Hacking [WIP] KARL3DS - Kernel access on N3DS via Ninjhax + Loadcode

[Lord Prime]

What have you done? I don't see it

I guess shiny downgraded from 9.5 to 9.0 using a hardmod successfully.
Though I was expecting to see "KARL Ver9.0.0-20E", haha

 

[shinyquagsire23]

What have you done? I don't see it

Oh, I guess you missed my post before. I was working on getting eShop working, so I made a new emuNAND on another SD which was just plain EUR. However, I forgot to actually copy the right bootloader.3dsx so I wasn't in emuNAND, did a system update, and... yeah, no fun. But I did a NAND mod and downgraded using the image dumped from our menu, so now it's back to 9.0.0-20E and I can get back to work.

 

[VinsCool]

Oh, I guess you missed my post before. I was working on getting eShop working, so I made a new emuNAND on another SD which was just plain EUR. However, I forgot to actually copy the right bootloader.3dsx so I wasn't in emuNAND, did a system update, and... yeah, no fun. But I did a NAND mod and downgraded using the image dumped from our menu, so now it's back to 9.0.0-20E and I can get back to work.

Oh very good news! Glad to know you recovered

 

[Ichii Giki]

Oh, I guess you missed my post before. I was working on getting eShop working, so I made a new emuNAND on another SD which was just plain EUR. However, I forgot to actually copy the right bootloader.3dsx so I wasn't in emuNAND, did a system update, and... yeah, no fun. But I did a NAND mod and downgraded using the image dumped from our menu, so now it's back to 9.0.0-20E and I can get back to work.

Good to know we have a confirmed field test of NAND dumps from KARL3DS working for restoring consoles on hardmods!

Also, now that Gateway has released their Cubic Ninja support (including 8.1J), has anyone gotten a chance to take a look at their exploit for feasibility of porting it to KARL3DS?

 

[VinsCool]

Good to know we have a confirmed field test of NAND dumps from KARL3DS working for restoring consoles on hardmods!

Also, now that Gateway has released their Cubic Ninja support (including 8.1J), has anyone gotten a chance to take a look at their exploit for feasibility of porting it to KARL3DS?

Thanks gamesquest1

 

[WulfyStylez]

Good to know we have a confirmed field test of NAND dumps from KARL3DS working for restoring consoles on hardmods!

Also, now that Gateway has released their Cubic Ninja support (including 8.1J), has anyone gotten a chance to take a look at their exploit for feasibility of porting it to KARL3DS?

Their exploit is already public, believe it or not. It's thoroughly documented, including source code, here. But yeah, we'll support 8.1J through CN, this has always been planned.

 

[Ichii Giki]

Their exploit is already public, believe it or not. It's thoroughly documented, including source code, here. But yeah, we'll support 8.1J through CN, this has always been planned.

Oh I knew Ninjhax source was available and documented for a while, but GW must be using a slightly different exploit chain since it works on 8.1J (browser-less FWs; Memchunkhax probably instead of spiderHax/skaterHax?). I was just curious if anyone had REed their payload yet to see exactly what they are doing differently.

 

[shinyquagsire23]

Oh I knew Ninjhax source was available and documented for a while, but GW must be using a slightly different exploit chain since it works on 8.1J (browser-less FWs; Memchunkhax probably instead of spiderHax?). I was just curious if anyone had REed their payload yet to see exactly what they are doing differently.

Well you can do memchunkhax from the second stage payload, it's just that ninjhax hijacks the browser to get extra permissions for homebrew. Technically we could actually replace that hack with memchunkhax itself.

 

[shinyquagsire23]

Please answer

will there work on 3dsxl?
But need to be on 9.2 rite? because im 6. something

No, it works on all firmwares 4.1-9.2, so you're still golden for support. Just don't update and you're good. Also make sure you have a copy of Cubic Ninja.

 

[Zidapi]

Quoted from the OSKAR thread.

This talk belongs more in the KARL thread. KARL will be completely closed-source and protected against RE from the ARM9 stage on out. Nobody is going to 'take our code to the next level', we're not dumb enough to not protect against that.

Hold up a moment. Since when was KARL "completely closed-source"?

I thought that only ARM9 and parts that directly lead to piracy were closed.

But that ARM11 was to be left open for Homebrew devs and community members to expand the functionality of the system software.

I'd envisioned a plugin based CFW much like the PSP, except without being able to launch pirated software.

Has the plan changed, or have I let my imagination run wild a little?

only 9.2 on new 3DS. 9.2 on old 3DS is possible if I could update my 3DS to 9.2.

Speak to Apache Thunder he was, after a lot of work, able to update his sysNAND to 9.2 in the last week or so. He's the resident expert on this at the moment.

 

[shinyquagsire23]

Quoted from the OSKAR thread.

Hold up a moment. Since when was KARL "completely closed-source"?

I thought that only ARM9 and parts that directly lead to piracy were closed.

But that ARM11 was to be left open for Homebrew devs and community members to expand the functionality of the system software.

I'd envisioned a plugin based CFW much like the PSP, except without being able to launch pirated software.

Has the plan changed, or have I let my imagination run wild a little?


Speak to Apache Thunder he was, after a lot of work, able to update his sysNAND to 9.2 in the last week or so. He's the resident expert on this at the moment.

Our ideal situation was that everything in ARM9 would be closed, including firmlaunch hax. We decided that keeping firmlaunch hax closed was pointless after OSKA successfully gained ARM9, and so we released. Both are now available to use for homebrewsters. Everything which actually involves launching our CFW will remain closed, and we have no plans to change that part at all. Our current goal is a simple CFW which can do region free and possibly region swapping, as well as providing N3DS utilities to the masses. From there we'll probably escalate into something similar to NTR-CFW where we can have plugins doing useful utilities, both for our own debugging and for those doing RAM research or save research and whatnot.

 

[Apache Thunder]

only 9.2 on new 3DS. 9.2 on old 3DS is possible if I could update my 3DS to 9.2.

You can update your 3DS to 9.2 using a game rom or CIAs. But you can't do it to sysnand directly or it will get bricked. Karl3DS will probably allow doing this safely. But until then, you'll have to copy sysnand to emunand and update emunand to 9.2 using CIAs or a game rom with the 9.2 update. Then you have to use rxTools to inject the firm0.bin/firm1.bin files dumped from an already working 9.2 sysnand image. If you never had 9.2 on your 3DS, this means getting these files from some one else. (also note that they should have "emu_" added to the file name so that rxTools will see them)

Once you inject the working firm0/firm1 files into emunand, it's then safe to extract emunand and flash that to your sysnand using gateway menu. While it shouldn't cause issues, I still recommend you get a hard mod if you are in any doubt on if you did it correctly.

Generally, if emunand boots correctly afterwords, you can have it on sysnand once the firm0/firm1 partitions are fixed.

Also if you go the CIA route. You can selectively leave out the CIAs for TWL_FIRM and the DS Cart White list. That way, whatever DS flashcarts that are working on your current sysnand will still work on 9.2.

For example. If you started out with 4.3 FW on a USA console updating to 9.2 in this way would allow AceKard2i to still work. Gateway blue card will still work if you updated from 4.5. I don't recall exactly when that one was blocked. But you get the general idea.

 

[Zidapi]

Our ideal situation was that everything in ARM9 would be closed, including firmlaunch hax. We decided that keeping firmlaunch hax closed was pointless after OSKA successfully gained ARM9, and so we released. Both are now available to use for homebrewsters. Everything which actually involves launching our CFW will remain closed, and we have no plans to change that part at all. Our current goal is a simple CFW which can do region free and possibly region swapping, as well as providing N3DS utilities to the masses. From there we'll probably escalate into something similar to NTR-CFW where we can have plugins doing useful utilities, both for our own debugging and for those doing RAM research or save research and whatnot.

Thanks for the further explanation and clarification. Looking forward to the next progress update now that you have a usable device again.

 

[sanni]

Guys, do you think someone will make a Homebrew Launcher menu for OoT? So I can launch a *.3dsx like bootstrap without Cubic Ninja.

 

[Idaho]

Guys, do you think someone will make a Homebrew Launcher menu for OoT? So I can launch a *.3dsx like bootstrap without Cubic Ninja.

Support for OoT is planned afaik...

 

[WhoAmI?]

You can update your 3DS to 9.2 using a game rom or CIAs. But you can't do it to sysnand directly or it will get bricked. Karl3DS will probably allow doing this safely. But until then, you'll have to copy sysnand to emunand and update emunand to 9.2 using CIAs or a game rom with the 9.2 update. Then you have to use rxTools to inject the firm0.bin/firm1.bin files dumped from an already working 9.2 sysnand image. If you never had 9.2 on your 3DS, this means getting these files from some one else. (also note that they should have "emu_" added to the file name so that rxTools will see them)

Once you inject the working firm0/firm1 files into emunand, it's then safe to extract emunand and flash that to your sysnand using gateway menu. While it shouldn't cause issues, I still recommend you get a hard mod if you are in any doubt on if you did it correctly.

Generally, if emunand boots correctly afterwords, you can have it on sysnand once the firm0/firm1 partitions are fixed.

Also if you go the CIA route. You can selectively leave out the CIAs for TWL_FIRM and the DS Cart White list. That way, whatever DS flashcarts that are working on your current sysnand will still work on 9.2.

For example. If you started out with 4.3 FW on a USA console updating to 9.2 in this way would allow AceKard2i to still work. Gateway blue card will still work if you updated from 4.5. I don't recall exactly when that one was blocked. But you get the general idea.

I just learnt a lot from that. Thank you!

 

[Furrymatt]

what does faffaff mean? is that a s or a c?

 

[Wowfunhappy]

I'm thinking I might try porting Decrypt9 or some other things to work as a .3dsx just as an example for people to go off of. Minus well make use of what we have since it's gone public now.

Are you still planning on trying this?

 

[NyaakoXD]

what does faffaff mean? is that a s or a c?

"Kernel Exploited, SVC patched and 7B succeeded - Note Down as S"

 

[Furrymatt]

"Kernel Exploited, SVC patched and 7B succeeded - Note Down as S"

SWEET that means I got 2 s and about 20 something c Ill update my docs info
Thanks for the info!