Installing arm9loaderhax
The final Step of this guide is to install arm9loaderhax and setup Luma3DS to run just milliseconds into the boot. This is accomplished by using SafeA9LHInstaller by
AuroraWright.
This will install
AuroraWright’s Fork of arm9loaderhax.
We will also setup the ability to launch payloads from arm9loaderhax, giving us the ability to unbrick our SysNAND from situations that would normally brick us by restoring from backup.
You cannot use another console’s OTP or you will brick GUARANTEED.
Overview of steps
In this section, we will go through the process that all the other steps have led up to: actually installing arm9loaderhax.
This is nearly the best possible kind of device exploit because it is permanently installable into the NAND firm partitions, and runs before most of the OS loads, allowing it to not only work on
all versions once installed, but also protect itself and recover from most situations that would brick a non-A9LH 3DS such as a nonfunctional home menu or bad title install.
The file arm9loaderhax.bin is what is launched by arm9loaderhax itself after it finishes loading off of NAND, and can be any valid arm9 payload. This file can be replaced at any time, although Luma3DS allows for the launch of other arm9 payloads using the Luma3DS chainloader.
In this case, we use Luma3DS by
AuroraWright to boot a patched SysNAND directly, allowing us to completely bypass the need for any kind of EmuNAND, vastly simplifying the usage of a hacked 3DS in addition to saving SD card space.
Once arm9loaderhax is installed and Luma3DS is setup with the correct options, we then restore our previous backup.
During this process, we also setup programs such as the following:
- FBI (installs CIA formatted games and applications)
- Luma3DS Updater (updates your CFW installation easily)
- Hourglass9 (multipurpose tool which can do NAND and cartridge functions)
What you need
Instructions
Section I - Prep work
Ensure you are using an SD card that is not corrupted!
If you use a corrupted SD card without fixing it, you may BRICK!
If you think your SD card may be corrupted, check your SD card for errors using H2testw (Windows), F3 (Linux), or F3X (Mac)!
- If it exists, copy the /files9/ folder on your SD card to a safe location on your computer and back it up to multiple locations (such as online file storage); the files inside could save you from total data loss if you break your system
- Create a folder named cias on the root of your SD card if it does not already exist
- Delete the 3ds folder from the root of your SD card if it exists
- Copy the contents of the starter folder in starter.zip to the root of your SD card
- This will include a brand new 3ds folder to replace the one you just deleted
- Copy the contents of the SafeA9LHInstaller .7z to the root of your SD card
- Copy the a9lh folder from the data_input .zip to the root of your SD Card
- Copy the contents of the arm9loaderhax release .7z to a9lh folder on your SD card
- Copy hblauncher_loader.cia from the hblauncher_loader .zip to the /cias/ folder on your SD card
- Copy lumaupdater.cia from the Luma3DS Updater .zip to the /cias/ folder on your SD card
- Copy FBI.cia from the FBI .zip to the /cias/ folder on your SD card
- Copy arm9loaderhax.bin from the Luma3DS .7z to the root of your SD card, overwrite existing files
- Create a folder named luma on the root of your SD card
- Create a folder named payloads in the luma folder on your SD card
- Copy Hourglass9.bin from the Hourglass9 .zip to the /luma/payloads/ folder on your SD card and rename Hourglass9.bin to start_Hourglass9.bin
- Copy aeskeydb.bin to the /files9/ folder on your SD card
- Copy DspDump.3dsx to the /3ds/ folder on your SD card
- Copy the contents of fbi-2.4.2-injectable.zip to the /files9/ folder on your SD card
Section II - Installing arm9loaderhax
- Reinsert your SD card into your 3DS
- Do the steps for installing arm9loaderhax on your device:
- You should be on 2.1.0
- Go to http://2xrsa.3ds.guide on your 3DS
- If you get the error “This service is not available in your region”, use the System Settings to set your device’s country to match the NAND region you installed with 2.1.0 ctrtransfer
- If you get another error, follow this troubleshooting guide
- If you get a glitched screen, follow this troubleshooting guide
- If you are on a 2DS or New 3DS and Wireless Communication is off, you can re-enable the wireless by removing the battery and unplugging the charger for several seconds then booting back up
- Press (Select) to Full Install
- The installer will now install arm9loaderhax on your device (this is very fast)
- Shut down your console by pressing any button
- Copy your console specific otp.bin from the /a9lh/ folder on your SD card to a safe location on your computer and back it up to multiple locations (such as online file storage), then reinsert your SD card into your 3DS
Section III - Configuring Luma3DS
- Boot your device while holding (Select) to enter the Luma3DS configuration menu
- Use the (A) button and the D-Pad to turn on the following:
- “Autoboot SysNAND”
- “Use SysNAND FIRM if booting with R”
- “Show NAND or user string in System Settings”
- If you are using a New 3DS, you can also enable the following:
- “New 3DS CPU” to “Clock+L2(x)”
- This will increase the framerate of many games, but may cause instability in others
- If some games do not work properly, disable this option and try again
- Press (Start) to save and reboot
- If you get a black screen, just continue to the next section
- If you get a “Failed to mount CTRNAND” error, just continue to the next section
Section IV - Restoring the System
If, before following this guide, you already had an EmuNAND setup and would like to move the contents of your previous EmuNAND to your new SysNAND CFW, now is the time to
follow Move EmuNAND instead of doing the first four steps in this section.
- Boot your device while holding (Start) to enter Hourglass9
- Go to “SysNAND Backup/Restore”
- Go to “SysNAND Restore (keep a9lh)” and restore from NANDmin.bin
- Press (Start) to reboot
- If your backup was of a version between 3.0.0 and 4.5.0, your console will not boot until you manually download the required firmware:
- Download this file and rename it to firmware.bin
- Download this file
- Copy firmware.bin and cetk to the /luma/ folder on your SD card
- Delete both of these files after updating your 3DS
- Update your 3DS by going to System Settings, then “Other Settings”, then going all the way to the right and using “System Update”
- Updates while using A9LH + Luma (what you have) are safe, stop asking about it
- The warning about never updating a New 3DS from 2.1.0 does not apply after restoring your NAND backup.
- If this gives you an error, set your DNS settings to “auto”
- If this still gives you an error and your NAND is below 9.2.0, follow 9.2.0 ctrtransfer
Section V - Injecting FBI
- Boot your device while holding (Start) to enter Hourglass9
- Go to “SysNAND Backup/Restore”, then select the “Health&Safety Dump” option to dump Health & Safety to hs.app (you can use Up and Down / Left and Right to change the name)
- Press (B), then select the “Health&Safety Inject” option
- Select the FBI injectable .app for your region
- Press (A) and confirm to inject
- Press (Start) to reboot