Hacking Official [Source Release] ReiNand CFW

[urherenow]

Possible? Though I am wondering how he dumped something that is supposed to be write only and cleared after use.

Ask those who have 10.3 emunand..

Because they weren't being cleared the same way on 2.0<
Basically, someone smart downgraded an emunand to 2.0 or 1.0 somehow to do this.

 

[ketal]

The keys are those, we have basically what we need. There are a couple console-unique keys but we can calculate them

 

[Aroth]

Because they weren't being cleared the same way on 2.0<
Basically, someone smart downgraded an emunand to 2.0 or 1.0 somehow to do this.

Uh.. what?

Pretty damn sure you can't downgrade a N3DS below 8.1 because there isnt any firmware for it below that and the O3DS firmware would cause a brick, plus the keys in question do not exist on 9.5 and below. Hell the keyslot itself was only created with 9.5 I thought.

 

[tivu100]

And this is what worries me. Because from what I am seeing the downgrade methods are not complete. Something is being left on the system that is causing all the weird ass glitches people seem to be getting.

So as we now have 9.2 N3DS, we can make back up of our NAND before update. So if we can get brick proof (software term. Not idiot proof) then this solve many problem for this self generate key. After downgrade we can restore a clean NAND back up.

Can I go and ask everyone with N3DS firmware between 9.2 and 9.5 to update to 10.3 now we know we need get 9.5+ self generate keys?

Not to too off topic. I downgrade 2 N3DS XL Zelda Hyrule for my nephew without problem. From that experience and what I read so far is the more like new/ out of box system software is, the more success in downgrading. This is not statement though.

What I do with those 2 out of box N3DS is first updated to 10.3 -> install browserhax -> install InvasionFall game -> Delete Browserhax -> install Ironhax -> downgrade to 9.2. All successful on first try.

 

[Apache Thunder]

Uh.. what?

Pretty damn sure you can't downgrade a N3DS below 8.1 because there isnt any firmware for it below that and the O3DS firmware would cause a brick, plus the keys in question do not exist on 9.5 and below. Hell the keyslot itself was only created with 9.5 I thought.

There actually is a way to downgrade n3DS down to 2.0/1.0. You just have to do some "changes" to NAND to make it work. I don't know all the details on it though so don't ask me how that's supposed to work. I'm just as surprised that 1.x/2.x works on an n3DS at all given the difference in hardware specs and what not.

And to those asking if we need to dump our own OTP or some how dig up some of our own console unique keys to use 9.6+ emunand, no that's not at all nessecery. The new 9.6 key is a fixed key that is the same for all consoles. That key was stored in OTP which is setup in a way that is console unique. Someone already dumped it, so that fixed key is already public now it seems.

You only need to dump your OTP if you want to make use of Arm9loaderhax as a method of super early code execution on cold boot I think. Basically menuhax on steroids.

You also need a nand mod to use Arm9loaderhax. It's probably not a very convenient thing to setup. But once it's setup, it's there for good and it's 99% effectively cold boot CFW. Not even a system format will get rid of it.

 

[Aroth]

So as we now have 9.2 N3DS, we can make back up of our NAND before update. So if we can get brick proof (software term. Not idiot proof) then this solve many problem for this self generate key. After downgrade we can restore a clean NAND back up.

Can I go and ask everyone with N3DS firmware between 9.2 and 9.5 to update to 10.3 now we know we need get 9.5+ self generate keys?

Not to too off topic. I downgrade 2 N3DS XL Zelda Hyrule for my nephew without problem. From that experience and what I read so far is the more like new/ out of box system software is, the more success in downgrading. This is not statement though.

What I do with those 2 out of box N3DS is first updated to 10.3 -> install browserhax -> install InvasionFall game -> Delete Browserhax -> install Ironhax -> downgrade to 9.2. All successful on first try.

If you managed to do it without ANY problems then you got lucky as fuck dude.

 

[tivu100]

If you managed to do it without ANY problems then you got lucky as fuck dude.

Yeah. That's why I said in my post, I was not making any misleading STATEMENT. Just an opinion.

My point is as those who are interested in the keys for 9.6+ EMUNAND, we already on 9.2. Therefore we have clean NANDs backup/ ability to make NAND backup. We need either a brick proof downgrading method or hard mod to be able to self generate the keys and downgrade safely back to 9.2. Then restore our clean NAND.

Note also: I said brick proof, not idiot proof because idiot proof may take eternal to be achieved.

 

[Kioku]

If you managed to do it without ANY problems then you got lucky as fuck dude.

The best way to do it is use a clean msd.. And if you're not afraid of losing everything, formatting the system. A clean slate leaves no trace. Oo

 

[AHP_person]

Uh.. what?

Pretty damn sure you can't downgrade a N3DS below 8.1 because there isnt any firmware for it below that and the O3DS firmware would cause a brick, plus the keys in question do not exist on 9.5 and below. Hell the keyslot itself was only created with 9.5 I thought.

I downgraded to 1.0 on n3ds just fine, so did Rei and some others. The keys have always existed (or at least the key sector keys), they just weren't used.

 

[Aroth]

The best way to do it is use a clean msd.. And if you're not afraid of losing everything, formatting the system. A clean slate leaves no trace. Oo

msd? And yeah, for most people who downgraded, a format prior to downgrade was probably not an option (dem eshop saves).

--------------------- MERGED ---------------------------

Ok then, so lets say a person has the keys needed, is updating their emunand to 10.3 something they could do themselves, or does it require major changes to the cfw base code itself?

 

[tivu100]

The best way to do it is use a clean msd.. And if you're not afraid of losing everything, formatting the system. A clean slate leaves no trace. Oo

That's also my point from my 2 post ago.

As we have 9.2 N3DS, we should just back up everything and format to clean/out of box state to do this then downgrading should be easier.

The consensus is people who reported error were downgrading with many apps installed on their NANDs. They just don't want to lose some whatever previous data to not to do a system format before downgrading.

 

[Kioku]

msd? And yeah, for most people who downgraded, a format prior to downgrade was probably not an option (dem eshop saves).

--------------------- MERGED ---------------------------

Ok then, so lets say a person has the keys needed, is updating their emunand to 10.3 something they could do themselves, or does it require major changes to the cfw base code itself?

The CFW would need to have changes implemented to support the new emunand.. On top of whatever code is necessary for us to even upgrade in the first place.

Msd=microsd

 

[Urbanshadow]

So the keys are now leaked. That didn't last long.

 

[urherenow]

Uh.. what?

Pretty damn sure you can't downgrade a N3DS below 8.1 because

That's how it was done. I wasn't speculating.

 

[tivu100]

Fail.

***Hiding under the bed*** I was about to say what @ Aroth said.

That knowledge is widely not known by newbies/end users like me. Can we be forgiven for this?

Who are the ones what release those unofficial sysupdater for downgrading? Can we request for a stable and brick proof build? This would help alot

 

[Vappy]

I downgraded to 1.0 on n3ds just fine, so did Rei and some others.

With some nondescript "changes to the NAND" that you were a little vague about. All said and done, I'm surprised it was that simple; I'd seen a few people theorize about downgrading a N3DS to <3.0 to dump the OTP months ago, but general consensus at the time was that it just wouldn't be compatible at all and would fail. Glad to see that proved wrong.

 

[AHP_person]

With some nondescript "changes to the NAND" that you were a little vague about. All said and done, I'm surprised it was that simple; I'd seen a few people theorize about downgrading a N3DS to <3.0 to dump the OTP months ago, but general consensus at the time was that it just wouldn't be compatible at all and would fail. Glad to see that proved wrong.

Yeah, I had the idea months ago, but I set the idea aside when a simple test failed (which I later realized was my bad and not the console's). Someone on our Skype group brought it up again, and we started proper testing.

 

[Vappy]

Yeah, I had the idea months ago, but I set the idea aside when a simple test failed (which I later realized was my bad and not the console's). Someone on our Skype group brought it up again, and we started proper testing.

Any chance of you revealing the steps involved, now that the important part has already been leaked? Or are you waiting until you've done some more work with it? Saw you post on twitter earlier that you were hoping no-one would leak it early so you could get something done first.

 

[AHP_person]

Any chance of you revealing the steps involved, now that the important part has already been leaked? Or are you waiting until you've done some more work with it? Saw you post on twitter earlier that you were hoping no-one would leak it early so you could get something done first.

Yeah. I wanted to get arm9loaderhax nice and neat for other people first, but the keys were leaked so early. I still plan to share everything once it's over and done with, assuming no one leaks info before then.

 

[tivu100]

Yeah, I had the idea months ago, but I set the idea aside when a simple test failed (which I later realized was my bad and not the console's). Someone on our Skype group brought it up again, and we started proper testing.

What is the benefit of downgrading down to 3.x on N3DS? Would it give us cleaner NAND when update back to 9.2 (for those with incomplete downgrade from >9.2)?

Edit: Nevermind the first question. just saw the answer.