Hacking [HOWTO] Use OOT Exploit on SKY3DS/Non Working Carts

[qproject]

Could you please tell me how did you get it work? I did format/write rom exactly the same as I did with the internal 4GB but everything I press A button, my 3DS will crash with black/white screens.

Did you wait 5-10 seconds before you press A? In diskwriter do a format and then do a reformat before writing roms. You need to prepare your microSD fresh.

 

[Escape]

Sorry. Did you try to reformat your microSD or maybe use another speare microSD and recopy your roms?

Yup, still same problem.

 

[qproject]

Yup, still same problem.

There's a lot of incompatible microSD brands, so it seems. You could try using your internal microSD Toshiba and try to run the exploit. I know sony and sandisk works perfectly.

Maybe check if your microSD is formatted in Fat32?

 

[GothicIII]

I did it!!!!!!
I know where the problem was. The problem is the redbutton Sky3DS when the gamelimit is broken.
The Sky3DS RED works like this:

0. Initialize Sectors of the ROMs (blinking first time when inserted new µSD)
1. Load game 1
2. Load save 1 while checking if ROM is registered. If not jump to 3
3. Load game 2
4. [...]
I have to break the sequence on no.2 before it changes the ROM so the ROM remains loaded. And here is the clue: In that sequence the Savefile is still written! If I break the sequence, the save is corrupt.

My workaround:
I have to load up 3 games.
The first two must be registered within the rom limit.
-The first ROM must have a working save.
-The 2nd ROM must have the gw-hacked save restored. This can only be done with a hex-editor, because DiskWriter checks for a valid savegame in the save-header.
-The 3rd ROM is Zelda also with the gw-hacked save restored.

1. I have to play the first ROM, so the EEPROM of the sky3ds is wiped and written with that save.
2. I exit the game and change the ROM to the 2nd Game. I don't load this game, because the save will be wiped if I start it.
3. Now I change the game to Zelda and break the sequence.
4. Gateway save loads!

This works, because Sky3DS don't wipes the save first, when it gets overwritten inside the EEPROM. Instead it is written sequencially. Maybe make a note in your start-thread that red-button sky3ds users can't use the save that easily

 

[Doc-Ziggy]

The version you need does not have a manual which is rev00. If it has manual before opening the rom is rev01.

i do have the rev00 - no manual.
still getting corrupt save/erasing :/

I did it!!!!!!
I know where the problem was. The problem is the redbutton Sky3DS when the gamelimit is broken.
The Sky3DS RED works like this:

0. Initialize Sectors of the ROMs (blinking first time when inserted new µSD)
1. Load game 1
2. Load save 1 while checking if ROM is registered. If not jump to 3
3. Load game 2
4. [...]
I have to break the sequence on no.2 before it changes the ROM so the ROM remains loaded. And here is the clue: In that sequence the Savefile is still written! If I break the sequence, the save is corrupt.

My workaround:
I have to load up 3 games.
The first two must be registered within the rom limit.
-The first ROM must have a working save.
-The 2nd ROM must have the gw-hacked save restored. This can only be done with a hex-editor, because DiskWriter checks for a valid savegame in the save-header.
-The 3rd ROM is Zelda also with the gw-hacked save restored.

1. I have to play the first ROM, so the EEPROM of the sky3ds is wiped and written with that save.
2. I exit the game and change the ROM to the 2nd Game. I don't load this game, because the save will be wiped if I start it.
3. Now I change the game to Zelda and break the sequence.
4. Gateway save loads!

This works, because Sky3DS don't wipes the save first, when it gets overwritten inside the EEPROM. Instead it is written sequencially. Maybe make a note in your start-thread that red-button sky3ds users can't use the save that easily

could you expand the details on the second rom?
i have the same problem...

 

[paura01]

I did manage to backup the sysnand into GW menu, once I am entry into main nintendo menu is it possible to update the emunand via wifi?

 

[GothicIII]

Replicate the structure of my µSD (like in my post)
Load up HxD and then go to openDisk-> select the µSD
open the hacked save in a new tab
In the save tab select all data from 0x58 onwards (thats the line beginning with 00 00 00 00 00 00 00 00) and copy it
In the µSD tab go to 0x200000 click the first byte so the cursor stands before it and paste the data with CTRL+B. If you get a warning message, then you did something wrong.
Save the changes.
Thats all to it

 

[r5xscn]

Hi I have problem with loading the exploit.
I can load the save, but once I pressed A button, the lower screen just showed white image.
What I have tried are:
Reformating SDCard with multiple program.
Use 2 copy of Zelda.
Tried all the save data.

Currently I only have 1 SDCard, and dont have access to screwdriver so I cant open and use the N3DS SD Card.
I put the launcher.dat through WiFi to the root of the SD Card and already checked the MD5 of the copied file (BB69F8DB67E390959A395E45DEF39E59) and both are same.

FYI: N3DS 8.1J Sky3DS Bluebutton Sandisk 32GB UHS 1.

Please help.

 

[Krane]

New 3DS firmware - XL Majora's Mask Edition 9.0E
Old 3DS firmware - Pikachu Edition : 4.5E
OoT - Front: LNA-CTR-AQEP-EUR
OoT - Back : AQEP510202
Working y/n - Yes without bug
Purchased when? - European Day one

My Eur Retail card works perfectly what can i do to help Sonic, i don't really understand :/ Sorry

 

[TheBroCode]

My Eur Retail card works perfectly what can i do to help Sonic, i don't really understand :/ Sorry

If you have SaveDataFiler installed on your 3DS, you can use that to export the save data from the OOT card (with the working Gateway save) to your SD card. I think those files then can be edited to work with other versions of OOT.

 

[Online]

Hi I have problem with loading the exploit.
I can load the save, but once I pressed A button, the lower screen just showed white image.
What I have tried are:
Reformating SDCard with multiple program.
Use 2 copy of Zelda.
Tried all the save data.

Currently I only have 1 SDCard, and dont have access to screwdriver so I cant open and use the N3DS SD Card.
I put the launcher.dat through WiFi to the root of the SD Card and already checked the MD5 of the copied file (BB69F8DB67E390959A395E45DEF39E59) and both are same.

FYI: N3DS 8.1J Sky3DS Bluebutton Sandisk 32GB UHS 1.

Please help.

Try it some more times, mine is buggy and will freeze on white screen 3/10 times. Other than that, the only other thing I can think of is incorrect rom version.

 

[r5xscn]

Try it some more times, mine is buggy and will freeze on white screen 3/10 times. Other than that, the only other thing I can think of is incorrect rom version.

Thanks for your help. I will try it. I used Bahamut release (as told on the first page). I have tried around 5, and only greeted with white screen.
Does anyone with launcher.dat copied through WiFi have successfully launched the exploit?

 

[neo_hito]

You're not getting what I'm saying, what I was trying to tell you is that you should be able to simply enter gateway mode, and then press select to play the games on your red card without having to formatt emunand. Yet for some reason pressing select won't pop up the game selection screen for me...

My 3DS is JP 8.1 if it means anything by the way.

yeah GW features doesn't work on 8.1 . The exploit works but after the you get the GW menu you'll have to make emunand and then update that emunand to 9.x to get the multi rom menu, etc

 

[Krane]

If you have SaveDataFiler installed on your 3DS, you can use that to export the save data from the OOT card (with the working Gateway save) to your SD card. I think those files then can be edited to work with other versions of OOT.

Damn ... I don't find out how i can do that :/
If i dump my save with the gateway menu, does it work ?

 

[Escape]

There's a lot of incompatible microSD brands, so it seems. You could try using your internal microSD Toshiba and try to run the exploit. I know sony and sandisk works perfectly.

Maybe check if your microSD is formatted in Fat32?

Alright fixed it, saw cearp's post and apparently it's a bug on 8.1.
Simply formatted emunand and updated to the latest version. Rom selection menu is working fine now.

 

[DevilHands]

JPN SAVE CONFIRMED WORKING!!!

I have mine booted to Gateway Mode!! Thanks Sonic!!!! I've used the Duowan one though..
The first save for me didn't work on both OOT tries on my Sky3DS so I just tried to use Duowan one... the first time I got an error again but after cycling it to the next Zelda OOT and run the save it worked!!!!

Problem is though I don't see a GW on my firmware... I know its a known bug. Is there a way for me to differentiate between a Sysnand and an Emunand so that I won't make any mistakes on updating Sysnand for now?? I heard about changing themes but I dont know how to do that. Any tutorial for that?

 

[jpossi]

New 3DS firmware - XL Majora's Mask Edition 9.0E
Old 3DS firmware - Pikachu Edition : 4.5E
OoT - Front: LNA-CTR-AQEP-EUR
OoT - Back : AQEP510202
Working y/n - Yes without bug
Purchased when? - European Day one

My Eur Retail card works perfectly what can i do to help Sonic, i don't really understand :/ Sorry

My Eur Retail card doesn't work, and i also don't get it, how to use SaveDataFiler to provide sonic with the files he need to get create a patched SaveGame.

New 3DS XL EUR (13.03.2015): 9.0.0-20E
Old 3DS EUR (12.05.2011): 9.2.0-20E
OoT - Front (14.05.2011): LNA-CTR-AQEP-EUR
OoT - Back: AQEP510134
Working y/n: No; Corrupt Save (gets deleted on launch)

 

[Keylogger]

It doesn't work with my red button sky... save is corrupted

 

[vLTD]

Man having to switch the mSD cards to use a 'fresh' card is horrible.
I loved the writing speeds of my sandisk before I had to switch....

 

[vLTD]

Backing up NN3DS sysnand now! Major thanks to OP