Homebrew Soundhax: a new primary 3DS entrypoint

[cheuble]

​

The long awaited soundhax by nedwill is finally here!

Soundhax is a new primary entrypoint discovered in the "Nintendo 3DS Sound", that loads the homebrew launcher via a .m4a file. The exploit was shown and explained during the 33c3 talk. The exploit relies on a heap overflow in tag processing leads to code execution when a specially- crafted m4a file is loaded by Nintendo 3DS Sound.

Exploits are tested and are confirmed working on USA, EUR and JPN region, works on Old3DS/2DS and New 3DS, on the latest firmware. At the moment KOR, CHN and TWN systems aren't working yet.

How to use?

Download the .m4a file corresponding to your region and model from the official website. Generate an otherapp payload for your model/region/version, and put it at the root of your SD. It has to be renamed "otherapp.bin". Then, simply start the sound application, and load the m4a file. Please note that this doesn't have a 100% success rate, so it may take a few tries.


Official Website
Github
Otherapp payload

 

[Kingy]

It's time.

 

[NoNAND]

PLEASE MAKE IT WORK ON EUR CONSOLE!

 

[Kingy]

PLEASE MAKE IT WORK ON EUR CONSOLE!

It possibly will, it just hasn't been tested on an EUR console, and the exploit hasn't got ready atm.

 

[xtheman]

Oh fuck yeah!
(Downloads now)

 

[ImCarlosGG]

Seems like we need "constants". For EUR / JPN I think.

https://twitter.com/NedWilliamson/status/814129496555225088

 

[Kingy]

EDIT: ATM, it seems like it is USA only, but it should be updated to support EUR and JPN soon

*JPN might possibly work, but it isn't tested.

Also note that this doesn't boot into homebrew yet.

 

[StarTrekVoyager]

Oh my gosh, so I've spent additional €80 for an MHGen N3DSXL on 10.7 for nothing ? -_-

 

[cheuble]

*JPN might work, but it isn't tested.

Check OP, it was edited. So I tried to run the file on my EUR console, but it just said "Unable to read"

 

[Kingy]

Check OP, it was edited. So I tried to run the file on my EUR console, but it just said "Unable to read"

So EUR doesn't work yet.

 

[Erikku]

Edit: Ninja'd

also u beat me op, thx

 

[cheuble]

So EUR doesn't work.

yet

 

[H1B1Esquire]

Maybe this is why f-shop got dm©®'d. An influx of millions of bro's trying to downgrade to get those titles, but bricking and trying to return the systems to Nintendo. Probably not, though.


Really cool this isn't that other guy with bad mp3's.

 

[Kingy]

PLEASE MAKE IT WORK ON EUR CONSOLE!

Sorry, but this is your answer.

So EUR doesn't work yet.

 

[PRAGMA]

-snip-

 

[Deleted-379826]

So I've tested it on my A9LH USA 11.2 New 3ds XL. I put the sound file on the root of my SD along with the matching otherapp.bin. On my first try it crashed, on my second try I booted into homebrew! It works .

--------------------- MERGED ---------------------------

Oh my gosh, so I've spent additional €80 for an MHGen N3DSXL on 10.7 for nothing ? -_-

Nah you would still need a second 3ds or a compatible DSiWare game that has been pulled.

 

[NoNAND]

So I've tested it on my A9LH USA 11.2 New 3ds XL. I put the sound file on the root of my SD along with the matching otherapp.bin. On my first try it crashed, on my second try I booted into homebrew! It works .

--------------------- MERGED ---------------------------


Nah you would still need a second 3ds or a compatible DSiWare game that has been pulled.

Where can i download the needed files?

 

[cheuble]

A quick update: thanks to @TheVinAnator , I can confirm the exploit works on USA consoles!!! To do so, download the .m4a file from the repo and then put an "otherapp.bin" (generate them from there) at the root of your SD. The exploit doesn't have a 100% boot rate though, so it might take multiple tries.
EDIT: 'd
2nd EDIT: It might work with JPN consoles too. Someone with a JPN one should try that.

 

[Deleted-379826]

Where can i download the needed files?

Look above me

 

[Lightyose]

All we need is a way to downgrade now...