Hacking FALSE: Gateway 3DS Bricking Mechanism Discovered

Foxi4

Endless Trash
Global Moderator
Joined
Sep 13, 2009
Messages
30,824
Trophies
3
Location
Gaming Grotto
XP
29,817
Country
Poland
What i have written on the other forum, is just my knowledge about this. The credits for that go to yellows8 and ichfly. Without them everyone would still think Gateway is right in everything, they say. Hopefully this shows you, they are not, what they promise to be and hopefully you can trust 3dbrew again after the decapping disaster.

The infos, i have given should be enough to unbrick every 3DS without sending it to Gateway and losing money, *if* you have a backup of the NAND.bin. Otherwise not, because the "emuNAND" partition can't be used for this, because Gateway reencrypted it with their own keys.

Good luck with recovering your 3DS/XL
A standard NAND.bin backup won't do if the NAND chip itself is borked and doesn't detect properly due to a memory controller wipe. Can you elaborate on how you plan on fixing that issue? ;)
 

Arras

Well-Known Member
Member
Joined
Sep 14, 2010
Messages
6,317
Trophies
2
XP
5,400
Country
Netherlands
A standard NAND.bin backup won't do if the NAND chip itself is borked and doesn't detect properly due to a memory controller wipe. Can you elaborate on how you plan on fixing that issue? ;)
Apparently you're supposed to send some sort of Erase/reset command to the eMMC chip which will fix the issue but delete everything on the NAND in the process. Of course you'll need your NAND.bin after that to fix it. There is another way that doesn't require a NAND.bin, which is to properly unlock the eMMC, but that requires a key that ATM only Gateway knows. This is my understanding from the 3DS xl NAND backup thread.
 

obcd

Well-Known Member
Member
Joined
Apr 5, 2011
Messages
1,594
Trophies
0
XP
432
Country
Belgium
Arras

You are correct. It's precisely what most think is possible.
The original purpose of the eMMC protection is to prevent someone who doesn't know the passkey from viewing it's contents.
As a backdoor, you can remove the lock with a force erase that makes you start with a fresh unlocked device (totally erased)
They also seem to have enabled the write protection.
That one is tricky. You can write protect an eMMC permanently without a way to recover.
Since you can't write..you can't disable the protection...
As gateway says they can recover your 3ds, I don't think permanent write protection is active, but people who start to experiment with the low level commands
should be aware that the command exists, and an eMMC chip isn't even usefull as doorstop.

Let's hope someone is capable to reverse the way gateway calculates it's passkey.
The eMMC CID probably can be extracted from the eMMC with the proper low level commands (even in locked state) I also read the 3ds AES encryption is used. Can another AES encryption library being used instead? I read that the gateway backups are reencrypted with other gateway specific keys, so they can't be used to reflash the eMMC. Does that means that only a backup taken with a sd card reader can be used? In such case, I doubt many people have such a backup?
 

Sonic4Ever

Well-Known Member
Member
Joined
Apr 21, 2008
Messages
249
Trophies
0
Age
31
XP
276
Country
France
So all developers of the board, who were previously categorized as "mere speculators", are now "evil clone engineers".

I am sick of these insults to the profession.
 

Gerbilly

Active Member
Newcomer
Joined
Dec 18, 2013
Messages
35
Trophies
0
Age
60
XP
97
Country
As to why there is an unlock code (for the bricked consoles) it would be reasonable to assume that in order to test the code the Gateway staff had to trigger it multiple times and could not justify throwing away a console each time and therefore they required a means to repair their own console bricks - hence their amazing, miraculous ability to fix a problem they claim never to have actually seen in person.

The code may have been intended as a way to scare people towards their products but the fallout problem resulting from the Normatt launcher bricks has clearly shown the problem is not with the clone hardware but with Gateway's own code and may well have scared more customers away.

At the very least more people will be wary of them in future. This is especially true given the sneaky way they made the bricking event happen in a somewhat random delayed fashion. What if their next code has a much longer delay? How can we be sure unless the source code is revealed?

Also, has anyone else taken note that they still have not clearly and directly denied writing the bricking code. If they did not as many still seem to believe why do they not just say so? Taking the 'We neither confirm nor deny' route makes them seem like slimy politicians, and makes their 'guilt' seem far more likely. Perhaps they would like to deny but don't because they are afraid some one will actually post the code in question and reveal their untruth in the matter?

Personally though, I would rather have an admission, or a clear denial.
 

boogiemantcb

Well-Known Member
Newcomer
Joined
Jan 11, 2014
Messages
67
Trophies
0
Age
38
XP
74
Country
United States
As to why there is an unlock code (for the bricked consoles) it would be reasonable to assume that in order to test the code the Gateway staff had to trigger it multiple times and could not justify throwing away a console each time and therefore they required a means to repair their own console bricks - hence their amazing, miraculous ability to fix a problem they claim never to have actually seen in person.

The code may have been intended as a way to scare people towards their products but the fallout problem resulting from the Normatt launcher bricks has clearly shown the problem is not with the clone hardware but with Gateway's own code and may well have scared more customers away.

At the very least more people will be wary of them in future. This is especially true given the sneaky way they made the bricking event happen in a somewhat random delayed fashion. What if their next code has a much longer delay? How can we be sure unless the source code is revealed?

Also, has anyone else taken note that they still have not clearly and directly denied writing the bricking code. If they did not as many still seem to believe why do they not just say so? Taking the 'We neither confirm nor deny' route makes them seem like slimy politicians, and makes their 'guilt' seem far more likely. Perhaps they would like to deny but don't because they are afraid some one will actually post the code in question and reveal their untruth in the matter?

Personally though, I would rather have an admission, or a clear denial.
Supposedly 48 hours until the new v 2.0 update is released. Official email from gateway.
 

Attachments

  • Screenshot_2014-01-20-02-06-43.png
    Screenshot_2014-01-20-02-06-43.png
    72 KB · Views: 349

LegendaryFighter

Well-Known Member
Member
Joined
Apr 13, 2011
Messages
103
Trophies
0
Location
Germany
XP
176
Country
Gambia, The
If they really wanted to release it during the next 48 hours, they would have said something like: "Be patient, our 2.0 update will be here till tomorrow".
But they didn't..
 

59672

Well-Known Member
Member
Joined
Mar 14, 2009
Messages
167
Trophies
1
XP
351
Country
Canada
Now that the jig is up, maybe Gateway 3DS can be convinced to remove their dangerous code from their next firmware release to regain the trust of their customers.


More like for gateway to regain the trust of the clone cards' customers.

From at least what I've seen the odds of a brick from a gateway card are incredibly tiny though not quite non-existent.
 

temp1312

Well-Known Member
Newcomer
Joined
Dec 3, 2013
Messages
67
Trophies
0
XP
171
Country
United States
If their 2.0 launcher needs a new fw and the fw doesn't work with ~2.0b1 launcher, It'll be a dilemma...
Hope they could remove the bricker code completely, they really don't need to do that.
At least, they don't need brick consoles like they are doing now, a "regular" brick is difficult enough to people, they won't open their consoles again and again just for saving $100.
 

Nobunaga

Empty
Member
Joined
Apr 19, 2010
Messages
2,077
Trophies
1
Age
28
XP
2,621
Country
Greece
Stop being pessimistic as they said they will release something tonight or tommorow.
This will probably remove the brick code and will add multi rom :)
 
  • Like
Reactions: temp1312

osirisjem

I miss the Wii remotes
Member
Joined
Jun 19, 2011
Messages
1,116
Trophies
1
XP
1,157
Country
Canada
#1: It is all based on info being mouthed out by Normatt which I and many others in scene world know for a fact he is main engineer behind the two clones so of course he will do anything to discredit the GW team and their efforts.


That's interesting.
 

kyogre123

Mexican Pride
Member
Joined
Sep 23, 2013
Messages
2,920
Trophies
0
Age
34
XP
1,347
Country
Mexico
I don't understand that part of emuNAND being encrypted different? I thought people with NAND-SD interfaces were able to write the emuNAND extracted with the "EmuNAND tool" to the NAND of the 3DS.
 

IronClouds

GBAtemp's Pokébro
Member
Joined
May 8, 2010
Messages
1,019
Trophies
0
XP
625
Country
United States
I'm very indifferent to all of this, mainly because my 3DS XL is still perfectly fine *knock on wood* I'm not launching the DS Profile until 2.0, so I'm perfectly content using the blue card and playing a little Pokémon Brown until that happens.

I don't believe 2.0 will be released in two days' time, mainly because of their wording in that screenshot e-mail -- specifically their use of the words "something" and "most likely." If they were releasing 2.0, they would've done something along the lines of what LegendaryFighter said a few posts up. Gateway is known to make a huge deal of their releases, so the fact they're not doing that right now is even more reason to believe the 2.0 update is still pending, and will stay that way for a while.

I really hope I'm wrong, but I don't think I am. :(
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    SugoiEndeavor @ SugoiEndeavor: What's up bakaz