---
title: "BannerBomb3"
---

{% include toc title="目录内容" %}

<details>
<summary><em>Technical Details (optional)</em></summary>
<p>To launch custom code, we exploit a flaw in the DSiWare Data Management window of the Settings application.</p>
<p>To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system.</p>
<p>For a more technical explanation, see <a href="https://github.com/zoogie/Bannerbomb3">here</a>.</p>
</details>
{: .notice--info}

### Compatibility Notes

这些操作可在美、欧、日、韩版的主机上工作，你可通过系统版本号末尾的 U，E，J，K 字符来区分主机版本。

如果你的主机是港台版的（系统版本号末尾以 T 结尾），请使用[这个方法](bannerbomb3-fredtool-(twn))；不要使用本页的方法。
{: .notice--warning}

### 你需要准备点啥？

* 你在 [Seedminer](seedminer) 步骤中获得的 `movable.sed` 文件

#### 第一步 – 准备工作

In this section, you will copy the files needed to trigger the BannerBomb3 exploit onto your device's SD card.

1. 将主机关机
1. 将你的 SD 卡插入到电脑
1. Open [Bannerbomb3 Injector](http://3dstools.nhnarwhal.com/#/bb3gen) on your computer
1. Upload your movable.sed using the “Choose File” option
1. Click “Build and Download”
  + This will download an exploit DSiWare called `F00D43D5.bin` and a payload called `bb3.bin` inside of a zip archive (`DSIWARE_EXPLOIT.zip`)
1. Copy `bb3.bin` from `DSIWARE_EXPLOIT.zip` to the root of your SD card
  + 根目录指的是你点进 SD 卡看到的目录，你可以在这个目录下看到 Nintendo 3DS 文件夹，但请不要点进去
  ![]({{ "/images/screenshots/bb3/bb3-root-layout.png" | absolute_url }}){: .notice--info}
1. 打开内存卡的 `Nintendo 3DS` -> `<ID0>` -> `<ID1>` 文件夹
  + `<ID0>` is the 32-letter folder name that you copied in [Seedminer](seedminer)
  + `<ID1>` is a 32-letter folder inside of the `<ID0>`
  ![]({{ "/images/screenshots/bb3/dsiware-location-1.png" | absolute_url }}){: .notice--info}
1. 在 `<ID1>` 文件夹内创建一个名为 `Nintendo DSiWare` 的文件夹
  + 如果这个位置已经存在了这个文件夹，**且**有一些名为 `<8位ID>.bin` 文件（DSiWare 备份文件）在里面，请将它们备份到电脑上，然后从 SD 卡中移除这些文件
1. Copy the `F00D43D5.bin` file from `DSIWARE_EXPLOIT.zip` to the `Nintendo DSiWare` folder

![]({{ "/images/screenshots/bb3/dsiware-location-2.png" | absolute_url }})
{: .notice--info} 

#### Section II - Hardware Button Check

In this section, you will test the SAFE_MODE function of your device. This will determine which method you will follow in the next page.

1. 将你的主机置于关机状态，按住 L + R + ↑ + A 四个按键，然后按下电源键
  + Keep holding the buttons until the device boots into Safe Mode (a "system update" menu)
1. If prompted to update, press Cancel
  + Your device will power off
  + If the device boots to the HOME Menu, just power off your device

___

### Next steps: Choose an exploit

If your device booted into Safe Mode and prompted to you to do a system update in Section II, Safe Mode is working on your device.

If your device booted into Safe Mode, continue to [Installing boot9strap (USM)](installing-boot9strap-(usm))
{: .notice--primary}

If your device did NOT boot into Safe Mode, continue to [Installing boot9strap (Fredtool)](installing-boot9strap-(fredtool))
{: .notice--warning}