Homebrew R4 Stage2 TWL Flashcart Launcher(and perhaps other cards soon™)....

[Marko1000Marko]

@Apache Thunder Hey dude, the wood TTDS launcher kinda works and sometimes boots up to the wood menu, and sometimes to a white screen. If it boots up to a white screen, taking out the TTDS makes it show the wood menu again.(But sometimes it will boot to the menu even if the TTDS card is in). However, when in the menu, you can't really do anything, a white popup with no text comes up if you click the sdcard, and the folder down below is empty.

Would a dump of the TTDS with wood menu on it help you? Just say the word.
Also, I uploaded a quick video showing the launcher in effect.(The regular launcher and the dsi one are exactly the same as far as I can tell). Thanks again for your efforts, hopefully we can get this working!

 

[Excelsis]

So I guess M3 is a no go? Kind of a shame since it was so close with WoodM3 using the last launcher from the previous thread.

 

[Whosian]

I can't get this to work at all. Tell me what I did wrong.

New 3ds on 9.2 sysnand and 10.5 emunand. Rxtools booted by ctrboot and menuhax. Running Wood R4 v1.62.

- Installed the Wood R4 launcher using FBI after first running Pasta CFW loader through menuhax. So, start system --> ctrboot --> homebrew launcher --> Pasta CFW loader --> ctrboot --> homebrew launcher --> FBI ---> installing launcher to sysnand (after pressing L)
- Then I just booted up emunand (RX mode) and installed both TWL_FIRM v2 and the Wood R4 launcher to emunand by pressing L.

Running the launcher gets me two black screens. Running the 3ds/nds card app gets me an error screen. The card runs fine on my DS. No problem.

Uninstalled (deleting 0004013800000102) and reinstalled TWL_FIRM v2. Uninstalled and reinstalled the Wood R4 launcher, both on emunand (using FBI) and sysnand (through the process detailed above).

Same black screens.

Did the same thing again. Black screens.

I copied everything to the micro SD card using Teracopy with the hash check function turned on.

What am I doing wrong here?

[edit] I'm using rxTools_2016-02-15, in case that's relevant.

I've got an update if anyone is interested.

Installed Reinand and set up dual boot in ctrboot. Finally worked. I think rxTools was fucking with TWL_FIRM somehow. It patched my already patched TWL_FIRM, maybe reverting it to a previous version or something.* I was using the latest precompiled version (2016-02-22) before I gave up on rxTools. For some reason Reinand made two of my games disappear. They reappeared when I booted up rxTools, with me having to unwrap them again.

[edit] *This is pure, uneducated speculation. I don't know what the fuck is going on. RxTools shouldn't support TWL_FIRM patching on New 3ds.

 

[cicciochiave]

I have an N5 (r4 clone) with this firmware (http://filetrip.net/nds-downloads/flashcart-files/download-n5-firmware-1-32-f26367.html)
Can I do something?

 

[einhuman197]

I have an N5 (r4 clone) with this firmware (http://filetrip.net/nds-downloads/flashcart-files/download-n5-firmware-1-32-f26367.html)
Can I do something?

Dump the kernel of it and ask apache thunder

 

[AboveColin]

Does somebody have a video tutorial for this, it will be easier to do it then the right way xD

 

[FIX94]

EDIT: TTDS Launchers for you to test. V1 holds the best chance. Haven't tested v2 yet:

TTDSLauncher_Final.rar

ok so this file is basically correct, it does fully detect my DSTT but it never loads the TTMENU.DAT which makes me think theres some aligment problem or something about ARM7/9 sections wrong, if I dont have a sd in the DSTT it asks for the sd card to be inserted, if I have it in but no TTMENU.DAT on it it asks for menu on sd card and if thats present its stuck on loading forever.
edit: so opening both .nds files in IDA shows that the ARM9 section appears to be just fine, all functions are detected (172) and the positions are fine. The ARM7 section however should have 30 functions, IDA in your content.bin only detects 14 and if you follow it already after the first function the next call is broken because some memory addresses dont line up at all which probably is the cause of it never leaving the loading screen. Maybe can you explain to why there is this ARM7 difference?

 

[AboveColin]

Is it maybe i fucked up the ds whitelist cia file? maybe is that the reason that it won't work on my 3ds?

 

[SuperNintendo64]

How do you install not-legit cia into sysnand?

 

[AboveColin]

How do you install not-legit cia into sysnand?

Post this question pls in a another section......

 

[ZeCroque]

How do you install not-legit cia into sysnand?

Use Pasta CFW or another sysNand CFW (sysNand <=9.2). But yeah, as AboveColin said, wrong topic.

Is it maybe i fucked up the ds whitelist cia file? maybe is that the reason that it won't work on my 3ds?

What are you talking about?

 

[AboveColin]

What are you talking about?

When i followed the tutorial to enable old 3ds r4i-gold cards, and then the ds whitelist file failed to install in fbi can that be the problem why it isn't working?

 

[ZeCroque]

I don't know about your Flashcard, I assume it worked on 3ds at some time so all you need to do is to patch the DS Whitelist, no TWL Slot-1 Launcher or R4 Stage2 required.. I don't know what you've been doing, but installing the TWL firm from that ISO site or updating the whitelist differently should be sufficient.

 

[einhuman197]

Sorry, but this is only for ds Flashcards! Please open another topic in the world wide forum .

 

[AboveColin]

Sorry, but this is only for ds Flashcards! Please open another topic in the world wide forum .

We were talking about that -,-

 

[Apache Thunder]

ok so this file is basically correct, it does fully detect my DSTT but it never loads the TTMENU.DAT which makes me think theres some aligment problem or something about ARM7/9 sections wrong, if I dont have a sd in the DSTT it asks for the sd card to be inserted, if I have it in but no TTMENU.DAT on it it asks for menu on sd card and if thats present its stuck on loading forever.
edit: so opening both .nds files in IDA shows that the ARM9 section appears to be just fine, all functions are detected (172) and the positions are fine. The ARM7 section however should have 30 functions, IDA in your content.bin only detects 14 and if you follow it already after the first function the next call is broken because some memory addresses dont line up at all which probably is the cause of it never leaving the loading screen. Maybe can you explain to why there is this ARM7 difference?

Did you use IDA on your unedited from dump? Also, I had to change the arm7 code entry and arm7 ram entry address setting at offset 0x30 and 0x34 in the header (not sure if this impacts what IDA tells you though)

It may be the reason why it didn't work. BUT, because my rom viewer said Secure area as decrypted, I had eNDryptS reencrypt the Secure Area. I can try a version where I won't touch this. Maybe that program screwed something up....

I also had to add an icon since it didn't have one. Maybe because it didn't have an icon, that secure area tool messed things up. Usually I just tack the icon to the end of file and have offset 0x68 point to it.

 

[FIX94]

Did you use IDA on your unedited from dump?

indeed, thats what I compared it to. The raw dump reads:

Spoiler

RAM:037F8000 ; Created with NDS Loader v1.12.
RAM:037F8000
RAM:037F8000 ; Author 1: [email protected]
RAM:037F8000 ; Author 2: [email protected]
RAM:037F8000
RAM:037F8000 ; Game Title: TOP TF/SD DSTTDS
RAM:037F8000
RAM:037F8000 ; Processor: ARM7
RAM:037F8000 ; ROM Header size: 0x00004000
RAM:037F8000 ; Header CRC: 0x1987
RAM:037F8000
RAM:037F8000 ; Offset in ROM: 0x0000E200
RAM:037F8000 ; Array: 0x037F8000 - 0x037F9300 (4864 bytes)
RAM:037F8000 ; Entry point: 0x037F8000

and yours reads:

Spoiler

RAM:02380000 ; Created with NDS Loader v1.12.
RAM:02380000
RAM:02380000 ; Author 1: [email protected]
RAM:02380000 ; Author 2: [email protected]
RAM:02380000
RAM:02380000 ; Game Title: TOP TF/SD DSAXUE01
RAM:02380000
RAM:02380000 ; Processor: ARM7
RAM:02380000 ; ROM Header size: 0x00004000
RAM:02380000 ; Header CRC: 0x6EA3
RAM:02380000
RAM:02380000 ; Offset in ROM: 0x0000E200
RAM:02380000 ; Array: 0x02380000 - 0x02381300 (4864 bytes)
RAM:02380000 ; Entry point: 0x02380000

which is a huge difference in memory addresses and obviously will break any hardcoded addresses.

 

[Apache Thunder]

I had two versions. I forget what I did with v2 that was different with v1. Can you remind me? Sorry had done a lot since then and just forgot what I did.

Did either version behave any differently? I'll redo the file to see if maybe something went wrong on my end. I'll only do one version this time. It's less confusing that way.

 

[FIX94]

I had two versions. I forget what I did with v2 that was different with v1. Can you remind me? Sorry had done a lot since then and just forgot what I did.

Did either version behave any differently? I'll redo the file to see if maybe something went wrong on my end. I'll only do one version this time. It's less confusing that way.

well my dump contains 2 "different" ROMs from 0-0x10000 and 0x10000-0x20000 but really they seem to be pretty much equal, both have the same oddity with the memory locations in your .cia files.

 

[alex257]

i know many might have asked this,but for the untested ones(r4 official and dstt) does it work?i need the audiance for these.for me it didnt work on both,i dont know why,am i doing something wrong?