Hacking [GUIDE][PLEASE FORGIVE] How to Autoboot EmuNAND on FW 9.0.0-11.2.0 (without A9LH)

[Platinum Lucario]

What Firmware are you on? Fasthax only works on 11.2. If you want to wait a day I will have a better tutorial on Github.

My New Nintendo 3DS is on firmware version 11.2.0-35E, which is the latest.

 

[Deleted User]

My New Nintendo 3DS is on firmware version 11.2.0-35E, which is the latest.

Try using the fasthax+safehax I attached. The only reason I left the regular fasthax+safehax in there is because I was in a time crunch yesterday morning. This should be better in all scenarios (i think you still need to have a cartridge in the console for this version)

 

[Platinum Lucario]

Try using the fasthax+safehax I attached. The only reason I left the regular fasthax+safehax in there is because I was in a time crunch yesterday morning. This should be better in all scenarios (i think you still need to have a cartridge in the console for this version)

I just restarted and my second attempt worked without having to replace any files with the ones you provided. I guess it's because I loaded ctr-ftpwn before loading fasthax, which caused the 3DS to crash while using fasthax.

Thanks anyways. ^^

 

[Deleted User]

Just installed rednand to another 3ds. Found out that deleting the homemenu, reboot, and shutdown boot entry on the boot.cfg breaks ctrbootmanager so it's best to place it back (though reboot and shutdown doesn't work). Sorry.

Sent from my SM-G935F using Tapatalk

Alright thanks

--------------------- MERGED ---------------------------

I just restarted and my second attempt worked without having to replace any files with the ones you provided. I guess it's because I loaded ctr-ftpwn before loading fasthax, which caused the 3DS to crash while using fasthax.

Thanks anyways. ^^

No problem. What's the point of making a guide if you aren't there to help with questions? This guide isn't as updated as I would like it to be, so try and check out annson24 comments. I will upload a new ctrbootmanager zip in a few minutes so don't use it yet

 

[Platinum Lucario]

Alright thanks

--------------------- MERGED ---------------------------


No problem. What's the point of making a guide if you aren't there to help with questions? This guide isn't as updated as I would like it to be, so try and check out annson24 comments. I will upload a new ctrbootmanager zip in a few minutes so don't use it yet

I'll do everything I can to help. And also, I meant to say that it was "ftpd v2.2" that I used, not "ctr-httpwn". I kinda got the names mixed up in my head, sorry about that.

 

[Deleted User]

I'll do everything I can to help. And also, I meant to say that it was "ftpd v2.2" that I used, not "ctr-httpwn". I kinda got the names mixed up in my head, sorry about that.

Alright. I will make sure to note that in the edit. Thanks btw

 

[Platinum Lucario]

Another thing too is that I've noticed that Hourglass9 needs 0x03 KeyX & KeyY, 0x05 KeyY, 0x25 KeyX, 0x18 KeyX, 0x1B KeyX and 0x24 KeyY.

 

[annson24]

Another thing too is that I've noticed that Hourglass9 needs 0x03 KeyX & KeyY, 0x05 KeyY, 0x25 KeyX, 0x18 KeyX, 0x1B KeyX and 0x24 KeyY.

aeskeydb.bin can cover all that for you.

Sent from my SM-G935F using Tapatalk

 

[Deleted User]

Oh i saw that someone did a guide about my idea ( https://gbatemp.net/threads/questio...lling-it-from-11-2.455697/page-3#post-6979358 )
GG to you, too many things to write XD

 

[Platinum Lucario]

Another thing I've noticed as well. The arm9loaderhax needs to be installed before using safehax to load Hourglass9. It doesn't even matter if you try to put the arm9loaderhax.bin in ./files9/ or in the root directory, it won't work unless it has been copy and pasted into the correct NAND file system with FBI.

 

[annson24]

Another thing I've noticed as well. The arm9loaderhax needs to be installed before using safehax to load Hourglass9. It doesn't even matter if you try to put the arm9loaderhax.bin in ./files9/ or in the root directory, it won't work unless it has been copy and pasted into the correct NAND file system with FBI.

You're right about the part where hg9 won't work with safehax. However, you can chainload hg9 with luma by placing hg9 on the /luma/payloads folder and designating a button to it. Now right after safehax loads luma3ds, quickly press that button ang hg9 will boot up. Luma doesn't necessarily need to be injected to the NAND for the chainload to work.

Sent from my SM-G935F using Tapatalk

 

[Platinum Lucario]

You're right about the part where hg9 won't work with safehax. However, you can chainload hg9 with luma by placing hg9 on the /luma/payloads folder and designating a button to it. Now right after safehax loads luma3ds, quickly press that button ang hg9 will boot up. Luma doesn't necessarily need to be injected to the NAND for the chainload to work.

Sent from my SM-G935F using Tapatalk

So for designating a button to it, I need to create a new file for it and write the correct words for it, right? Because I haven't used Luma3DS on this New 3DS.

 

[annson24]

So for designating a button to it, I need to create a new file for it and write the correct words for it, right? Because I haven't used Luma3DS on this New 3DS.

Just rename Decrypt9WIP.bin to something like x_Decrypt9WIP.bin inside the /luma/payloads folder. Then after you open safehax (either normally or autoboot), press and hold the X button to chainload Decrypt9

Sent from my SM-G935F using Tapatalk

 

[Platinum Lucario]

Just rename Decrypt9WIP.bin to something like x_Decrypt9WIP.bin inside the /luma/payloads folder. Then after you open safehax (either normally or autoboot), press and hold the X button to chainload Decrypt9

Sent from my SM-G935F using Tapatalk

Okay, now I'm in Luma3DS. I'm pretty sure I have to patch the SVC/service/archive/ARM9 directory. But just a question, is it permanently saved into the NAND? Or is it only stored within 3DS RAM (volatile memory)?

 

[Deleted User]

Okay, now I'm in Luma3DS. I'm pretty sure I have to patch the SVC/service/archive/ARM9 directory. But just a question, is it permanently saved into the NAND? Or is it only stored within 3DS RAM (volatile memory)?

I am not sure I understand your question. Are you asking if booting emuNAND stores the Luma3DS to NAND? The answer to that is no. If you do not keep the arm9loaderhax.bin on the SD card, then you will not load Luma3DS.

 

[Platinum Lucario]

I am not sure I understand your question. Are you asking if booting emuNAND stores the Luma3DS to NAND? The answer to that is no. If you do not keep the arm9loaderhax.bin on the SD card, then you will not load Luma3DS.

What I'm asking is, does enabling the "Patch SVC/service/archive/ARM9 access" option store it into NAND? Or is it only stored in volatile memory (RAM)?

 

[Deleted User]

What I'm asking is, does enabling the "Patch SVC/service/archive/ARM9 access" option store it into NAND? Or is it only stored in volatile memory (RAM)?

iirc that allows for apps to access those. lemme check the wiki really quick.

--------------------- MERGED ---------------------------

Leave it unchecked. afaik, it doesn't do anything beneficial enabling it. it just means that you need to use exploits used for that firmware to get into kernel

 

[Platinum Lucario]

iirc that allows for apps to access those. lemme check the wiki really quick.

--------------------- MERGED ---------------------------

Leave it unchecked. afaik, it doesn't do anything beneficial enabling it. it just means that you need to use exploits used for that firmware to get into kernel

Alrighty. That's good to know that it's not needed.

Also, is Hourglass9 meant to work with 11.2.0-35E? Because when I try to load it, it's able to load the keys, but when it checks arm9loaderhax, it says this: Checking arm9loaderhax... failed.

I've got the payload_stage1.bin and payload_stage1.bin files (along with their .sha files as well) in the files9 directory. I might have them in the wrong place. Lemme try to put them on the root of the SD card, then I'll try the /luma/payloads/ directory.

 

[Deleted User]

Alrighty. That's good to know that it's not needed.

Also, is Hourglass9 meant to work with 11.2.0-35E? Because when I try to load it, it's able to load the keys, but when it checks arm9loaderhax, it says this: Checking arm9loaderhax... failed.

I've got the payload_stage1.bin and payload_stage1.bin files (along with their .sha files as well) in the files9 directory. I might have them in the wrong place. Lemme try to put them on the root of the SD card, then I'll try the /luma/payloads/ directory.

Now that I think about it, it is probably better to use Decrypt9 over Hourglass9 because Hourglass9 requires a9lh I just found out

 

[Platinum Lucario]

I've just tried using Ctrbootmgr 1.9 using your configuration, but as soon as I load it from Soundhax, it says that it's creating a new boot.cfg file and it says to press any button. But when I do, the system crashes. I don't think Ctrbootmgr is even meant to work unless A9LH is installed.