Homebrew [Coming Soon] OTPless A9LH installation on N3DS (no 2.1 downgrade)

[vb_encryption_vb]

And I have the first bricked console being shipped to me using this method.... It was bound to happen and it has.

N3DS running 9.2, bricked using the unsafeal9h installer... Good thing they had a backup.

 

[rikipy]

whoa whoa dude this tool its so fucking fast and working O_O

 

[yuu.hack]

Run luma with HBL, there's a .3dsx i think, and yeah, I had the same issue

Also a tip- immediately after you click the luma program in HBL, press select and edit the luma settings to indicate which nand you're on (select boot into sysnand, and enable the option to show a string in the system settings, this will let you be sure you're in luma), forgot the exact option, but it should be pretty straight forward. and make SURE you have EVERYTHING you need before installing a9lh, specifically arm9loaderhax.bin on the root

You also need to set an option in Luma to boot into Sysnand, and not emunand

You've been following this: https://github.com/Plailect/Guide/wiki/Part-3-(A9LH) correct?

Yes i'had been following that url. Thanks for the tips! I will try following ur step to see if it works.

 

[Roboman]

And I have the first bricked console being shipped to me using this method.... It was bound to happen and it has.

N3DS running 9.2, bricked using the unsafeal9h installer... Good thing they had a backup.

Yikes. Any specific details about what happened?

 

[OrGoN3]

And I have the first bricked console being shipped to me using this method.... It was bound to happen and it has.

N3DS running 9.2, bricked using the unsafeal9h installer... Good thing they had a backup.

Dumb. If they had waited 3 days they would've been able to use SafeA9LHInstaller with this feature.

 

[vb_encryption_vb]

It won't be any safer.

 

[yuu.hack]

Run luma with HBL, there's a .3dsx i think, and yeah, I had the same issue

Also a tip- immediately after you click the luma program in HBL, press select and edit the luma settings to indicate which nand you're on (select boot into sysnand, and enable the option to show a string in the system settings, this will let you be sure you're in luma), forgot the exact option, but it should be pretty straight forward. and make SURE you have EVERYTHING you need before installing a9lh, specifically arm9loaderhax.bin on the root

You also need to set an option in Luma to boot into Sysnand, and not emunand

You've been following this: https://github.com/Plailect/Guide/wiki/Part-3-(A9LH) correct?

Ok got same problem. I had followed ur instruction to run luma3ds through hbl. At luma3ds option screen, still no respond after i pressed button to choose an option. Up/down button also not responding. Seems like the screen just hang. Did i miss anything that should have been done before running luma?

 

[Quantumcat]

It won't be any safer.

Would you advise the 2.1 CTR transfer method over the new SafeArm9Installer then?

 

[vb_encryption_vb]

Yes. Unless you have hardmod.

 

[fodder]

Ok got same problem. I had followed ur instruction to run luma3ds through hbl. At luma3ds option screen, still no respond after i pressed button to choose an option. Up/down button also not responding. Seems like the screen just hang. Did i miss anything that should have been done before running luma?

Wait what? In the Luma options screen it hangs? Try redownloading Luma if that's the case, all you really have to enable is the load to sysnand setting, and once in the Sysnand with Luma loaded, you open HBL thru whatever method you please, and run the A9LH installer

 

[yuu.hack]

Wait what? In the Luma options screen it hangs? Try redownloading Luma if that's the case, all you really have to enable is the load to sysnand setting, and once in the Sysnand with Luma loaded, you open HBL thru whatever method you please, and run the A9LH installer

I dunno what to called it,either screen hang or the command sent (by pressing button) not responded. Same situation happened when i tried to install a9lh. Do you have emunand before running luma? I have only hbl in my system. It can running any built-in .3dsx normally (including 3dsident,decrypt9) just fine before. I tried launch hbl from both menuxhax & browserhax but still no good. Any suggestion?

 

[ManuelKoegler]

In a sense, yes, but only until you download another arm9loaderhax.bin. a9lh boots milliseconds into your system and runs the aforementioned bin file. If that bin file is not present, then you are out of luck for booting. However, you can get said file in many many places online, and it is not console specific. Found in many guides, and even in basic setting up of Luma. Just relocate a copy of that bin file, place on a fresh SD card, and you should be able to boot, with very slight dependencies, depending on where you got the bin file from, for example, the luma directory, if you got it from the Luma setup.

I don't think that's all you require for it to work.
Aren't you supposed to also have the console specific optless bin file?
From my understanding, instead of using the actual otp, this runs using the otp hash, which is the otpless bin file I understand correctly, meaning if you haven't backed that up and your sd fails, you're still screwed.


Sent from my iPhone using Tapatalk

 

[gamesquest1]

once a9lh is installed you cannot be screwed Unless you wipe/corrupt your FIRM partitions (which would screw you even if you had your otp) or if the SD slot stops working.....which again would be just as bad even if you had your otp

other than those you can always drop a different SD card in with a arm9loaderhax.bin file on

 

[el_gonz87]

Yes. Unless you have hardmod.

Since I completed A9LH successfully using OTPLess method, is it not safe for me to ever update A9LH using SafeA9LHInstaller without the OTP?

 

[OrGoN3]

It won't be any safer.

Did their brick have to do with "SD card is no longer initialized after the reboot during OTPless installs (might fix corner case bricks where the SD is corrupted)"? How did it brick?

 

[vb_encryption_vb]

Did their brick have to do with "SD card is no longer initialized after the reboot during OTPless installs (might fix corner case bricks where the SD is corrupted)"? How did it brick?

From the details they gave me, once they ran safearm9 it bricked.

 

[OrGoN3]

From the details they gave me, once they ran safearm9 it bricked.

Oh ok, so PEBKAC :3

 

[metroid maniac]

otpless works because you can copy key0 to key1, put 10.0 New 3DS FIRM in firm0, put a payload into arm9 memory, reboot, and get the otp hash from there and install proper a9lh.

So when you try decrypt FIRM 10.0 with key0 instead of the expected key1, it decrypts to a branch to your payload?

I assume this works because RAM isn't cleared between reboots, so you can write your payload at the target of the branch and have it be executed after a reboot.

What address does it jump to?

EDIT: I'm asking because I'm wondering about installing OTPless a9lh from DSi mode.
The 10.0 FIRM downgrade would work from DSiWare, as proven by dgTool.
I'm pretty sure you control arm9 memory so you can write your payload where it needs to be for 10.0 to execute it on a reboot.
All that remains is triggering an MCU reboot, which I believe is what exiting to home menu is.

A DSiWare OTPless install would be useful - it'd be pretty much futureproof if I understand correctly. So is it technically possible?