Hacking [WIP] KARL3DS - Kernel access on N3DS via Ninjhax + Loadcode

[shinyquagsire23]

Apparently it's not supported on smea's web page, however it might be possible to run it from ninjhax's second stage exploit (cn_secondary_payload , where it has full usermode code within Cubic Ninja's process but no spider hax or rohax yet). It probably won't be the highest priority since the amount of people who happen to have JAP Cubic Ninja, a JAP N3DS, and are on 8.1 is quite low (unless I guess they get a sky3DS). Not impossible though, just a bit tricky.

 

[Click This]

Looks like us people with 8.1.0-0J are *mostly* screwed again. Dx

 

[daxtsu]

Apparently it's not supported on smea's web page, however it might be possible to run it from ninjhax's second stage exploit (cn_secondary_payload , where it has full usermode code within Cubic Ninja's process but no spider hax or rohax yet). It probably won't be the highest priority since the amount of people who happen to have JAP Cubic Ninja, a JAP N3DS, and are on 8.1 is quite low (unless I guess they get a sky3DS). Not impossible though, just a bit tricky.

If it means possible homebrew on my New 3DS before Gateway supports it, that's good enough for me. Even if it doesn't (I know that wasn't a promise or anything ), thanks for answering my questions.

Edit: I wonder..and this is just me "thinking out loud", but couldn't the Cubic Ninja exploit perhaps look for a code payload on the SD card instead of downloading it from a website? Or would you not have enough user permissions at that stage yet? Maybe I should read Smealum's writeup again; I can't remember how most of it works.

 

[Kracken]

If this works for region free I think plenty of people would buy a sky/qq to then use cubic ninja. There are quite a few people who own 8.1J consoles that would really appreciate what you are doing.

 

[hippy dave]

Great work guys! I have an old3DS with gateway, but I'll still look forward to more powerful usermode for homebrew in general, and full speed GBA emulation in particular

 

[Idaho]

Probably not, since no piracy

If it has kernel access and ninjhax, I guess we could you know launch big red menu and install .cia files from it?

 

[overlord00]

6. Modify Sysnand to boot into our kernel code

I've been thinking about this for a while..
What has to be done/changed/modified/pwned to have cold boot hacks?
ie: region free, homebrew, cia, etc, etc directly from power on?

At what point in the chain do we need to get control to make this possible?
And as speculation at this point; how could it be done?

 

[Idaho]

I've been thinking about this for a while..
What has to be done/changed/modified/pwned to have cold boot hacks?
ie: region free, homebrew, cia, etc, etc directly from power on?

At what point in the chain do we need to get control to make this possible?
And as speculation at this point; how could it be done?

What I've been told and what I understood was that the boot loader is encrypted and checks the NAND at every boot to see if it matches what he's been told, so it'd require to decrypt the boot loader and then hack it to load anything and not only official stuffs.

I guess such a task would require some heavy electronic reverse engineering that nobody has been into yet or maybe we don't know it, but I guess if this is hacked we could theoretically boot linux or any OS made compatible with ARM on the 3DS much like it was possible to boot PPC compiled linux distros with specific drivers on the xbox360.

Anyway guys, this KARL project seems rather interesting and I really hope you can make it, the homebrew community needs such a thing, ninjhax is already limited by now because it doesn't allow sound on n3DS...

 

[NicEXE]

I don't know if this helps or if you seen that yet but smea explains how ninjhax works
ninjhax : the writeup

 

[Zidapi]

I don't know if this helps or if you seen that yet but smea explains how ninjhax works
ninjhax : the writeup

Yeah, I think they're well past that point already...

 

[VeryCrushed]

What I've been told and what I understood was that the boot loader is encrypted and checks the NAND at every boot to see if it matches what he's been told, so it'd require to decrypt the boot loader and then hack it to load anything and not only official stuffs.

I guess such a task would require some heavy electronic reverse engineering that nobody has been into yet or maybe we don't know it, but I guess if this is hacked we could theoretically boot linux or any OS made compatible with ARM on the 3DS much like it was possible to boot PPC compiled linux distros with specific drivers on the xbox360.

Anyway guys, this KARL project seems rather interesting and I really hope you can make it, the homebrew community needs such a thing, ninjhax is already limited by now because it doesn't allow sound on n3DS...

I vote for android lol

Anyways, that's sounding correct. So much to do with the 3DS is gonna deal with encryption, by design it was meant to keep us out. Let's just jump some walls.

 

[SLiV3R]

I wish you all luck for this project, because you gonna need it. The task is not easy. I would easy bet 100 euros that you won't be successful. I think this is the fifth thread that announce this kind of stuff since yifan_lu spider tools Was released. But No one has released anything..

 

[Henning B]

I wish you all luck for this project, because you gonna need it. The is easy is great but I would easy bet 100 euros that you won't be successful. I think this is the fifth thread that announce this kind of stuff since yifan_lu spider tools Was released. But No one has released anything..

He has released the source, progress is progress

 

[JustPingo]

KARLMARX3DS!

Sorry.


Anyway, that is the kind of thing that make me hesitate between buying that €20 european Cubic Ninja or waiting to use the Gateway I already own...
Good luck!

 

[enarky]

Apparently it's not supported on smea's web page, however it might be possible to run it from ninjhax's second stage exploit (cn_secondary_payload , where it has full usermode code within Cubic Ninja's process but no spider hax or rohax yet). It probably won't be the highest priority since the amount of people who happen to have JAP Cubic Ninja, a JAP N3DS, and are on 8.1 is quite low (unless I guess they get a sky3DS). Not impossible though, just a bit tricky.

Well, I for one happen to own a 8.1.0-0J N3DS and a copy of JPN Cubic Ninja, so there's at least one of us...

 

[Ericss]

Depends on if somebody wants to, or if the source is released. lets just hope there will be some anti-piracy backup manager

How about no. If they're giving us a crippled backup manager with unnecessary limitations, then they shouldn't bother at all.

 

[Idaho]

How about no. If they're giving us a crippled backup manager with unnecessary limitations, then they shouldn't bother at all.

How about it can be modified if you want to? Why are people always whining so much around here...

 

[Ericss]

How about it can be modified if you want to? Why are people always whining so much around here...

Someone asked about the possibility of a backup loader via cia installs and Henning B replied and added the AP part, so I was addressing that part.

 

[128bit_benny]

He has released the source, progress is progress

Probably a dumb question. But where is the source?

 

[Henning B]

Someone asked about the possibility of a backup loader via cia installs and Henning B replied and added the AP part, so I was addressing that part.

(I just added that so I make myself sound better than every pirate, I do in fact pirate a lot)