Tutorial  Updated

How to make a fast CFW-Installer ntrboot card

This guide is for advanced users only.
(Ya know, people that know their way around command prompt or terminal window.)
It's also a bit long and wordy. Not good for those with little patience. :unsure:

All that the target stock 3DS needs is an SD card of decent size (at least 1.3ish GiB if you want to do a NAND backup) and an internet connection.

Interested? Continue on if you're feeling confident.

Disclaimer:
If you decide to try this, know that you are responsible for yourself and your actions.
I will not be held responsible for any action you take. This includes the potential for bricking of 3DS consoles and/or flashcarts.


Prerequisites:
  • python (3.X)
  • git (doesn't really matter what version, but you should have this obviously)
  • devkitpro with devkitarm installed (latest version)
  • firmtool installed (latest version, installed using the above python)
  • A text editor you are comfortable with.
  • Some sort of internet web host for serving a file. (This needs to be direct linkable, something like mega.nz won't work.)
  • A 3DS already outfitted with boot9strap and ntrboot_flasher.
  • A flashcart capable of ntrboot (with at least 1MiB flashable, the amount of flashable varies. Ex: TTDS is too small, Ak2i and R4i Gold 3DS RTS work fine.)
  • That perfect aeskeydb mentioned in the GodMode9 readme.
All set? Ok good. I won't be providing help for setting these up, either. That stuff is basic, if you can't sort it out on your own, this thread probably isn't for you.

Part 1: Getting some things
The first thing you want to do is download the following things.
The second thing you want to do is use git to clone the following repos to wherever you feel like on your machine.
(command reminder: git clone --recursive <url>)
Part 2: The self-extracting homebrew zip file
This part revolves around crafting the zip file (and the zip3dsfx) that will be downloaded from your webserver. If you don't have somewhere to host it, you should go set that up. Ideally you want something you can control and update if necessary.

First, decide what homebrew you think you want to include in this zip file. You are essentially making your own homebrew starter pack here. In fact, you can also just use the actual homebrew starter pack if you would like. All you need, at minimum, is a copy of the homebrew launcher, named boot.3dsx, in the root of the zip archive, since this will be extracted to the root of the SD card.

In addition, you will also be able to include anything else you want on the SD card in this zip file, provided you try to keep the zip file under about 10MiB. I recommend including your boot9strap payloads, such as GodMode9 and Ntrboot_Flasher in the typical luma chainloader path as well, but this is all up to you.

Once you've decided on the files, zip them up with your favorite archiver, generally Deflate at Ultra compression is a good way to compress it. Once you have it, name it archive.zip and copy it into data folder inside the zip3dsfx folder you cloned in Part 1.

Next, pull up a terminal or command prompt and do "make sfx_hard" in the zip3dsfx folder, to build the software, and it should be dumped into the /build/ folder as Homebrew.3dsx. You're gonna want to rename this to boot.3dsx and 7z it, and upload it to your webserver.

Part 3: Collecting Items for the embedded VRAM
So, the next step leads right out of the one from Part 2, you should now have a url for the 7z file (containing the zip3dsfx you compiled, named boot.3dsx) you uploaded to your webserver. Now you need to copy it and open the config.json you downloaded earlier. You're going to need to paste it in the URL field over the placeholder I stuck there. Simple enough. Save the file and we'll get on with things.

The next step is to gather the necessary files for the embedded vram you need to put together to go with the godmode9 script, and place them inside the data folder of your cloned copy of the GodMode9 source code- which will be packed into a vram.tar file when you build the software later.
  • aeskeydb.bin (you can also get that from somewhere on this page)
  • autorun.gm9 (from the downloads above)
  • boot.firm (from the Luma3DS stable download)
  • boot.3dsx (from MultiUpdater 3.2.1)
  • boot9strap.firm (from the latest regular boot9strap download)
  • config.json (from a moment ago)
  • secret_sector.bin (you can get that from somewhere on this page)
Lastly, you can either provide 6 Luma3DS configuration files for each of the 6 console regions by making them yourself, or use the example ones I've provided above. The example configurations come with the Enable game patching, Show NAND or user string in System Settings, and Show GBA boot screen in patched AGB_FIRM settings all turned on, with the hb. title set to be each region's specific Download Play app.

So, with that last file, that makes a total of 13 files.

Part 4: Building a customized GodMode9
This part is the most integral thing, building the firm you will be flashing to your flashcart.
GodMode9 offers several options for ways to customize your build of the software. Today we will be taking advantage of these to create a build of GodMode9 that runs the included autorun.gm9 script and contains needed files for said script embedded within.

Before moving on, It's worth noting that you can pretty easily customize the autorun.gm9 script as long as you're careful and have at least a bit of experience with shell or bash scripting- as gm9 script is quite similar. I've also commented my script quite a bit, which should help.

An example customization would be to skip performing a NAND backup and sha256 filedump to speed up the install, like seen in the video above. You may disable it by adding a comment symbol (#) at the start of the line with the instruction that copies the backup, or by removing the section from the script outright.

Once you're done tweaking the script to your liking (or not touching it at all, which is fine too) with all 13 files in this data folder, you may return up a directory to the GodMode9 folder and open your terminal or command prompt here- and/or open one and navigate it to this path.

In order to build this firm, you will of course, need firmtool, which is installed with python. These were listed in the prerequisites section. You may also need to update firmtool if you already had it, as it is updated somewhat regularly.

You will want to run the following command to build GodMode9 with some specific flags.

"make NTRBOOT=1 SCRIPT_RUNNER=1 AUTO_UNLOCK=1 FIXED_BRIGHTNESS=255"

Once it's done building, you should be able to open the /output/ folder and find a handful of files.

Part 5: Flashing the Firm
The two important files here are
  • GodMode9_ntr.firm
  • GodMode9_ntr.firm.sha
GodMode9_ntr.firm specifically should be about 800KiB to 1MiB in size roughly, which about what you want.

These two files you must rename as "boot9strap_ntr.firm" and "boot9strap_ntr.firm.sha" and place upon the SD card of your 3DS in the ntrboot folder. This will allow you to flash them to suitable flashcarts using ntrboot_flasher.

From here, it's a simple matter of launching ntrboot_flasher, making sure your flashcart is backed up, and flashing ntrboot to the flashcart. It's worth noting that this payload will not work in the event that the flashcart is unable to actually fit the payload on it.

Some supported flashcarts for this have absurdly limited storage space, such as the TTDS line- which typically has only about 64KiB of flashable storage. Unfortunately, if you flashcart is unsupported due to not having enough space for the firm, there's not much you can do.

I can confirm personally that this works fine with the Acekard2i and R4i Gold 3DS RTS, the latter of which was shown in the demo I did at the start of the thread.

Part 6: The fruits of your labors
If you did everything right, this flashcart will hack any 3DS you want in only a few minutes. Here's how you use it.
  1. Insert the flashcart in the 3ds you want to hack.
  2. Place the magnet on the sleep switch spot or switch sleep mode on.
  3. Hold X+Start+Select+Power until the console boots into the script.
  4. Press A when prompted to unlock writing to SysNAND, and again when it double confirms that's what you want to do.
  5. Wait for the console to reboot.
  6. You should be rebooted into the 3DS's Home Menu. Verify the console is online. (If it is not, go connect it to the internet)
  7. Open the application you configured Rosalina to open Homebrew Launcher as.
  8. Press A to download the file and extract you uploaded to the internet.
  9. Press Start to exit the downloader and run the zip3dsfx you made, extracting the files to the SD card.
  10. Once it's finished extracting, press any button to exit the zip3dsfx to exit into what is now the Homebrew Launcher, fully stocked with whatever homebrew you included.
The entire process can take about a 2 minutes if you removed the nand backup section, maybe an extra 8 to 15 minutes longer if not.

Afterword and FAQ:
This thread/guide is provided as is with no guarantee for support and no guarantee that this will even work. (though it probably does for the most part.) Here's some cool people I'd like to thank: @AnalogMan @ihaveamac @Wolfvak @d0k3

I will not be uploading any pre-built/compiled files and I actively discourage anyone participating in this thread from doing so. This is intended to be built and used personally, not publically distributed. If you just want to hack your 3DS, use http://3ds.guide.

Thanks for reading, and if this helped you or was of use to you, cool. I put in a lot of time writing this thread. :yay3ds:
 
Last edited by CheatFreak47,

TheFIrstAv3nger

Well-Known Member
Member
Joined
Apr 2, 2017
Messages
122
Trophies
0
Age
31
Location
Michigan
XP
225
Country
United States
Thanks for this guide! Just did this with a few changes to speedrun. Using EixMode9 instead to get rid of the write protection and using Zip3DSfx as boot.3dsx, then that extracts HBL and FBI to the right paths.

Gonna redo this with multiupdater and such for hacking friends consoles and I'll edit this and let you know how it goes!
 
  • Like
Reactions: Deleted User

CheatFreak47

Catgirl Expert
OP
Member
Joined
Oct 11, 2011
Messages
1,570
Trophies
2
Age
28
Location
Michigan, USA
XP
2,760
Country
United States
Thanks for this guide! Just did this with a few changes to speedrun. Using EixMode9 instead to get rid of the write protection and using Zip3DSfx as boot.3dsx, then that extracts HBL and FBI to the right paths.

Gonna redo this with multiupdater and such for hacking friends consoles and I'll edit this and let you know how it goes!
The main issue with embedding a Zip3DSfx instead of downloading it is that many flashcarts have extremely limited space for a firm, and the vram itself is unable to be above 3MiB anyway for various reasons.
 
  • Like
Reactions: Deleted User

TheFIrstAv3nger

Well-Known Member
Member
Joined
Apr 2, 2017
Messages
122
Trophies
0
Age
31
Location
Michigan
XP
225
Country
United States
The main issue with embedding a Zip3DSfx instead of downloading it is that many flashcarts have extremely limited space for a firm, and the vram itself is unable to be above 3MiB anyway for various reasons.

True. Mine just has FBI and HBL. So my .firm that I flash to my R4i is 1.34mb, which is almost pushing it.
 

thisisallowed

中国御宅族
Member
Joined
Oct 8, 2015
Messages
621
Trophies
0
Age
114
Location
Jinan, Shandong
XP
371
Country
China
For some reason my 3DSs does not want to boot from the ntrboot card, but GM9 boots the firmware perferctly. Size of firm is just above 1mb, r4i gold. Built new firm, gonna test it.

--------------------- MERGED ---------------------------

Same thing, gonna restore and inject again.
 

TheFIrstAv3nger

Well-Known Member
Member
Joined
Apr 2, 2017
Messages
122
Trophies
0
Age
31
Location
Michigan
XP
225
Country
United States
For some reason my 3DSs does not want to boot from the ntrboot card, but GM9 boots the firmware perferctly. Size of firm is just above 1mb, r4i gold. Built new firm, gonna test it.

--------------------- MERGED ---------------------------

Same thing, gonna restore and inject again.

How much above 1mb? What firm is gm9 booting perfectly?
 

urherenow

Well-Known Member
Member
Joined
Mar 8, 2009
Messages
4,714
Trophies
2
Age
48
Location
Japan
XP
3,588
Country
United States
Nice guide!

But why even mention including ntrboot_flasher in the .zip? If you're hacking a 3ds for someone, they most likely will not have what is needed to use it themselves, or understand how to use it in the first place :unsure:. And obviously, you already have your cart flashed with it...
 

TheFIrstAv3nger

Well-Known Member
Member
Joined
Apr 2, 2017
Messages
122
Trophies
0
Age
31
Location
Michigan
XP
225
Country
United States
Nice guide!

But why even mention including ntrboot_flasher in the .zip? If you're hacking a 3ds for someone, they most likely will not have what is needed to use it themselves, or understand how to use it in the first place :unsure:. And obviously, you already have your cart flashed with it...

Pretty sure he was just using that as an example. But regardless just because you're doing it for someone else doesn't mean they can't or won't ever use it.
 

urherenow

Well-Known Member
Member
Joined
Mar 8, 2009
Messages
4,714
Trophies
2
Age
48
Location
Japan
XP
3,588
Country
United States
just because you're doing it for someone else doesn't mean they can't or won't ever use it.
It means they can't (because they don't own a compatible flash cart) or they shouldn't even try (if they had a flash cart, but needed you to do everything for them, do you really think they should be trying this with someone else's system?). If they went out of their way to get a good flash cart and wanted to do this for other people they can easily find all of the files and understand the tutorials, if it's something they should be trying in the first place. Until that time, it's a waste of space.
 
Last edited by urherenow,

TheFIrstAv3nger

Well-Known Member
Member
Joined
Apr 2, 2017
Messages
122
Trophies
0
Age
31
Location
Michigan
XP
225
Country
United States
It means they can't (because they don't own a compatible flash cart) or they shouldn't even try (if they had a flash cart, but needed you to do everything for them, do you really think they should be trying this with someone else's system?). If they went out of their way to get a good flash cart and wanted to do this for other people they can easily find all of the files and understand the tutorials, if it's something they should be trying in the first place. Until that time, it's a waste of space.

Well then don't add it to your zip :)
Simple as that, as you don't know anyone elses but your own situation. And you know what they say about assuming things.
That whopping 205kb firm file isn't barely taking any space. And this isn't just for other peoples consoles, could just be for your personal use. I can see what you're saying to an extent but we all started somewhere, and including a thing like this isnt gonna enable them to go mess up anyone else's console.
 

TheFIrstAv3nger

Well-Known Member
Member
Joined
Apr 2, 2017
Messages
122
Trophies
0
Age
31
Location
Michigan
XP
225
Country
United States
last I'll comment (because I do think it's a good guide), but again, if it's for your own personal use you don't need the darn thing because you've already flashed your card!

What if you wanna flash a new firm or update? What if you get a new cart? What if you brick your cart or 3ds? Better to be safe than sorry.
 

urherenow

Well-Known Member
Member
Joined
Mar 8, 2009
Messages
4,714
Trophies
2
Age
48
Location
Japan
XP
3,588
Country
United States
What if you wanna flash a new firm or update? What if you get a new cart? What if you brick your cart or 3ds? Better to be safe than sorry.
You already have it on your PC, your 3/2DS, and still have no reason to include it in a package that's intended to get installed into a non-hacked system. *snip*

P.S. If you need to update b9s, it STILL has nothing to do with the ntrboot_flasher. B9S goes in the boot9strap folder. And this method doesn't even allow updating without rebuilding stuff anyway. If you get a new cart? And you want to flash it with ntrboot as well? Guess what? IT'S ALREADY ON YOUR 3DS. STILL no need to include it in this package.
 
Last edited by MelodieOctavia, , Reason: Tone down the venom. Keep it civil.

Cuphat

Well-Known Member
Member
Joined
May 16, 2011
Messages
1,295
Trophies
1
XP
1,223
Country
United States
Thanks for putting this together and sharing your scripts/config. I have flashed this setup to my Acekard now.

Weirdly though, I don't think the GodMode9 on the flashcart is able to actually copy files to my main 3DS's SD card. The script fails the first time it tries to use the SD card. It works perfectly on one of my other 3DSes, so it seems like a weird quirk/bug in GodMode9.

Edit: My issue was just a recent bug with GodMode9: https://github.com/d0k3/GodMode9/issues/262
 
Last edited by Cuphat,
  • Like
Reactions: CheatFreak47

CheatFreak47

Catgirl Expert
OP
Member
Joined
Oct 11, 2011
Messages
1,570
Trophies
2
Age
28
Location
Michigan, USA
XP
2,760
Country
United States
did a few small updates to the thread, including a new script that uses new flow control stuff in godmode9, updated instructions for the most recent godmode9 sources, and also makes the script region proof.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • Sicklyboy @ Sicklyboy:
    maaaaan that's so awesome but I also don't want to fork over a hundo for it
  • Veho @ Veho:
    The fuuuuu---
  • Veho @ Veho:
    I thought it was an actual xBox at that price.
  • Sicklyboy @ Sicklyboy:
    I wanna grab a 360 Slim and a 360 E one of these days. Missed the boat of getting them at their lowest though, once they were discontinued. Could've got them for cheap back when I was a broke 20 something working at Target, but then again, I was a broke 20 something working at Target
  • Veho @ Veho:
    Being broke is no fun.
  • K3Nv2 @ K3Nv2:
    @Sicklyboy, $150 isn't that bad for a jtag slim on ebay
  • Veho @ Veho:
    I only wish it was actually playable.
  • Veho @ Veho:
    There's a guy on the Tube of You that makes playable mechanical arcade games out of Lego. This could work on the same principle.
  • Veho @ Veho:
    Just a couple of guys taking their manatee out for some fresh air, why you have to molest them?
  • Veho @ Veho:
    Stupid Chinese shop switched their shipping company and this one is slooooooow.
  • LeoTCK @ LeoTCK:
    STOP BUYING CHINESE CRAP THEN
  • LeoTCK @ LeoTCK:
    SUPPORT LOCAL PRODUCTS, MAKE REVOLUTION
  • LeoTCK @ LeoTCK:
    THEY KEEP REMOVING LOCAL SHIt AND REPLACING WItH INFERIOR CHINESE CRAP
  • LeoTCK @ LeoTCK:
    THATS WHY MY PARTNER CANT GET A GOOTWEAR HIS SIZE ANYMORE
  • LeoTCK @ LeoTCK:
    HE HAS BIG FOOT AND BIG DUCK
  • LeoTCK @ LeoTCK:
    d*ck i mean*
  • LeoTCK @ LeoTCK:
    lol
  • Veho @ Veho:
    Mkay.
  • Veho @ Veho:
    I just ordered another package from China just to spite you.
  • SylverReZ @ SylverReZ:
    Leo could not withstand communism.
  • SylverReZ @ SylverReZ:
    Its OUR products to begin with lol.
    SylverReZ @ SylverReZ: Its OUR products to begin with lol.