move to using bb3 multihax (#2110)

Restructure all BB3-related methods into a monolithic branch under 
BannerBomb3, and use the multihax injector. (Manually fixed bb3.bin 
by me to make things not confusing.)

Makes guide easier to maintain, and many other things cleaned up overall.

Co-authored-by: lifehackerhansol <lifehacker@hansol.ca>
This commit is contained in:
Gruetzig 2022-10-12 18:01:24 +02:00 committed by GitHub
parent c6d266e0a6
commit ee1bd12cd5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 77 additions and 68 deletions

View file

@ -6,8 +6,8 @@ title: "BannerBomb3"
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>To dump system DSiWare, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to dump the DSi Internet Settings application to the SD root.</p>
<p>To launch custom code, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system.</p>
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
</details>
{: .notice--info}
@ -27,38 +27,43 @@ If you have a Taiwanese console (indicated by a T after the system version), fol
In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.
1. Open [BannerBomb3 Tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php) on your computer
1. Upload your movable.sed using the "Choose File" option
1. Click "Build and Download"
+ This will download an exploit DSiWare called `F00D43D5.bin` inside of a zip file (`BannerBomb3.zip`)
1. If your console is powered on, power off your console
1. Power off your device
1. Insert your SD card into your computer
1. Open [Bannerbomb3 Injector](http://3dstools.nhnarwhal.com/#/bb3gen) on your computer
1. Upload your movable.sed using the “Choose File” option
1. Click “Build and Download”
+ This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
1. Copy the `F00D43D5.bin` file from `BannerBomb3.zip` to the `Nintendo DSiWare` folder
1. Copy the `F00D43D5.bin` file from `DSIWARE_EXPLOIT.zip` to the `Nintendo DSiWare` folder
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
{: .notice--info}
#### Section II - BannerBomb3
#### Section II - Hardware Button Check
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next page.
In this section, you will test the SAFE_MODE function of your device. This will determine which method you will follow in the next page.
1. Reinsert your SD card into your device
1. Power on your device
1. Launch System Settings on your device
1. Navigate to `Data Management` -> `DSiWare` -> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
+ Your system should flash Magenta (pink/purple) and then crash a few seconds later. This means it worked
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
+ If the device boots to the HOME Menu, just continue to the next step
1. Power off your device
1. Insert your SD card into your computer
1. You should now have `42383841.bin` on the root of your SD card. Copy this file to somewhere on your computer, as you will use it on the next page
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
___
Continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
### Next steps: Choose an exploit
If your device booted into Safe Mode and prompted to you to do a system update in Section II, Safe Mode is working on your device.
If your device booted into Safe Mode, continue to [Installing boot9strap (USM)](installing-boot9strap-(usm))
{: .notice--primary}
If your device did NOT boot into Safe Mode, continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
{: .notice--warning}

View file

@ -6,14 +6,13 @@ title: "Installing boot9strap (Fredtool)"
<details>
<summary><em>Technical Details (optional)</em></summary>
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application. This requires you to have a DSiWare backup, which you should have gotten in the previous section.</p>
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
</details>
{: .notice--info}
### What You Need
* A DSiWare Backup, normally `42383841.bin` (You should have one on the root of your SD card from following [BannerBomb3](bannerbomb3))
* Your `movable.sed` file from completing [Seedminer](seedminer)
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
@ -27,17 +26,32 @@ As an additional safety measure, we will perform an additional check for custom
1. Hold the (Select) button
1. Power on your device while still holding the (Select) button
1. If the check was successful, you will boot to the HOME Menu and you may proceed with this guide
1. Power off your device
If you see a configuration menu, you already have CFW, and continuing with these instructions may BRICK your device! Follow [Checking for CFW](checking-for-cfw) to upgrade your existing CFW.
If you see a configuration menu or the console immediately powers off, you already have CFW, and continuing with these instructions may BRICK your device! Follow [Checking for CFW](checking-for-cfw) to upgrade your existing CFW.
{: .notice--danger}
#### Section II - BannerBomb3
#### Section II - Prep Work
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.
1. Reinsert your SD card into your device
1. Power on your device
1. Launch System Settings on your device
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
+ Your device should show the BB3 multihax menu
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-bb3-multihax-menu-fredtool)
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
+ Your device will automatically power off
#### Section III - Prep Work
In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.
1. Insert your SD card into your computer
1. Open the [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) website on your computer
1. Under the "Username" field, enter any alphanumeric name (no spaces or special characters)
1. Under the "DSiBin" field, upload your `42383841.bin` file using the first "Browse..." option
1. Under the "DSiBin" field, upload your `42383841.bin` file from the root of your SD card using the first "Browse..." option
1. Under the "MovableSed" field, upload your `movable.sed` file using the second "Browse..." option
1. Under the "InjectionTarget" field, set the injection target to `DSinternet` (NOT memorypit)
1. Click "Build"
@ -46,7 +60,6 @@ In this section, you will copy the files necessary to temporarily replace DS Con
1. Click on the first search result
+ This result should have the latest timestamp
1. Click the "output_(name).zip" link
1. Insert your SD card into your computer
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
@ -60,7 +73,7 @@ In this section, you will copy the files necessary to temporarily replace DS Con
![]({{ "/images/screenshots/fredtool-root-layout.png" | absolute_url }})
{: .notice--info}
#### Section III - Overwriting DS Connection Settings
#### Section IV - Overwriting DS Connection Settings
In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.
@ -73,7 +86,7 @@ In this section, you will copy the hacked DS Connection Settings DSiWare to inte
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio
#### Section IV - Flipnote Exploit
#### Section V - Flipnote Exploit
If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
{: .notice--info}
@ -99,7 +112,7 @@ In this section, you will perform a series of very specific steps within Flipnot
+ If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
+ If you see the Luma Configuration screen, press (Start) to reboot, then continue with the guide
#### Section V - Luma3DS Verification
#### Section VI - Luma3DS Verification
Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.
@ -113,9 +126,9 @@ At this point, your console will boot to Luma3DS by default.
+ Luma3DS does not look any different from the normal HOME Menu. If your console has booted into the HOME Menu, it is running custom firmware.
+ On the next page, you will install useful homebrew applications to complete your setup.
#### Section VI - Restoring DS Connection Settings
#### Section VII - Restoring DS Connection Settings
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section III.
In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section IV.
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
1. Copy the `42383841.bin` file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one

View file

@ -18,45 +18,28 @@ title: "Installing boot9strap (USM)"
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [an alternate branch of Seedminer](installing-boot9strap-(fredtool)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
{: .notice--warning}
### What You Need
* Your `movable.sed` file from completing [Seedminer](seedminer)
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
* The latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) (direct download)
#### Section I - Prep Work
In this section, you will copy the files needed to trigger the BannerBomb3 and unSAFE_MODE exploits onto your device's SD card.
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card.
1. If your device is powered on, power off your device
1. Open [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php) on your computer
1. Upload your movable.sed using the "Choose File" option
1. Click "Build and Download"
+ This will download an exploit DSiWare called `F00D43D5.bin` and a SAFE_MODE exploit data file called `usm.bin` inside of a zip archive (`unSAFE_MODE.zip`)
1. Insert your SD card into your computer
1. Your SD card should be inserted in your computer
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
1. Create a folder named `boot9strap` on the root of your SD card
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
1. Copy `usm.bin` from `unSAFE_MODE.zip` to the root of your SD card
![]({{ "/images/screenshots/bb3/usm-root-layout.png" | absolute_url }}){: .notice--info}
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }}){: .notice--info}
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` on your SD card
+ `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
+ `<ID1>` is a 32-letter folder inside of the `<ID0>`
![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
1. Create a folder named `Nintendo DSiWare` inside of the `<ID1>`
+ If you already had the folder *and* there are any existing DSiWare backup files (`<8-character-id>.bin`) inside, copy them to your PC and remove them from your SD card
1. Copy the `F00D43D5.bin` file from `unSAFE_MODE.zip` to the `Nintendo DSiWare` folder
![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
{: .notice--info}
1. Copy `usm.bin` to the root of your SD card
#### Section II - BannerBomb3
@ -66,9 +49,9 @@ In this section, you will trigger the BannerBomb3 exploit using the DSiWare Mana
1. Power on your device
1. Launch System Settings on your device
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-usm-menu)
1. Press (A) to select "Inject haxx"
+ Your device should show the BB3 multihax menu
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-bb3-multihax-menu-usm)
1. Use the D-Pad to navigate and press the (A) button to select "Install unSAFE_MODE"
+ Your device will automatically power off
#### Section III - unSAFE_MODE
@ -77,7 +60,7 @@ In this section, you will enter Safe Mode (a feature available on all 3DS family
1. With your device still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your device
+ Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of Seedminer](bannerbomb3). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
+ If you're unable to get into Safe Mode after multiple attempts, one of your buttons may be failing or broken. If this is the case, you will need to follow [an alternate branch of BannerBomb3](installing-boot9strap-(fredtool)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
1. Press "OK" to accept the update
+ There is no update. This is part of the exploit
1. Press "I accept" to accept the terms and conditions
@ -107,8 +90,7 @@ In this section, you will trigger the BannerBomb3 exploit a second time so that
1. Launch System Settings on your device
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
+ Your device should show the [Bannerbomb3 menu](/images/screenshots/bb3/usm-menu.png)
1. Use the D-Pad to navigate and press the (A) button to select "Restore slots"
1. Use the D-Pad to navigate and press the (A) button to select "Uninstall unSAFE_MODE"
+ Your device will automatically reboot
1. Power off your device
1. Insert your SD card into your computer

View file

@ -56,6 +56,7 @@ In this section, you will use the Bruteforce Movable website to retrieve your de
+ If you are still waiting after half an hour, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask (in English) for someone there to assist you
1. When the process is completed, download your `movable.sed` file from the site
+ Keep this file as you will need it in the upcoming pages
1. Power off your device
___
@ -63,11 +64,11 @@ ___
Once you have your device's encryption key (`movable.sed`), you will use it in conjunction with other exploits to install custom firmware on your 3DS.
#### unSAFE_MODE (Recommended)
#### BannerBomb3
This method of using Seedminer for further exploitation uses your `movable.sed` file to take advantage of exploits in the SAFE_MODE firmware present in all 3DS units.
This method of using Seedminer for further exploitation uses your `movable.sed` file to take advantage of exploits in the System Settings application.
Continue to [Installing boot9strap (USM)](installing-boot9strap-(usm))
Continue to [BannerBomb3](bannerbomb3)
{: .notice--primary}
___
@ -77,4 +78,4 @@ ___
If you have a Taiwanese device (indicated with a T at the end of the system version, such as 11.15.0-39**T**), you must follow this route. **Other regions may not follow this route.**
Continue to [BannerBomb3 + Fredtool (TWN)](bannerbomb3-fredtool-(twn))
{: .notice--warning}
{: .notice--warning}

View file

@ -126,11 +126,11 @@ If this is unsuccessful, try using another SD card.
## Installing boot9strap (USM)
### DSiWare Management menu crashes without showing USM menu
### DSiWare Management menu crashes without showing BB3 multihax menu (USM)
Ensure that `F00D43D5.bin` is the only file in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`. If it is, then re-create it with the [unSAFE_MODE Exploit Injector](https://3ds.nhnarwhal.com/3dstools/unsafemode.php).
Ensure that `F00D43D5.bin` is the only file in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`. If it is, then re-create it with the [Bannerbomb3 Injector](http://3dstools.nhnarwhal.com/#/bb3gen).
Also, ensure that `usm.bin` is on the root of the SD card. If it is missing, then download the latest release of [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/releases/latest) (the RELEASE `.zip` file), and copy the `usm.bin` file to the root of your SD card.
Also, ensure that `bb3.bin` is on the root of the SD card. If it is missing, then download the latest release of [Bannerbomb3](https://github.com/lifehackerhansol/Bannerbomb3/releases/download/v3.0-lhs1/bb3.bin) (direct download), and copy the `bb3.bin` file to the root of your SD card.
If neither of these solutions fixes this problem, then custom firmware may have been uninstalled on this device in a way that makes this method impossible to perform. If this is the case, you will need to follow [an alternate branch of Seedminer](homebrew-launcher-(pichaxx)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
@ -144,16 +144,24 @@ If neither of these solutions fixes this problem, then custom firmware may have
### DSiWare Management shows a question mark
There may be an issue with your `F00D43D5.bin` file (it may be corrupted or intended for the wrong 3DS). Re-create your `F00D43D5.bin` file with the [BannerBomb3 tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php), ensuring that you use the `movable.sed` file for your console.
There may be an issue with your `F00D43D5.bin` file (it may be corrupted or intended for the wrong 3DS). Re-create your `F00D43D5.bin` file with the [Bannerbomb3 Injector](http://3dstools.nhnarwhal.com/#/bb3gen), ensuring that you use the `movable.sed` file for your console.
### DSiWare Management menu crashes without purple screen
Ensure that `F00D43D5.bin` is the only file in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`. If it is, then re-create it with the [BannerBomb3 tool](https://3ds.nhnarwhal.com/3dstools/bannerbomb3.php). If this fails, then custom firmware may have been uninstalled on this device in a way that makes this method impossible to perform. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) for assistance.
Ensure that `F00D43D5.bin` is the only file in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`. If it is, then re-create it with the [Bannerbomb3 Injector](http://3dstools.nhnarwhal.com/#/bb3gen). If this fails, then custom firmware may have been uninstalled on this device in a way that makes this method impossible to perform. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) for assistance.
---
## Installing boot9strap (Fredtool)
### DSiWare Management menu crashes without showing BB3 multihax menu (Fredtool)
Ensure that `F00D43D5.bin` is the only file in `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare`. If it is, then re-create it with the [Bannerbomb3 Injector](http://3dstools.nhnarwhal.com/#/bb3gen).
Also, ensure that `bb3.bin` is on the root of the SD card. If it is missing, then download the latest release of [Bannerbomb3](https://github.com/lifehackerhansol/Bannerbomb3/releases/download/v3.0-lhs1/bb3.bin) (direct download), and copy the `bb3.bin` file to the root of your SD card.
If neither of these solutions fixes this problem, then custom firmware may have been uninstalled on this device in a way that makes this method impossible to perform. If this is the case, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
### Error on Fredtool Injector page
Ensure that your `movable.sed` and DSiWare backup come from the same console. A mismatch will result in an error.