This takes advantage of an oversight which allows DSiWare titles to read and write anywhere in NAND.
{: .notice--info}
Be prepared to wait 20 minutes (New 3DS) to an hour (Old 3DS). Slowhax (waithax) is named so for a reason.
{: .notice--info}
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
{: .notice--info}
Your DSiWare's save will be backed up before getting replaced by the hacked save.
{: .notice--info}
#### What you need
* Already own one of the following exploitable DSiWare games installed on your 3DS *(you must have already installed one; they have all been pulled from the eShop)*
* An entrypoint from [Homebrew Launcher (No Browser)](homebrew-launcher-(no-browser)) or (on 11.0.0 EUR / USA) [Homebrew Launcher (Browser)](homebrew-launcher-(browser))
After completing the entire guide, you can use this backup to restore your DSiWare saves by deleting the DSiWare from your System Memory and copying it from your SD Card.
This backup can only be used on this NAND. If you format your 3DS or restore another NAND (specifically if `movable.sed` is ever modified), it will become unusable.
6. Select the DSiWare game you want to install the exploit on
7. Once it's done, press (A) to exit
8. Press (Start) to open the homebrew launcher exit menu
9. Press (A) to exit
##### Section IV - Backing up NFIRM
3. Launch your DSiWare game
4. Launch dgTool using your DSiWare game
+ **Fieldrunners**: Touch the 'Scores' button at the main menu
+ **Legends of Exidia**: After pressing (A) or (Start) at the two title screens, select the first save slot and press continue
+ **Guitar Rock Tour**: Scroll down and go to High-Scores -> Drums -> Easy
+ **The Legend of Zelda: Four Swords**: Just start the game
+ If your game does not have the hacked save file installed, restart from the beginning
5. Select "Dump f0f1" to backup your NFIRM
6. Make note of the NFIRM backup's location
7. Exit dgTool
+ You may have to force power off by holding the power button
8. Put your SD card in your computer, then copy `F0F1_N3DS.bin` or `F0F1_O3DS.bin` (depending on your device) to a safe location; make backups in multiple locations; this backup will save you from a brick if anything goes wrong
##### Section V - Flashing NFIRM
**Never downgrade with dgTool on a device that already has arm9loaderhax installed or you will BRICK!**
{: .notice--danger}
1. Launch your DSiWare game on
4. Launch dgTool using your DSiWare game
+ **Fieldrunners**: Touch the 'Scores' button at the main menu
+ **Legends of Exidia**: After pressing (A) or (Start) at the two title screens, select the first save slot and press continue
+ **Guitar Rock Tour**: Scroll down and go to High-Scores -> Drums -> Easy
+ **The Legend of Zelda: Four Swords**: Just start the game
3. Select "Downgrade FIRM to 10.4" and confirm to flash the 10.4.0 NFIRM bin
4. Exit dgTool
+ You may have to force power off by holding the power button
5. Reboot
##### Section VI - Exploit verification
2. Reinsert your SD card into your 3DS
3. Launch the homebrew launcher on using your entrypoint
4. Launch 3DSident
5. Verify that the following:
+ **Kernel version**: 2.50-11
+ **FIRM version**: 2.50-11
+ If either of these do not display the versions above, make sure you used the correct NFIRM zip and try flashing NFIRM again
Your version number will *not* have changed in the settings.