Hacking Official [Source Release] ReiNand CFW

  • Thread starter Thread starter Reisyukaku
  • Start date Start date
  • Views Views 988,458
  • Replies Replies 6,480
  • Likes Likes 115
Okay got it working from just Ninjhax, instructions if someone else wants to try:

Get the mset 4.x cia from a Gateway release and put the correct version cia matching your region into your sdcard. Get bluecardfix.cia from the same folder if your 3DS does not support your DS card.

Grab FBI version 1.4.2(at later) for Ninjhax. This version supports overwriting.
Grab Pasta CFW to let FBI get am service (install cias)

1. Boot Ninjhax and run Pasta CFW. (You are now in sysNAND)
2. Boot Ninjhax and run FBI
3. Install the mset cia to your NAND(!) not sd.
4. It will ask you to overwrite the old one. Yes.
5. Install the bluecardfix(if you need it)
6. Put the rninstaller.nds onto you DS flashcart.
7. Boot the DS cart from sysNAND! not emuNAND.
8. Run the installer and choose the reiNAND option.
9. After installing restart the console.
10. Start the exploit from DS profile from System Settings and press Start to boot up.

Enjoy!
When I try to follow your steps, I get an error saying "description invalid title version"? What am I doing wrong? I have FBI 1.4.6, the mset for eur from a GW release (btw am running on a 9.0.0-20E n3DS) and am trying the installation after booting Pasta.
 
Hello Rei,

I've been experimenting with your source since you released it. Great work. Fascinating to say the least; I'm learning a lot from it.
One of my biggest issues with my jpn n3ds (turned european) was the non working eshop.

yifan_lu suggested the issue was the ctcert not matching the serial; so I dumped the ram from my old 3ds, and from my new 3ds, replacing the ctcert occurences using your injected arm9 thread.
This are the offset I found (for 9.5 firm):

memcpy((void*)0x01FFB804, patchctcert, 0x7c); // ctcert "ITCM" version
memcpy((void*)0x8095b34, patchctcert, 0x4); // u32 device id
memcpy((void*)0x80ef200, patchctcert, 0x4); // same as above
memcpy((void*)0x80df7c5, patchctcert, 0x4); // same as above
memcpy((void*)0x8095ba0, patchctcert2, 0x180); // ctcert "full" version
memcpy((void*)0x2f06a764, spr, 0x3); // product code (in my case, KTR)

Those however, are not enough. The error code changed, but the eshop is still not loading :/

Would love a clue from you, if you had any to share.

Thanks
Hmm.. i might look into this more.. my N3DS s region swapped from jpn to us, using my US XL's secureinfo file.. so i wonder if my problem would just be the serial too.
 
I just wanted to thank you for releasing your CFW. I lost my GW red card a couple of weeks ago (it didn't even turn up while packing). So to see that your CFW basically does what I was using the red card for (entering into emuNAND), I was very pleased as it means that I don't have to shell out another $60+ to enter emuNAND again. Again, thank you.

My question is how would I go about installing .cia as your NAND is superior to GW in that it has GBA VC support (afaik) as I had BBM on my red card? I don't have access to CN as I'd used the OoT entry point. I apologize if it's been asked already.
 
Hmm.. i might look into this more.. my N3DS s region swapped from jpn to us, using my US XL's secureinfo file.. so i wonder if my problem would just be the serial too.
Not sure, but in theory swapping the ctcert should have turned it into an old 3ds to Nintendo's eyes. This still didn't happen maybe because there are more places to patch? Not sure

Thanks for sharing your time, this is something I periodically come back on, and I feel so stupid for not succeding each time lol
 
I really really hope someone does something akin to a boot selector. Sucks having to switch ROPs every time.
 
When I try to follow your steps, I get an error saying "description invalid title version"? What am I doing wrong? I have FBI 1.4.6, the mset for eur from a GW release (btw am running on a 9.0.0-20E n3DS) and am trying the installation after booting Pasta.
Remember to install to NAND, not SD.
 
Have you tried by yourself? I won't take that risk. Restore mset just a minute but bricking the system can count by money.

Just wanted to let you know. I can confirm now with first hand experience that formatting the Sysnand -after- nvram + mset exploit has been installed, does not have any negative consequences. All it does it wipes out the profile exploit that's installed, which can then be repaired with the NDS flashcart - ROPInstaller.

Tested on New N3DS I had off to the side, which I had previously installed the Nvram + Mset exploit on & nothing else. :)
 
  • Like
Reactions: thaikhoa
Anyone link a precompiled one?

I is two pᴉdnʇs tooo c0mp1le mysƎlf

Edit: Recieved, thanks anonymous person
 
When I try to follow your steps, I get an error saying "description invalid title version"? What am I doing wrong? I have FBI 1.4.6, the mset for eur from a GW release (btw am running on a 9.0.0-20E n3DS) and am trying the installation after booting Pasta.

You have to erase the original one on the nand first (with FBI , title id 0004001000022000 , CTR-N-HASP), then you will be able to install the downgraded one , this worked for me . (before doing this on real nand , I first tested it on my emunand)
 

Site & Scene News

Popular threads in this forum