01e5abf63f
These pages now use the safemodecheck include, except for kartdlphax, which is added in this commit. This also means we can remove the include arguments.
98 lines
5 KiB
Text
98 lines
5 KiB
Text
---
|
|
title: "Installing boot9strap (USM)"
|
|
---
|
|
|
|
{% include toc title="Table of Contents" %}
|
|
|
|
{% capture technical_info %}
|
|
<summary><em>Technical Details (optional)</em></summary>
|
|
|
|
In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
|
|
|
|
We can do this using an existing exploit, BannerBomb3.
|
|
|
|
To accomplish this, we use your system's encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
|
|
|
|
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
|
|
|
|
For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: [BannerBomb3](https://github.com/zoogie/Bannerbomb3), [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE/).
|
|
|
|
{% endcapture %}
|
|
<details>{{ technical_info | markdownify }}</details>
|
|
{: .notice--info}
|
|
|
|
### Compatibility Notes
|
|
|
|
These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
|
|
|
|
If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [an alternate branch of Seedminer](installing-boot9strap-(fredtool)). For assistance with this matter, join [Nintendo Homebrew on Discord](https://discord.gg/MWxPgEp) and ask, in English, for help.
|
|
{: .notice--warning}
|
|
|
|
### What You Need
|
|
|
|
* The latest release of [SafeB9SInstaller](https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip) (direct download)
|
|
* The latest release of [boot9strap](https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip) (direct download)
|
|
* The latest release of [Luma3DS](https://github.com/LumaTeam/Luma3DS/releases/latest) (the Luma3DS `.zip` file)
|
|
* [usm.bin](https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin) (direct download)
|
|
|
|
|
|
#### Section I - Prep Work
|
|
|
|
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your device's SD card.
|
|
|
|
1. Your SD card should be inserted in your computer
|
|
1. Copy `usm.bin` to the root of your SD card
|
|
1. Copy `boot.firm` and `boot.3dsx` from the Luma3DS `.zip` to the root of your SD card
|
|
+ The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
|
|
1. Create a folder named `boot9strap` on the root of your SD card
|
|
1. Copy `boot9strap.firm` and `boot9strap.firm.sha` from the boot9strap `.zip` to the `/boot9strap/` folder on your SD card
|
|
1. Copy `SafeB9SInstaller.bin` from the SafeB9SInstaller `.zip` to the root of your SD card
|
|
|
|
![]({{ "/images/screenshots/usm/usm-root-layout.png" | absolute_url }})
|
|
{: .notice--info}
|
|
|
|
![]({{ "/images/screenshots/boot9strap-folder.png" | absolute_url }})
|
|
{: .notice--info}
|
|
|
|
#### Section II - BannerBomb3
|
|
|
|
In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
|
|
|
|
1. Reinsert your SD card into your device
|
|
1. Power on your device
|
|
1. Launch System Settings on your device
|
|
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
|
+ Your device should show the BB3 multihax menu
|
|
+ If this step causes your device to crash, [follow this troubleshooting guide](troubleshooting#bannerbomb3)
|
|
+ If the BB3 multihax menu says "cfw installed already", you already have custom firmware and should continue from [here](checking-for-cfw)
|
|
1. Use the D-Pad to navigate and press the (A) button to select "Install unSAFE_MODE"
|
|
+ Your device will automatically power off
|
|
|
|
#### Section III - unSAFE_MODE
|
|
|
|
{% include_relative include/exploit-usm.txt %}
|
|
|
|
#### Section IV - Installing boot9strap
|
|
|
|
{% include_relative include/install-boot9strap-safeb9sinstaller.txt %}
|
|
{%- include_relative include/configure-luma3ds.txt %}
|
|
|
|
{% include_relative include/luma3ds-installed-note.txt %}
|
|
|
|
#### Section V - Restoring WiFi Configuration Profiles
|
|
|
|
In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
|
|
|
|
1. Launch System Settings on your device
|
|
1. Navigate to `Data Management` -> `DSiWare`-> `SD Card` ([image](/images/screenshots/bb3/dsiware-management.png))
|
|
1. Use the D-Pad to navigate and press the (A) button to select "Uninstall unSAFE_MODE"
|
|
+ Your device will automatically reboot
|
|
1. Power off your device
|
|
1. Insert your SD card into your computer
|
|
1. Navigate to `Nintendo 3DS` -> `<ID0>` -> `<ID1>` -> `Nintendo DSiWare` on your SD card
|
|
1. Delete `F00D43D5.bin` from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
|
|
|
|
___
|
|
|
|
### Continue to [Finalizing Setup](finalizing-setup)
|
|
{: .notice--primary}
|