Hacking The status of Gateway and A9LH

Stack3r · May 27, 2016

liomajor said:
Did you switch stage 2 payloads?

Place a copy of Luma3DS's arm9loaderhax.bin in \a9lh and try booting with X+A.

\a9lh\arm9loaderhax.bin

Tried holding x and y, x and a it just stays at a black screen

xfcrowman · May 27, 2016

I have one more update on my tests:

-I have 2 USA O3DS (one Toshiba NAND, one Samsung NAND). The GW a9lh installer works on my Toshiba NAND, but not the Samsung NAND.

Can anyone else confirm this with their tests? Here are the NAND sizes for old and new 3DS, which tells you the type of NAND that you have:

https://github.com/Plailect/Guide/wiki/NAND-Size

liomajor · May 27, 2016

Slasher115 said:
Tried holding x and y, x and a it just stays at a black screen

Blackscreen/Powering off is OK IF arm9loaderhax.bin is missing.

I had a weird behavior only using stage 2 from aurora instead of dark_samus,
it worked trying to boot a dozen of time doing it this way:

- Power off 3ds
- Remove memorycard
- Try to turn on without memorycard > it turns off
- Insert memorycard
- Try booting arm9loaderhax.bin X+A
- 10 Times and once it worked

To undo installed a9lh with three stage 2 is possible booting once a9lh
arm9loaderhax.bin or using gateway's menu (371) restoring \nand.bin .

Stack3r · May 27, 2016

liomajor said:
Blackscreen/Powering off is OK IF arm9loaderhax.bin is missing.

I had a weird behavior only using stage 2 from aurora instead of dark_samus,
it worked trying to boot a dozen of time doing it this way:

- Power off 3ds
- Remove memorycard
- Try to turn on without memorycard > it turns off
- Insert memorycard
- Try booting arm9loaderhax.bin X+A
- 10 Times and once it worked

To undo installed a9lh with three stage 2 is possible booting once a9lh
arm9loaderhax.bin or using gateway's menu (371) restoring \nand.bin .

So this is what i did, i put all the files in a9lh, renamed stage2_3 to stage 2, deleted the regular stage 2, complete update. And i meant it just stays at a black screen while powered on while pressing x+a or x+y

ludyan · May 27, 2016

xfcrowman said:
I have one more update on my tests:

-I have 2 USA O3DS (one Toshiba NAND, one Samsung NAND). The GW a9lh installer works on my Toshiba NAND, but not the Samsung NAND.

Can anyone else confirm this with their tests? Here are the NAND sizes for old and new 3DS, which tells you the type of NAND that you have:

https://github.com/Plailect/Guide/wiki/NAND-Size

My O3DS' NAND is the Toshiba one too, and it's working just great (booting luma if I don't press anything, GW if I press X+Y).

liomajor · May 27, 2016

Details:

Code:

Stage 2                Button    Sector         Offset                            Path   File to load

payload_stage2.bin   = Default = Sector 5C000 = (5C000 * 200 hex) Offset B800000  \      arm9loaderhax.bin
payload_stage2_2.bin = X + Y   = Sector 5A000 = (5A000 * 200 hex) Offset B400000  \      launcher.dat
payload_stage2_3.bin = X + A   = Sector 5A100 = (5A100 * 200 hex) Offset B420000  \a9lh  arm9loaderhax.bin

Slasher115 said:
So this is what i did, i put all the files in a9lh, renamed stage2_3 to stage 2, deleted the regular stage 2, complete update. And i meant it just stays at a black screen while powered on while pressing x+a or x+y

Deleting payload_stage2.bin and injecting there payload_stage2_3.bin and you need a arm9loaderhax.bin in a9lh folder,
i guess you didn't replace 2_3 so you only can boot either gw (redscreen) or \a9lh\arm9loaderhax.bin

Stack3r · May 27, 2016

liomajor said:
Details:

Code:

Stage 2 Button Sector Offset Path File to load payload_stage2.bin = Default = Sector 5C000 = (5C000 * 200 hex) Offset B800000 \ arm9loaderhax.bin payload_stage2_2.bin = X + Y = Sector 5A000 = (5A000 * 200 hex) Offset B400000 \ launcher.dat payload_stage2_3.bin = X + A = Sector 5A100 = (5A100 * 200 hex) Offset B420000 \a9lh arm9loaderhax.bin

Deleting payload_stage2.bin and injecting there payload_stage2_3.bin and you need a arm9loaderhax.bin in a9lh folder,
i guess you didn't replace 2_3 so you only can boot either gw (redscreen) or \a9lh\arm9loaderhax.bin

Okay so how can i fix this...

Kazuma77 · May 27, 2016

Slasher115 said:
So this is what i did, i put all the files in a9lh, renamed stage2_3 to stage 2, deleted the regular stage 2, complete update. And i meant it just stays at a black screen while powered on while pressing x+a or x+y

Wait, you only used one stage2 payload? If you left the other stage2 intact, you might be able to copy the arm9loaderhax.bin to "a9lh/arm9loaderhax.bin" and get one of those hotkeys to work. If all you did was copy your modified stage2.bin and stage1.bin over, I hope you don't have an updated SysNAND. GW's NAND restore function is broken in 4.0a (then again, you might be able to use 3.7.1 to do it). My only way out was to update with PSMD, then downgrade. If you're on 10.7 or 11.0 you may very well need a hard mod to get out of this.

liomajor · May 27, 2016

No, booting GW and restoring NAND.bin is possible from gateway menu (371 has a restore function that should work)

Stack3r · May 27, 2016

Kazuma77 said:
Wait, you only used one stage2 payload? If you left the other stage intact, you might be able to copy the arm9loaderhax.bin to "a9lh/arm9loaderhax.bin" and get one of those hotkeys to work. If all you did was copy your modified stage2.bin and stage1.bin over, I hope you don't have an updated SysNAND. The NAND restore function is broken. My only way out was to update with PSMD, then downgrade. If you're on 10.7 or 11.0 you may very well need a hard mod to get out of this.

I copied stage 1 and i renamed either stage2_3 or stage 2_2 to stage2 and copied it over, im on 9.2 sysnand

otto888 · May 27, 2016

xfcrowman said:
I have one more update on my tests:

-I have 2 USA O3DS (one Toshiba NAND, one Samsung NAND). The GW a9lh installer works on my Toshiba NAND, but not the Samsung NAND.

Can anyone else confirm this with their tests? Here are the NAND sizes for old and new 3DS, which tells you the type of NAND that you have:

https://github.com/Plailect/Guide/wiki/NAND-Size

I have two Samsung NAND N3DS' (1 normal, 1 XL), and the GW payload doesn't work on either of them.

Kazuma77 · May 27, 2016

Slasher115 said:
I copied stage 1 and i renamed either stage2_3 or stage 2_2 to stage2 and copied it over, im on 9.2 sysnand

OK, then try 3.7.1's NAND restore option (hold up and hit A at the downgrade option). You will need a SysNAND backup named NAND.bin in the root. If that won't work, use 4.0a (and only 4.0a) to update with a ROM like PSMD then downgrade (hold up while you hit X to load SysNAND mode to enable ROM updates).

Stack3r · May 27, 2016

Kazuma77 said:
OK, then try 3.7.1's NAND restore option (hold up and hit A at the downgrade option). You will need a SysNAND backup named NAND.bin in the root. If that won't work, use 4.0a (and only 4.0a) to update with a ROM like PSMD then downgrade (hold up while you hit X to load SysNAND mode to enable ROM updates).

Will this delete my emunand? My last nand.bin backup was before i installed a9lh will that work?

Kazuma77 · May 27, 2016

Slasher115 said:
Will this delete my emunand? My last nand.bin backup was before i installed a9lh will that work?

Should be alright. You might lose any recent installs. You'll just have to run an exploit like Browserhax or Ninjhax and run the .3dsx version of the included Safe A9LH Installer (don't forget to copy all stage2 payloads as is this time, because it needs to install all 3 of them, you can switch 2 and 2_2 if you want GW for your primary, but they should all 3 be there in the "a9lh" folder).

Stack3r · May 27, 2016

Kazuma77 said:
Should be alright. You might lose any recent installs. You'll just have to run an exploit like Browserhax or Ninjhax and run the .3dsx version of the included Safe A9LH Installer (don't forget to copy all stage2 payloads as is this time, because it needs to install all 3 of them, you can switch 2 and 2_2 if you want GW for your primary, but they should all 3 be there in the "a9lh" folder).

Im on n3ds, this wont brick will it?

urherenow · May 27, 2016

My N3DS has a Samsung NAND and this doesn't work.

EDIT: My o3ds has a Toshiba NAND and it works!

So, the offset(s) have to be fixed for Samsung NANDs. How do I do that?

Kazuma77 · May 27, 2016

Slasher115 said:
Im on n3ds, this wont brick will it?

Extremely unlikely. GW's NAND restore feature is very safe. It's just their new downgrader that could use some work (to say the least).

Stack3r · May 27, 2016

Kazuma77 said:
Extremely unlikely. GW's NAND restore feature is very safe.

I thought plailect said something about bricking new 3ds if you flashed firmware?

Kazuma77 · May 27, 2016

Slasher115 said:
I thought plailect said something about bricking new 3ds if you flashed firmware?

I've restored my N3DS to a pre-A9LH state and it was fine (had to back when this trick required you to compile the A9LH -- the installer won't run on an A9LH system, not even with Cakes and the firm protection disabled).

Stack3r · May 27, 2016

Kazuma77 said:
I've restored my N3DS to a pre-A9LH state and it was fine (had to back when this trick required you to compile the A9LH -- the installer wont run on an A9LH system, not even with Cakes and the firm protection disabled).

Okay, so if i restore my sysnand, my emunand will still be there and i just have to run homebrew to reinstall a9lh with my otp?

Hacking The status of Gateway and A9LH

Shizuo Heiwajima

Well-Known Member

Well-Known Member

Shizuo Heiwajima

Active Member

Well-Known Member

Shizuo Heiwajima

Well-Known Member

Well-Known Member

Shizuo Heiwajima

I break things for a living.

Well-Known Member

Shizuo Heiwajima

Well-Known Member

Shizuo Heiwajima

Well-Known Member

Well-Known Member

Shizuo Heiwajima

Well-Known Member

Shizuo Heiwajima

Similar threads

Popular threads in this forum