Homebrew What ever happened to ntrccardhax?

[runetoonxx2]

Just wanna know

 

[Vappy]

https://github.com/normmatt/ntrcardhax

 

[runetoonxx2]

https://github.com/normmatt/ntrcardhax

So its dead? There hasn't been a commit in 3 months

 

[Stoned]

What can it do?

 

[Deleted User]

What can it do?

ARM9 access with a NDS Card that was hacked or something

 

[zoogie]

So its dead? There hasn't been a commit in 3 months

@d3m3vilurr has been working on it
https://github.com/d3m3vilurr/ntrcardhax/tree/more

Problem is, the last piece of the puzzle is an app to flash the payload to an ak2i and @Normmatt says only an arm9 app can do this, which defeats the purpose.

I still would very much like to see a POC anyway.

 

[The Catboy]

It kind of lost speed. It's a nice idea and would have been cool to see, but it seemed like the other options got more attention and this one just dropped out of the public's eye

 

[Quantumcat]

@d3m3vilurr has been working on it
https://github.com/d3m3vilurr/ntrcardhax/tree/more

Problem is, the last piece of the puzzle is an app to flash the payload to an ak2i and @Normmatt says only an arm9 app can do this, which defeats the purpose.

I still would very much like to see a POC anyway.

It can just be a secondary thing anyway, or people can resell flashcarts with the payload or whatever on them. Doesn't seem like a dealbreaker.

 

[evandixon]

Problem is, the last piece of the puzzle is an app to flash the payload to an ak2i and @Normmatt says only an arm9 app can do this, which defeats the purpose.

Ak2i cards have an updatable firmware using a .nds installer run from the cart itself. While I know Normmatt knows what he's talking about, it seems like this would be a non-issue.

 

[Wolfvak]

FYI it also got completely murdered on 10.4

 

[gnmmarechal]

Pretty much dead, since it won't work with 10.4+ afaik, and 10.7 or less can be downgraded to an exploitable firmware just with software.

 

[Roboman]

It was overshadowed by the fact that with arm11 kennel you could downgrade.

Everybody just downgraded rather than bother with the extra hardware.

 

[d3m3vilurr]

i think, ntrcardhax still important for some asian regions.
currently, ninjhax2 payload only support jap, eur, usa, and partially kor.

but, kor n3ds only have 9.6~11.x firm, so they cannot use arm9 control feature until release other arm9 exploit.
if we can launch hblauncher, still can downgrade or upgrade to 10.3, then can use ntrcardhax for the arm9 execution.

 

[shinyquagsire23]

i think, ntrcardhax still important for some asian regions.
currently, ninjhax2 payload only support jap, eur, usa, and partially kor.

but, kor n3ds only have 9.6~11.x firm, so they cannot use arm9 control feature until release other arm9 exploit.
if we can launch hblauncher, still can downgrade or upgrade to 10.3, then can use ntrcardhax for the arm9 execution.

Without an AK2i flasher or similar, the only way to do ntrcardhax would be custom hardware, but that is definitely a valid point.

EDIT: Actually, the other alternative for KOR consoles would be to use a valid SecureInfo_A from a US,EU or JP console and when downgrading, use another region's files. This would cripple the console partially though and would be tricky, because you would also have to get to a point where you can remove KOR titles to make it stable again. That, or just get to ARM9 anyhow and then swap back and remove the US,EU,JP titles.

EDIT: Actually you need ARM9 to install the SecureInfo_A, so nope @ that.

 

[Jair]

NTRCardhax won't work on 10.4+? Bummer I didn't knew that. I was actually hoping that maybe in the future that it could be used to downgrade 11.0 without hardmod.

 

[Roboman]

NTRCardhax won't work on 10.4+? Bummer I didn't knew that. I was actually hoping that maybe in the future that it could be used to downgrade 11.0 without hardmod.

It's been public since Christmas.
Nintendo usua)y patches public kexploits Within a month.

 

[d3m3vilurr]

Without an AK2i flasher or similar, the only way to do ntrcardhax would be custom hardware, but that is definitely a valid point.

EDIT: Actually, the other alternative for KOR consoles would be to use a valid SecureInfo_A from a US,EU or JP console and when downgrading, use another region's files. This would cripple the console partially though and would be tricky, because you would also have to get to a point where you can remove KOR titles to make it stable again. That, or just get to ARM9 anyhow and then swap back and remove the US,EU,JP titles.

EDIT: Actually you need ARM9 to install the SecureInfo_A, so nope @ that.

yep. if can change region code, it is best option. but this action already require arm9 execution first if not use hardmod.

@d3m3vilurr has been working on it
https://github.com/d3m3vilurr/ntrcardhax/tree/more

Problem is, the last piece of the puzzle is an app to flash the payload to an ak2i and @Normmatt says only an arm9 app can do this, which defeats the purpose.

I still would very much like to see a POC anyway.

Normmatt's code need ak2i flash dump and reflash, and he said these actions require arm9 code execution..
but i have some problems for these works.

1. dump
launched ak2i mode, ak2i will change chipid. in this case, need to clear overlay data for dump. so require eject and reinsert to cart.
this action make, cannot dump to ak2i's sdcard with dsl(lost dldi connection at the eject time.(i don't know dsi mode. maybe they can dump to device sdcard. but i'm not have dsi, so not tested..)
currently, i try to use modified uncart code on the jap n3ds. current uncart code can send ntr commands to dscart.
(but i think, my dumped header data is little weird, and i don't know right flashrom position)

2. reflash
reversed ak2i flasher show some custom commands and encrypted flash rom data,
but i don't know direct write command.. (i need to dump before this work, so i will test next time..)

anyway, Normmatt also confirmed, dumped ak2i flashrom data can use another ak2 or ak2i. so someone discover dump and flasher method, it can use all ak2i owners.
(and i think, homebrew flasher can work with dsl and dsi)

 

[shinyquagsire23]

yep. if can change region code, it is best option. but this action already require arm9 execution first if not use hardmod.


Normmatt's code need ak2i flash dump and reflash, and he said these actions require arm9 code execution..
but i have some problems for these works.

1. dump
launched ak2i mode, ak2i will change chipid. in this case, need to clear overlay data for dump. so require eject and reinsert to cart.
this action make, cannot dump to ak2i's sdcard with dsl(lost dldi connection at the eject time.(i don't know dsi mode. maybe they can dump to device sdcard. but i'm not have dsi, so not tested..)
currently, i try to use modified uncart code on the jap n3ds. current uncart code can send ntr commands to dscart.
(but i think, my dumped header data is little weird, and i don't know right flashrom position)

2. reflash
reversed ak2i flasher show some custom commands and encrypted flash rom data,
but i don't know direct write command.. (i need to dump before this work, so i will test next time..)

anyway, Normmatt also confirmed, dumped ak2i flashrom data can use another ak2 or ak2i. so someone discover dump and flasher method, it can use all ak2i owners.
(and i think, homebrew flasher can work with dsl and dsi)

Realistically you should also be able to do flashing from a DS I'm pretty sure? I mean, it would make sense to be able to...

 

[dark_samus3]

Why exactly is arm9 needed to reflash? The arm11 has access to the ntrcard registers (why ntrcardhax works in the first place) so, why couldn't a flasher be made to work on arm11? Or is it just the fact that no one has made it yet?

 

[Roboman]

Why exactly is arm9 needed to reflash? The arm11 has access to the ntrcard registers (why ntrcardhax works in the first place) so, why couldn't a flasher be made to work on arm11? Or is it just the fact that no one has made it yet?

It is difficult if not impossible for the arm11 to interface with ntr cards fully and properly. It was designed to acess the card slot for 3ds games. Ds games also using that slot the premise of this hax