Homebrew Factory NATIVE_FIRM info.

[PabloMK7]

So recently, a ncch with TID: 0004000100000002 came into my hands. It is the factory NATIVE_FIRM. I extracted the FIRM partition from the exefs and checked for the hashes. They match! So we got a Factory firmware. I tried launching it with Luma3DS, but crashed with the attached crash dump. I also noticed that the block 0x920-0x11FF is filled with "FF" bytes , that is strange as other firms doesn't have that block. So is this firm possible to launch with Luma3DS? (I can't share it because GBAtemp rules)

 

[Suiginou]

1. A firmware consists of more than one title.
2. O3DS factory titles all have TID high 00040001. Factory NATIVE_FIRM will look for dependencies and titles with the same TID high. It won't be able to do anything with your setup as-is.
3. You can't just launch a FIRM like that. You'd need a proper reboot into a different FIRM, which will only hang until you have at least the menu it boots (probably TestMenu) and all of its dependencies.

 

[PabloMK7]

1. A firmware consists of more than one title.
2. O3DS factory titles all have TID high 00040001. Factory NATIVE_FIRM will look for dependencies and titles with the same TID high. It won't be able to do anything with your setup as-is.
3. You can't just launch a FIRM like that. You'd need a proper reboot into a different FIRM, which will only hang until you have at least the menu it boots (probably TestMenu) and all of its dependencies.

You mean all of those?

The problem is I can't go past Luma3DS.
I have also checked that FIRM modules (pm, fs, cxi, etc) are in the FIRM I got.

 

[Suiginou]

You mean all of those?

The problem is I can't go past Luma3DS

More. Presumably at least these, and all of them need to pass hash checks (and possibly ticket checks -- some units apparently don't ship with tickets for factory titles):

0004000100000002 - f_native
(0004000100000102 - f_twl -- not sure if there's a dep)
(0004000100000202 - f_agb -- same)
0004000100001502 - am
0004000100001602 - camera
0004000100001702 - cfg
0004000100001802 - codec
(0004000100001902 - dmnt -- same)
0004000100001a02 - dsp
0004000100001b02 - gpio
0004000100001c02 - gsp
0004000100001d02 - hid
0004000100001e02 - i2c
0004000100001f02 - mcu
0004000100002002 - mic
0004000100002102 - pdn
0004000100002202 - ptm
0004000100002302 - spi
0004000100002402 - ac
0004000100002602 - streetpass sysmodule
0004000100002702 - csnd
0004000100002802 - dlp
0004000100002902 - http
0004000100002a02 - mp
0004000100002b02 - ndm
0004000100002c02 - nim
0004000100002d02 - nwm
0004000100002e02 - soc
0004000100002f02 - ssl
0004000100003102 - ps
0004000100003202 - friends
0004000100003302 - ir
0004000100003402 - boss
0004000100008002 - ns
0004000100008102 - TestMenu
0004000100008a02 - DevErrDi

Also, 176F00 is probably a Tri Force Heroes update or something, not a factory title

And again, I have no idea how you're launching your FIRM, but if you're not doing it with ns:s#LaunchApplicationFIRM or ns:s#LaunchFIRM (too lazy to read up which one is the correct one), you're presumably doomed to failure.

 

[PabloMK7]

More. Presumably at least these, and all of them need to pass hash checks (and possibly ticket checks -- some units apparently don't ship with tickets for factory titles):

0004000100000002 - f_native
(0004000100000102 - f_twl -- not sure if there's a dep)
(0004000100000202 - f_agb -- same)
0004000100001502 - am
0004000100001602 - camera
0004000100001702 - cfg
0004000100001802 - codec
(0004000100001902 - dmnt -- same)
0004000100001a02 - dsp
0004000100001b02 - gpio
0004000100001c02 - gsp
0004000100001d02 - hid
0004000100001e02 - i2c
0004000100001f02 - mcu
0004000100002002 - mic
0004000100002102 - pdn
0004000100002202 - ptm
0004000100002302 - spi
0004000100002402 - ac
0004000100002602 - streetpass sysmodule
0004000100002702 - csnd
0004000100002802 - dlp
0004000100002902 - http
0004000100002a02 - mp
0004000100002b02 - ndm
0004000100002c02 - nim
0004000100002d02 - nwm
0004000100002e02 - soc
0004000100002f02 - ssl
0004000100003102 - ps
0004000100003202 - friends
0004000100003302 - ir
0004000100003402 - boss
0004000100008002 - ns
0004000100008102 - TestMenu
0004000100008a02 - DevErrDi

Also, 176F00 is probably a Tri Force Heroes update or something, not a factory title

And again, I have no idea how you're launching your FIRM, but if you're not doing it with ns:s#LaunchApplicationFIRM or ns:s#LaunchFIRM (too lazy to read up which one is the correct one), you're presumably doomed to failure.

Except gba_f, they have correct hashes. I need help with making the firm launch tho.

 

[Clector]

Also, what units don't ship with tickets for factory titles?

 

[chaojimbo]

I'm curious as to what the importance about all of this is. o:

 

[Ghost Liberator]

Replying the thread to stay updated with it, i'm interested in see what comes

 

[Link_of_Hyrule]

We already have pretty low level access not sure what would happen by using these.

 

[MassExplosion213]

Also, what units don't ship with tickets for factory titles?

Well, tickets are "deleted" by CTRAging. It doesn't always delete stuff right, hence the titles just now surfacing. Our group had to recover the ticket from one 3DS and the tmd and .app from another. Good news is, if built with the factory ticket, it's a legit CIA.

--------------------- MERGED ---------------------------

More. Presumably at least these, and all of them need to pass hash checks (and possibly ticket checks -- some units apparently don't ship with tickets for factory titles):

0004000100000002 - f_native
(0004000100000102 - f_twl -- not sure if there's a dep)
(0004000100000202 - f_agb -- same)
0004000100001502 - am
0004000100001602 - camera
0004000100001702 - cfg
0004000100001802 - codec
(0004000100001902 - dmnt -- same)
0004000100001a02 - dsp
0004000100001b02 - gpio
0004000100001c02 - gsp
0004000100001d02 - hid
0004000100001e02 - i2c
0004000100001f02 - mcu
0004000100002002 - mic
0004000100002102 - pdn
0004000100002202 - ptm
0004000100002302 - spi
0004000100002402 - ac
0004000100002602 - streetpass sysmodule
0004000100002702 - csnd
0004000100002802 - dlp
0004000100002902 - http
0004000100002a02 - mp
0004000100002b02 - ndm
0004000100002c02 - nim
0004000100002d02 - nwm
0004000100002e02 - soc
0004000100002f02 - ssl
0004000100003102 - ps
0004000100003202 - friends
0004000100003302 - ir
0004000100003402 - boss
0004000100008002 - ns
0004000100008102 - TestMenu
0004000100008a02 - DevErrDi

Also, 176F00 is probably a Tri Force Heroes update or something, not a factory title

And again, I have no idea how you're launching your FIRM, but if you're not doing it with ns:s#LaunchApplicationFIRM or ns:s#LaunchFIRM (too lazy to read up which one is the correct one), you're presumably doomed to failure.

Also, in responce to this, DevErrDisp is usually unrecoverable due to the ticket being overwritten

 

[PabloMK7]

nvm

 

[dankzegriefer]

Are you sure?
View attachment 47883
Just installed the dumped ErrDisp, and this happened. I'm not sure if it has to do with ntr, or config enabling crash reports.

EDIT: I have exited ntr mode, and the same crash report displays. Accorting to it, the cause is the home menu.

What's your CFW?

 

[PabloMK7]

What's your CFW?

I just noticed I had dev features enabled in Luma 3DS

 

[dankzegriefer]

I just noticed I had dev features enabled in Luma 3DS

Yeah, that's an effect of Dev Features.

 

[YamiHoshi.nl]

nvm

I already answered it on DSHack.org, but just so others can see it:

Level        LEVEL_PERMANENT (リトライできないプログラム エラーです。)
Summary        SUMMARY_NOT_SUPPORTED (対応していない操作です。)
Module        MODULE_APPLICATION
Description    DESCRIPTION_OUT_OF_MEMORY (1011)
Brief        メモリが足りません。

Long story short: Insufficient RAM.

 

[PabloMK7]

I already answered it on DSHack.org, but just so others can see it:

Level        LEVEL_PERMANENT (リトライできないプログラム エラーです。)
Summary        SUMMARY_NOT_SUPPORTED (対応していない操作です。)
Module        MODULE_APPLICATION
Description    DESCRIPTION_OUT_OF_MEMORY (1011)
Brief        メモリが足りません。

Long story short: Insufficient RAM.

Well, it is an intentional crash

 

[Slattz]

Can I ask what is special about the factory firm compared to other firms?

 

[kje123]

Can I ask what is special about the factory firm compared to other firms?

I'm not an expert, but I believe the factory firm has a blank ticket that allows you to install anything, as well as access to modify/back up the NAND without a hardmod.

 

[cearp]

install anything

my pirate senses are tingling

 

[kje123]

my pirate senses are tingling

No, that's just what I remember from previous times it was brought up.