (Turkish) * New translations installing-boot9strap-(hardmod).txt (Chinese Simplified) * New translations installing-boot9strap-(hardmod).txt (Vietnamese) * New translations installing-boot9strap-(hardmod).txt (Chinese Traditional) * New translations installing-boot9strap-(hardmod).txt (Indonesian) * New translations installing-boot9strap-(hardmod).txt (Thai) * New translations installing-boot9strap-(hardmod).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(hardmod).txt (Malay) * New translations installing-boot9strap-(hardmod).txt (Croatian) * New translations installing-boot9strap-(hardmod).txt (Pirate English) * New translations installing-boot9strap-(hbl-usm).txt (Korean) * New translations finalizing-setup.txt (Hungarian) * New translations installing-boot9strap-(kartdlphax).txt (Hungarian) * New translations uninstall-cfw.txt (Hungarian) * New translations troubleshooting.txt (Hungarian) * New translations installing-boot9strap-(hbl-usm).txt (Hungarian) * New translations installing-boot9strap-(fredtool).txt (Spanish) * New translations installing-boot9strap-(fredtool).txt (Romanian) * New translations installing-boot9strap-(usm).txt (Romanian) * New translations installing-boot9strap-(fredtool).txt (French) * New translations installing-boot9strap-(usm).txt (French) * New translations installing-boot9strap-(usm).txt (Korean) * New translations troubleshooting.txt (Korean) * New translations installing-boot9strap-(fredtool).txt (Catalan) * New translations installing-boot9strap-(usm).txt (Catalan) * New translations installing-boot9strap-(fredtool).txt (Czech) * New translations installing-boot9strap-(usm).txt (Czech) * New translations installing-boot9strap-(usm).txt (Spanish) * New translations installing-boot9strap-(usm).txt (Arabic) * New translations installing-boot9strap-(fredtool).txt (Arabic) * New translations installing-boot9strap-(fredtool).txt (Bulgarian) * New translations installing-boot9strap-(usm).txt (Bulgarian) * New translations installing-boot9strap-(fredtool).txt (Hebrew) * New translations installing-boot9strap-(usm).txt (Finnish) * New translations installing-boot9strap-(fredtool).txt (Hungarian) * New translations installing-boot9strap-(usm).txt (Hebrew) * New translations installing-boot9strap-(fredtool).txt (Finnish) * New translations installing-boot9strap-(fredtool).txt (German) * New translations installing-boot9strap-(usm).txt (German) * New translations installing-boot9strap-(fredtool).txt (Greek) * New translations installing-boot9strap-(usm).txt (Greek) * New translations installing-boot9strap-(usm).txt (Hungarian) * New translations installing-boot9strap-(fredtool).txt (Korean) * New translations installing-boot9strap-(fredtool).txt (Dutch) * New translations installing-boot9strap-(usm).txt (Dutch) * New translations installing-boot9strap-(fredtool).txt (Italian) * New translations installing-boot9strap-(usm).txt (Italian) * New translations installing-boot9strap-(fredtool).txt (Japanese) * New translations installing-boot9strap-(usm).txt (Japanese) * New translations installing-boot9strap-(fredtool).txt (Norwegian) * New translations installing-boot9strap-(usm).txt (Norwegian) * New translations installing-boot9strap-(fredtool).txt (Russian) * New translations installing-boot9strap-(usm).txt (Russian) * New translations installing-boot9strap-(fredtool).txt (Swedish) * New translations installing-boot9strap-(usm).txt (Swedish) * New translations installing-boot9strap-(fredtool).txt (Polish) * New translations installing-boot9strap-(usm).txt (Polish) * New translations installing-boot9strap-(fredtool).txt (Portuguese) * New translations installing-boot9strap-(usm).txt (Portuguese) * New translations installing-boot9strap-(usm).txt (Chinese Simplified) * New translations installing-boot9strap-(fredtool).txt (Chinese Traditional) * New translations installing-boot9strap-(usm).txt (Chinese Traditional) * New translations installing-boot9strap-(fredtool).txt (Chinese Simplified) * New translations installing-boot9strap-(fredtool).txt (Turkish) * New translations installing-boot9strap-(usm).txt (Turkish) * New translations installing-boot9strap-(fredtool).txt (Ukrainian) * New translations installing-boot9strap-(usm).txt (Ukrainian) * New translations installing-boot9strap-(fredtool).txt (Vietnamese) * New translations installing-boot9strap-(usm).txt (Vietnamese) * New translations installing-boot9strap-(fredtool).txt (Thai) * New translations installing-boot9strap-(usm).txt (Thai) * New translations installing-boot9strap-(fredtool).txt (Croatian) * New translations installing-boot9strap-(usm).txt (Croatian) * New translations installing-boot9strap-(fredtool).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(usm).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(fredtool).txt (Indonesian) * New translations installing-boot9strap-(usm).txt (Indonesian) * New translations bannerbomb3.txt (Romanian) * New translations installing-boot9strap-(fredtool).txt (Malay) * New translations installing-boot9strap-(usm).txt (Malay) * New translations installing-boot9strap-(fredtool).txt (Pirate English) * New translations installing-boot9strap-(usm).txt (Pirate English) * New translations bannerbomb3.txt (Spanish) * New translations bannerbomb3.txt (Arabic) * New translations bannerbomb3.txt (French) * New translations bannerbomb3.txt (Catalan) * New translations bannerbomb3.txt (Bulgarian) * New translations bannerbomb3.txt (Czech) * New translations bannerbomb3.txt (Greek) * New translations bannerbomb3.txt (German) * New translations bannerbomb3.txt (Hebrew) * New translations bannerbomb3.txt (Hungarian) * New translations bannerbomb3.txt (Finnish) * New translations bannerbomb3.txt (Japanese) * New translations bannerbomb3.txt (Korean) * New translations bannerbomb3.txt (Italian) * New translations bannerbomb3.txt (Norwegian) * New translations bannerbomb3.txt (Dutch) * New translations bannerbomb3.txt (Polish) * New translations bannerbomb3.txt (Russian) * New translations bannerbomb3.txt (Portuguese) * New translations bannerbomb3.txt (Ukrainian) * New translations bannerbomb3.txt (Swedish) * New translations bannerbomb3.txt (Turkish) * New translations bannerbomb3.txt (Chinese Traditional) * New translations bannerbomb3.txt (Chinese Simplified) * New translations bannerbomb3.txt (Vietnamese) * New translations bannerbomb3.txt (Indonesian) * New translations bannerbomb3.txt (Portuguese, Brazilian) * New translations bannerbomb3.txt (Malay) * New translations bannerbomb3.txt (Croatian) * New translations bannerbomb3.txt (Thai) * New translations troubleshooting.txt (French) * New translations troubleshooting.txt (Spanish) * New translations troubleshooting.txt (Romanian) * New translations bannerbomb3.txt (Pirate English) * New translations troubleshooting.txt (Czech) * New translations troubleshooting.txt (Arabic) * New translations troubleshooting.txt (German) * New translations troubleshooting.txt (Bulgarian) * New translations troubleshooting.txt (Catalan) * New translations troubleshooting.txt (Hebrew) * New translations troubleshooting.txt (Hungarian) * New translations troubleshooting.txt (Greek) * New translations troubleshooting.txt (Finnish) * New translations troubleshooting.txt (Italian) * New translations troubleshooting.txt (Dutch) * New translations troubleshooting.txt (Norwegian) * New translations troubleshooting.txt (Japanese) * New translations troubleshooting.txt (Swedish) * New translations troubleshooting.txt (Turkish) * New translations troubleshooting.txt (Russian) * New translations troubleshooting.txt (Polish) * New translations troubleshooting.txt (Portuguese) * New translations troubleshooting.txt (Chinese Traditional) * New translations troubleshooting.txt (Vietnamese) * New translations troubleshooting.txt (Ukrainian) * New translations troubleshooting.txt (Chinese Simplified) * New translations troubleshooting.txt (Croatian) * New translations troubleshooting.txt (Malay) * New translations troubleshooting.txt (Thai) * New translations troubleshooting.txt (Portuguese, Brazilian) * New translations troubleshooting.txt (Indonesian) * New translations troubleshooting.txt (Pirate English) * New translations installing-boot9strap-(usm).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(kartdlphax).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(hardmod).txt (Portuguese, Brazilian) * New translations bannerbomb3.txt (Portuguese, Brazilian) * New translations troubleshooting.txt (Portuguese, Brazilian) * New translations bannerbomb3-fredtool-(twn).txt (Korean) * New translations troubleshooting.txt (Korean) * New translations bannerbomb3.txt (Korean) * New translations installing-boot9strap-(usm).txt (Korean) * New translations installing-boot9strap-(hbl-usm).txt (Hungarian) * New translations installing-boot9strap-(hbl-usm).txt (Spanish) * New translations installing-boot9strap-(hbl-usm).txt (Arabic) * New translations installing-boot9strap-(hbl-usm).txt (Bulgarian) * New translations installing-boot9strap-(hbl-usm).txt (Catalan) * New translations installing-boot9strap-(hbl-usm).txt (Czech) * New translations installing-boot9strap-(hbl-usm).txt (German) * New translations installing-boot9strap-(hbl-usm).txt (Greek) * New translations installing-boot9strap-(hbl-usm).txt (Finnish) * New translations installing-boot9strap-(hbl-usm).txt (Hebrew) * New translations installing-boot9strap-(hbl-usm).txt (Italian) * New translations installing-boot9strap-(hbl-usm).txt (Romanian) * New translations installing-boot9strap-(hbl-usm).txt (Japanese) * New translations installing-boot9strap-(hbl-usm).txt (Korean) * New translations installing-boot9strap-(hbl-usm).txt (Dutch) * New translations installing-boot9strap-(hbl-usm).txt (Norwegian) * New translations installing-boot9strap-(hbl-usm).txt (Polish) * New translations installing-boot9strap-(hbl-usm).txt (Portuguese) * New translations installing-boot9strap-(hbl-usm).txt (Russian) * New translations installing-boot9strap-(hbl-usm).txt (Swedish) * New translations installing-boot9strap-(hbl-usm).txt (Turkish) * New translations installing-boot9strap-(hbl-usm).txt (Ukrainian) * New translations installing-boot9strap-(hbl-usm).txt (French) * New translations installing-boot9strap-(soundhax).txt (Korean) * New translations bannerbomb3.txt (Korean) * New translations installing-boot9strap-(hbl-usm).txt (Chinese Simplified) * New translations installing-boot9strap-(hbl-usm).txt (Chinese Traditional) * New translations installing-boot9strap-(hbl-usm).txt (Vietnamese) * New translations installing-boot9strap-(hbl-usm).txt (Portuguese, Brazilian) * New translations installing-boot9strap-(hbl-usm).txt (Indonesian) * New translations installing-boot9strap-(hbl-usm).txt (Thai) * New translations installing-boot9strap-(hbl-usm).txt (Croatian) * New translations installing-boot9strap-(hbl-usm).txt (Malay) * New translations installing-boot9strap-(hbl-usm).txt (Pirate English)
This commit is contained in:
parent
d5d602c099
commit
a303943683
262 changed files with 1937 additions and 754 deletions
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Power off your device
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section II - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Run hardmod-b9s-installer
|
||||
+ Windows Users: Run `install-b9s.exe`
|
||||
+ Mac and Linux Users: Run `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Power off your device
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section II - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Run hardmod-b9s-installer
|
||||
+ Windows Users: Run `install-b9s.exe`
|
||||
+ Mac and Linux Users: Run `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Power off your device
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section II - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Run hardmod-b9s-installer
|
||||
+ Windows Users: Run `install-b9s.exe`
|
||||
+ Mac and Linux Users: Run `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Power off your device
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section II - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Run hardmod-b9s-installer
|
||||
+ Windows Users: Run `install-b9s.exe`
|
||||
+ Mac and Linux Users: Run `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Schalte deinen 3DS aus
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installieren von boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
Eine exzellente Anleitung (auf Englisch) für einen Hardmod kannst du [hier](https://gbatemp.net/threads/414498/) finden.
|
||||
|
||||
Dies ist eine zurzeit funktionierende Implementation des "FIRM Partitions Known-Plaintext"-Exploits. Details findest du [hier](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
Um die `.7z` Dateien, welche auf dieser Seite verlinkt sind, entpacken zu können, benötigst du ein Archivprogramm wie zum Beispiel [7-Zip](http://www.7-zip.org/) oder [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ Dies funktioniert auf mit New 3DS, New 2DS, Old 3DS und Old 2DS auf *allen* Vers
|
|||
|
||||
#### Schritt I - Vorbereitungen
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Schalte deinen 3DS aus
|
||||
1. Stecke deine SD-Karte in deinen Computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ Dies funktioniert auf mit New 3DS, New 2DS, Old 3DS und Old 2DS auf *allen* Vers
|
|||
|
||||
#### Schritt II - Installation von boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Starte den hardmod-b9s-installer
|
||||
+ Windows Nutzer: Führe `install-b9s.exe` aus
|
||||
+ Mac und Linux Nutzer: Führe `install-b9s.py` aus
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Schritt III - boot9strap installieren
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Inhalt" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Erstelle einen Ordner namens `boot9strap` im Stammverzeichnis deiner SD-Karte
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Dein Gerät sollte neu starten und die Luma3DS Konfiguration anzeigen
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Starte die Download-Spiel Anwendung
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Power off your device
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
Για να αποσυμπιέσετε τα επισυναπτόμενα αρχεία '.7z' , θα χρειαστείτε ένα πρόγραμμα αρχειοθέτησης όπως το [7-Zip](http://www.7-zip.org/) ή το [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Power off your device
|
||||
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section II - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Run hardmod-b9s-installer
|
||||
+ Windows Users: Run `install-b9s.exe`
|
||||
+ Mac and Linux Users: Run `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Πίνακας περιεχομένων" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Power off ye device
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Power off ye device
|
||||
1. Insert ye SD card into ye computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section II - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Run hardmod-b9s-installer
|
||||
+ Windows Users: Run `install-b9s.exe`
|
||||
+ Mac and Linux Users: Run `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Create a folder named `boot9strap` on th' root 'o ye SD card
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Ye device should have rebooted into th' Luma3DS configuration menu
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ La raíz de tu tarjeta SD se refiere al primer directorio de la tarjeta, donde puedes ver la carpeta Nintendo 3DS pero no estás dentro de ella
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Apaga tu consola
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Sección II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Abre [la página de PicHaxx Injector](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) en tu computadora
|
||||
1. Selecciona tu archivo `movable.sed`
|
||||
1. Selecciona "Build and Download" (Construir y Descargar)
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copia `boot.nds` (B9STool) a la raíz de tu tarjeta SD
|
||||
1. Copia la carpeta `private` contenida en el `.zip` de Frogminer_save a la raíz de tu tarjeta SD
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Instalar boot9strap (hardmod)"
|
|||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
Puedes encontrar una excelente guía de como hacer hardmod [aquí](https://gbatemp.net/threads/414498/) (*en inglés*).
|
||||
|
||||
Todo esto son implementaciones funcionales del exploit "Particiones FIRM de texto plano conocido" detallado [aquí](https://www.3dbrew.org/wiki/3DS_System_Flaws) (*en inglés*).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
Para extraer los archivos `.7z` enlazados esta página, necesitarás un gestor de archivos como [7-Zip](http://www.7-zip.org/) o [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ Esto funcionará en New 3DS, New 2DS, Old 3DS, y Old 2DS en *todas* las versione
|
|||
|
||||
#### Sección I - Preparativos
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Apaga tu consola
|
||||
1. Inserta tu tarjeta SD en tu computadora
|
||||
1. Copia los archivos `boot.firm` y `boot.3dsx` desde el `.zip` de Luma3DS a la raíz de tu tarjeta SD
|
||||
|
@ -78,6 +84,8 @@ Esto funcionará en New 3DS, New 2DS, Old 3DS, y Old 2DS en *todas* las versione
|
|||
|
||||
#### Sección II - Instalar boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Ejecuta hardmod-b9s-installer
|
||||
+ Usuarios de Windows: Ejecutar `install-b9s.exe`
|
||||
+ Usuarios de Mac y Linux: Ejecutar `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Presiona sobre "Acepto" para aceptar los términos y condiciones
|
||||
1. The update will eventually fail, with the error code `003-1099`. Este comportamiento es el esperado
|
||||
1. Cuando se te pregunte "¿Quieres configurar tu conexión a internet?", selecciona "Aceptar"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. Si el exploit ha funcionado, la consola habrá iniciado SafeB9SInstaller
|
||||
|
||||
#### Sección III - Instalar boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Instalar boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Tabla de contenidos" %}
|
||||
|
||||
### Lectura requerida
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax es un exploit para el Modo Descarga de Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
Para seguir estas instrucciones, necesitarás lo siguiente:
|
||||
|
||||
- Una segunda 3DS con custom firmware (la **3DS de origen**) que sea de la misma región que la 3DS que estás intentando modificar (la **3DS de destino**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- Una copia física o digital de Mario Kart 7 de la misma región que ambas consolas
|
||||
- Una tarjeta SD para cada consola
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
En la **3DS de origen** (la 3DS con custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
En la **3DS de destino** (la 3DS que estás intentando modificar):
|
||||
|
@ -33,6 +42,8 @@ En la **3DS de destino** (la 3DS que estás intentando modificar):
|
|||
|
||||
#### Sección I - Preparativos (3DS de origen)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Inserta la tarjeta SD de la **3DS de origen** en tu computadora
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ La raíz de tu tarjeta SD se refiere al primer directorio de la tarjeta, donde puedes ver la carpeta Nintendo 3DS pero no estás dentro de ella
|
||||
|
@ -45,6 +56,8 @@ En la **3DS de destino** (la 3DS que estás intentando modificar):
|
|||
|
||||
#### Sección II - Preparativos (3DS de destino)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Inserta la tarjeta SD de la **3DS de destino** en tu computadora
|
||||
1. Copia los archivos `boot.firm` y `boot.3dsx` desde el `.zip` de Luma3DS *normal* a la raíz de tu tarjeta SD
|
||||
1. Crea una carpeta llamada `boot9strap` en la raíz de tu tarjeta SD
|
||||
|
@ -57,6 +70,8 @@ En la **3DS de destino** (la 3DS que estás intentando modificar):
|
|||
|
||||
#### Sección III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Enciende la **3DS de origen**
|
||||
- Si te le pide que configures Luma3DS, pulsa START para guardar la configuración
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Mantén pulsados los botones hasta que la consola encienda en modo seguro
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Presiona "OK" para aceptar la actualización
|
||||
+ No hay actualización. Esto es parte del exploit
|
||||
1. Presiona sobre "Acepto" para aceptar los términos y condiciones
|
||||
1. The update will eventually fail, with the error code `003-1099`. Este comportamiento es el esperado
|
||||
1. Cuando se te pregunte "¿Quieres configurar tu conexión a internet?", selecciona "Aceptar"
|
||||
1. En el menú siguiente, navega a `Conexión 1` -> `Modificar ajustes` -> `Siguiente página (flecha derecha)` -> `Servidor proxy` -> `Ajustes avanzados`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. Si el exploit ha funcionado, la consola habrá iniciado SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. Cuando se te pida, introduce la combinación de botones mostrada para instalar boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Tu consola debería haber reiniciado en el menú de configuración de Luma3DS
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Inicia la aplicación de Modo Descarga
|
||||
1. Espera hasta que veas los dos botones
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copia `SafeB9SInstaller.bin` desde el `.zip` de SafeB9SInstaller a la raíz de tu tarjeta SD
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Sección II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Presiona sobre "Acepto" para aceptar los términos y condiciones
|
||||
1. The update will eventually fail, with the error code `003-1099`. Este comportamiento es el esperado
|
||||
1. Cuando se te pregunte "¿Quieres configurar tu conexión a internet?", selecciona "Aceptar"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. Si el exploit ha funcionado, la consola habrá iniciado SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. No añadas manualmente la extensión `.bin` al archivo si ves que no la tiene.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Error al abrir SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" no aparece en la pantalla
|
||||
|
||||
Hay un problema con el archivo `42383821.bin` (es incorrecto, no está presente, está mal colocado o está corrupto). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
Hay un problema con el archivo `42383821.bin` (es incorrecto, no está presente, está mal colocado o está corrupto). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### El menú de Conexiones de Nintendo DS inicia normalmente
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Sammuta konsolisi
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,16 +4,19 @@ title: "Boot9strapin asentaminen (laitteistomodaus)"
|
|||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
Mainion oppaan konsolisi laitteistomodaamiseen löydät [täältä](https://gbatemp.net/threads/414498/)
|
||||
(englanniksi).
|
||||
|
||||
Tämä menetelmä käyttää FIRM-osioiden salaamatonta muotoa (known-plaintext, selitetty [täällä](https://www.3dbrew.org/wiki/3DS_System_Flaws)) hyödyntävää haavoittuvuutta.
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
Purkaaksesi tämän osion `.7z`-tiedostot tarvitset pakkausohjelman, kuten [7-Zip](http://www.7-zip.org/)in tai [The Unarchiver](https://theunarchiver.com/)in.
|
||||
|
@ -66,6 +69,8 @@ Tämä toimii *kaikilla* versioilla New 3DS:llä, New 2DS:llä, vanhalla 3DS:ll
|
|||
|
||||
#### Vaihe I – Valmistelut
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Sammuta konsolisi
|
||||
1. Aseta SD-korttisi tietokoneeseesi
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -79,6 +84,8 @@ Tämä toimii *kaikilla* versioilla New 3DS:llä, New 2DS:llä, vanhalla 3DS:ll
|
|||
|
||||
#### Vaihe II – Boot9strapin asentaminen
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Suorita hardmod-b9s-installer
|
||||
+ Windows-käyttäjät: Avaa `install-b9s.exe`
|
||||
+ Mac- ja Linux-käyttäjät: Suorita `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Vaihe III – Boot9strapin asentaminen
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Sisällysluettelo" %}
|
||||
|
||||
### Tärkeää tietoa
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Luo `boot9strap`-niminen kansio SD-korttisi juureen
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Konsolisi pitäisi uudelleenkäynnistyä suoraan Luma3DS:n määritysvalikkoon
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Avaa Download Play -sovellus
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ La racine de la carte SD représente le répertoire initial de la carte SD où vous pouvez voir le dossier Nintendo 3DS, mais ce n'est pas à l'intérieur de ce dernier
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Éteignez votre 3DS
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Ouvrez [le site Web de PicHaxx Injector](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) sur votre ordinateur
|
||||
1. Sélectionnez votre fichier `movable.sed`
|
||||
1. Sélectionnez "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copiez le fichier `boot.nds`(B9STool) vers la racine de votre carte SD
|
||||
1. Copiez le dossier `private` du fichier `.zip` de Frogminer_save vers la racine de votre carte SD
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installer boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Lecture requise
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
Un excellent guide pour obtenir un hardmod se trouve [ici](https://gbatemp.net/threads/414498/).
|
||||
|
||||
Ceci est une implémentation de l'exploit "FIRM partitions known-plaintext" qui est décrit [ici](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
Pour extraire les fichiers `.7z` sur cette page, vous aurez besoin d'un programme d'archives comme [7-Zip](http://www.7-zip.org/) ou [The Unarchiver](https://theunarchiver.com).
|
||||
|
@ -65,6 +69,8 @@ Cela fonctionne sur la New3DS, Old3DS, New 2DS et Old 3DS sur *toutes* les versi
|
|||
|
||||
#### Section I - Préparatifs
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Éteignez votre 3DS
|
||||
1. Insérez votre carte SD dans votre ordinateur
|
||||
1. Copiez `boot.firm` et `boot.3dsx` depuis Luma3DS `.zip`vers la racine de votre carte SD
|
||||
|
@ -78,6 +84,8 @@ Cela fonctionne sur la New3DS, Old3DS, New 2DS et Old 3DS sur *toutes* les versi
|
|||
|
||||
#### Section II - Installation de boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Exécutez hardmod-b9s-installer
|
||||
+ Utilisateurs Windows: Lancer `install-b9s.exe`
|
||||
+ Utilisateurs Mac et Linux: Lancer `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Appuyez sur « J'accepte » pour accepter les termes et conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. Ne vous inquiétez pas, c'est normal
|
||||
1. Lorsque votre console vous demande "Paramétrer la connexion Internet de la console ?", sélectionnez "Paramétrer"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. Si l'exploit a réussi, votre console devrait avoir démarré sur SafeB9SInstaller
|
||||
|
||||
#### Section III - Installation de boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installation de boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Table des matières" %}
|
||||
|
||||
### Lecture requise
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax est un exploit pour le mode Téléchargement de Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
Pour suivre ces instructions, vous aurez besoin de ceci :
|
||||
|
||||
- Une seconde 3DS avec un firmware custom (la **3DS source**) qui est la même région que la 3DS que vous essayez de modifier (la **3DS cible**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- Une copie physique ou numérique de Mario Kart 7 qui est de la même région que les deux consoles
|
||||
- Une carte SD pour les deux consoles
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
Sur la **3DS source** (la 3DS avec un firmware custom) :
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
Sur la **3DS cible** (la 3DS que vous essayez de modifier):
|
||||
|
@ -33,6 +42,8 @@ Sur la **3DS cible** (la 3DS que vous essayez de modifier):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ La racine de la carte SD représente le répertoire initial de la carte SD où vous pouvez voir le dossier Nintendo 3DS, mais ce n'est pas à l'intérieur de ce dernier
|
||||
|
@ -45,6 +56,8 @@ Sur la **3DS cible** (la 3DS que vous essayez de modifier):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Créez un dossier à la racine de votre carte SD nommé `boot9strap`
|
||||
|
@ -57,6 +70,8 @@ Sur la **3DS cible** (la 3DS que vous essayez de modifier):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Maintenez les boutons enfoncés jusqu'à ce que la console démarre en mode sans échec
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Appuyez sur "OK" pour accepter la mise à jour
|
||||
+ Aucune mise à jour nécessaire. Ceci fait partie de l'exploit
|
||||
1. Appuyez sur « J'accepte » pour accepter les termes et conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. Ne vous inquiétez pas, c'est normal
|
||||
1. Lorsque votre console vous demande "Paramétrer la connexion Internet de la console ?", sélectionnez "Paramétrer"
|
||||
1. Dans le menu suivant, accédez à `Connexion 1` -> `Modifier` -> `Page suivante (flèche de droite)` -> `Serveur proxy` -> `Paramètres avancés`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. Si l'exploit a réussi, votre console devrait avoir démarré sur SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. Lorsque vous y êtes invité, entrez la combinaison de touches indiquée sur l'écran supérieur pour installer boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Votre console va redémarrer dans la configuration de Luma3DS
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Lancez l’application Mode téléchargement
|
||||
1. Attendez jusqu'à ce que vous voyiez les deux boutons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copiez `SafeB9SInstaller.bin` depuis le fichier `.zip` de SafeB9SInstaller à la racine de votre carte SD
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Appuyez sur « J'accepte » pour accepter les termes et conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. Ne vous inquiétez pas, c'est normal
|
||||
1. Lorsque votre console vous demande "Paramétrer la connexion Internet de la console ?", sélectionnez "Paramétrer"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. Si l'exploit a réussi, votre console devrait avoir démarré sur SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. תכבו את המכשיר
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "התקנת boot9strap (הלחמה)"
|
|||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
מדריך מצוין לעשות את ההלחמה ניתן למצוא [כאן](https://gbatemp.net/threads/414498/).
|
||||
|
||||
זה כרגע יישום עובד של הפירצה "PLAINTEXT ידוע למחיצת הFIRM" עם הסבר [כאן](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ To extract the `.7z` files linked on this page, you will need a file archiver li
|
|||
|
||||
#### חלק I - הכנות
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. תכבו את המכשיר
|
||||
1. תכניסו את ה-SD שלכם למחשב
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ To extract the `.7z` files linked on this page, you will need a file archiver li
|
|||
|
||||
#### חלק II - התקנת boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. תפעילו את hardmod-b9s-installer
|
||||
+ משתמשי Windows: תריצו את `install-b9s.exe`
|
||||
+ משתמשי Mac ו Linux: תריצו את `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### חלק III - התקנת boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="תוכן העניינים" %}
|
||||
|
||||
### קריאה דרושה
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. תצרו ב-SD שלכם תיקייה חדשה בשם `boot9strap`
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. הקןנסולה שלכם צריכה לאתחל לתפריט ההגדרות של Luma3DS
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. תפעילו את Download Play
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
|
|||
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
|
||||
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
|
||||
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Power off your device
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
|
|||
#### Section II - PicHaxx
|
||||
|
||||
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
|
||||
|
||||
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
|
||||
1. Select your `movable.sed` file
|
||||
1. Select "Build and Download"
|
||||
|
|
|
@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
|
|||
1. Copy `boot.nds` (B9STool) to the root of your SD card
|
||||
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section IV - Overwriting DS Connection Settings
|
||||
|
|
|
@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
|
||||
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
|
||||
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
### Compatibility Notes
|
||||
|
||||
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
{: .notice--warning}
|
||||
|
||||
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
|
||||
|
||||
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
|
||||
|
||||
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
|
||||
|
||||
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
|
||||
|
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section I - Prep Work
|
||||
|
||||
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
|
||||
|
||||
1. Power off your device
|
||||
1. Insert your SD card into your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
|
|||
|
||||
#### Section II - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
|
||||
|
||||
1. Run hardmod-b9s-installer
|
||||
+ Windows Users: Run `install-b9s.exe`
|
||||
+ Mac and Linux Users: Run `install-b9s.py`
|
||||
|
|
|
@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section III - Installing boot9strap
|
||||
|
|
|
@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
|
|||
|
||||
{% include toc title="Table of Contents" %}
|
||||
|
||||
### Required Reading
|
||||
<details>
|
||||
<summary><em>Technical Details (optional)</em></summary>
|
||||
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
|
||||
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
|
||||
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
|
||||
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
|
||||
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
|
||||
</details>
|
||||
{: .notice--info}
|
||||
|
||||
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
|
||||
### Compatibility Notes
|
||||
|
||||
In order to follow these instructions, you will need the following:
|
||||
|
||||
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
|
||||
- The consoles must be USA, JPN, or EUR region consoles
|
||||
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
|
||||
- An SD card for both devices
|
||||
|
||||
|
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
|
|||
|
||||
On the **source 3DS** (the 3DS with custom firmware):
|
||||
|
||||
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
|
||||
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
|
||||
|
||||
On the **target 3DS** (the 3DS that you are trying to modify):
|
||||
|
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section I - Prep Work (source 3DS)
|
||||
|
||||
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
|
||||
|
||||
1. Insert the SD card of your **source 3DS** in your computer
|
||||
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
|
||||
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
||||
|
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section II - Prep Work (target 3DS)
|
||||
|
||||
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
|
||||
|
||||
1. Insert the SD card of your **target 3DS** in your computer
|
||||
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
|
||||
1. Create a folder named `boot9strap` on the root of your SD card
|
||||
|
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
|
|||
|
||||
#### Section III - kartdlphax
|
||||
|
||||
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
||||
1. Power on the **source 3DS**
|
||||
- If you are prompted to set up Luma3DS, just press START to save the configuration
|
||||
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
|
||||
|
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
|
|||
|
||||
#### Section IV - unSAFE_MODE
|
||||
|
||||
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
|
||||
|
||||
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
|
||||
+ Keep holding the buttons until the device boots into Safe Mode
|
||||
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
|
||||
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
||||
1. Press "OK" to accept the update
|
||||
+ There is no update. This is part of the exploit
|
||||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
|
||||
+ This is a [visual representation](/images/safemode_highlighted.png)
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
|
||||
#### Section V - Installing boot9strap
|
||||
|
||||
In this section, you will install custom firmware onto your device.
|
||||
|
||||
1. When prompted, input the key combo given on the top screen to install boot9strap
|
||||
+ If the top screen is blank, power off your device and re-do Section IV
|
||||
+ If the top screen is blank, power off your device and re-do Section III
|
||||
1. Once it is complete, press (A) to reboot your device
|
||||
1. Your device should have rebooted into the Luma3DS configuration menu
|
||||
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
|
||||
|
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
|
|||
|
||||
#### Section VI - Restoring WiFi Configuration Profiles
|
||||
|
||||
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
|
||||
|
||||
1. Launch the Download Play application
|
||||
1. Wait until you see the two buttons
|
||||
+ Do not press either of the buttons
|
||||
|
|
|
@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
|
|||
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
||||
1. Copy `usm.bin` to the root of your SD card
|
||||
|
||||
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### Section II - BannerBomb3
|
||||
|
||||
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
|
||||
|
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
|
|||
1. Press "I accept" to accept the terms and conditions
|
||||
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
|
||||
1. When asked "Would you like to configure Internet settings?", select "Yes"
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
|
||||
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
|
||||
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
|
||||
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
|
||||
|
||||
#### Section IV - Installing boot9strap
|
||||
|
||||
|
|
|
@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
|
|||
|
||||
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
|
||||
|
||||
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
|
||||
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
|
||||
|
||||
### Failed to open SafeB9SInstaller.bin
|
||||
|
||||
|
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
|
|||
|
||||
### "Haxxxxxxxxx!" does not appear
|
||||
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
|
||||
|
||||
### DS Connection Settings launches normally
|
||||
|
||||
|
|
|
@ -35,6 +35,7 @@ Ebben a fejezetben fel fogod másolni azokat a fájlokat az eszközöd SD kárty
|
|||
+ Ez letölt egy exploit DSiWare-t `F00D43D5.bin` néven és egy payload adatfájlt `bb3.bin` néven egy zip mappán belül (`DSIWARE_EXPLOIT.zip`)
|
||||
1. Másold át a `bb3.bin` fájlt a `DSIWARE_EXPLOIT.zip`-ből az SD kártya gyökerébe
|
||||
+ Az SD kártya gyökere a kezdőkönyvtárt jelenti az SD kártyán, ahol látható a Nintendo 3DS könyvtár, de nem vagyunk benne
|
||||
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
|
||||
1. Navigálj a `Nintendo 3DS` -> `<ID0>` -> `<ID1>` mappába az SD kártyádon
|
||||
+ Az `<ID0>` egy 32 karakter hosszú mappanév, amit a [Seedminer](seedminer)-nél másoltál
|
||||
+ Az `<ID1>` egy 32 karakter hosszú nevű mappa az `<ID0>` mappában
|
||||
|
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
|
|||
1. Az eszközöd kikapcsolt állapotában tartsd nyomva a következő gombokat: (Bal Váll) + (Jobb Váll) + (D-Pad Fel) + (A), majd ezen gombok nyomva tartása mellett kapcsold be az eszközöd
|
||||
+ Tartsd nyomva a gombokat, amíg az eszköz be nem bootol a Safe Mode-ba (a "system update" menübe)
|
||||
1. If prompted to update, press Cancel
|
||||
+ If the device boots to the HOME Menu, just continue to the next step
|
||||
1. Kapcsold ki a készüléked
|
||||
+ Your device will power off
|
||||
+ If the device boots to the HOME Menu, just power off your device
|
||||
|
||||
___
|
||||
|
||||
|
|
|
@ -82,7 +82,7 @@ Ebben a fejezetben átmenetileg le fogod cserélni a Download Play-t a Homebrew
|
|||
|
||||
1. Indítsd el a Download Play alkalmazást (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
|
||||
1. Várj, amíg `Nintendo 3DS` és `Nintendo DS` gombokat nem látsz
|
||||
1. Nyomd le az (L) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
|
||||
1. Nyomd le az (Bal Váll) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
|
||||
1. Válaszd ki a "Miscellaneous options"-t
|
||||
1. Válaszd a "Switch the hb. title to the current app." opciót
|
||||
1. Nyomd meg a (B) gombot a folytatáshoz
|
||||
|
@ -96,7 +96,7 @@ Ebben a fejezetben átmenetileg le fogod cserélni a Download Play-t a Homebrew
|
|||
|
||||
Ebben a fejezetben szinkronizálni fogod a 3DS belső óráját az aktuális időhöz és dumpolni a hang firmware-t (ami szükséges néhány homebrew alkalmazáshoz, hogy a hangot megfelelően használja).
|
||||
|
||||
1. Nyomd le az (L) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
|
||||
1. Nyomd le az (Bal Váll) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
|
||||
1. Válaszd ki a "Miscellaneous options"-t
|
||||
1. Válaszd a "Dump DSP firmware" opciót
|
||||
1. Nyomd meg a (B) gombot a folytatáshoz
|
||||
|
|
|
@ -51,6 +51,7 @@ Ebben a fejezetben fel fogod másolni a fájlokat, amik a Homebrew Launcher ind
|
|||
#### II. rész - PicHaxx
|
||||
|
||||
Ebben a fejezetben létre fogsz hozni egy hackelt Pokémon Picross mentés fájlt, ami használatakor betölti a Homebrew Launcher-t az eszközödön.
|
||||
|
||||
1. Nyisd meg [a PicHaxx Injector weboldalát](nhnarwhal.com/3dstools/pichaxx.php/) a számítógépen
|
||||
1. Válaszd ki a `movable.sed` fájlod
|
||||
1. Válaszd a "Build and Download" menüpontot
|
||||
|
|
|
@ -71,7 +71,7 @@ Ebben a fejezetben fel fogod másolni azokat a fájlokat, amik átmenetileg lecs
|
|||
1. Másold a `boot.nds` (B9STool) fájlt az SD kártyád gyökerébe
|
||||
1. Másold át a `private` mappát a Frogminer_save `.zip`-ből az SD kártyád gyökerébe
|
||||
|
||||
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
|
||||
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
|
||||
{: .notice--info}
|
||||
|
||||
#### IV. rész - A DS Connection Settings felülírása
|
||||
|
|
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue