Obviously you need the game. The hacked save game exploits the game itself when it is loaded. So obviously you need to the game to load the save.dudes, wtf ? can you guys please clarify me something ?
they find an exploit in some game, 3DS stores savegames on SD card, do we really need the game cart in order to hack or just the savegame, thant could be copied from the computer ?
Anyway, the 3DS does not store saves for game cards on the SD card, those saves are stored on the game card itself. Only downloaded games have their saves stored on the SD card, and those cannot be attacked without first running code through some other exploit i.e. a game card exploit.