Hacking seedminer (single system DSiWare injection)

[Sal91]

It's one of those weird 3ds's with a mismatched msed3/LFCS (I suspect unbanning or other msed manipulation). The only remedy is a system reformat or system transfer with that system as the source. Then start the process over.

I've seen 2, maybe 3 of these so far. In each case, it was a new3ds with an old3ds msed.

Hello again, I found a way to format without losing purchases, here is the new movable_part1.sed the zip file name is my new id

 

[Marenthyu]

Hello again, I found a way to format without losing purchases, here is the new movable_part1.sed the zip file name is my new id

working on it now.
though, it already has an ID0 attached to it and the zip name is an invalid one or already in the file.

--------------------- MERGED ---------------------------

Done. msed attached (and movable sent via PM)

 

[Marenthyu]

<insert witty comment about attached msed here>

 

[dani-J18]

hi could someone help me with brute forcing my movable_part1.sed please.

 

[Marenthyu]

hi could someone help me with brute forcing my movable_part1.sed please.

on it (... after the one im currently cracking)

 

[dani-J18]

on it

thanks!!

 

[Marenthyu]

thanks!!

sorry, but the file you attached is invalid - neither is it a zip file, nor can it be read by seedminer if renamed to .sed

Please make sure you zip the file correctly and upload it again

 

[dani-J18]

sorry, but the file you attached is invalid - neither is it a zip file, nor can it be read by seedminer if renamed to .sed

Please make sure you zip the file correctly and upload it again

sorry i took so long i had to do something. here is the file, hopefully this time it works just remove .zip

 

[Marenthyu]

sorry i took so long i had to do something. here is the file, hopefully this time it works just remove .zip

no, that file is still invalid. please right click the original file -> send to -> zip folder

 

[dani-J18]

no, that file is still invalid. please right click the original file -> send to -> zip folder

 

[Marenthyu]

sorry, but your file still seems invalid.

maybe @zoogie can help?

 

[zoogie]

sorry, but your file still seems invalid.

maybe @zoogie can help?

There's an id0 but no lfcs

 

[dani-J18]

There's an id0 but no lfcs

is there a way to add the lfcs to the file or should i start again?

 

[zoogie]

is there a way to add the lfcs to the file or should i start again?

is there a way to add the lfcs to the file or should i start again?

Start over

 

[Marenthyu]

two more

 

[dani-J18]

There's an id0 but no lfcs

i think i found out the problem now sorry for bothering you.

 

[Marenthyu]

i think i found out the problem now sorry for bothering you.

file seems valid, cracking it now. will PM the result. or you add me on discord. Marenthyu#4211

Taking a tad longer, this one. Cracked another one in parallel in the meantime, at 500 offset already.

 

[Deleted member 442567]

What is this:
A stable implementation of the 3ds vuln described here. The old thread about it is here.
This is a new way to inject dsiwarehax -- which can install B9S -- that doesn't require a second 3ds on hand.

What you need:
Seedminer only needs a system's *LFCS and ID0 (the long hex # in your Nintendo 3DS folder) to work its magic.
Currently, you need either a userland entrypoint or someone online you can friend code exchange with and send you a file with the LFCS.
Other ways to get the LFCS are being worked on, more details in the release archive's readme.
A PC is required for a brute-forcing of the actual movable.sed. A CPU will suffice, but a dedicated GPU is
much, much better. Integrated graphics suck, don't count on that to be much better than a CPU. It can even be worse.
You will also need to buy a $2 dsiware game if you don't have a compatible one yet.

* Local Friend Code Seed - this is not the same as LocalFriendCodeSeed_B, see readme.txt for more details.

How to do this:
Please see the readme in the release archive for detailed instructions.

How can I help:
There is actually one thing either users of seedminer, or people who already have cfw, can do - dump msed_data nodes!
Seedminer uses "error correction" to make better guesses on where to start brute forcing - this can greatly improve speed, especially needed with
cpu brute-forcing. This data is gathered from actual movable.seds. You can dump and share this data with seedstarter.3dsx in the release archive (option X). It is also dumped at the conclusion of a successful brute-force (alongside your movable.sed). It looks like "msed_data_00001234.bin" for example.
The data consists of [LFCS - truncated 12 bits for data privacy] [msed3 error distance] [seedtype new/old 3ds] (12 bytes total)
REMEMBER - it is entirely optional to share this, but greatly appreciated! You can post it in the thread or PM, your choice. I will then add them to the seedminer database files at regular intervals.

If you would like to help people brute-force their seeds, or help them get their LFCS with a friend code exchange, there is a special thread for that here.

Q&A:
Q. I've got my movable.sed and now I'm at the TADpole part, what's this about the ctcert.bin, will you be providing one?
A. No. That file is extremely console-unique and not something I'm comfortable sharing. Someone else will have to share. It only takes one - they work globally. Don't upload it here, it will probably be considered warez (not really sure about that designation - not my call).
Q. Why not ntrboot?
A. Ntrboot is fantastic! It's certainly a better long term solution. However, seedminer only requires a $2 dsiware purchase and you don't have to wait weeks for China Post to deliver a flashcard. Seedminer is pretty involved though, so if you're not comfortable with a lot of steps, just go with
ntrboot.
Q. Could Nintendo patch this?
A. Yes, certainly at least the dsiware injection. Now that it's a primary, they might consider it more of a priority to fix than when it was just used for dsiware transfer hax (3ds.guide). That doesn't account for the possibility of additional dsiware savehax games, however. The movable.sed vuln itself will be a bit more difficult to patch since it's pretty deeply built into the security infrastructure of the 3ds. They could at least make it harder to fish out the LFCS from userland and below.
Q. If dsiware injection was fixed, could this be used for anything else?
A. Yes, I think so at least. Knowing the movable.sed should allow one to modify 3ds game saves, and this should essentially turn eshop userland secondary exploits into primaries. Again, I haven't actually tested this, but it should work. @wwylele made a tool recently that could help with this.

Thanks:
Code
@JimmyZ - for providing the sorely-needed ocl brute forcer
@Joel16 - tons of friend functions and other useful code
Testers
@Quantumcat - tons of advice and testing
@FallenApex - first successful public trial!
@PowerBall253 - the second successful public trial!

Release:
Download
Source
QR for seedstarter.cia
View attachment 113500

Can someone do the Dsiware injection for me I have a gtx 1050 Ti and it takes OVER 6 hours.

I have a European New 3ds

i send my Moveable_part1.sed via Pm

 

[Marenthyu]

Can someone do the Dsiware injection for me I have a gtx 1050 Ti and it takes OVER 6 hours.

I have a European New 3ds

i send my Moveable_part1.sed via Pm

As i responded to you in the other thread (please dont double post btw), your file took over 5500 offset and was not yet done. Even on my card (and i have mined ~30 seeds already), it took over 12 hours to get to that point. Either your attached ID0 is incorrect, or your movable.sed has been tampered with and will take a lot longer. If you wait a few days, i may let it run for 24 hours again. But dont expect me to.

 

[Marenthyu]

file seems valid, cracking it now. will PM the result. or you add me on discord. Marenthyu#4211

Taking a tad longer, this one. Cracked another one in parallel in the meantime, at 500 offset already.

I'm at 1k now, but would like to use my GPU for something else in a bit - do you think this is another "tampered" one and will take much longer or should i give up, @zoogie ?