Hacking 3DS unbricking progress

[HAFEDHBY]

You can NOT use a dump from another 3DS XL. It is encrypted with a key that is locked to your specific 3DS. Using a nand dump from a different 3DS is the fastest way to brick your 3DS beyond recovery.

I have not understood or not I can use a copy of nand another 3ds
Where can I download the nands 3ds?

 

[mvmiranda]

Has anyone tried using the new V2 raspberry pi?

The one announced this month?
I think this should work too, right? Of course the memory slot changed from SD to micro SD but the "guts" are the same, and it still supports the linux "flavor" we use to unbrick, right?

 

[bkifft]

http://4dsdev.org/forum.php?id=5
Could you make it less obvious that you're gathering IPs and useragents.

Offtopic: Why on earth would someone want to do this?

Has anyone tried using the new V2 raspberry pi?

As the new SoC is said to be fully compatible the tool itself should still work. The supplied linux image won't. (Sidenote: gamesquest1 tested it on a B+ where it didn't work, too.).

While tweaking a regular RPi linux image ain't hard at all (just requires USB boot and a self built kernel without the MMC stuff, for both of which there exists a plethora of tutorials) I won't be doing it in the foreseeable future. I will answer questions that can't be googled though.

I have not understood or not I can use a copy of nand another 3ds
Where can I download the nands 3ds?

(Disclaimer: The following is not meant to be condescending. I'm just trying to use as simple English as possible.)

No other 3DS NAND. Only own 3DS NAND. No way for other NAND.

Pressed "U"? Or pressed "F"?

If pressed "F" and not own 3DS NAND -> 3DS boom byebye.

 

[y03usw6e]

We are an English speaking community. Please post in legible English ONLY.

http://gbatemp.net/help/terms

 

[gamesquest1]

http://gbatemp.net/help/terms

Yeah I think he is struggling with the English side of things, maybe if someone can help him understand in French they should take it to PM's

 

[Arisotura]

http://4dsdev.org/forum.php?id=5




Could you make it less obvious that you're gathering IPs and useragents.

Do you think it's the best place to post this?

And do you think I'm the only one to do that? Every board does that.


By the way, the data for guests are deleted after 5 minutes. We're not the NSA.

 

[Arisotura]

As a side note, that bug has been fixed.


(because if you didn't notice, it was a bug, not OMG WE TRACK YOU WE ARE THE NSA)

 

[xdrako23x]

.

Lawl you use the same avatar picture as my steam account.

 

[Razorbacktrack]

Any news for Raspberry Pi 2?

 

[bkifft]

Any news for Raspberry Pi 2?

Sorry, all quiet on the western front.

At least I haven't had any feedback yet.

I also don't own a Pi 2, nor do I have any means to connect my big (as in regular SD card size) MMC card to the microSD slot for testing purposes.

 

[Avalynn]

I could help on this end? I have a RPI 2 and have ways to connect to the microSD and eMMC on the N3DS XL if needed.

 

[bkifft]

I could help on this end? I have a RPI 2 and have ways to connect to the microSD and eMMC on the N3DS XL if needed.

Thanks for the offer, when/if I find the time to build a kernel I'll let you know.

 

[Mr.1999]

Hi folk!
I'm really sorry for my this new slight OT.
I don't want hijacking the thread but I need some informations related with the Arduino's sketch 3dsunbricker.
About the possibility to put and remove a password into the cards (Lock/Unlock) I can't understand some things.
I don't understand where the presetted password is stored.
I saw in sd_raw_roland.cpp that at row 199 there is what should be the presetted password used by Arduino:
199 char GlobalPWDStr[16] = {'T', 'W', 'I', 'L', 'I', 'G', 'S', 'P', 'O', 'R', 'K', 'L', 'E', 'P', 'A', 'H'}; // password used to lock the card
(by the history of the sd_raw_roland.cpp file that line was changed at the end assuming the syntax that I quoted)
My problem is that it isn't the password that is used by the scketch, the real one is totally different, it doesent match with that.
More, even changing the string in the row 199 seems to do anything, the password used by the Arduino's sketch is still the same as before.
It would seem that the string in the line 199 is good for nothing due the fact that even changing it all still works with the password issued which is always the same, nothing changes.
That's what I don't understand.
Where is the real password stored?
How can it be possible that the password in the row 199 can be translated into the real one used by the sketch due the fact that by changing it nothing happens and it remains unchanged?
If there is an algorithm somewhere in the library or the sketch that translates the string in the real password used by Arduino I expect that by changing the string then will be issued a different password, instead despite any change it's always the same.
Really I don't understand it.
Apologize me again for the OT and the long message.
Thanks in advance for any possible answer.
Regards.
Bob

 

[bkifft]

I saw in sd_raw_roland.cpp that at row 199 there is what should be the presetted password used by Arduino:
199 char GlobalPWDStr[16] = {'T', 'W', 'I', 'L', 'I', 'G', 'S', 'P', 'O', 'R', 'K', 'L', 'E', 'P', 'A', 'H'}; // password used to lock the card
(by the history of the sd_raw_roland.cpp file that line was changed at the end assuming the syntax that I quoted)

The one in line 199 was just an arbitrarily chosen test password used to test if the locking/unlocking of SD card works (Bro-hoof if you can guess it's origin).

Where is the real password stored?

The real password is generated by xoring the device specific CID with secret GW magic (the key array) in the unlock function "unlock_XOR()" (line 1347ff.).

Fröhliches Käsefondue

 

[Mr.1999]

Thank you bkifft!
I'm sorry to still abusing of your and yours patience but I need one clarification.
Ok, the real password is generated by xoring the device specific CID with the secret key array in the unlock function at line 1347.
That's for VERNAM CYPHER UNLOCK (v) or VERNAM CYPHER LOCK (o) using Vernam's cipher.
For what I can see it works precisely in that way, the password change with the card (it's related to the CID of the card).
Instead I'm talking about LOCK (l) and UNLOCK (u) where I see the password is alway the same without regard to the CID of the card.
Surely could be that the string "TWILIGSPORKLEPAH" xoring with the secret key array at line 1347 is able to produce the password issued by Arduino by following LOCK (l) and UNLOCK (u) from the menu, though if this is the case then by changing that string to something different (for instance "WTZLIGPSORKLEPHA") the itself password which is send have to be changed too, but it isn't so.
Here is why I'm asking.
You wrote that TWILIGSPORKLEPAH is just an arbitrarily chosen test password used to test if the locking/unlocking card works.
The password that I see by performing LOCK (l) or UNLOCK (u) is a meaningful sentence that never changes, it's always the same even changing the string "TWILIGSPORKLEPAH" into line 199.
Since I don't know if I can show the password here I will only say that what I read and I checked out is nothing but a truncated message that is output from skectch and that seems to be stored or pointed specifically rather than obtained from the Vernam cipher or something else.
This is what I can't understand.
Apologize me again for the OT.
Thanks in advance.
Regards.
Bob

 

[bkifft]

I'm sorry to still abusing of your and yours patience but I need one clarification.

As I can't be arsed right now to check into it (nothing personal ) let me tag in the arduino versions author krisztian1997.

edit: In the mean time you can check out http://www.seanet.com/~karllunt/sdlocker2.html. While thats for a barebone atmega the principles are still the same.

 

[Mr.1999]

Hi bkifft.
I'm sorry I have bothered you and all here by having wrote OT things, apologize me.
I thank you for your valuable answers and the patience.
I already know sdlocker2, thanks for the hint though.
I don't intend to argue or criticize anyone or anything.
I was just trying to figure out how it works because for what I can see the password sent actually don't depends from the syntax of the string at line 199 nor from the magic key array when using LOCK (l) and UNLOCK (u).
Surely it works, meaning that locks and unlocks the card, however like password is used a portion of a text message and only by changing its content it is possible to change the password in use.
Ok, bkifft.
Thank you very much again for the support and please to excuse me for having made you angry, that was not my intention.
Sorry!
Kind regards and thanks.
Bob

 

[bkifft]

Hi bkifft.
I'm sorry I have bothered you and all here by having wrote OT things, apologize me.
Sorry!

No worries, I'm in no way offended or anything

Answering your question would just mean I'd have to figure out how krisztian1997 did it exactly on my own first, that's why I hoped the tagging would trigger him.

You could try and write him a PM, though.

 

[happydance]

hello, I finally bricked my 3ds by messing around with rxtool I got 3 NAND backup made by gateway and a teensy++ 2.0

I can wire up my teensy, but I kinda lack guide to follow regarding the software side on flashing my nand backup back

and I've read in this post

you only need to unbrick if you have the blue screen of death, you can upgrade and downgrade at will with a hardware mod and SD reader

I got a black screen with no recovery menu, does that mean I don't need to unlock it? and how would I write back the nand backup?

 

[Oishikatta]

hello, I finally bricked my 3ds by messing around with rxtool I got 3 NAND backup made by gateway and a teensy++ 2.0

I can wire up my teensy, but I kinda lack guide to follow regarding the software side on flashing my nand backup back

and I've read in this post


I got a black screen with no recovery menu, does that mean I don't need to unlock it? and how would I write back the nand backup?

This thread is specifically for bricks caused by gateway's brick code. In your case all you need to do should be to just write the backup normally, using the equivalent of `dd` (linux/mac) or win32diskimager (windows).