New Crowdin updates (#2118)

* New translations installing-boot9strap-(kartdlphax).txt (Dutch)

* New translations installing-boot9strap-(kartdlphax).txt (Japanese)

* New translations homebrew-launcher-(pichaxx).txt (Hungarian)

* New translations homebrew-launcher-(pichaxx).txt (Italian)

* New translations installing-boot9strap-(kartdlphax).txt (Hungarian)

* New translations installing-boot9strap-(kartdlphax).txt (Italian)

* New translations homebrew-launcher-(pichaxx).txt (Japanese)

* New translations homebrew-launcher-(pichaxx).txt (Norwegian)

* New translations homebrew-launcher-(pichaxx).txt (Russian)

* New translations installing-boot9strap-(kartdlphax).txt (Russian)

* New translations homebrew-launcher-(pichaxx).txt (Swedish)

* New translations homebrew-launcher-(pichaxx).txt (Portuguese)

* New translations installing-boot9strap-(kartdlphax).txt (Portuguese)

* New translations homebrew-launcher-(pichaxx).txt (Polish)

* New translations installing-boot9strap-(kartdlphax).txt (Norwegian)

* New translations installing-boot9strap-(kartdlphax).txt (Polish)

* New translations installing-boot9strap-(kartdlphax).txt (Swedish)

* New translations homebrew-launcher-(pichaxx).txt (Chinese Simplified)

* New translations installing-boot9strap-(kartdlphax).txt (Chinese Simplified)

* New translations homebrew-launcher-(pichaxx).txt (Chinese Traditional)

* New translations installing-boot9strap-(kartdlphax).txt (Chinese Traditional)

* New translations homebrew-launcher-(pichaxx).txt (Turkish)

* New translations installing-boot9strap-(kartdlphax).txt (Turkish)

* New translations homebrew-launcher-(pichaxx).txt (Ukrainian)

* New translations installing-boot9strap-(kartdlphax).txt (Ukrainian)

* New translations homebrew-launcher-(pichaxx).txt (Thai)

* New translations installing-boot9strap-(kartdlphax).txt (Thai)

* New translations homebrew-launcher-(pichaxx).txt (Croatian)

* New translations installing-boot9strap-(kartdlphax).txt (Croatian)

* New translations installing-boot9strap-(kartdlphax).txt (Indonesian)

* New translations homebrew-launcher-(pichaxx).txt (Indonesian)

* New translations homebrew-launcher-(pichaxx).txt (Vietnamese)

* New translations installing-boot9strap-(kartdlphax).txt (Vietnamese)

* New translations homebrew-launcher-(pichaxx).txt (Portuguese, Brazilian)

* New translations installing-boot9strap-(kartdlphax).txt (Portuguese, Brazilian)

* New translations installing-boot9strap-(hardmod).txt (French)

* New translations installing-boot9strap-(hardmod).txt (Romanian)

* New translations homebrew-launcher-(pichaxx).txt (Malay)

* New translations installing-boot9strap-(kartdlphax).txt (Malay)

* New translations homebrew-launcher-(pichaxx).txt (Pirate English)

* New translations installing-boot9strap-(kartdlphax).txt (Pirate English)

* New translations installing-boot9strap-(hardmod).txt (Arabic)

* New translations installing-boot9strap-(hardmod).txt (Spanish)

* New translations installing-boot9strap-(hardmod).txt (Czech)

* New translations installing-boot9strap-(hardmod).txt (Bulgarian)

* New translations installing-boot9strap-(hardmod).txt (Catalan)

* New translations installing-boot9strap-(hardmod).txt (Finnish)

* New translations installing-boot9strap-(hardmod).txt (Greek)

* New translations installing-boot9strap-(hardmod).txt (German)

* New translations installing-boot9strap-(hardmod).txt (Hungarian)

* New translations installing-boot9strap-(hardmod).txt (Hebrew)

* New translations installing-boot9strap-(hardmod).txt (Korean)

* New translations installing-boot9strap-(soundhax).txt (Korean)

* New translations bannerbomb3.txt (Korean)

* New translations installing-boot9strap-(hardmod).txt (Dutch)

* New translations installing-boot9strap-(hardmod).txt (Italian)

* New translations installing-boot9strap-(hardmod).txt (Japanese)

* New translations installing-boot9strap-(hardmod).txt (Norwegian)

* New translations installing-boot9strap-(hardmod).txt (Polish)

* New translations installing-boot9strap-(hardmod).txt (Swedish)

* New translations installing-boot9strap-(hardmod).txt (Portuguese)

* New translations installing-boot9strap-(hardmod).txt (Russian)

* New translations installing-boot9strap-(hardmod).txt (Ukrainian)

* New translations installing-boot9strap-(hardmod).txt (Turkish)

* New translations installing-boot9strap-(hardmod).txt (Chinese Simplified)

* New translations installing-boot9strap-(hardmod).txt (Vietnamese)

* New translations installing-boot9strap-(hardmod).txt (Chinese Traditional)

* New translations installing-boot9strap-(hardmod).txt (Indonesian)

* New translations installing-boot9strap-(hardmod).txt (Thai)

* New translations installing-boot9strap-(hardmod).txt (Portuguese, Brazilian)

* New translations installing-boot9strap-(hardmod).txt (Malay)

* New translations installing-boot9strap-(hardmod).txt (Croatian)

* New translations installing-boot9strap-(hardmod).txt (Pirate English)

* New translations installing-boot9strap-(hbl-usm).txt (Korean)

* New translations finalizing-setup.txt (Hungarian)

* New translations installing-boot9strap-(kartdlphax).txt (Hungarian)

* New translations uninstall-cfw.txt (Hungarian)

* New translations troubleshooting.txt (Hungarian)

* New translations installing-boot9strap-(hbl-usm).txt (Hungarian)

* New translations installing-boot9strap-(fredtool).txt (Spanish)

* New translations installing-boot9strap-(fredtool).txt (Romanian)

* New translations installing-boot9strap-(usm).txt (Romanian)

* New translations installing-boot9strap-(fredtool).txt (French)

* New translations installing-boot9strap-(usm).txt (French)

* New translations installing-boot9strap-(usm).txt (Korean)

* New translations troubleshooting.txt (Korean)

* New translations installing-boot9strap-(fredtool).txt (Catalan)

* New translations installing-boot9strap-(usm).txt (Catalan)

* New translations installing-boot9strap-(fredtool).txt (Czech)

* New translations installing-boot9strap-(usm).txt (Czech)

* New translations installing-boot9strap-(usm).txt (Spanish)

* New translations installing-boot9strap-(usm).txt (Arabic)

* New translations installing-boot9strap-(fredtool).txt (Arabic)

* New translations installing-boot9strap-(fredtool).txt (Bulgarian)

* New translations installing-boot9strap-(usm).txt (Bulgarian)

* New translations installing-boot9strap-(fredtool).txt (Hebrew)

* New translations installing-boot9strap-(usm).txt (Finnish)

* New translations installing-boot9strap-(fredtool).txt (Hungarian)

* New translations installing-boot9strap-(usm).txt (Hebrew)

* New translations installing-boot9strap-(fredtool).txt (Finnish)

* New translations installing-boot9strap-(fredtool).txt (German)

* New translations installing-boot9strap-(usm).txt (German)

* New translations installing-boot9strap-(fredtool).txt (Greek)

* New translations installing-boot9strap-(usm).txt (Greek)

* New translations installing-boot9strap-(usm).txt (Hungarian)

* New translations installing-boot9strap-(fredtool).txt (Korean)

* New translations installing-boot9strap-(fredtool).txt (Dutch)

* New translations installing-boot9strap-(usm).txt (Dutch)

* New translations installing-boot9strap-(fredtool).txt (Italian)

* New translations installing-boot9strap-(usm).txt (Italian)

* New translations installing-boot9strap-(fredtool).txt (Japanese)

* New translations installing-boot9strap-(usm).txt (Japanese)

* New translations installing-boot9strap-(fredtool).txt (Norwegian)

* New translations installing-boot9strap-(usm).txt (Norwegian)

* New translations installing-boot9strap-(fredtool).txt (Russian)

* New translations installing-boot9strap-(usm).txt (Russian)

* New translations installing-boot9strap-(fredtool).txt (Swedish)

* New translations installing-boot9strap-(usm).txt (Swedish)

* New translations installing-boot9strap-(fredtool).txt (Polish)

* New translations installing-boot9strap-(usm).txt (Polish)

* New translations installing-boot9strap-(fredtool).txt (Portuguese)

* New translations installing-boot9strap-(usm).txt (Portuguese)

* New translations installing-boot9strap-(usm).txt (Chinese Simplified)

* New translations installing-boot9strap-(fredtool).txt (Chinese Traditional)

* New translations installing-boot9strap-(usm).txt (Chinese Traditional)

* New translations installing-boot9strap-(fredtool).txt (Chinese Simplified)

* New translations installing-boot9strap-(fredtool).txt (Turkish)

* New translations installing-boot9strap-(usm).txt (Turkish)

* New translations installing-boot9strap-(fredtool).txt (Ukrainian)

* New translations installing-boot9strap-(usm).txt (Ukrainian)

* New translations installing-boot9strap-(fredtool).txt (Vietnamese)

* New translations installing-boot9strap-(usm).txt (Vietnamese)

* New translations installing-boot9strap-(fredtool).txt (Thai)

* New translations installing-boot9strap-(usm).txt (Thai)

* New translations installing-boot9strap-(fredtool).txt (Croatian)

* New translations installing-boot9strap-(usm).txt (Croatian)

* New translations installing-boot9strap-(fredtool).txt (Portuguese, Brazilian)

* New translations installing-boot9strap-(usm).txt (Portuguese, Brazilian)

* New translations installing-boot9strap-(fredtool).txt (Indonesian)

* New translations installing-boot9strap-(usm).txt (Indonesian)

* New translations bannerbomb3.txt (Romanian)

* New translations installing-boot9strap-(fredtool).txt (Malay)

* New translations installing-boot9strap-(usm).txt (Malay)

* New translations installing-boot9strap-(fredtool).txt (Pirate English)

* New translations installing-boot9strap-(usm).txt (Pirate English)

* New translations bannerbomb3.txt (Spanish)

* New translations bannerbomb3.txt (Arabic)

* New translations bannerbomb3.txt (French)

* New translations bannerbomb3.txt (Catalan)

* New translations bannerbomb3.txt (Bulgarian)

* New translations bannerbomb3.txt (Czech)

* New translations bannerbomb3.txt (Greek)

* New translations bannerbomb3.txt (German)

* New translations bannerbomb3.txt (Hebrew)

* New translations bannerbomb3.txt (Hungarian)

* New translations bannerbomb3.txt (Finnish)

* New translations bannerbomb3.txt (Japanese)

* New translations bannerbomb3.txt (Korean)

* New translations bannerbomb3.txt (Italian)

* New translations bannerbomb3.txt (Norwegian)

* New translations bannerbomb3.txt (Dutch)

* New translations bannerbomb3.txt (Polish)

* New translations bannerbomb3.txt (Russian)

* New translations bannerbomb3.txt (Portuguese)

* New translations bannerbomb3.txt (Ukrainian)

* New translations bannerbomb3.txt (Swedish)

* New translations bannerbomb3.txt (Turkish)

* New translations bannerbomb3.txt (Chinese Traditional)

* New translations bannerbomb3.txt (Chinese Simplified)

* New translations bannerbomb3.txt (Vietnamese)

* New translations bannerbomb3.txt (Indonesian)

* New translations bannerbomb3.txt (Portuguese, Brazilian)

* New translations bannerbomb3.txt (Malay)

* New translations bannerbomb3.txt (Croatian)

* New translations bannerbomb3.txt (Thai)

* New translations troubleshooting.txt (French)

* New translations troubleshooting.txt (Spanish)

* New translations troubleshooting.txt (Romanian)

* New translations bannerbomb3.txt (Pirate English)

* New translations troubleshooting.txt (Czech)

* New translations troubleshooting.txt (Arabic)

* New translations troubleshooting.txt (German)

* New translations troubleshooting.txt (Bulgarian)

* New translations troubleshooting.txt (Catalan)

* New translations troubleshooting.txt (Hebrew)

* New translations troubleshooting.txt (Hungarian)

* New translations troubleshooting.txt (Greek)

* New translations troubleshooting.txt (Finnish)

* New translations troubleshooting.txt (Italian)

* New translations troubleshooting.txt (Dutch)

* New translations troubleshooting.txt (Norwegian)

* New translations troubleshooting.txt (Japanese)

* New translations troubleshooting.txt (Swedish)

* New translations troubleshooting.txt (Turkish)

* New translations troubleshooting.txt (Russian)

* New translations troubleshooting.txt (Polish)

* New translations troubleshooting.txt (Portuguese)

* New translations troubleshooting.txt (Chinese Traditional)

* New translations troubleshooting.txt (Vietnamese)

* New translations troubleshooting.txt (Ukrainian)

* New translations troubleshooting.txt (Chinese Simplified)

* New translations troubleshooting.txt (Croatian)

* New translations troubleshooting.txt (Malay)

* New translations troubleshooting.txt (Thai)

* New translations troubleshooting.txt (Portuguese, Brazilian)

* New translations troubleshooting.txt (Indonesian)

* New translations troubleshooting.txt (Pirate English)

* New translations installing-boot9strap-(usm).txt (Portuguese, Brazilian)

* New translations installing-boot9strap-(kartdlphax).txt (Portuguese, Brazilian)

* New translations installing-boot9strap-(hardmod).txt (Portuguese, Brazilian)

* New translations bannerbomb3.txt (Portuguese, Brazilian)

* New translations troubleshooting.txt (Portuguese, Brazilian)

* New translations bannerbomb3-fredtool-(twn).txt (Korean)

* New translations troubleshooting.txt (Korean)

* New translations bannerbomb3.txt (Korean)

* New translations installing-boot9strap-(usm).txt (Korean)

* New translations installing-boot9strap-(hbl-usm).txt (Hungarian)

* New translations installing-boot9strap-(hbl-usm).txt (Spanish)

* New translations installing-boot9strap-(hbl-usm).txt (Arabic)

* New translations installing-boot9strap-(hbl-usm).txt (Bulgarian)

* New translations installing-boot9strap-(hbl-usm).txt (Catalan)

* New translations installing-boot9strap-(hbl-usm).txt (Czech)

* New translations installing-boot9strap-(hbl-usm).txt (German)

* New translations installing-boot9strap-(hbl-usm).txt (Greek)

* New translations installing-boot9strap-(hbl-usm).txt (Finnish)

* New translations installing-boot9strap-(hbl-usm).txt (Hebrew)

* New translations installing-boot9strap-(hbl-usm).txt (Italian)

* New translations installing-boot9strap-(hbl-usm).txt (Romanian)

* New translations installing-boot9strap-(hbl-usm).txt (Japanese)

* New translations installing-boot9strap-(hbl-usm).txt (Korean)

* New translations installing-boot9strap-(hbl-usm).txt (Dutch)

* New translations installing-boot9strap-(hbl-usm).txt (Norwegian)

* New translations installing-boot9strap-(hbl-usm).txt (Polish)

* New translations installing-boot9strap-(hbl-usm).txt (Portuguese)

* New translations installing-boot9strap-(hbl-usm).txt (Russian)

* New translations installing-boot9strap-(hbl-usm).txt (Swedish)

* New translations installing-boot9strap-(hbl-usm).txt (Turkish)

* New translations installing-boot9strap-(hbl-usm).txt (Ukrainian)

* New translations installing-boot9strap-(hbl-usm).txt (French)

* New translations installing-boot9strap-(soundhax).txt (Korean)

* New translations bannerbomb3.txt (Korean)

* New translations installing-boot9strap-(hbl-usm).txt (Chinese Simplified)

* New translations installing-boot9strap-(hbl-usm).txt (Chinese Traditional)

* New translations installing-boot9strap-(hbl-usm).txt (Vietnamese)

* New translations installing-boot9strap-(hbl-usm).txt (Portuguese, Brazilian)

* New translations installing-boot9strap-(hbl-usm).txt (Indonesian)

* New translations installing-boot9strap-(hbl-usm).txt (Thai)

* New translations installing-boot9strap-(hbl-usm).txt (Croatian)

* New translations installing-boot9strap-(hbl-usm).txt (Malay)

* New translations installing-boot9strap-(hbl-usm).txt (Pirate English)
This commit is contained in:
ihaveahax 2022-10-15 16:53:48 -07:00 committed by GitHub
parent d5d602c099
commit a303943683
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
262 changed files with 1937 additions and 754 deletions

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Power off your device
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section I - Prep Work
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Power off your device
1. Insert your SD card into your computer
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section II - Installing boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Run hardmod-b9s-installer
+ Windows Users: Run `install-b9s.exe`
+ Mac and Linux Users: Run `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section III - Installing boot9strap

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Create a folder named `boot9strap` on the root of your SD card
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Your device should have rebooted into the Luma3DS configuration menu
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Launch the Download Play application
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Power off your device
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section I - Prep Work
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Power off your device
1. Insert your SD card into your computer
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section II - Installing boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Run hardmod-b9s-installer
+ Windows Users: Run `install-b9s.exe`
+ Mac and Linux Users: Run `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section III - Installing boot9strap

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Create a folder named `boot9strap` on the root of your SD card
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Your device should have rebooted into the Luma3DS configuration menu
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Launch the Download Play application
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Power off your device
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section I - Prep Work
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Power off your device
1. Insert your SD card into your computer
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section II - Installing boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Run hardmod-b9s-installer
+ Windows Users: Run `install-b9s.exe`
+ Mac and Linux Users: Run `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section III - Installing boot9strap

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Create a folder named `boot9strap` on the root of your SD card
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Your device should have rebooted into the Luma3DS configuration menu
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Launch the Download Play application
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Power off your device
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section I - Prep Work
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Power off your device
1. Insert your SD card into your computer
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section II - Installing boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Run hardmod-b9s-installer
+ Windows Users: Run `install-b9s.exe`
+ Mac and Linux Users: Run `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section III - Installing boot9strap

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Create a folder named `boot9strap` on the root of your SD card
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Your device should have rebooted into the Luma3DS configuration menu
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Launch the Download Play application
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Schalte deinen 3DS aus
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installieren von boot9strap (Hardmod)"
{% include toc title="Inhalt" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
Eine exzellente Anleitung (auf Englisch) für einen Hardmod kannst du [hier](https://gbatemp.net/threads/414498/) finden.
Dies ist eine zurzeit funktionierende Implementation des "FIRM Partitions Known-Plaintext"-Exploits. Details findest du [hier](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
Um die `.7z` Dateien, welche auf dieser Seite verlinkt sind, entpacken zu können, benötigst du ein Archivprogramm wie zum Beispiel [7-Zip](http://www.7-zip.org/) oder [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ Dies funktioniert auf mit New 3DS, New 2DS, Old 3DS und Old 2DS auf *allen* Vers
#### Schritt I - Vorbereitungen
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Schalte deinen 3DS aus
1. Stecke deine SD-Karte in deinen Computer
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ Dies funktioniert auf mit New 3DS, New 2DS, Old 3DS und Old 2DS auf *allen* Vers
#### Schritt II - Installation von boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Starte den hardmod-b9s-installer
+ Windows Nutzer: Führe `install-b9s.exe` aus
+ Mac und Linux Nutzer: Führe `install-b9s.py` aus

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Schritt III - boot9strap installieren

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Inhalt" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Erstelle einen Ordner namens `boot9strap` im Stammverzeichnis deiner SD-Karte
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Dein Gerät sollte neu starten und die Luma3DS Konfiguration anzeigen
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Starte die Download-Spiel Anwendung
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Power off your device
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
{% include toc title="Πίνακας περιεχομένων" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
Για να αποσυμπιέσετε τα επισυναπτόμενα αρχεία '.7z' , θα χρειαστείτε ένα πρόγραμμα αρχειοθέτησης όπως το [7-Zip](http://www.7-zip.org/) ή το [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section I - Prep Work
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Power off your device
1. Εισάγετε την κάρτα SD στον υπολογιστή σας
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section II - Installing boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Run hardmod-b9s-installer
+ Windows Users: Run `install-b9s.exe`
+ Mac and Linux Users: Run `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section III - Installing boot9strap

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Πίνακας περιεχομένων" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Create a folder named `boot9strap` on the root of your SD card
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Your device should have rebooted into the Luma3DS configuration menu
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Launch the Download Play application
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Power off ye device
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section I - Prep Work
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Power off ye device
1. Insert ye SD card into ye computer
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section II - Installing boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Run hardmod-b9s-installer
+ Windows Users: Run `install-b9s.exe`
+ Mac and Linux Users: Run `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section III - Installing boot9strap

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Create a folder named `boot9strap` on th' root 'o ye SD card
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Ye device should have rebooted into th' Luma3DS configuration menu
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Launch the Download Play application
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ La raíz de tu tarjeta SD se refiere al primer directorio de la tarjeta, donde puedes ver la carpeta Nintendo 3DS pero no estás dentro de ella
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Apaga tu consola
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Sección II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Abre [la página de PicHaxx Injector](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) en tu computadora
1. Selecciona tu archivo `movable.sed`
1. Selecciona "Build and Download" (Construir y Descargar)

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copia `boot.nds` (B9STool) a la raíz de tu tarjeta SD
1. Copia la carpeta `private` contenida en el `.zip` de Frogminer_save a la raíz de tu tarjeta SD
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Instalar boot9strap (hardmod)"
{% include toc title="Tabla de contenidos" %}
### Lectura requerida
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
Puedes encontrar una excelente guía de como hacer hardmod [aquí](https://gbatemp.net/threads/414498/) (*en inglés*).
Todo esto son implementaciones funcionales del exploit "Particiones FIRM de texto plano conocido" detallado [aquí](https://www.3dbrew.org/wiki/3DS_System_Flaws) (*en inglés*).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
Para extraer los archivos `.7z` enlazados esta página, necesitarás un gestor de archivos como [7-Zip](http://www.7-zip.org/) o [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ Esto funcionará en New 3DS, New 2DS, Old 3DS, y Old 2DS en *todas* las versione
#### Sección I - Preparativos
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Apaga tu consola
1. Inserta tu tarjeta SD en tu computadora
1. Copia los archivos `boot.firm` y `boot.3dsx` desde el `.zip` de Luma3DS a la raíz de tu tarjeta SD
@ -78,6 +84,8 @@ Esto funcionará en New 3DS, New 2DS, Old 3DS, y Old 2DS en *todas* las versione
#### Sección II - Instalar boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Ejecuta hardmod-b9s-installer
+ Usuarios de Windows: Ejecutar `install-b9s.exe`
+ Usuarios de Mac y Linux: Ejecutar `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Presiona sobre "Acepto" para aceptar los términos y condiciones
1. The update will eventually fail, with the error code `003-1099`. Este comportamiento es el esperado
1. Cuando se te pregunte "¿Quieres configurar tu conexión a internet?", selecciona "Aceptar"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. Si el exploit ha funcionado, la consola habrá iniciado SafeB9SInstaller
#### Sección III - Instalar boot9strap

View file

@ -4,13 +4,22 @@ title: "Instalar boot9strap (kartdlphax)"
{% include toc title="Tabla de contenidos" %}
### Lectura requerida
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax es un exploit para el Modo Descarga de Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
Para seguir estas instrucciones, necesitarás lo siguiente:
- Una segunda 3DS con custom firmware (la **3DS de origen**) que sea de la misma región que la 3DS que estás intentando modificar (la **3DS de destino**)
- The consoles must be USA, JPN, or EUR region consoles
- Una copia física o digital de Mario Kart 7 de la misma región que ambas consolas
- Una tarjeta SD para cada consola
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
En la **3DS de origen** (la 3DS con custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
En la **3DS de destino** (la 3DS que estás intentando modificar):
@ -33,6 +42,8 @@ En la **3DS de destino** (la 3DS que estás intentando modificar):
#### Sección I - Preparativos (3DS de origen)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Inserta la tarjeta SD de la **3DS de origen** en tu computadora
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ La raíz de tu tarjeta SD se refiere al primer directorio de la tarjeta, donde puedes ver la carpeta Nintendo 3DS pero no estás dentro de ella
@ -45,6 +56,8 @@ En la **3DS de destino** (la 3DS que estás intentando modificar):
#### Sección II - Preparativos (3DS de destino)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Inserta la tarjeta SD de la **3DS de destino** en tu computadora
1. Copia los archivos `boot.firm` y `boot.3dsx` desde el `.zip` de Luma3DS *normal* a la raíz de tu tarjeta SD
1. Crea una carpeta llamada `boot9strap` en la raíz de tu tarjeta SD
@ -57,6 +70,8 @@ En la **3DS de destino** (la 3DS que estás intentando modificar):
#### Sección III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Enciende la **3DS de origen**
- Si te le pide que configures Luma3DS, pulsa START para guardar la configuración
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Mantén pulsados los botones hasta que la consola encienda en modo seguro
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Presiona "OK" para aceptar la actualización
+ No hay actualización. Esto es parte del exploit
1. Presiona sobre "Acepto" para aceptar los términos y condiciones
1. The update will eventually fail, with the error code `003-1099`. Este comportamiento es el esperado
1. Cuando se te pregunte "¿Quieres configurar tu conexión a internet?", selecciona "Aceptar"
1. En el menú siguiente, navega a `Conexión 1` -> `Modificar ajustes` -> `Siguiente página (flecha derecha)` -> `Servidor proxy` -> `Ajustes avanzados`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. Si el exploit ha funcionado, la consola habrá iniciado SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. Cuando se te pida, introduce la combinación de botones mostrada para instalar boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Tu consola debería haber reiniciado en el menú de configuración de Luma3DS
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Inicia la aplicación de Modo Descarga
1. Espera hasta que veas los dos botones
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copia `SafeB9SInstaller.bin` desde el `.zip` de SafeB9SInstaller a la raíz de tu tarjeta SD
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Sección II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Presiona sobre "Acepto" para aceptar los términos y condiciones
1. The update will eventually fail, with the error code `003-1099`. Este comportamiento es el esperado
1. Cuando se te pregunte "¿Quieres configurar tu conexión a internet?", selecciona "Aceptar"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. Si el exploit ha funcionado, la consola habrá iniciado SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. No añadas manualmente la extensión `.bin` al archivo si ves que no la tiene.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Error al abrir SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" no aparece en la pantalla
Hay un problema con el archivo `42383821.bin` (es incorrecto, no está presente, está mal colocado o está corrupto). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
Hay un problema con el archivo `42383821.bin` (es incorrecto, no está presente, está mal colocado o está corrupto). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### El menú de Conexiones de Nintendo DS inicia normalmente

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Sammuta konsolisi
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,16 +4,19 @@ title: "Boot9strapin asentaminen (laitteistomodaus)"
{% include toc title="Sisällysluettelo" %}
### Tärkeää tietoa
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
Mainion oppaan konsolisi laitteistomodaamiseen löydät [täältä](https://gbatemp.net/threads/414498/)
(englanniksi).
Tämä menetelmä käyttää FIRM-osioiden salaamatonta muotoa (known-plaintext, selitetty [täällä](https://www.3dbrew.org/wiki/3DS_System_Flaws)) hyödyntävää haavoittuvuutta.
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
Purkaaksesi tämän osion `.7z`-tiedostot tarvitset pakkausohjelman, kuten [7-Zip](http://www.7-zip.org/)in tai [The Unarchiver](https://theunarchiver.com/)in.
@ -66,6 +69,8 @@ Tämä toimii *kaikilla* versioilla New 3DS:llä, New 2DS:llä, vanhalla 3DS:ll
#### Vaihe I Valmistelut
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Sammuta konsolisi
1. Aseta SD-korttisi tietokoneeseesi
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -79,6 +84,8 @@ Tämä toimii *kaikilla* versioilla New 3DS:llä, New 2DS:llä, vanhalla 3DS:ll
#### Vaihe II Boot9strapin asentaminen
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Suorita hardmod-b9s-installer
+ Windows-käyttäjät: Avaa `install-b9s.exe`
+ Mac- ja Linux-käyttäjät: Suorita `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Vaihe III Boot9strapin asentaminen

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Sisällysluettelo" %}
### Tärkeää tietoa
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Luo `boot9strap`-niminen kansio SD-korttisi juureen
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Konsolisi pitäisi uudelleenkäynnistyä suoraan Luma3DS:n määritysvalikkoon
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Avaa Download Play -sovellus
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ La racine de la carte SD représente le répertoire initial de la carte SD où vous pouvez voir le dossier Nintendo 3DS, mais ce n'est pas à l'intérieur de ce dernier
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Éteignez votre 3DS
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Ouvrez [le site Web de PicHaxx Injector](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) sur votre ordinateur
1. Sélectionnez votre fichier `movable.sed`
1. Sélectionnez "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copiez le fichier `boot.nds`(B9STool) vers la racine de votre carte SD
1. Copiez le dossier `private` du fichier `.zip` de Frogminer_save vers la racine de votre carte SD
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installer boot9strap (Hardmod)"
{% include toc title="Table of Contents" %}
### Lecture requise
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
Un excellent guide pour obtenir un hardmod se trouve [ici](https://gbatemp.net/threads/414498/).
Ceci est une implémentation de l'exploit "FIRM partitions known-plaintext" qui est décrit [ici](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
Pour extraire les fichiers `.7z` sur cette page, vous aurez besoin d'un programme d'archives comme [7-Zip](http://www.7-zip.org/) ou [The Unarchiver](https://theunarchiver.com).
@ -65,6 +69,8 @@ Cela fonctionne sur la New3DS, Old3DS, New 2DS et Old 3DS sur *toutes* les versi
#### Section I - Préparatifs
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Éteignez votre 3DS
1. Insérez votre carte SD dans votre ordinateur
1. Copiez `boot.firm` et `boot.3dsx` depuis Luma3DS `.zip`vers la racine de votre carte SD
@ -78,6 +84,8 @@ Cela fonctionne sur la New3DS, Old3DS, New 2DS et Old 3DS sur *toutes* les versi
#### Section II - Installation de boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Exécutez hardmod-b9s-installer
+ Utilisateurs Windows: Lancer `install-b9s.exe`
+ Utilisateurs Mac et Linux: Lancer `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Appuyez sur « J'accepte » pour accepter les termes et conditions
1. The update will eventually fail, with the error code `003-1099`. Ne vous inquiétez pas, c'est normal
1. Lorsque votre console vous demande "Paramétrer la connexion Internet de la console ?", sélectionnez "Paramétrer"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. Si l'exploit a réussi, votre console devrait avoir démarré sur SafeB9SInstaller
#### Section III - Installation de boot9strap

View file

@ -4,13 +4,22 @@ title: "Installation de boot9strap (kartdlphax)"
{% include toc title="Table des matières" %}
### Lecture requise
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax est un exploit pour le mode Téléchargement de Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
Pour suivre ces instructions, vous aurez besoin de ceci :
- Une seconde 3DS avec un firmware custom (la **3DS source**) qui est la même région que la 3DS que vous essayez de modifier (la **3DS cible**)
- The consoles must be USA, JPN, or EUR region consoles
- Une copie physique ou numérique de Mario Kart 7 qui est de la même région que les deux consoles
- Une carte SD pour les deux consoles
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
Sur la **3DS source** (la 3DS avec un firmware custom) :
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
Sur la **3DS cible** (la 3DS que vous essayez de modifier):
@ -33,6 +42,8 @@ Sur la **3DS cible** (la 3DS que vous essayez de modifier):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ La racine de la carte SD représente le répertoire initial de la carte SD où vous pouvez voir le dossier Nintendo 3DS, mais ce n'est pas à l'intérieur de ce dernier
@ -45,6 +56,8 @@ Sur la **3DS cible** (la 3DS que vous essayez de modifier):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Créez un dossier à la racine de votre carte SD nommé `boot9strap`
@ -57,6 +70,8 @@ Sur la **3DS cible** (la 3DS que vous essayez de modifier):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Maintenez les boutons enfoncés jusqu'à ce que la console démarre en mode sans échec
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Appuyez sur "OK" pour accepter la mise à jour
+ Aucune mise à jour nécessaire. Ceci fait partie de l'exploit
1. Appuyez sur « J'accepte » pour accepter les termes et conditions
1. The update will eventually fail, with the error code `003-1099`. Ne vous inquiétez pas, c'est normal
1. Lorsque votre console vous demande "Paramétrer la connexion Internet de la console ?", sélectionnez "Paramétrer"
1. Dans le menu suivant, accédez à `Connexion 1` -> `Modifier` -> `Page suivante (flèche de droite)` -> `Serveur proxy` -> `Paramètres avancés`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. Si l'exploit a réussi, votre console devrait avoir démarré sur SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. Lorsque vous y êtes invité, entrez la combinaison de touches indiquée sur l'écran supérieur pour installer boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Votre console va redémarrer dans la configuration de Luma3DS
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Lancez lapplication Mode téléchargement
1. Attendez jusqu'à ce que vous voyiez les deux boutons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copiez `SafeB9SInstaller.bin` depuis le fichier `.zip` de SafeB9SInstaller à la racine de votre carte SD
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Appuyez sur « J'accepte » pour accepter les termes et conditions
1. The update will eventually fail, with the error code `003-1099`. Ne vous inquiétez pas, c'est normal
1. Lorsque votre console vous demande "Paramétrer la connexion Internet de la console ?", sélectionnez "Paramétrer"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. Si l'exploit a réussi, votre console devrait avoir démarré sur SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. תכבו את המכשיר
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "התקנת boot9strap (הלחמה)"
{% include toc title="תוכן העניינים" %}
### קריאה דרושה
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
מדריך מצוין לעשות את ההלחמה ניתן למצוא [כאן](https://gbatemp.net/threads/414498/).
זה כרגע יישום עובד של הפירצה "PLAINTEXT ידוע למחיצת הFIRM" עם הסבר [כאן](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ To extract the `.7z` files linked on this page, you will need a file archiver li
#### חלק I - הכנות
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. תכבו את המכשיר
1. תכניסו את ה-SD שלכם למחשב
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ To extract the `.7z` files linked on this page, you will need a file archiver li
#### חלק II - התקנת boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. תפעילו את hardmod-b9s-installer
+ משתמשי Windows: תריצו את `install-b9s.exe`
+ משתמשי Mac ו Linux: תריצו את `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### חלק III - התקנת boot9strap

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="תוכן העניינים" %}
### קריאה דרושה
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. תצרו ב-SD שלכם תיקייה חדשה בשם `boot9strap`
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. הקןנסולה שלכם צריכה לאתחל לתפריט ההגדרות של Luma3DS
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. תפעילו את Download Play
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ In this section, you will copy the files needed to trigger the BannerBomb3 explo
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Power off your device
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -51,6 +51,7 @@ In this section, you will copy some of the files that will be used to launch the
#### Section II - PicHaxx
In this section, you will create a hacked Pokémon Picross save file that, when used, will load the Homebrew Launcher on your device.
1. Open [the PicHaxx Injector website](https://3ds.nhnarwhal.com/3dstools/pichaxx.php) on your computer
1. Select your `movable.sed` file
1. Select "Build and Download"

View file

@ -71,7 +71,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section IV - Overwriting DS Connection Settings

View file

@ -4,15 +4,19 @@ title: "Installing boot9strap (Hardmod)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>An excellent guide to getting a hardmod can be found <a href="https://gbatemp.net/threads/414498/">here</a>.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
<p>Using a hardmod, we can dump the NAND image, install custom firmware to the NAND image, then re-install the hacked NAND image to the console.</p>
</details>
{: .notice--info}
### Compatibility Notes
The instructions on this page do not currently work on the latest firmware (11.16.0). If you were directly linked to this page, [return to Get Started](get-started) or join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
An excellent guide to getting a hardmod can be found [here](https://gbatemp.net/threads/414498/).
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
To use the [magnet](https://wikipedia.org/wiki/Magnet_URI_scheme) links on this page, you will need a torrent client like [qBittorrent](https://www.qbittorrent.org/download.php) or [Deluge](http://dev.deluge-torrent.org/wiki/Download).
To extract the `.7z` files linked on this page, you will need a file archiver like [7-Zip](http://www.7-zip.org/) or [The Unarchiver](https://theunarchiver.com/).
@ -65,6 +69,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section I - Prep Work
In this section, you will download the necessary files for the hardmod and dump the NAND image in preparation to install custom firmware.
1. Power off your device
1. Insert your SD card into your computer
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
@ -78,6 +84,8 @@ This will work on New 3DS, New 2DS, Old 3DS, and Old 2DS on *all* versions that
#### Section II - Installing boot9strap
In this section, you will install custom firmware to the dumped NAND image, and then install this NAND image back onto the device to install custom firmware on it.
1. Run hardmod-b9s-installer
+ Windows Users: Run `install-b9s.exe`
+ Mac and Linux Users: Run `install-b9s.py`

View file

@ -60,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section III - Installing boot9strap

View file

@ -4,13 +4,22 @@ title: "Installing boot9strap (kartdlphax)"
{% include toc title="Table of Contents" %}
### Required Reading
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.</p>
<p>To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.</p>
<p>This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.</p>
<p>Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.</p>
<p>For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: <a href="https://github.com/PabloMK7/kartdlphax">kartdlphax</a>, <a href="https://github.com/zoogie/unSAFE_MODE/">unSAFE_MODE</a>.</p>
</details>
{: .notice--info}
kartdlphax is an exploit for the Download Play mode of Mario Kart 7. It can be used with unSAFE_MODE to install custom firmware on target devices.
### Compatibility Notes
In order to follow these instructions, you will need the following:
- A second 3DS with custom firmware (the **source 3DS**) that is the same region as the 3DS you are trying to modify (the **target 3DS**)
- The consoles must be USA, JPN, or EUR region consoles
- A physical or digital copy of Mario Kart 7 that is the same region as both consoles
- An SD card for both devices
@ -21,7 +30,7 @@ If the (Right/Left Shoulder), (D-Pad Up), or (A) buttons on the **target 3DS** d
On the **source 3DS** (the 3DS with custom firmware):
* The latest release of [kartdlphax](https://github.com/mariohackandglitch/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [kartdlphax](https://github.com/PabloMK7/kartdlphax/releases/latest) (`plugin.3gx`)
* The latest release of [Luma3DS 3GX Loader Edition](https://github.com/Nanquitas/Luma3DS/releases/latest) (`boot.firm`)
On the **target 3DS** (the 3DS that you are trying to modify):
@ -33,6 +42,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
1. Insert the SD card of your **source 3DS** in your computer
1. Copy Luma 3GX Loader Edition's `boot.firm` to the root of the **source 3DS**'s SD card, replacing any existing file
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
@ -45,6 +56,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section II - Prep Work (target 3DS)
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)'s SD card.
1. Insert the SD card of your **target 3DS** in your computer
1. Copy `boot.firm` and `boot.3dsx` from the standard Luma3DS `.zip` to the root of your SD card
1. Create a folder named `boot9strap` on the root of your SD card
@ -57,6 +70,8 @@ On the **target 3DS** (the 3DS that you are trying to modify):
#### Section III - kartdlphax
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
1. Power on the **source 3DS**
- If you are prompted to set up Luma3DS, just press START to save the configuration
1. Once in the HOME Menu, press (Left Shoulder) + (Down D-Pad) + (Select) to bring up the Rosalina menu
@ -91,22 +106,25 @@ You will **not** need to use your **source 3DS** to complete any further steps o
#### Section IV - unSAFE_MODE
In this section, you will enter Safe Mode (a feature available on all 3DS family devices) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup`
+ This is a [visual representation](/images/safemode_highlighted.png)
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
#### Section V - Installing boot9strap
In this section, you will install custom firmware onto your device.
1. When prompted, input the key combo given on the top screen to install boot9strap
+ If the top screen is blank, power off your device and re-do Section IV
+ If the top screen is blank, power off your device and re-do Section III
1. Once it is complete, press (A) to reboot your device
1. Your device should have rebooted into the Luma3DS configuration menu
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
@ -118,6 +136,8 @@ At this point, your console will boot to Luma3DS by default.
#### Section VI - Restoring WiFi Configuration Profiles
In this section, you will enter the Homebrew Launcher so that you can restore the Wi-Fi connection slots that were overwritten in Section III.
1. Launch the Download Play application
1. Wait until you see the two buttons
+ Do not press either of the buttons

View file

@ -41,6 +41,12 @@ In this section, you will copy the files needed to trigger the unSAFE_MODE explo
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` to the root of your SD card
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
{: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwitten while the exploit is active.
@ -66,8 +72,9 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. Press "I accept" to accept the terms and conditions
1. The update will eventually fail, with the error code `003-1099`. This is intended behaviour
1. When asked "Would you like to configure Internet settings?", select "Yes"
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/bb3/safemode_highlighted.png))
1. On the following menu, navigate to `Connection 1` -> `Change Settings` -> `Next Page (right arrow)` -> `Proxy Settings` -> `Detailed Setup` ([image](/images/screenshots/usm/safemode_highlighted.png))
1. If the exploit was successful, your device will have booted into SafeB9SInstaller
+ If your device instead shows a red screen, you are missing `usm.bin` from the root of your SD card
#### Section IV - Installing boot9strap

View file

@ -154,7 +154,7 @@ unSAFE_MODE is not installed. Follow the instructions on your page to install un
The file `usm.bin` is missing or misplaced. Download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) and place `usm.bin` on the root of your SD card. Do not add the `.bin` extension if you do not already see it.
There is also a possibility that the console doesn't read your SD card. Make sure it is inserted and formatted correctly.
There is also a possibility that the console isn't reading your SD card. Make sure it is inserted and formatted correctly.
### Failed to open SafeB9SInstaller.bin
@ -180,7 +180,7 @@ You forgot to delete `F00D43D5.bin` from the SD card. Navigate to `Nintendo 3DS`
### "Haxxxxxxxxx!" does not appear
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [Fredtool](https://3ds.nhnarwhal.com/3dstools/fredtool.php) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
There is an issue with your `42383821.bin` file (it is incorrect, missing, misplaced, or corrupted). Re-create your files with the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website and ensure that you place the `42383821.bin` file from `output.zip` -> `hax` in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`.
### DS Connection Settings launches normally

View file

@ -35,6 +35,7 @@ Ebben a fejezetben fel fogod másolni azokat a fájlokat az eszközöd SD kárty
+ Ez letölt egy exploit DSiWare-t `F00D43D5.bin` néven és egy payload adatfájlt `bb3.bin` néven egy zip mappán belül (`DSIWARE_EXPLOIT.zip`)
1. Másold át a `bb3.bin` fájlt a `DSIWARE_EXPLOIT.zip`-ből az SD kártya gyökerébe
+ Az SD kártya gyökere a kezdőkönyvtárt jelenti az SD kártyán, ahol látható a Nintendo 3DS könyvtár, de nem vagyunk benne
![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. Navigálj a `Nintendo 3DS` -> `<ID0>` -> `<ID1>` mappába az SD kártyádon
+ Az `<ID0>` egy 32 karakter hosszú mappanév, amit a [Seedminer](seedminer)-nél másoltál
+ Az `<ID1>` egy 32 karakter hosszú nevű mappa az `<ID0>` mappában
@ -53,8 +54,8 @@ In this section, you will test the SAFE_MODE function of your device. This will
1. Az eszközöd kikapcsolt állapotában tartsd nyomva a következő gombokat: (Bal Váll) + (Jobb Váll) + (D-Pad Fel) + (A), majd ezen gombok nyomva tartása mellett kapcsold be az eszközöd
+ Tartsd nyomva a gombokat, amíg az eszköz be nem bootol a Safe Mode-ba (a "system update" menübe)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Kapcsold ki a készüléked
+ Your device will power off
+ If the device boots to the HOME Menu, just power off your device
___

View file

@ -82,7 +82,7 @@ Ebben a fejezetben átmenetileg le fogod cserélni a Download Play-t a Homebrew
1. Indítsd el a Download Play alkalmazást (![]({{ "/images/download-play-icon.png" | absolute_url }}){: height="24px" width="24px"})
1. Várj, amíg `Nintendo 3DS` és `Nintendo DS` gombokat nem látsz
1. Nyomd le az (L) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
1. Nyomd le az (Bal Váll) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
1. Válaszd ki a "Miscellaneous options"-t
1. Válaszd a "Switch the hb. title to the current app." opciót
1. Nyomd meg a (B) gombot a folytatáshoz
@ -96,7 +96,7 @@ Ebben a fejezetben átmenetileg le fogod cserélni a Download Play-t a Homebrew
Ebben a fejezetben szinkronizálni fogod a 3DS belső óráját az aktuális időhöz és dumpolni a hang firmware-t (ami szükséges néhány homebrew alkalmazáshoz, hogy a hangot megfelelően használja).
1. Nyomd le az (L) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
1. Nyomd le az (Bal Váll) + (D-Pad le) + (Select) gombokat egyszerre a Rosalina menü megnyitásához
1. Válaszd ki a "Miscellaneous options"-t
1. Válaszd a "Dump DSP firmware" opciót
1. Nyomd meg a (B) gombot a folytatáshoz

View file

@ -51,6 +51,7 @@ Ebben a fejezetben fel fogod másolni a fájlokat, amik a Homebrew Launcher ind
#### II. rész - PicHaxx
Ebben a fejezetben létre fogsz hozni egy hackelt Pokémon Picross mentés fájlt, ami használatakor betölti a Homebrew Launcher-t az eszközödön.
1. Nyisd meg [a PicHaxx Injector weboldalát](nhnarwhal.com/3dstools/pichaxx.php/) a számítógépen
1. Válaszd ki a `movable.sed` fájlod
1. Válaszd a "Build and Download" menüpontot

View file

@ -71,7 +71,7 @@ Ebben a fejezetben fel fogod másolni azokat a fájlokat, amik átmenetileg lecs
1. Másold a `boot.nds` (B9STool) fájlt az SD kártyád gyökerébe
1. Másold át a `private` mappát a Frogminer_save `.zip`-ből az SD kártyád gyökerébe
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### IV. rész - A DS Connection Settings felülírása

Some files were not shown because too many files have changed in this diff Show more