Hacking 3DS unbricking progress

HAFEDHBY

Well-Known Member
Newcomer
Joined
Jan 28, 2014
Messages
63
Trophies
0
Age
42
Location
Tunis, Tunisia
XP
220
Country
You can NOT use a dump from another 3DS XL. It is encrypted with a key that is locked to your specific 3DS. Using a nand dump from a different 3DS is the fastest way to brick your 3DS beyond recovery.


I have not understood or not I can use a copy of nand another 3ds
Where can I download the nands 3ds?
 

bkifft

avowed Cuthwaldian
Member
Joined
Jun 10, 2010
Messages
613
Trophies
0
XP
625
Country
Gambia, The
http://4dsdev.org/forum.php?id=5
Could you make it less obvious that you're gathering IPs and useragents.

Offtopic: Why on earth would someone want to do this?

Has anyone tried using the new V2 raspberry pi?
As the new SoC is said to be fully compatible the tool itself should still work. The supplied linux image won't. (Sidenote: gamesquest1 tested it on a B+ where it didn't work, too.).

While tweaking a regular RPi linux image ain't hard at all (just requires USB boot and a self built kernel without the MMC stuff, for both of which there exists a plethora of tutorials) I won't be doing it in the foreseeable future. I will answer questions that can't be googled though.

I have not understood or not I can use a copy of nand another 3ds
Where can I download the nands 3ds?

(Disclaimer: The following is not meant to be condescending. I'm just trying to use as simple English as possible.)

No other 3DS NAND. Only own 3DS NAND. No way for other NAND.

Pressed "U"? Or pressed "F"?

If pressed "F" and not own 3DS NAND -> 3DS boom byebye.
 

Arisotura

rise of melonism
Member
Joined
Dec 5, 2009
Messages
839
Trophies
1
Age
30
Location
center of the Sun
Website
kuribo64.net
XP
2,498
Country
France
http://4dsdev.org/forum.php?id=5




Could you make it less obvious that you're gathering IPs and useragents.
Do you think it's the best place to post this?

And do you think I'm the only one to do that? Every board does that.


By the way, the data for guests are deleted after 5 minutes. We're not the NSA.
 

Mr.1999

Member
Newcomer
Joined
Jun 2, 2014
Messages
8
Trophies
0
Age
24
XP
62
Country
Swaziland
Hi folk!
I'm really sorry for my this new slight OT.
I don't want hijacking the thread but I need some informations related with the Arduino's sketch 3dsunbricker.
About the possibility to put and remove a password into the cards (Lock/Unlock) I can't understand some things.
I don't understand where the presetted password is stored.
I saw in sd_raw_roland.cpp that at row 199 there is what should be the presetted password used by Arduino:
199 char GlobalPWDStr[16] = {'T', 'W', 'I', 'L', 'I', 'G', 'S', 'P', 'O', 'R', 'K', 'L', 'E', 'P', 'A', 'H'}; // password used to lock the card
(by the history of the sd_raw_roland.cpp file that line was changed at the end assuming the syntax that I quoted)
My problem is that it isn't the password that is used by the scketch, the real one is totally different, it doesent match with that.
More, even changing the string in the row 199 seems to do anything, the password used by the Arduino's sketch is still the same as before.
It would seem that the string in the line 199 is good for nothing due the fact that even changing it all still works with the password issued which is always the same, nothing changes.
That's what I don't understand.
Where is the real password stored?
How can it be possible that the password in the row 199 can be translated into the real one used by the sketch due the fact that by changing it nothing happens and it remains unchanged?
If there is an algorithm somewhere in the library or the sketch that translates the string in the real password used by Arduino I expect that by changing the string then will be issued a different password, instead despite any change it's always the same.
Really I don't understand it.
Apologize me again for the OT and the long message.
Thanks in advance for any possible answer.
Regards.
Bob
 

bkifft

avowed Cuthwaldian
Member
Joined
Jun 10, 2010
Messages
613
Trophies
0
XP
625
Country
Gambia, The
I saw in sd_raw_roland.cpp that at row 199 there is what should be the presetted password used by Arduino:
199 char GlobalPWDStr[16] = {'T', 'W', 'I', 'L', 'I', 'G', 'S', 'P', 'O', 'R', 'K', 'L', 'E', 'P', 'A', 'H'}; // password used to lock the card
(by the history of the sd_raw_roland.cpp file that line was changed at the end assuming the syntax that I quoted)

The one in line 199 was just an arbitrarily chosen test password used to test if the locking/unlocking of SD card works (Bro-hoof if you can guess it's origin).

Where is the real password stored?

The real password is generated by xoring the device specific CID with secret GW magic (the key array) in the unlock function "unlock_XOR()" (line 1347ff.).

Fröhliches Käsefondue ;)
 

Mr.1999

Member
Newcomer
Joined
Jun 2, 2014
Messages
8
Trophies
0
Age
24
XP
62
Country
Swaziland
Thank you bkifft!
I'm sorry to still abusing of your and yours patience but I need one clarification.
Ok, the real password is generated by xoring the device specific CID with the secret key array in the unlock function at line 1347.
That's for VERNAM CYPHER UNLOCK (v) or VERNAM CYPHER LOCK (o) using Vernam's cipher.
For what I can see it works precisely in that way, the password change with the card (it's related to the CID of the card).
Instead I'm talking about LOCK (l) and UNLOCK (u) where I see the password is alway the same without regard to the CID of the card.
Surely could be that the string "TWILIGSPORKLEPAH" xoring with the secret key array at line 1347 is able to produce the password issued by Arduino by following LOCK (l) and UNLOCK (u) from the menu, though if this is the case then by changing that string to something different (for instance "WTZLIGPSORKLEPHA") the itself password which is send have to be changed too, but it isn't so.
Here is why I'm asking.
You wrote that TWILIGSPORKLEPAH is just an arbitrarily chosen test password used to test if the locking/unlocking card works.
The password that I see by performing LOCK (l) or UNLOCK (u) is a meaningful sentence that never changes, it's always the same even changing the string "TWILIGSPORKLEPAH" into line 199.
Since I don't know if I can show the password here I will only say that what I read and I checked out is nothing but a truncated message that is output from skectch and that seems to be stored or pointed specifically rather than obtained from the Vernam cipher or something else.
This is what I can't understand.
Apologize me again for the OT.
Thanks in advance.
Regards.
Bob
 

bkifft

avowed Cuthwaldian
Member
Joined
Jun 10, 2010
Messages
613
Trophies
0
XP
625
Country
Gambia, The

Mr.1999

Member
Newcomer
Joined
Jun 2, 2014
Messages
8
Trophies
0
Age
24
XP
62
Country
Swaziland
Hi bkifft.
I'm sorry I have bothered you and all here by having wrote OT things, apologize me.
I thank you for your valuable answers and the patience.
I already know sdlocker2, thanks for the hint though.
I don't intend to argue or criticize anyone or anything.
I was just trying to figure out how it works because for what I can see the password sent actually don't depends from the syntax of the string at line 199 nor from the magic key array when using LOCK (l) and UNLOCK (u).
Surely it works, meaning that locks and unlocks the card, however like password is used a portion of a text message and only by changing its content it is possible to change the password in use.
Ok, bkifft.
Thank you very much again for the support and please to excuse me for having made you angry, that was not my intention.
Sorry!
Kind regards and thanks.
Bob
 

bkifft

avowed Cuthwaldian
Member
Joined
Jun 10, 2010
Messages
613
Trophies
0
XP
625
Country
Gambia, The
Hi bkifft.
I'm sorry I have bothered you and all here by having wrote OT things, apologize me.
Sorry!

No worries, I'm in no way offended or anything :)

Answering your question would just mean I'd have to figure out how krisztian1997 did it exactly on my own first, that's why I hoped the tagging would trigger him.

You could try and write him a PM, though.
 

happydance

Well-Known Member
Member
Joined
Jul 16, 2009
Messages
598
Trophies
0
XP
349
Country
hello, I finally bricked my 3ds by messing around with rxtool I got 3 NAND backup made by gateway and a teensy++ 2.0

I can wire up my teensy, but I kinda lack guide to follow regarding the software side on flashing my nand backup back

and I've read in this post
you only need to unbrick if you have the blue screen of death, you can upgrade and downgrade at will with a hardware mod and SD reader

I got a black screen with no recovery menu, does that mean I don't need to unlock it? and how would I write back the nand backup?
 

Oishikatta

Well-Known Member
Member
Joined
Oct 30, 2014
Messages
971
Trophies
0
XP
603
Country
United States
hello, I finally bricked my 3ds by messing around with rxtool I got 3 NAND backup made by gateway and a teensy++ 2.0

I can wire up my teensy, but I kinda lack guide to follow regarding the software side on flashing my nand backup back

and I've read in this post


I got a black screen with no recovery menu, does that mean I don't need to unlock it? and how would I write back the nand backup?


This thread is specifically for bricks caused by gateway's brick code. In your case all you need to do should be to just write the backup normally, using the equivalent of `dd` (linux/mac) or win32diskimager (windows).
 
  • Like
Reactions: bkifft

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Veho @ Veho: The cybertruck is a death trap.