Hacking Official Corbenik - Another CFW for advanced users (with bytecode patches!)

chaoskagami

G̷̘̫̍̈́̊̓̈l̴̙͔̞͠i̵̳͊ţ̸̙͇͒̓c̵̬̪̯̥̳͒͌̚h̵̹̭͛̒̊̽̚
OP
Developer
Joined
Mar 26, 2016
Messages
1,365
Trophies
1
Location
↑↑↓↓←→←→BA
Website
github.com
XP
2,287
Country
United States
Blergh.

Is there any built binary to download? I Got R4 (hk & com) failed to load on hourly Luma3DS.

Once it's merged to master, yes.

I already fix the issue of reboot_hook and made a pull request about 5 hours ago, I tested and it works, would be awesome if someone tested as well to be certain

I'm guessing the stack layout changed and the fread handle got moved from the changes. Ugh. Also, check github - I made a comment there for a fixup.

The mov sp line shouldn't be needed, can you test without it? Nothing around there uses stack, and the payload immediately overwrites sp, so removing that shouldn't cause issues.

I'll merge that and @ih8ih8sn0w's commit once you confirm that. won't be able to test stuff right now.

So, I take it some shit severely broke if even Luma is having issues. I'll need to read up on what changed.
 
Last edited by chaoskagami,

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,947
Trophies
4
Location
Making a non-binary fuss
XP
39,338
Country
Antarctica
Blergh.



Once it's merged to master, yes.



I'm guessing the stack layout changed and the fread handle got moved from the changes. Ugh. Also, check github - I made a comment there for a fixup.

The mov sp line shouldn't be needed, can you test without it? Nothing around there uses stack, and the payload immediately overwrites sp, so removing that shouldn't cause issues.

I'll merge that and @ih8ih8sn0w's commit once you confirm that. won't be able to test stuff right now.

So, I take it some shit severely broke if even Luma is having issues. I'll need to read up on what changed.
I will give the reboot patch a quick test
 

Gray_Jack

Well-Known Member
Member
Joined
Jan 13, 2016
Messages
732
Trophies
0
XP
407
Country
I'm guessing the stack layout changed and the fread handle got moved from the changes. Ugh. Also, check github - I made a comment there for a fixup.

I will give the reboot patch a quick test

Ok, here is the corbenik with the suggestion that @chaoskagami did on github
https://up1.secretalgorithm.com/#kCM8INQoOrk7u1H4gE3hkw

Can you test if it works the same as the last one that I posted? I was almost sleeping when I received the e-mail notification, so I'll try when I wake up
 

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,947
Trophies
4
Location
Making a non-binary fuss
XP
39,338
Country
Antarctica
Last edited by The Catboy,

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,947
Trophies
4
Location
Making a non-binary fuss
XP
39,338
Country
Antarctica
With none builds?
Just freezes with a black screen on my old3DS. I've tried both your builds and the latest nightly with the updated files.
Let me post my code

Code:
Cache: Signature Fix
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: FIRM Protection
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Title Downgrade Fix (11.0+ NFIRM)
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Region Free HOME (Loader)
  Version: 10
  cache: 0004003000008F02
  cache: 0004003000008202
  cache: 0004003000009802
  cache: 000400300000A102
  cache: 000400300000A902
  cache: 000400300000B102
            Cache: Block Cart Update / Cart RF (Loader)
  Version: 10
  cache: 0004013000008002
            Cache: Block eShop Updates (Loader)
  Version: 10
  cache: 0004013000002C02
            Cache: Block NIM Updates (Loader)
  Version: 10
  cache: 0004013000002C02
            Cache: RO Signature Fix (Loader)
  Version: 10
  cache: 0004013000003702
            Cache: Fake Friends Version (Loader)
  Version: 10
  cache: 0004013000003202
            Cache: Download Play Region Fix (Loader)
  Version: 10
  cache: 0004013000002802
            Cache: Settings Version String (Loader)
  Version: 10
  cache: 0004001000021000
  cache: 0004001000020000
  cache: 0004001000022000
  cache: 0004001000026000
  cache: 0004001000027000
  cache: 0004001000028000
            Cache: SecureInfo_A Signature Fix (Loader)
  Version: 10
  cache: 0004013000001702
            Cache: TWL Patches (1/2 - new3ds)
  Version: 10
  cache: 0004013820000102
            Cache: TWL Patches (2/2 - o3ds)
  Version: 10
  cache: 0004013800000102
            Cache: AGB Signature Fix
  Version: 10
  cache: 0004013800000202
  cache: 0004013820000202
            Cache: AGB Bootscreen
  Version: 10
  cache: 0004013800000202
  cache: 0004013820000202
            Cache: FIRM Protection (2.x)
  Version: 1
  cache: 0004013800000002
  cache: 0004013800000003
  cache: 0004013820000003
            Cache: Remove Outlines - Pokemon S/M (Loader)
  Version: 1
  cache: 0004000000164800
  cache: 0004000000175E00
            Cache: Disable SVC Permission Checks
  Version: 1
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Signature Fix
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: FIRM Protection
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Title Downgrade Fix (11.0+ NFIRM)
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Region Free HOME (Loader)
  Version: 10
  cache: 0004003000008F02
  cache: 0004003000008202
  cache: 0004003000009802
  cache: 000400300000A102
  cache: 000400300000A902
  cache: 000400300000B102
            Cache: Block Cart Update / Cart RF (Loader)
  Version: 10
  cache: 0004013000008002
            Cache: Block eShop Updates (Loader)
  Version: 10
  cache: 0004013000002C02
            Cache: Block NIM Updates (Loader)
  Version: 10
  cache: 0004013000002C02
            Cache: RO Signature Fix (Loader)
  Version: 10
  cache: 0004013000003702
            Cache: Fake Friends Version (Loader)
  Version: 10
  cache: 0004013000003202
            Cache: Download Play Region Fix (Loader)
  Version: 10
  cache: 0004013000002802
            Cache: Settings Version String (Loader)
  Version: 10
  cache: 0004001000021000
  cache: 0004001000020000
  cache: 0004001000022000
  cache: 0004001000026000
  cache: 0004001000027000
  cache: 0004001000028000
            Cache: SecureInfo_A Signature Fix (Loader)
  Version: 10
  cache: 0004013000001702
            Cache: TWL Patches (1/2 - new3ds)
  Version: 10
  cache: 0004013820000102
            Cache: TWL Patches (2/2 - o3ds)
  Version: 10
  cache: 0004013800000102
            Cache: AGB Signature Fix
  Version: 10
  cache: 0004013800000202
  cache: 0004013820000202
            Cache: AGB Bootscreen
  Version: 10
  cache: 0004013800000202
  cache: 0004013820000202
            Cache: FIRM Protection (2.x)
  Version: 1
  cache: 0004013800000002
  cache: 0004013800000003
  cache: 0004013820000003
            Cache: Remove Outlines - Pokemon S/M (Loader)
  Version: 1
  cache: 0004000000164800
  cache: 0004000000175E00
            Cache: Disable SVC Permission Checks
  Version: 1
  cache: 0004013800000002
  cache: 0004013820000002
            TWL Patches (2/2 - o3ds)
AGB Signature Fix
AGB Bootscreen
Signature Fix
FIRM Protection
Title Downgrade Fix (11.0+ NFIRM)
FIRM Protection (2.x)
Disable SVC Permission Checks
reboot: proc9 mem @ 08028000
reboot: proc9 off @ 24152a10
            reboot: firmlaunch @ 241af568
reboot: fopen @ 08059e35
            svc: 0x7B (backdoor) missing.
Svc: backdoor is 64 bytes
Svc: Read code to 24137e38
svc: Injected 0x7B.
Module: Grow 11 units
Module: injected /corbenik/lib/module/native/loader.cxi


Code:
Title: 0004013000008002
  validated params
  patched cpu
  patch: /corbenik/var/cache/loader/0004013000008002
  exec
Block Cart Update / Cart RF (Loader)
Created process
Title: 0004013000002202
  validated params
Created process
Title: 0004013000001702
  validated params
  patch: /corbenik/var/cache/loader/0004013000001702
  exec
SecureInfo_A Signature Fix (Loader)
Created process
Title: 0004013000001B02
  validated params
Created process
Title: 0004013000001E02
  validated params
Created process
Title: 0004013000001F02
  validated params
Created process
Title: 0004013000002102
  validated params
Created process
Title: 0004013000002302
  validated params
Created process
Title: 0004013000003102
  validated params
Created process
Title: 0004013000001502
  validated params
Created process
 
Last edited by The Catboy,

Gray_Jack

Well-Known Member
Member
Joined
Jan 13, 2016
Messages
732
Trophies
0
XP
407
Country
Just freezes with a black screen on my old3DS. I've tried both your builds and the latest nightly with the updated files.
Let me post my code

Code:
Cache: Signature Fix
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: FIRM Protection
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Title Downgrade Fix (11.0+ NFIRM)
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Region Free HOME (Loader)
  Version: 10
  cache: 0004003000008F02
  cache: 0004003000008202
  cache: 0004003000009802
  cache: 000400300000A102
  cache: 000400300000A902
  cache: 000400300000B102
            Cache: Block Cart Update / Cart RF (Loader)
  Version: 10
  cache: 0004013000008002
            Cache: Block eShop Updates (Loader)
  Version: 10
  cache: 0004013000002C02
            Cache: Block NIM Updates (Loader)
  Version: 10
  cache: 0004013000002C02
            Cache: RO Signature Fix (Loader)
  Version: 10
  cache: 0004013000003702
            Cache: Fake Friends Version (Loader)
  Version: 10
  cache: 0004013000003202
            Cache: Download Play Region Fix (Loader)
  Version: 10
  cache: 0004013000002802
            Cache: Settings Version String (Loader)
  Version: 10
  cache: 0004001000021000
  cache: 0004001000020000
  cache: 0004001000022000
  cache: 0004001000026000
  cache: 0004001000027000
  cache: 0004001000028000
            Cache: SecureInfo_A Signature Fix (Loader)
  Version: 10
  cache: 0004013000001702
            Cache: TWL Patches (1/2 - new3ds)
  Version: 10
  cache: 0004013820000102
            Cache: TWL Patches (2/2 - o3ds)
  Version: 10
  cache: 0004013800000102
            Cache: AGB Signature Fix
  Version: 10
  cache: 0004013800000202
  cache: 0004013820000202
            Cache: AGB Bootscreen
  Version: 10
  cache: 0004013800000202
  cache: 0004013820000202
            Cache: FIRM Protection (2.x)
  Version: 1
  cache: 0004013800000002
  cache: 0004013800000003
  cache: 0004013820000003
            Cache: Remove Outlines - Pokemon S/M (Loader)
  Version: 1
  cache: 0004000000164800
  cache: 0004000000175E00
            Cache: Disable SVC Permission Checks
  Version: 1
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Signature Fix
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: FIRM Protection
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Title Downgrade Fix (11.0+ NFIRM)
  Version: 10
  cache: 0004013800000002
  cache: 0004013820000002
            Cache: Region Free HOME (Loader)
  Version: 10
  cache: 0004003000008F02
  cache: 0004003000008202
  cache: 0004003000009802
  cache: 000400300000A102
  cache: 000400300000A902
  cache: 000400300000B102
            Cache: Block Cart Update / Cart RF (Loader)
  Version: 10
  cache: 0004013000008002
            Cache: Block eShop Updates (Loader)
  Version: 10
  cache: 0004013000002C02
            Cache: Block NIM Updates (Loader)
  Version: 10
  cache: 0004013000002C02
            Cache: RO Signature Fix (Loader)
  Version: 10
  cache: 0004013000003702
            Cache: Fake Friends Version (Loader)
  Version: 10
  cache: 0004013000003202
            Cache: Download Play Region Fix (Loader)
  Version: 10
  cache: 0004013000002802
            Cache: Settings Version String (Loader)
  Version: 10
  cache: 0004001000021000
  cache: 0004001000020000
  cache: 0004001000022000
  cache: 0004001000026000
  cache: 0004001000027000
  cache: 0004001000028000
            Cache: SecureInfo_A Signature Fix (Loader)
  Version: 10
  cache: 0004013000001702
            Cache: TWL Patches (1/2 - new3ds)
  Version: 10
  cache: 0004013820000102
            Cache: TWL Patches (2/2 - o3ds)
  Version: 10
  cache: 0004013800000102
            Cache: AGB Signature Fix
  Version: 10
  cache: 0004013800000202
  cache: 0004013820000202
            Cache: AGB Bootscreen
  Version: 10
  cache: 0004013800000202
  cache: 0004013820000202
            Cache: FIRM Protection (2.x)
  Version: 1
  cache: 0004013800000002
  cache: 0004013800000003
  cache: 0004013820000003
            Cache: Remove Outlines - Pokemon S/M (Loader)
  Version: 1
  cache: 0004000000164800
  cache: 0004000000175E00
            Cache: Disable SVC Permission Checks
  Version: 1
  cache: 0004013800000002
  cache: 0004013820000002
            TWL Patches (2/2 - o3ds)
AGB Signature Fix
AGB Bootscreen
Signature Fix
FIRM Protection
Title Downgrade Fix (11.0+ NFIRM)
FIRM Protection (2.x)
Disable SVC Permission Checks
reboot: proc9 mem @ 08028000
reboot: proc9 off @ 24152a10
            reboot: firmlaunch @ 241af568
reboot: fopen @ 08059e35
            svc: 0x7B (backdoor) missing.
Svc: backdoor is 64 bytes
Svc: Read code to 24137e38
svc: Injected 0x7B.
Module: Grow 11 units
Module: injected /corbenik/lib/module/native/loader.cxi


Code:
Title: 0004013000008002
  validated params
  patched cpu
  patch: /corbenik/var/cache/loader/0004013000008002
  exec
Block Cart Update / Cart RF (Loader)
Created process
Title: 0004013000002202
  validated params
Created process
Title: 0004013000001702
  validated params
  patch: /corbenik/var/cache/loader/0004013000001702
  exec
SecureInfo_A Signature Fix (Loader)
Created process
Title: 0004013000001B02
  validated params
Created process
Title: 0004013000001E02
  validated params
Created process
Title: 0004013000001F02
  validated params
Created process
Title: 0004013000002102
  validated params
Created process
Title: 0004013000002302
  validated params
Created process
Title: 0004013000003102
  validated params
Created process
Title: 0004013000001502
  validated params
Created process

Are you using the 11.4 FIRM? ( cause with my first try I loaded the 11.4 emuNAND with a 11.2 FIRM and things got messy, every title I tried to load or gets on a black screen or the system froze after I click on "open"

I just tested the recent build with a GBA game and it worked (for me I felt like it take longer to load the game... but it can easily be my sleepy state)
I don't tested the DS/DSi cause, as people know now, for some weird reason the TWL firm load and patch is not working for me
 

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,947
Trophies
4
Location
Making a non-binary fuss
XP
39,338
Country
Antarctica
Are you using the 11.4 FIRM? ( cause with my first try I loaded the 11.4 emuNAND with a 11.2 FIRM and things got messy, every title I tried to load or gets on a black screen or the system froze after I click on "open"

I just tested the recent build with a GBA game and it worked (for me I felt like it take longer to load the game... but it can easily be my sleepy state)
I don't tested the DS/DSi cause, as people know now, for some weird reason the TWL firm load and patch is not working for me
OK, so it looks like an old cache file kept finding it's way into my files.
Old3DS tested (new3DS test coming soon)
Testing with the second one posted.
HMM Game: Super Mario Mario Marker 3DS: Works
GBA: FF1&2: Works
DSi: TWL Slot-1 Launcher with DSONEi: Works
 

Gray_Jack

Well-Known Member
Member
Joined
Jan 13, 2016
Messages
732
Trophies
0
XP
407
Country
OK, so it looks like an old cache file kept finding it's way into my files.
Old3DS tested (new3DS test coming soon)
Testing with the second one posted.
HMM Game: Super Mario Mario Marker 3DS: Works
GBA: FF1&2: Works
DSi: TWL Slot-1 Launcher with DSONEi: Works

If saves your time, try only the last build, if the last one works, then the first one works as well
if the last build don't work, then test the first one.
At least I think it will save you some time
 

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,947
Trophies
4
Location
Making a non-binary fuss
XP
39,338
Country
Antarctica
If saves your time, try only the last build, if the last one works, then the first one works as well
if the last build don't work, then test the first one.
At least I think it will save you some time
Both tests are being done with the second build
New3DS tests, using the second file as well
EMM: Not needed for New3DS, but tested anyways: Monster Hunter Gen: Working
GBA: FF1&2: Working
DSi: DSTT launcher: Works
 
  • Like
Reactions: Gray_Jack

chaoskagami

G̷̘̫̍̈́̊̓̈l̴̙͔̞͠i̵̳͊ţ̸̙͇͒̓c̵̬̪̯̥̳͒͌̚h̵̹̭͛̒̊̽̚
OP
Developer
Joined
Mar 26, 2016
Messages
1,365
Trophies
1
Location
↑↑↓↓←→←→BA
Website
github.com
XP
2,287
Country
United States
My battery is dead, so I have to wait for it to charge up, but good to see this resolves the issue (hopefully.)

Merged, so Jenkins will build sometime within the next hour.

Both of the mentioned builds are working on my n3ds when launching ctraging

I accidentally fixed ctraging at some point?
 

JerryShaw

Well-Known Member
Member
Joined
Feb 7, 2017
Messages
127
Trophies
0
Age
38
XP
503
Country
Switzerland
It is weird that the reboot patch works on corbenik when even booting from CtrBootManager9, but only works on Luma when booted without any boot manager.

--------------------- MERGED ---------------------------

My battery is dead, so I have to wait for it to charge up, but good to see this resolves the issue (hopefully.)

Merged, so Jenkins will build sometime within the next hour.



I accidentally fixed ctraging at some point?
Seems like we can get the latest binary later, wow...
 

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,947
Trophies
4
Location
Making a non-binary fuss
XP
39,338
Country
Antarctica
It is weird that the reboot patch works on corbenik when even booting from CtrBootManager9, but only works on Luma when booted without any boot manager.
This actually isn't shocking.
Corbenik's patches are not part of the launcher. So you can rename the launcher literally anything, so even "fart.bin," and the patches will work.
Luma3DS tethers all of the patches the "arm9loaderhax.bin" so it's cleaner, but it's broken with custom paths. You actually need to enable the custom paths in the settings for the patches to work.
 

ih8ih8sn0w

Koreaboo
Member
Joined
Aug 22, 2015
Messages
1,677
Trophies
0
Age
25
Location
Hell
XP
898
Country
United States
My battery is dead, so I have to wait for it to charge up, but good to see this resolves the issue (hopefully.)

Merged, so Jenkins will build sometime within the next hour.



I accidentally fixed ctraging at some point?
Ctraging acts similarly to emm titles on o3ds fsr, so firmlaunch hook is needed to launch.
 

JerryShaw

Well-Known Member
Member
Joined
Feb 7, 2017
Messages
127
Trophies
0
Age
38
XP
503
Country
Switzerland
This actually isn't shocking.
Corbenik's patches are not part of the launcher. So you can rename the launcher literally anything, so even "fart.bin," and the patches will work.
Luma3DS tethers all of the patches the "arm9loaderhax.bin" so it's cleaner, but it's broken with custom paths. You actually need to enable the custom paths in the settings for the patches to work.
OK, I think I got what you meant. Actually, I preferred CakesFW and Corbenik, which could be fully functional when managed under a boot manager.
 

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,947
Trophies
4
Location
Making a non-binary fuss
XP
39,338
Country
Antarctica
OK, I think I got what you meant. Actually, I preferred CakesFW and Corbenik, which could be fully functional when managed under a boot manager.
An interesting note, Corbenik's patching function was actually inspired off of CakesFW. So they function similarly in that aspect.
 

chaoskagami

G̷̘̫̍̈́̊̓̈l̴̙͔̞͠i̵̳͊ţ̸̙͇͒̓c̵̬̪̯̥̳͒͌̚h̵̹̭͛̒̊̽̚
OP
Developer
Joined
Mar 26, 2016
Messages
1,365
Trophies
1
Location
↑↑↓↓←→←→BA
Website
github.com
XP
2,287
Country
United States
Ctraging acts similarly to emm titles on o3ds fsr, so firmlaunch hook is needed to launch.

The reason I ask is because pre-firmlaunch-refactor, it was broken. You would only boot to a black screen.

This actually isn't shocking.
Corbenik's patches are not part of the launcher. So you can rename the launcher literally anything, so even "fart.bin," and the patches will work.
Luma3DS tethers all of the patches the "arm9loaderhax.bin" so it's cleaner, but it's broken with custom paths. You actually need to enable the custom paths in the settings for the patches to work.

It works basically the same as Luma now, but appends the payload path to the hook, and there's a copy of the payload in /corbenik rather than required at the sd root.
 

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,947
Trophies
4
Location
Making a non-binary fuss
XP
39,338
Country
Antarctica
It works basically the same as Luma now, but appends the payload path to the hook, and there's a copy of the payload in /corbenik rather than required at the sd root.
Well, that's kind of the nature of all CFWs, just saying.
But what I mean is, Luma3DS crams everything into the launcher. All of the payloads are completely part of the actual launcher, expect for the settings file.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    SylverReZ @ SylverReZ: @OctoAori20, Cool. Same here.