---
title: "Installing boot9strap (Fredtool)"
---

{% include toc title="Inhalt" %}

<details>
<summary><em>Technische Details (optional)</em></summary>
<p>This method of using Seedminer for further exploitation uses your <code>movable.sed</code> file to decrypt any DSiWare title for the purposes of injecting an exploitable DSiWare title into the DS Internet Settings application.</p>
<p>This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed <a href="https://www.3dbrew.org/wiki/3DS_System_Flaws">here</a>.</p>
</details>
{: .notice--info}

### Was du brauchst

* Deine `movable.sed` Datei vom [Seedminer](seedminer)
* The latest release of [Frogminer_save](https://github.com/zoogie/Frogminer/releases/latest) (`Frogminer_save.zip`)
* The latest release of [b9sTool](https://github.com/zoogie/b9sTool/releases/latest) (`boot.nds`)
* Die neueste Version von [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (die Luma3DS `.zip` Datei)

#### Abschnitt I - CFW Check

As an additional safety measure, we will perform an additional check for custom firmware. This is because using this method when custom firmware is already installed has a risk of bricking the console (rendering it unusable without recovery methods like [ntrboot](ntrboot)).

1. Schalte deinen 3DS aus
1. Hold the (Select) button
1. Power on your device while still holding the (Select) button
1. If the check was successful, you will boot to the HOME Menu and you may proceed with this guide
1. Schalte deinen 3DS aus

If you see a configuration menu or the console immediately powers off, you already have CFW, and continuing with these instructions may BRICK your device! Folge [Überprüfen nach CFW](checking-for-cfw), um deine bestehende CFW zu aktualisieren.
{: .notice--danger}
    
#### Section II - BannerBomb3

In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu and copy the resulting file dump to your computer so that you can use it on the next section.

1. Stecke deine SD-Karte nun wieder in deinen 3DS
1. Schalte deine Konsole an
1. Launch System Settings on your device
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
  + Your device should show the BB3 multihax menu
  + If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#dsiware-management-menu-crashes-without-showing-bb3-multihax-menu)
1. Use the D-Pad to navigate and press the (A) button to select "Dump DSiWare"
  + Your device will automatically reboot
1. Schalte deinen 3DS aus
  
#### Section III - Prep Work

In this section, you will copy the files necessary to temporarily replace DS Connection Settings with Flipnote Studio, which is used to launch the boot9strap (custom firmware) installer.

1. Stecke deine SD-Karte in deinen Computer
1. Öffne die [DSIHaxInjector_new](https://jenkins.nelthorya.net/job/DSIHaxInjector_new/build?delay=0sec) Webseite auf deinem Computer
1. Bei dem "Username" Feld, gib irgendeinen normalen Namen (keine Leerzeichen oder Sonderzeichen) an
1. Under the "DSiBin" field, upload your `42383841.bin` file from the root of your SD card using the first "Browse..." option
1. Wähle beim "MovableSed" Feld deine `movable.sed` Datei mit der "Browse..." Option aus
1. Under the "InjectionTarget" field, set the injection target to `DSinternet` (NOT memorypit)
1. Drücke auf "Build"
  + Warte ein paar Sekunden, bis der Erstellungsprozess abgeschlossen ist
1. Gib im Abschnitt Build-Verlauf links den Benutzernamen in das "suchen" Feld ein
1. Klicke das erste Suchergebnis
  + Dieses Ergebnis sollte das neuste sein
1. Drücke auf den "output_(name).zip" Link
1. Navigiere zu `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` auf deiner SD-Karte
  + Diese `<ID0>` ist die, die du beim [Seedminer](seedminer) verwendet hast
  + Die `<ID1>` ist ein 32 Zeichen langer Ordner in der `<ID0>` 
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder
1. Copy the `42383841.bin`  file from the `hax` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder
  ![]({{ "/images/screenshots/bb3/dsiware-location-4.png" | absolute_url }}){: .notice--info} 
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
  + The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
1. Copy `boot.nds` (B9STool) to the root of your SD card
1. Copy the `private` folder from the Frogminer_save `.zip` to the root of your SD card
1. Stecke deine SD-Karte nun wieder in deinen 3DS
1. Schalte deine Konsole an

    ![]({{ "/images/screenshots/fredtool/fredtool-root-layout.png" | absolute_url }})
    {: .notice--info}

#### Section IV - Overwriting DS Connection Settings

In this section, you will copy the hacked DS Connection Settings DSiWare to internal memory, which will temporarily replace it with Flipnote Studio.

1. Launch System Settings on your device
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
1. Select the "Haxxxxxxxxx!" title
1. Select "Copy", then select "OK"
1. Return to main menu of the System Settings
1. Navigate to `Internet Settings` -> `Nintendo DS Connections`, then select "OK" ([image](/images/screenshots/fredtool/dsconnection.png))
1. If the exploit was successful, your device will have loaded the JPN version of Flipnote Studio

#### Abschnitt V - Flipnote Exploit

If you would prefer a visual guide to this section, one is available [here](https://zoogie.github.io/web/flipnote_directions/).
{: .notice--info}

In this section, you will perform a series of very specific steps within Flipnote Studio that, when performed correctly, will launch the boot9strap (custom firmware) installer.

1. Complete the initial setup process for the launched game until you reach the main menu
  + Select the left option whenever prompted during the setup process
1. Using the touch-screen, select the large left box, then select the box with an SD card icon
1. Once the menu loads, select the face icon, then the bottom right icon to continue
1. Press (X) or (UP) on the D-Pad depending on which is shown on the top screen
1. Select the second button along the top with a film-reel icon
1. Scroll right until reel "3/3" is selected
1. Tap the third box with the letter "A" in it
1. Scroll left until reel "1/3" is selected
1. Tap the fourth box with the letter "A" in it
1. If the exploit was successful, your device will have loaded b9sTool
1. Using the D-Pad, move to "Install boot9strap"
  + If you miss this step, the system will exit to HOME Menu instead of installing boot9strap and you will need to open System Settings, then start over from Step 6 of Section IV
1. Press (A), then press START and SELECT at the same time to begin the process
1. Once completed and the bottom screen says "done.", exit b9sTool, then power off your device
  + Unter Umständen musst du das Ausschalten der Konsole erzwingen indem du den Power-Knopf gedrückt hälst
  + If your device shuts down when you try to power it on, ensure that you have copied `boot.firm` from the Luma3DS `.zip` to the root of your SD card
  + If you see the Luma Configuration screen, press (Start) to reboot, then continue with the guide

#### Section VI - Luma3DS Verification

Due to the nature of the exploit used, it is occasionally (but rarely) possible for boot9strap to not actually get installed. This section will therefore verify that boot9strap was successfully installed by seeing if some files that are normally automatically generated by Luma3DS were created.

1. Schalte deinen 3DS aus
1. Stecke deine SD-Karte in deinen Computer
1. Verify that a `luma` folder exists and that `config.ini` is inside of it
  + The existence of these folders and files confirms that Luma3DS is installed
  + If you do not see the `luma` folder or `config.ini`, [follow this troubleshooting guide](https://github.com/zoogie/b9sTool/blob/master/TROUBLESHOOTING.md)

At this point, your console will boot to Luma3DS by default.
  + Luma3DS does not look any different from the normal HOME Menu. If your console has booted into the HOME Menu, it is running custom firmware.
  + On the next page, you will install useful homebrew applications to complete your setup.

#### Section VII - Restoring DS Connection Settings

In this section, you will restore DS Connection Settings to the way it was before it was temporarily replaced with Flipnote Studio in Section IV.

1. Navigiere zu `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` auf deiner SD-Karte
1. Copy the `42383841.bin`  file from the `clean` folder of the downloaded DSiWare archive (output_(name).zip) to the `Nintendo DSiWare` folder, replacing the existing one
1. Stecke deine SD-Karte nun wieder in deinen 3DS
1. Schalte deine Konsole an
1. Launch System Settings on your device
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
1. Select the "Nintendo DSi™" title
1. Select "Copy", then select "OK"

___

### Fortfahren mit [Setup fertigstellen](finalizing-setup)
{: .notice--primary}