Hacking About 3ds version 2.0.0 running on newer consolesconsoles

LinusRG · May 28, 2020

When I first hacked my now physically broken old 3ds, I had to use the CTRTransfer method to install a9lh. Why could the 2.0.0 transfer even work on consoles that were not the og 3ds? Wouldn't the new 3ds have a ton of kernel module errors due to the modules on that firmware only being designed, and available for the og 3ds? And when it came to the 2ds, how could the 3ds firmware interact with the 2ds' single screen and tell it how to lay things out? (granted ther are some minor graphical glitches.) Also, does the 2ds brick when put into sleep mode while on this firmware like the new 3ds does?

I know this is all irrelevant thanks to easier and safer and easier methods existing now, but I'm just curious.

Shadow#1 · May 28, 2020

LinusRG said:
When I first hacked my now physically broken old 3ds, I had to use the CTRTransfer method to install a9lh. Why could the 2.0.0 transfer even work on consoles that were not the og 3ds? Wouldn't the new 3ds have a ton of kernel module errors due to the modules on that firmware only being designed, and available for the og 3ds? And when it came to the 2ds, how could the 3ds firmware interact with the 2ds' single screen and tell it how to lay things out? (granted ther are some minor graphical glitches.) Also, does the 2ds brick when put into sleep mode while on this firmware like the new 3ds does?

I know this is all irrelevant thanks to easier and safer and easier methods existing now, but I'm just curious.

On 2ds and n2/3ds/XL u brick on 2.x if u powered off or rebooted

Myria · May 28, 2020

The theory behind it has to do with some flaws in the 3DS firmware and boot ROM.

The Old 3DS and New 3DS have the exact same boot ROM. This means that a New 3DS will attempt to boot Old 3DS firmware. The changes to New 3DS hardware were backward compatible enough that Old 3DS firmware 2.1.0 was able to run.

The reason that we wanted to run version 2.1.0 at all was because we wanted to dump a per-system file called the "OTP". This file contained secret keys that were different for each unit, and was burned in at the factory. Normally, this file is available at boot, but the OS turns off access once the keys aren't needed anymore. But Nintendo forgot to actually do this until firmware 3.0.0. On firmware 2.1.0, if you exploit the system and gain control, the OTP was still readable, and the hack dumped this file to SD card.

The OTP's per-unit keys were needed for executing an attack called "arm9loaderhax". This hack got full system access at boot time, and was the standard for hacked 3DSes for a year. Later, the far superior and easier installed "sighax" replaced it.

Hacking About 3ds version 2.0.0 running on newer consolesconsoles

Well-Known Member

Wii, 3DS Softmod & Dumpster Diving Expert

Well-Known Member

Similar threads

Popular threads in this forum