Homebrew ARM9Loader -- Technical Details and Discussion

  • Thread starter Thread starter Selver
  • Start date Start date
  • Views Views 570,682
  • Replies Replies 4,025
  • Likes Likes 42
So I was looking through payloads that might be easy/nice to modify for a9lh and ReiNAND looks like the best candidate... I'll have to look into the o3ds mod and see if I can get source (since most people who've got it installed have an o3ds) I should have a payload up sometime in the future, not sure when or if someone will beat me to it

To save yourself some work you might want to wait until Rei updates the source code again, I believe in a post he mentioned that he got it to work with A9LH, so I wouldn't be surprised if he will push code related to it in the near futue.
 
Last edited by daxtsu, , Reason: Grammar
  • Like
Reactions: klear and peteruk
To save yourself some work you might want to wait until Rei updates the source code again, I believe in a post he mentioned that he got it to work with A9LH, so I wouldn't be surprised if he pushes code related to it in the near futue.
Meh, I'd rather have it sooner than later... Though "later" won't be for hours, anyways the "trouble" I'll be going through is literally a two line change, compile, copy a few files and upload them somewhere, so no trouble at all really...
 
  • Like
Reactions: peteruk and daxtsu
As much as I would like to do this let's say I downgrade and get my OTP what's the point really? Is this better than using Emunand and if so why?
 
  • Like
Reactions: peteruk
As much as I would like to do this let's say I downgrade and get my OTP what's the point really? Is this better than using Emunand and if so why?
First thing's first arm9 code execution ON BOOT earlier than menuhax ever thought of being, on 10.5... If you brick your sysNAND, so what? You can just boot something like Decrypt9 and restore a NAND backup and be on your way, emuNAND is negated... Why? Easy, this exploit is unpatchable... Leave the FIRM(s) alone and you can update to the latest every time, no worries... Again if something happens, just boot D9 and restore a backup, easy peasy... It's the ULTIMATE 3ds hack, and the only way to fix it is with a hardware revision
 
First thing's first arm9 code execution ON BOOT earlier than menuhax ever thought of being, on 10.5... If you brick your sysNAND, so what? You can just boot something like Decrypt9 and restore a NAND backup and be on your way, emuNAND is negated... Why? Easy, this exploit is unpatchable... Leave the FIRM(s) alone and you can update to the latest every time, no worries... Again if something happens, just boot D9 and restore a backup, easy peasy... It's the ULTIMATE 3ds hack, and the only way to fix it is with a hardware revision
I guess you're right I didn't think about that but the process just seems really convoluted for someone like me I dont want to say I need to be spoon fed but after reading that technical right up I might as well be a dribbling baby. Ill wait for clearer steps so I dont get my dick caught in a ceiling fan again.
 
I guess you're right I didn't think about that but the process just seems really convoluted for someone like me I dont want to say I need to be spoon fed but after reading that technical right up I might as well be a dribbling baby. Ill wait for clearer steps so I dont get my dick caught in a ceiling fan again.
LOL... It's really not THAT bad, assuming you have cubic ninja it's basically downgrade to 1.x-2.x, put files on SD card, scan QR code, get back to 9.2 then compile arm9loaderhax with your OTP dump then run the .3dsx installer which does most of the work for you... But it's really for developers only atm
 
I guess you're right I didn't think about that but the process just seems really convoluted for someone like me I dont want to say I need to be spoon fed but after reading that technical right up I might as well be a dribbling baby. Ill wait for clearer steps so I dont get my dick caught in a ceiling fan again.
Right, it's not an easy process, and attempting it without a hardmod really isn't recommended at all. For N3DS, it's all but required. If you're happy with menuhax and emuNAND, then keep using that. This is just for people who'll put in a lot to gain a little extra. :P
So, the best way to downgrade is 9.x to 4.x, then to 1.x/2.x?
I don't think enough people have performed the downgrade and reported their success to really say what the best method is, but it does seem possible that 4.x FIRM will be more compatible with 2.x titles.
 
LOL... It's really not THAT bad, assuming you have cubic ninja it's basically downgrade to 1.x-2.x, put files on SD card, scan QR code, get back to 9.2 then compile arm9loaderhax with your OTP dump then run the .3dsx installer which does most of the work for you... But it's really for developers only atm
I have cubic Ninja and my N3DS is hard modded I just dont understand how to do this without scratching my head wondering why im getting black screens at step.X know what I mean.
 
Right, it's not an easy process, and attempting it without a hardmod really isn't recommended at all. For N3DS, it's all but required. If you're happy with menuhax and emuNAND, then keep using that. This is just for people who'll put in a lot to gain a little extra. :P

I don't think enough people have performed the downgrade and reported their success to really say what the best method is, but it does seem possible that 4.x FIRM will be more compatible with 2.x titles.
Here's my experience with it, downgrading always errors out for some reason, and when booting again you have to restart the downgrade again... I seemed to have better luck with exploits if I went 9.2 -> 4.5 -> 2.1... But that's just me, several other users have reported just going direct from 9.2 to 1.0 with 0 problems

--------------------- MERGED ---------------------------

I have cubic Ninja and my N3DS is hard modded I just dont understand how to do this without scratching my head wondering why im getting black screens at step.X know what I mean.
Ah, yeah, haven't seen anyone with an n3ds get downgraded yet... I feel like there might be something more that we're missing, something stupid and obvious haha
 
Last edited by dark_samus3,
LOL... It's really not THAT bad, assuming you have cubic ninja it's basically downgrade to 1.x-2.x, put files on SD card, scan QR code, get back to 9.2 then compile arm9loaderhax with your OTP dump then run the .3dsx installer which does most of the work for you... But it's really for developers only atm
Does the 3dsx have to be compiled with the otp.bin. I keep getting errors compiling it. It gets the firm0 and firm1 in data output then errors. Seeing as the data input goes on the sd root can someone share the 3dsx please
 
  • Like
Reactions: peteruk
For anyone who's already got it installed, here's a Very Tiny Payload, essentially just patois' helloARM9 with draw functions taken out. Waits for a button press then powers down. Maybe since it doesn't touch the screen, it'll actually work. :D
Does the 3dsx have to be compiled with the otp.bin. I keep getting errors compiling it. It gets the firm0 and firm1 in data output then errors. Seeing as the data input goes on the sd root can someone share the 3dsx please
Yes, the OTP.bin is mandatory, and unique to each individual 3DS. You can't use anyone else's.
 

Attachments

Awww so this won't work on a N3DSXL? That's a bummer I swear I saw people showing off 1.0 and 0.0.0-00.
 
Small question... To dump the otp, is it possible to downgrade Emunand? (Maybe it's a dumb question but well, it may be interesting to now.)
It would probably be useless because we need a hardmod to install the hax, right?

I'll just stick with MenuHax even if ARM9LoaderHax seems really really great... Don't want to install a hardmod.
 
Small question... To dump the otp, is it possible to downgrade Emunand? (Maybe it's a dumb question but well, it may be interesting to now.)
It would probably be useless because we need a hardmod to install the hax, right?

I'll just stick with MenuHax even if ARM9LoaderHax seems really really great... Don't want to install a hardmod.
You can start the process with emuNAND (though there's really no point for it on o3ds) but you cannot finish it... Mainly because the protection bit has already been set by the NATIVE_FIRM that is loaded on boot and booting it in emuNAND isn't enough to undo that... Also there's no emuNAND patches for 1.x-2.x (or 3.x for that matter) so it wouldn't work
 
Short answer, no.
Longer answer, maybe, if it's a N3DS, and if you set up the not-yet-publicly-implemented bruteforce method http://gbatemp.net/threads/arm9loader-automated-brute-force-using-raspberry-pi2.415032/
Actually, you could just not use the OTP data... Change a byte in the secret sector and hope it works, if it doesn't try again and again until you get a jump to the payload (which is more likely than you'd think) once you get the jump to the payload you'd just need a payload to do the unbricking
 

Site & Scene News

Popular threads in this forum