Homebrew ARM9Loader -- Technical Details and Discussion

[peteruk]

Summed up: Decrypted partition => readable and "modifiable", has to be reencypted to reinject
Encrypted partition => not modifiable, but can be dumped anyway and reinjected

--------------------- MERGED ---------------------------


The arm9loaderhax.bin is your CFW.
There is a payload on NAND too. This one will need to be updated. Updaters will be given for this. You won't need to compile them if you already have a9lhax installed.

thanks for explaining this, appreciate it

 

[Supster131]

Summed up: Decrypted partition => readable and "modifiable", has to be reencypted to reinject
Encrypted partition => not modifiable, but can be dumped anyway and reinjected

That's great to know! I'll be updating then, that way I can delete my emuNAND and regain 2GB on my SD card.

 

[RednaxelaNnamtra]

Last I heard, screen init was going to be a patch for A9LH itself, with screen deinit handled by payloads before firmlaunching.

Yes I know, but my bootloader is included in a arm9loaderhax fork, and I also some people may be afraid to update their nand payload, these people could use the bootloader loader together with added screen init.

 

[3xkrazy]

Last I heard, screen init was going to be a patch for A9LH itself, with screen deinit handled by payloads before firmlaunching.

Could you clarify this? So screen init will be built into A9LH itself... will current payloads (D9, EmuNAND9, Uncart, CFW, etc.) be usable in it's current state, or will some of them need to be modified to start at offset 0x12000?

I was hoping one of the devs would be able to patch the brahma menu into A9LH itself, so that we could select the payload we want to run during boot.

 

[ChaosRipple]

Could you clarify this? So screen init will be built into A9LH itself... will current payloads (D9, EmuNAND9, Uncart, CFW, etc.) be usable in it's current state, or will some of them need to be modified to start at offset 0x12000?

I was hoping one of the devs would be able to patch the brahma menu into A9LH itself, so that we could select the payload we want to run during boot.

IIRC, everything before the offset 0x12000 is ROP code. That's why you need to trim that part off of the CFW for A9LH. So my guess is that you will still need to trim those byes out for a CFW to work unless someone creates a Arm9Loader.bin that will read the CFW starting at 0x12000.

 

[mariogamer]

Summed up: Decrypted partition => readable and "modifiable", has to be reencypted to reinject
Encrypted partition => not modifiable, but can be dumped anyway and reinjected

--------------------- MERGED ---------------------------


The arm9loaderhax.bin is your CFW.
There is a payload on NAND too. This one will need to be updated. Updaters will be given for this. You won't need to compile them if you already have a9lhax installed.

CFW? How? Renaming the main cfw file (like cake.dat,for cake) to arm9loaderhax.bin?

 

[Potato hoarder]

Can someone explain this in words everyone can understand?

 

[ChaosRipple]

CFW? How? Renaming the main cfw file (like cake.dat,for cake) to arm9loaderhax.bin?

Yes basically but you delete the first 0x12000 bytes because it's ROP code.

 

[3xkrazy]

CFW? How? Renaming the main cfw file (like cake.dat,for cake) to arm9loaderhax.bin?

rename build/main.bin to arm9loaderhax.bin for Cakes and ReiNand. I don't think the offical Cakes support A9HL right now, but I might be wrong according to it's updated github. I'll check that out later.

 

[mariogamer]

rename build/main.bin to arm9loaderhax.bin for Cakes and ReiNand. I don't think the offical Cakes support A9HL right now, but I might be wrong according to it's updated github. I'll check that out later.

Yes since: https://github.com/mid-kid/CakesForeveryWan/commit/c7304f4f41f71b00830f4dc15d2234667f6831a1 I think.

 

[Supster131]

Can someone explain this in words everyone can understand?

How Arm9LoaderHax works?

I'm probably not the best person to answer this, but I'll try my best. Arm9LoaderHax loads the hax/payload about a millisecond after you press the power button, even before the 3DS home menu boots. Unlike menuhax which boots after most things from sysNAND have loaded (one of the important things being theme data). This means you have control over Arm9 before boot, which means way faster boot times and a 100% boot rate, plus more.

Any feel free to correct me or add on to what I said.

 

[mariogamer]

Can someone explain this in words everyone can understand?

Everyone can understand,just have to do some efforts...

Like me I was a noob but always try to understand,so now I can explain lot of thing on 3ds scene...

--------------------- MERGED ---------------------------

How Arm9LoaderHax works?

I'm probably not the best person to answer this, but I'll try my best. Arm9LoaderHax loads the hax/payload about a millisecond after you press the power button, even before the 3DS home menu boots. Unlike menuhax which boots after most things from sysNAND have loaded (one of the important things being theme data). This means you have control over Arm9 before boot, which means way faster boot times and a 100% boot rate, plus more.

Any feel free to correct me or add on to what I said.

Pretty sure it's good.

 

[Potato hoarder]

Everyone can understand,just have to do some efforts...

Like me I was a noob but always try to understand,so now I can explain lot of thing on 3ds scene...

--------------------- MERGED ---------------------------


Pretty sure it's good.

If you can explain lots on the 3ds scene, could you start with how arm9loader hax works?

 

[RednaxelaNnamtra]

IIRC, everything before the offset 0x12000 is ROP code. That's why you need to trim that part off of the CFW for A9LH. So my guess is that you will still need to trim those byes out for a CFW to work unless someone creates a Arm9Loader.bin that will read the CFW starting at 0x12000.

That's something my bootloader already does(on the devices it works).


Maybe I will try to port ctrbootmanager, after my bootctr like bootmanager is working, and nobody did it already till then. While Bootctr is more simple, ctrbootmanager has a nice ui, so especially with screen init it would be an interessting project

 

[mariogamer]

If you can explain lots on the 3ds scene, could you start with how arm9loader hax works?

Ok,but I have to read all,and don't have time now...Also,I have to take my time,I'm not an english man

PS: Find this strange,I understand more than some,and I'm just a teenager XD

 

[Supster131]

If you can explain lots on the 3ds scene, could you start with how arm9loader hax works?

What more do you want to know?

 

[mariogamer]

What more do you want to know?

I understand him,me to I alway want to know all XD

 

[Mrrraou]

If you can explain lots on the 3ds scene, could you start with how arm9loader hax works?

Well, it's in the OP...

 

[Potato hoarder]

What more do you want to know?

How it works and what you can do with it

 

[Supster131]

How it works and what you can do with it

Well, it's in the OP...

How Arm9LoaderHax works?

I'm probably not the best person to answer this, but I'll try my best. Arm9LoaderHax loads the hax/payload about a millisecond after you press the power button, even before the 3DS home menu boots. Unlike menuhax which boots after most things from sysNAND have loaded (one of the important things being theme data). This means you have control over Arm9 before boot, which means way faster boot times and a 100% boot rate, plus more.

Any feel free to correct me or add on to what I said.

As for what you can do with it, load CFW essentially. Once you install A9LH you cannot boot your 3DS without a payload. So you'll need to be using something like (Au)ReiNAND or Cakes.

Currently AuReiNAND allows you to boot into emuNAND and sysNAND.