NTRBoot Released!

It's here!
ntrboot_checklist_2.png

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.
The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

  1. Any 3DS model on any firmware can be hacked with minimal effort
  2. You can unbrick any 3DS model from any type of brick.
    - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
    - This does not apply to MCU bricks.
  3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this
This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

:arrow: Release
:arrow: Guide
:arrow: Free NTRBoot Flashing
:arrow: Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.
 
Last edited by Deleted member 381889,

GerbilSoft

Well-Known Member
Member
Joined
Mar 8, 2012
Messages
2,395
Trophies
2
Age
34
XP
4,255
Country
United States
One Time Programable memory.
Specifically, with regards to the 3DS, it contains various system-specific IDs and encryption keys. It's also used by arm9loader on New 3DS as an encryption key, which is why the OTP was needed for A9LH.

https://www.3dbrew.org/wiki/OTP_Registers has a description of the contents of the 3DS's OTP.
 
Last edited by GerbilSoft, , Reason: +IDs
  • Like
Reactions: mvmiranda

DocKlokMan

Plugin Dev
Member
Joined
Apr 20, 2007
Messages
3,009
Trophies
2
Age
36
XP
4,571
Country
United States
Hi there!
First of all, I would like to thank the developers for such a good job, and all those involved.
Now I have a question. I followed the 3ds.guide tutorial using the NTRboothax and an Acekard 2i to mod my O3DSXL. As a result, now I got a 3DS with luma and the starter pack installed and working. The only issue is that when I open Download Play app it ends openning the Homebrew Launcher. And when I open the Homebrew Launcher it gives me an error. Tried deleting DownloadPlay and installing again via update, but it gives the same errors. Did someone get this problem too? And how to solve that? Searching the web and forum, just found an error that opening HBlauncher it opens the DownlosdPlay. It's not the same problem but it may be related. If the post is on the wrong place, then sorry. And sorry for my bad english too.

Enviado de meu Redmi Note 3 usando Tapatalk
Open the Rosalina Menu and go to Miscellaneous Options > Switch the hb. title to hblauncher_loader. Then be sure to Save settings.
 
  • Like
Reactions: Quantumcat

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
Hi there!
First of all, I would like to thank the developers for such a good job, and all those involved.
Now I have a question. I followed the 3ds.guide tutorial using the NTRboothax and an Acekard 2i to mod my O3DSXL. As a result, now I got a 3DS with luma and the starter pack installed and working. The only issue is that when I open Download Play app it ends openning the Homebrew Launcher. And when I open the Homebrew Launcher it gives me an error. Tried deleting DownloadPlay and installing again via update, but it gives the same errors. Did someone get this problem too? And how to solve that? Searching the web and forum, just found an error that opening HBlauncher it opens the DownlosdPlay. It's not the same problem but it may be related. If the post is on the wrong place, then sorry. And sorry for my bad english too.

Enviado de meu Redmi Note 3 usando Tapatalk
Just open another app you rarely use, press L+dpad down+select to open Rosalina, select miscellaneous options, switch the hb. title to the current app, then save settings afterward.
Ninja'd by several minutes lol
 
Last edited by TheCyberQuake,

greatdini

New Member
Newbie
Joined
Mar 14, 2009
Messages
4
Trophies
0
XP
345
Country
Brazil
Open the Rosalina Menu and go to Miscellaneous Options > Switch the hb. title to hblauncher_loader. Then be sure to Save settings.
Just open another app you rarely use, press L+dpad down+select to open Rosalina, select miscellaneous options, switch the hb. title to the current app, then save settings afterward.
Ninja'd by several minutes lol
Thanks for the quick feedback! I will test it later when my son let go of the 3DS.

Enviado de meu Redmi Note 3 usando Tapatalk
 

failzers

Well-Known Member
Member
Joined
Aug 3, 2015
Messages
135
Trophies
0
Age
33
XP
283
Country
United States
Exactly why does the OP say that an MCU brick can't be fixed with this? The mcu brick is literally fixed by removing the battery for ten minutes. A9LH can even overwrite mcu firm, so why does this say that this cannot override mcu firm if this in boot-order loads before the mcu panics and before a9l loaded? Just because the tool for it isn't made yet, doesn't mean it's not possible. There is also only one confirmed MCU brick anyways, and that's yellows8.

Source: http://gbatemp.net/threads/release-3ds-rgb-led-test-program.441633/page-5#post-6689042
 
Last edited by failzers,
  • Like
Reactions: zfreeman

Quantumcat

Dead and alive
Member
Joined
Nov 23, 2014
Messages
15,144
Trophies
0
Location
Canberra, Australia
Website
boot9strap.com
XP
11,119
Country
Australia
Exactly why does the OP say that an MCU brick can't be fixed with this? The mcu brick is literally fixed by removing the battery for ten minutes. A9LH can even overwrite mcu firm, so why does this say that this cannot override mcu firm if this in boot-order loads before the mcu panics and before a9l loaded? Just because the tool for it isn't made yet, doesn't mean it's not possible. There is also only one confirmed MCU brick anyways, and that's yellows8.

Source: http://gbatemp.net/threads/release-3ds-rgb-led-test-program.441633/page-5#post-6689042
The MCU controls how power is delivered to the device. It can't start properly if the MCU is screwed up, bootloader or not.
 

failzers

Well-Known Member
Member
Joined
Aug 3, 2015
Messages
135
Trophies
0
Age
33
XP
283
Country
United States
The MCU controls how power is delivered to the device. It can't start properly if the MCU is screwed up, bootloader or not.
And that is easily remedied by removing the battery. The mcu doesn't have long-term persistent storage. After power is completely removed and disconnected from the battery, the problem is fixed.
 

KunoichiZ

Well-Known Member
Member
Joined
Mar 16, 2012
Messages
8,830
Trophies
0
Age
28
XP
4,597
Country
United States

failzers

Well-Known Member
Member
Joined
Aug 3, 2015
Messages
135
Trophies
0
Age
33
XP
283
Country
United States

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
And that is easily remedied by removing the battery. The mcu doesn't have long-term persistent storage. After power is completely removed and disconnected from the battery, the problem is fixed.
There are other ways to brick other than bad code in storage. A fried chip will brick the system. And AFAIK not all mcu bricks can be fixed by removing the battery.
 
  • Like
Reactions: Quantumcat

Nomelas

Well-Known Member
Member
Joined
May 6, 2015
Messages
369
Trophies
0
Age
39
XP
851
Country
Canada
Pictures of currently supported cards can be found in the README of this link.
It's really not that confusing, if you click on the cards, it brings you to nds-card items that are those.

"officially supported" I get that part, but I'm talking about the "unofficial clones" as they are... there's no link to them.

They are literal clones of cards that are supported.

http://www.nds-card.com/ProShow.asp?ProID=146 vs http://www.nds-card.com/ProShow.asp?ProID=149

looks pretty cloney to me.... I get it though, they are different "brands", which is why it's confusing.
 

Cuphat

Well-Known Member
Member
Joined
May 16, 2011
Messages
1,295
Trophies
1
XP
1,223
Country
United States
  • Like
Reactions: Kioku

Nomelas

Well-Known Member
Member
Joined
May 6, 2015
Messages
369
Trophies
0
Age
39
XP
851
Country
Canada
They both have labels ripping off the original R4, that doesn't mean they are remotely similar in hardware.

thanks, but again that does not make it easy for those who don't know the difference between clones, official cards, etc and what their own falls under. I thought it was a pretty simple request.
 

Raugo

Well-Known Member
Member
Joined
Nov 22, 2014
Messages
630
Trophies
0
XP
2,451
Country
Spain
Thanks a ton, this helps a lot! And, yeah, you can install NTRboot via the flasher, but not recommended. We use the flasher for reverse engineering, and eventually (don't worry, won't take too long) this will make it into a proper installer.

Glad to help, if you need to test something I have two DSTT with the ES29LV400DB flash memory.
 

Nirmonculus

Well-Known Member
Member
Joined
Nov 4, 2014
Messages
735
Trophies
0
XP
560
Country
There may be a slight chance that it could work. But most likely you would be looking at a bricked flashcart.
Yeah, I was afraid of that. I have r4 3d 2012 from r4i3d.com

I'm not entirely sure if it would work because it is not on the list... I don't want to lose its use though. I have a ds lite, dsi, and new 3ds that I can use the cart with.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    BakerMan @ BakerMan: GANFD