Hacking How to use BrowserHax on Firmware 10.7.0 and 11.0.0 and get your exploit games (ready for slowhax)

clancy94

Well-Known Member
OP
Member
Joined
Oct 18, 2008
Messages
454
Trophies
1
XP
532
Country
Australia
Reddit user 'ASK-ABOUT-VETRANCH' from /r/3dshacks said it's cool that I post this here for more exposure.
Link: https://www.reddit.com/r/3dshacks/comments/5eu9h2/how_to_successfully_use_browserhax_on_the_first/

*EDIT* As of 27/11 Legends of Exidia is the only DSiWare game still available to buy/download in the eShop, so that's why it's the only one mentioned in the guide.

Before reading this guide let's be clear that 10.7 is already downgradeable and doesn't need to wait for slowhax, this is just to fix browserhax as a homebrew entry point for some people who are getting the browser nag. People on 11.0 & 11.1 are not eligible for normal downgrade methods but are eligible for slowhax (when it's released), use this guide to download a DSiWare game (Legends of Exidia is the last one left) in preparation for slowhax & the before LoE is removed from the eShop too!

Preface
It should be noted that I did not discover this trick. I can't find the comment right now The comment that helped me with is is here. Its buried in a thread from a week month ago and provides a command to use on your router to bypass the version check. I am simply providing a full list of steps to do this.

It should be noted that I have only tested this on one device on one firmware (N3DSXL 11.0.0-33U), and that I have set this up in one specific scenario. I cannot guarantee every configuration will work with this.

This guide should work even if you have already had the browser nag (I know that I did). If it doesn't, you may need to do a system format (back up your data!) to be able to do this.

I specified only 10.7 and 11.0 in the title because as far as I know, lower versions do not have the browser nag. If you are interested in putting homebrew on those, follow Plailect's guide exactly.

Part 0: Preparation
For this guide, you need the following:

  • Your 3DS on 10.7 or 11.0 firmware
  • An SD card loaded with the browserhax files described in Plailect's guide, plus a ropbin payload that is compatible with your device and firmware obtained from Smea's site.
  • A router you can SSH into with root access, or a rooted* Android device which you can use hotspotting on.
  • If you are using an Android phone, you need to install an app that lets you modify iptables. I used this.
* note that I have only tested with a rooted device on Marshmallow 6.0.1, your success may vary.

You should rename the ropbin payload you downloaded to browserhax_hblauncher_ropbin_payload.bin and place it in the root of the SD. I was getting stuck on a grey screen because the exploit couldn't get this payload, so if you have it already it should let it work fine.

It may also be possible to do this if you have can create a hotspot on your laptop, however you will need to be able to use iptables or an equivalent.

You will also need to make sure you have ctr-httpwn if you want to download an exploit game such as Steel Diver: Sub Wars or one of the DSiWare games in preparation for Slowhax. You will not be able to use the one packaged with the current browserhax kit because yellows8's stuff is being moved. There are mirrors set up for this and a fork of the project that lets you choose the mirror.

Part 1: Connecting to your router/phone
  1. If you are connected to any networks on your 3DS other than the router you plan on using, remove them from your 3DS.
  2. Now, create the hotspot on your phone if you are using it, and connect your 3DS just like you normally would, without any DNS.
  3. Now, set up the iptableson the device of your choice:
    • If you are using your router, you need to SSH into it now. On Windows, you can use something like PuTTY. If you are on Mac, you should be able to use ssh through the Terminal Emulator. On Linux, just run your shell of choice and use ssh as normal. You will connect to it by entering the local IP address of your router, and (usually) port 22.
    • If you are using your phone, open the iptables app you installed.
    • Once you have done one of the above, you will need to run the following command: iptables -I FORWARD -d conntest.nintendowifi.net -j DROP.
    • If this executes successfully (no output usually means successful), you can proceed to the next part.
Part 2: Using browserhax
  1. You can essentially do this like you normally would. Since the default browserhax page is down, you should use something like Plailect's mirror for it. I did this using the QR code, but entering the URL should work fine.
  2. Assuming everything went correctly, you should have entered the Homebrew launcher! If you are on 10.7, you should be able to follow Plailect's guide from here on out. Before that, skip to Part 5 of this guide.
  3. If you are on 11.0 and are interested in getting a DSiWare exploit game from the eShop (I believe only LoE remains, $7.99), or you would like to download a game from the eShop for an alternate secondary entrypoint to Menuhax, you need to go to Part 3. Otherwise if you are just interested in Homebrew for now, you can install Menuhax as per Plailect's guide, after going to Part 5 of this guide.
Part 3: Using ctr-httpwn
  1. Do NOT install Menuhax. If you did, you need to delete it. It is not compatible with ctr-httpwn.
  2. Run ctr-httpwn from the Homebrew launcher and install it.
  3. Once done and you are back at the Homebrew launcher, press Start and then reboot directly into the home menu. If you do a normal reboot this will not work and you will have to re-do Part 2!
  4. Open the eShop like you normally would. It may take some time (especially if you are hotspotting on your phone) to load, so be patient.
    • If after waiting for a long time you receive a connection error, re-do Part 2, then do Part 4, and then finally come back and retry Part 3.
  5. Download whatever titles you need for your exploit and install. Do not install updates to these titles if prompted.
  6. If you have done Part 4 at all before this step (in case of an error), re-do Part 1.
  7. Get back into the Homebrew Launcher by re-doing part 2, then proceed to the conclusion.
Part 4: Re-Allowing Access
  1. Now that we don't have to block Nintendo's stuff anymore, you need to remove the entry you created in iptables
  2. First, through whatever medium you were modifying, run the command iptables -L --line-numbers. You should get an output listing a bunch of rules.
    • If you are using the Android app to do this, you may need to clear the output screen between commands to see their output.
  3. Look for a line in the output which says Chain FORWARD. Below it you will find some forwarding rules. Look for the one with an IP that starts with 69. This is the custom rule we added. Remember the left-most number corresponding to the row of this rule.
  4. Run the command iptables -D FORWARD #, where # is the number of the row from the last step.
  5. Now you should be able to access everything without issues. You will still get nags from Nintendo stuff about updating and whatnot.
Part 5: Conclusion
  1. You should probably do Part 4 now. It isn't necessary for Android devices (probably, do it anyways though).
  2. If you are on 10.7, go ahead and downgrade. What are you waiting for?
  3. If you are on 11.0, you can either set up Menuhax (note that you will have to delete it and re-install any time you want to use ctr-httpwn), or set up a different secondary entrypoint (steelhax, basehax, etc) and sit tight while we wait for the release of Slowhax for downgrading. Whatever you do, do NOT update at this point. It's probably safer to just disable WiFi.
And that's pretty much everything! I hope that the guide is clear and I will try and clarify in the comments. Hopefully some more experienced users can help too. It may look long but in reality you can have your setup fully complete in 20 minutes, which is much quicker than the hours I spent trying to race against the nag like in Plailect's guide.
 
Last edited by clancy94,

Miles54321

Well-Known Member
Member
Joined
Dec 16, 2010
Messages
905
Trophies
0
Location
Gateway Headquarters with SonyUSA
Website
derbergerac.com
XP
486
Country
Clancy94, I've got a question,

I have a N3ds with Gateway 3.7 on
- sysNand (V9.0.0-E)
- emuNand (V11.2.0-E)

How would I get Homebrew Launcher CIA for my N3ds without having to get Arm9/Luma3DS

I've heard Luma3DS is better for homebrew but what homebrew is available for a Gateway N3DS Emu 11.2, SysN 9.0?

Thanks :)
 

clancy94

Well-Known Member
OP
Member
Joined
Oct 18, 2008
Messages
454
Trophies
1
XP
532
Country
Australia
Clancy94, I've got a question,

I have a N3ds with Gateway 3.7 on
- sysNand (V9.0.0-E)
- emuNand (V11.2.0-E)

How would I get Homebrew Launcher CIA for my N3ds without having to get Arm9/Luma3DS

I've heard Luma3DS is better for homebrew but what homebrew is available for a Gateway N3DS Emu 11.2, SysN 9.0?

Thanks :)
Did you try this guide? It hasn't been tested one 11.2 but doesn't mean it wouldn't work.

Otherwise you'd be looking at one of these: https://3ds.guide/homebrew-launcher-(no-browser)

I'd recommend just following Plailects guide from the start and getting luma3ds running, doesn't take too long and it's so much better than my old gateway


Sent from my iPhone using Tapatalk
 

karloz25

Well-Known Member
Member
Joined
Dec 11, 2010
Messages
452
Trophies
1
XP
865
Country
United States
i am super new to the exploitable 3ds scene, i use to do R4i cards.

So at the end of this tutorial, what will be accessible to me? nand? 3ds pirated games playable? homebrew apps?

Thanks.
 

clancy94

Well-Known Member
OP
Member
Joined
Oct 18, 2008
Messages
454
Trophies
1
XP
532
Country
Australia
This will basically give you access to the Homebrew launcher which you will want to use to buy Legends of Exidia and download Steel divers sub wars from the eshop (you can't access the eshop on anything but the latest firmware usually), then with the release of slowhax in December you'll be able to downgrade your 3ds giving it access to your nand then installing a CFW (custom firmware). With CFW installed you can install homebrew apps such as Freeshop which is a hacked version of the eShop and you'll be able to play games for free, and online without risk of ban :)


Sent from my iPhone using Tapatalk
 
Last edited by clancy94,

Hanafuda

Well-Known Member
Member
Joined
Nov 21, 2005
Messages
4,485
Trophies
2
XP
6,940
Country
United States
Is this why I can't get browserhax to work following plailect's guide on a 10.7 N3DS? I was successful on another one about 7-8 weeks ago (same model, SM3DLand bundle) but this time I followed the updated guide to edit the 1st bookmark, etc., with the new URL but I get a "must update to use browser" popup before the page opens, every time.
 

fodder

STARMAN
Member
Joined
Aug 3, 2014
Messages
863
Trophies
0
XP
544
Country
United States
Is this why I can't get browserhax to work following plailect's guide on a 10.7 N3DS? I was successful on another one about 7-8 weeks ago (same model, SM3DLand bundle) but this time I followed the updated guide to edit the 1st bookmark, etc., with the new URL but I get a "must update to use browser" popup before the page opens, every time.
Yeah, they patched browserhax on 10.7 not too long after you did it and now you need to do this to do it

Sent from my LG-H901 using Tapatalk
 

MrHaqs

Well-Known Member
Newcomer
Joined
Jun 12, 2016
Messages
97
Trophies
0
Age
21
Location
Home
XP
219
Country
United Kingdom
Reddit user 'ASK-ABOUT-VETRANCH' from /r/3dshacks said it's cool that I post this here for more exposure.
Link: https://www.reddit.com/r/3dshacks/comments/5eu9h2/how_to_successfully_use_browserhax_on_the_first/

Preface
It should be noted that I did not discover this trick. I can't find the comment right now The comment that helped me with is is here. Its buried in a thread from a week month ago and provides a command to use on your router to bypass the version check. I am simply providing a full list of steps to do this.

It should be noted that I have only tested this on one device on one firmware (N3DSXL 11.0.0-33U), and that I have set this up in one specific scenario. I cannot guarantee every configuration will work with this.

This guide should work even if you have already had the browser nag (I know that I did). If it doesn't, you may need to do a system format (back up your data!) to be able to do this.

I specified only 10.7 and 11.0 in the title because as far as I know, lower versions do not have the browser nag. If you are interested in putting homebrew on those, follow Plailect's guide exactly.

Part 0: Preparation
For this guide, you need the following:

  • Your 3DS on 10.7 or 11.0 firmware
  • An SD card loaded with the browserhax files described in Plailect's guide, plus a ropbin payload that is compatible with your device and firmware obtained from Smea's site.
  • A router you can SSH into with root access, or a rooted* Android device which you can use hotspotting on.
  • If you are using an Android phone, you need to install an app that lets you modify iptables. I used this.
* note that I have only tested with a rooted device on Marshmallow 6.0.1, your success may vary.

You should rename the ropbin payload you downloaded to browserhax_hblauncher_ropbin_payload.bin and place it in the root of the SD. I was getting stuck on a grey screen because the exploit couldn't get this payload, so if you have it already it should let it work fine.

It may also be possible to do this if you have can create a hotspot on your laptop, however you will need to be able to use iptables or an equivalent.

You will also need to make sure you have ctr-httpwn if you want to download an exploit game such as Steel Diver: Sub Wars or one of the DSiWare games in preparation for Slowhax. You will not be able to use the one packaged with the current browserhax kit because yellows8's stuff is being moved. There are mirrors set up for this and a fork of the project that lets you choose the mirror.

Part 1: Connecting to your router/phone
  1. If you are connected to any networks on your 3DS other than the router you plan on using, remove them from your 3DS.
  2. Now, create the hotspot on your phone if you are using it, and connect your 3DS just like you normally would, without any DNS.
  3. Now, set up the iptableson the device of your choice:
    • If you are using your router, you need to SSH into it now. On Windows, you can use something like PuTTY. If you are on Mac, you should be able to use ssh through the Terminal Emulator. On Linux, just run your shell of choice and use ssh as normal. You will connect to it by entering the local IP address of your router, and (usually) port 22.
    • If you are using your phone, open the iptables app you installed.
    • Once you have done one of the above, you will need to run the following command: iptables -I FORWARD -d conntest.nintendowifi.net -j DROP.
    • If this executes successfully (no output usually means successful), you can proceed to the next part.
Part 2: Using browserhax
  1. You can essentially do this like you normally would. Since the default browserhax page is down, you should use something like Plailect's mirror for it. I did this using the QR code, but entering the URL should work fine.
  2. Assuming everything went correctly, you should have entered the Homebrew launcher! If you are on 10.7, you should be able to follow Plailect's guide from here on out. Before that, skip to Part 5 of this guide.
  3. If you are on 11.0 and are interested in getting a DSiWare exploit game from the eShop (I believe only LoE remains, $7.99), or you would like to download a game from the eShop for an alternate secondary entrypoint to Menuhax, you need to go to Part 3. Otherwise if you are just interested in Homebrew for now, you can install Menuhax as per Plailect's guide, after going to Part 5 of this guide.
Part 3: Using ctr-httpwn
  1. Do NOT install Menuhax. If you did, you need to delete it. It is not compatible with ctr-httpwn.
  2. Run ctr-httpwn from the Homebrew launcher and install it.
  3. Once done and you are back at the Homebrew launcher, press Start and then reboot directly into the home menu. If you do a normal reboot this will not work and you will have to re-do Part 2!
  4. Open the eShop like you normally would. It may take some time (especially if you are hotspotting on your phone) to load, so be patient.
    • If after waiting for a long time you receive a connection error, re-do Part 2, then do Part 4, and then finally come back and retry Part 3.
  5. Download whatever titles you need for your exploit and install. Do not install updates to these titles if prompted.
  6. If you have done Part 4 at all before this step (in case of an error), re-do Part 1.
  7. Get back into the Homebrew Launcher by re-doing part 2, then proceed to the conclusion.
Part 4: Re-Allowing Access
  1. Now that we don't have to block Nintendo's stuff anymore, you need to remove the entry you created in iptables
  2. First, through whatever medium you were modifying, run the command iptables -L --line-numbers. You should get an output listing a bunch of rules.
    • If you are using the Android app to do this, you may need to clear the output screen between commands to see their output.
  3. Look for a line in the output which says Chain FORWARD. Below it you will find some forwarding rules. Look for the one with an IP that starts with 69. This is the custom rule we added. Remember the left-most number corresponding to the row of this rule.
  4. Run the command iptables -D FORWARD #, where # is the number of the row from the last step.
  5. Now you should be able to access everything without issues. You will still get nags from Nintendo stuff about updating and whatnot.
Part 5: Conclusion
  1. You should probably do Part 4 now. It isn't necessary for Android devices (probably, do it anyways though).
  2. If you are on 10.7, go ahead and downgrade. What are you waiting for?
  3. If you are on 11.0, you can either set up Menuhax (note that you will have to delete it and re-install any time you want to use ctr-httpwn), or set up a different secondary entrypoint (steelhax, basehax, etc) and sit tight while we wait for the release of Slowhax for downgrading. Whatever you do, do NOT update at this point. It's probably safer to just disable WiFi.
And that's pretty much everything! I hope that the guide is clear and I will try and clarify in the comments. Hopefully some more experienced users can help too. It may look long but in reality you can have your setup fully complete in 20 minutes, which is much quicker than the hours I spent trying to race against the nag like in Plailect's guide.
So i followed this guide and got stuck on the computer ssh thing. putty always gives me an error when i try to connect to my routers local ip how do i fix this??
 

fodder

STARMAN
Member
Joined
Aug 3, 2014
Messages
863
Trophies
0
XP
544
Country
United States
This guide worked quite well for me (used my android phone as a hotspot for the brower nag bypass)

BUT

I personally needed to set a 2nd access point (my router) because my android hotspot didnt allow ctr-httpwn to download for some reason

Like once in the HBC I turned off my android hotspot so my 3DS connected to my router

--------------------- MERGED ---------------------------

Okay, still doing DSiWare downgrade, managed to downgrade to 9.2.0-20U successfully while using the browser has a HBC entrypoint
 
  • Like
Reactions: clancy94

Jayro

MediCat USB Dev
Developer
Joined
Jul 23, 2012
Messages
12,964
Trophies
4
Location
WA State
Website
ko-fi.com
XP
16,974
Country
United States
This will basically give you access to the Homebrew launcher which you will want to use to buy Legends of Exidia and download Steel divers sub wars from the eshop (you can't access the eshop on anything but the latest firmware usually), then with the release of slowhax in December you'll be able to downgrade your 3ds giving it access to your nand then installing a CFW (custom firmware). With CFW installed you can install homebrew apps such as Freeshop which is a hacked version of the eShop and you'll be able to play games for free, and online without risk of ban :)


Sent from my iPhone using Tapatalk
How much is Legends of Exidia? I bought Field Runners for $5 on the eShop.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    K3Nv2 @ K3Nv2: https://youtu.be/MddR6PTmGKg?si=mU2EO5hoE7XXSbSr