Hacking seedminer (single system DSiWare injection)

If you are planning on using seedminer, do you have a dedicated graphics card in your PC?

  • Yes!

    Votes: 207 45.1%
  • No

    Votes: 105 22.9%
  • What's dedicated graphics?

    Votes: 35 7.6%
  • I'm a cat, we can just guess our movable.sed through feline intuition

    Votes: 112 24.4%

  • Total voters
    459
  • This poll will close: .

Hipeopeo

Well-Known Member
Newcomer
Joined
Apr 22, 2017
Messages
69
Trophies
0
Age
28
Location
Pretty Much Hell
Website
hipeopeo.tk
XP
182
Country
United States
What is this:
A stable implementation of the 3ds vuln described here. The old thread about it is here.
This is a new way to inject dsiwarehax -- which can install B9S -- that doesn't require a second 3ds on hand.

What you need:
Seedminer only needs a system's *LFCS and ID0 (the long hex # in your Nintendo 3DS folder) to work its magic.
Currently, you need either a userland entrypoint or someone online you can friend code exchange with and send you a file with the LFCS.
Other ways to get the LFCS are being worked on, more details in the release archive's readme.
A PC is required for a brute-forcing of the actual movable.sed. A CPU will suffice, but a dedicated GPU is
much, much better. Integrated graphics suck, don't count on that to be much better than a CPU. It can even be worse.
You will also need to buy a $2 dsiware game if you don't have a compatible one yet.

* Local Friend Code Seed - this is not the same as LocalFriendCodeSeed_B, see readme.txt for more details.

How to do this:
Please see the readme in the release archive for detailed instructions.

How can I help:
There is actually one thing either users of seedminer, or people who already have cfw, can do - dump msed_data nodes!
Seedminer uses "error correction" to make better guesses on where to start brute forcing - this can greatly improve speed, especially needed with
cpu brute-forcing. This data is gathered from actual movable.seds. You can dump and share this data with seedstarter.3dsx in the release archive (option X). It is also dumped at the conclusion of a successful brute-force (alongside your movable.sed). It looks like "msed_data_00001234.bin" for example.
The data consists of [LFCS - truncated 12 bits for data privacy] [msed3 error distance] [seedtype new/old 3ds] (12 bytes total)
REMEMBER - it is entirely optional to share this, but greatly appreciated! You can post it in the thread or PM, your choice. I will then add them to the seedminer database files at regular intervals.

If you would like to help people brute-force their seeds, or help them get their LFCS with a friend code exchange, there is a special thread for that here.

Q&A:
Q. I've got my movable.sed and now I'm at the TADpole part, what's this about the ctcert.bin, will you be providing one?
A. No. That file is extremely console-unique and not something I'm comfortable sharing. Someone else will have to share. It only takes one - they work globally. Don't upload it here, it will probably be considered warez (not really sure about that designation - not my call).
Q. Why not ntrboot?
A. Ntrboot is fantastic! It's certainly a better long term solution. However, seedminer only requires a $2 dsiware purchase and you don't have to wait weeks for China Post to deliver a flashcard. Seedminer is pretty involved though, so if you're not comfortable with a lot of steps, just go with
ntrboot.
Q. Could Nintendo patch this?
A. Yes, certainly at least the dsiware injection. Now that it's a primary, they might consider it more of a priority to fix than when it was just used for dsiware transfer hax (3ds.guide). That doesn't account for the possibility of additional dsiware savehax games, however. The movable.sed vuln itself will be a bit more difficult to patch since it's pretty deeply built into the security infrastructure of the 3ds. They could at least make it harder to fish out the LFCS from userland and below.
Q. If dsiware injection was fixed, could this be used for anything else?
A. Yes, I think so at least. Knowing the movable.sed should allow one to modify 3ds game saves, and this should essentially turn eshop userland secondary exploits into primaries. Again, I haven't actually tested this, but it should work. @wwylele made a tool recently that could help with this.


Thanks:
Code
@JimmyZ - for providing the sorely-needed ocl brute forcer
@Joel16 - tons of friend functions and other useful code
Testers
@Quantumcat - tons of advice and testing
@FallenApex - first successful public trial!
@PowerBall253 - the second successful public trial!

Release:
Download
Source
QR for seedstarter.cia
View attachment 115016
I am relying on this. It’s taking a while (About 3 Hours), and I want to know: when will it finish? I have to go to my mom’s house, and I want to know: how many mset things will it take? Ex: it will get to 17
 

Marenthyu

Well-Known Member
Member
Joined
Feb 13, 2018
Messages
289
Trophies
0
Age
27
XP
185
Country
Germany
I am relying on this. It’s taking a while (About 3 Hours), and I want to know: when will it finish? I have to go to my mom’s house, and I want to know: how many mset things will it take? Ex: it will get to 17
anywhere from 10 to possibly 500 - it's effectively random.
And if you're concerned about it taking too long - just send it to us, we can propably do it faster :) (assuming you are using a cpu here)
 
  • Like
Reactions: Hipeopeo

Hipeopeo

Well-Known Member
Newcomer
Joined
Apr 22, 2017
Messages
69
Trophies
0
Age
28
Location
Pretty Much Hell
Website
hipeopeo.tk
XP
182
Country
United States
since you are at this part already, i assume you have your movable_part1.sed already - if not, add me 4682-8511-4632 and tell me your friend code and id0
Yes, I have it. The download is: http://bit.ly/2CHRjSs. My 3DS code thing is 6591b71c3ab9a1c9cbdaf4d94a5d7f02 The other code was my brother's
 
Last edited by Hipeopeo,

Marenthyu

Well-Known Member
Member
Joined
Feb 13, 2018
Messages
289
Trophies
0
Age
27
XP
185
Country
Germany
I used the wrong ID0. It was my brother's. Please use 6591b71c3ab9a1c9cbdaf4d94a5d7f02
either this one is another really "bad" one or i don't know. at -+300 now, did another one in the meantime;
more msed attached. Gonna continue hipeopeo's now.
 

Attachments

  • fuego.zip
    154 bytes · Views: 74
  • jesse.zip
    152 bytes · Views: 63
  • Like
Reactions: Hipeopeo and zoogie

Marenthyu

Well-Known Member
Member
Joined
Feb 13, 2018
Messages
289
Trophies
0
Age
27
XP
185
Country
Germany
either this one is another really "bad" one or i don't know. at -+300 now, did another one in the meantime;
more msed attached. Gonna continue hipeopeo's now.
I keep interrupting it, did 4 others in the meantime (jeez, they are popping up like mushrooms right now^^)
But I'm running hip's now, ;)
 

Attachments

  • lupicciondmemt.zip
    152 bytes · Views: 73
  • tosses.zip
    154 bytes · Views: 66
  • lucidd.zip
    152 bytes · Views: 80
  • drago.zip
    154 bytes · Views: 65
  • Like
Reactions: zoogie and Hipeopeo

Marenthyu

Well-Known Member
Member
Joined
Feb 13, 2018
Messages
289
Trophies
0
Age
27
XP
185
Country
Germany
Do we track "fastest seed mined"?
(also, on 600 with hip's seed by now...)
3BYPZplC.png
 

Attachments

  • officldaftpunk.zip
    154 bytes · Views: 65
  • Like
Reactions: zoogie and Hipeopeo

Marenthyu

Well-Known Member
Member
Joined
Feb 13, 2018
Messages
289
Trophies
0
Age
27
XP
185
Country
Germany
Woah. And a relatively similar size to the others. That's awesome.
Sorry, but yours has hit the 1200 mark now - i honestly doubt it is a correct file + id0. Please double check both and send it again. I'll leave it running for a bit longer, but i do plan to go for bed in a little.
 

Deceitful_Ninja

New Member
Newbie
Joined
Dec 7, 2014
Messages
2
Trophies
0
Age
24
XP
120
Country
United States
I'm getting this error when I try to do step 5 for Part C of LFCS/ID0:
"MII selected
bfcl lfcs 00008001 0200 2ba679e3a96c864f 00000000
selected device GeForce GT 630 on platform NVIDIA CUDA
0.003 seconds for OpenCL compiling
local work size: 1024
ocl_assert: ocl_brute.c, function ocl_brute_lfcs, line 514
clEnqueueReadBuffer(command_queue, mem_out, CL_TRUE, 0, sizeof(cl_uint), &out, 0, NULL, NULL)
error: out of resources
Traceback (most recent call last):
File "seedminer_launcher3.py", line 393, in <module>
generate_part2()
File "seedminer_launcher3.py", line 177, in generate_part2
with open("movable_part1.sed", "rb") as f:
FileNotFoundError: [Errno 2] No such file or directory: 'movable_part1.sed'"

(I'm very new to this and just starting out in the 3DS side of homebrewing, I currently own a "New" 3DS and I've done all of the previous steps, but getting confused at this step seeing as though I need a "Movable_part1.sed" which I have no idea how to obtain seeing as though I have no friends with homebrew or cfw. Would anyone mind helping me out? I do have the "input.bin" but I'm not sure what to do with it since I get this error whenever I use it with the python3.py script.)

TLDR; I'm new and have no idea what I'm doing and need some help if given any, "New DS."

(Sorry for long reply to the post)
 
Last edited by Deceitful_Ninja,

Marenthyu

Well-Known Member
Member
Joined
Feb 13, 2018
Messages
289
Trophies
0
Age
27
XP
185
Country
Germany
I'm getting this error when I try to do step 5 for Part C of LFCS/ID0:
"MII selected
bfcl lfcs 00008001 0200 2ba679e3a96c864f 00000000
selected device GeForce GT 630 on platform NVIDIA CUDA
0.003 seconds for OpenCL compiling
local work size: 1024
ocl_assert: ocl_brute.c, function ocl_brute_lfcs, line 514
clEnqueueReadBuffer(command_queue, mem_out, CL_TRUE, 0, sizeof(cl_uint), &out, 0, NULL, NULL)
error: out of resources
Traceback (most recent call last):
File "seedminer_launcher3.py", line 393, in <module>
generate_part2()
File "seedminer_launcher3.py", line 177, in generate_part2
with open("movable_part1.sed", "rb") as f:
FileNotFoundError: [Errno 2] No such file or directory: 'movable_part1.sed'"

(I'm very new to this and just starting out in the 3DS side of homebrewing, I currently own a "New" 3DS and I've done all of the previous steps, but getting confused at this step seeing as though I need a "Movable_part1.sed" which I have no idea how to obtain seeing as though I have no friends with homebrew or cfw. Would anyone mind helping me out? I do have the "input.bin" but I'm not sure what to do with it since I get this error whenever I use it with the python3.py script.)
Post your friendcode andsomeone here will help you out :) (i need to sleep now. it's past 4am.)
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Sonic Angel Knight @ Sonic Angel Knight: :ninja: