Hacking 3DS Flashcarts - News, Updates, and Support Thread

[kyogre123]

I just noticed that they removed ps3crunch from their "official forums" list.

Nevermind, it's the same forum.

 

[MopSec]

I just noticed that they removed ps3crunch from their "official forums" list.

Well PS3crunch doesn't exist anymore, it has merged with Maxconsole
To quote the official statement: "Recently, PSVitaGuru, WiiUNewz, XboxOneCrunch, 360Crunch and now PS3Crunch have all merged with the Maxconsole Underground Forums[...]"

 

[weatMod]

Probably all 3 if retail cards work on EmuNAND, if not you'll probably be able to update via online or with a ROM

well since it says that you can dump your own roms in 2.0 then i assume that retail card would not be blocked ,unless they are blocked from running but not for dumping tool

 

[kyogre123]

well since it says that you can dump your own roms in 2.0 then i assume that retail card would not be blocked ,unless they are blocked from running but not for dumping tool

This is what their FAQ says about this concern:
- Will you support retail gamecards? Yes, we will add an option to launch the original firmware (with emunand support) so you can play retail gamecards.
So maybe GW2.0 will support original games, but apparently it would be through "an option".

 

[justinkb]

If I were Gateway, I would make activating emunand boot into a mode for backups, then allow switching to "retail" mode, but only make the switching only work when the red Gateway card is inserted. That way they could ensure that their loader isn't used by 4.5 firmware people who didn't actually buy their product, but still want to play 5.0+ retail games. I think it's pretty likely this is actually what they will do.

 

[Idaho]

what I still don't understand is, why do we need to always activate the flaw through DS mode, wouldn't it be possible to flash the modded firmware once for all ?

 

[dragonmaster]

what I still don't understand is, why do we need to always activate the flaw through DS mode, wouldn't it be possible to flash the modded firmware once for all ?

actually what gateway has is an exploit ,a bug in the OS that allows kernel access to gateway ,it isn't possible to remove the process of install as long as there is no cfw present.and installing cfw has many dangers and also it isn't a money generator for all those cards clones and original too.
what i at least wait is some homebrew and emulators and even a cheat gen but those will come later on

 

[justinkb]

No. Impossible to actually encrypt new firmware without knowing the encryption key, which can't be retrieved (except perhaps by destroying the actual hardware in the process) and the 3DS bootloader will only accept properly encrypted firmware when coldbooting.

 

[Aurora Wright]

actually what gateway has is an exploit ,a bug in the OS that allows kernel access to gateway ,it isn't possible to remove the process of install as long as there is no cfw present.and installing cfw has many dangers and also it isn't a money generator for all those cards clones and original too.
what i at least wait is some homebrew and emulators and even a cheat gen but those will come later on

Nothing to do with money, modern consoles have something called a "chain of trust": the boot process is divided in various phases, in each phase a piece of code authenticates the next one and then loads it. Unless you find a problem in one of the "authentication" processes, you can't replace anything. Old PSPs had such a bug in the very first piece of code that is executed, the "preIPL", this allowed custom firmware (and brick recovery via pandora). New PSPs had the bug fixed, but the key used by Sony to sign the OS "components" (I'm simplifying) was found out thanks to a PSP emulator embedded in the PS3 (lol) so you could just modify them, sign them and flash them back. Let's not even talk about Wii, which didn't have a proper "chain of trust", since the System Menu (last part in the boot process) wasn't even being authenticated prior to being loaded. Neither were the IOSes. So no hassles at all. PS3 had the signing key found out too because of a "math mistake" by Sony (they didn't sign properly). So you could modify, sign and flash back. X360 had no problems at all, so they basically had to glitch the processor with a chip (the processor basically gets "confused" until the authentication succeeds). No software mistakes. After this wall of text, the possibilities are:
- There's an "authentication" (signature verification) bug in one of the phases of the 3DS boot process (it could happen. decap must be performed to check)
- The signing key gets found out (no chance, unless a miracle happens haha)

 

[justinkb]

Also, earliest XBOX360 model, xenon, had JTAG interface on its motherboard. Can you say "oops"...

 

[Idaho]

actually what gateway has is an exploit ,a bug in the OS that allows kernel access to gateway ,it isn't possible to remove the process of install as long as there is no cfw present.and installing cfw has many dangers and also it isn't a money generator for all those cards clones and original too.
what i at least wait is some homebrew and emulators and even a cheat gen but those will come later on

I know all of this, but once the flaw is activated I don't see what's holding the Gateway team to flash the modded firmware they're using on the 3DS NAND, you'd still need to use their flashcart and we would just not have to activate that flaw every time we use DS mode...

 

[Pedeadstrian]

I know all of this, but once the flaw is activated I don't see what's holding the Gateway team to flash the modded firmware they're using on the 3DS NAND, you'd still need to use their flashcart and we would just not have to activate that flaw every time we use DS mode...

They're not using a modded firmware, they're basically dualbooting two different firmware versions. Both of them are unmodified firmwares, they just happen to be in different places. If Gateway had the ability to make custom firmware, then we wouldn't need carts in the first place.

 

[Idaho]

They're not using a modded firmware, they're basically dualbooting two different firmware versions. Both of them are unmodified firmwares, they just happen to be in different places. If Gateway had the ability to make custom firmware, then we wouldn't need carts in the first place.

they're using a custom firmware dude, how else would you bypass the security checks then ? they just do like smealum is doing at the moment but only pacing their work on the free games for the moment...

And if you need the cart its only so they can sell it to you

 

[Pedeadstrian]

they're using a custom firmware dude, how else would you bypass the security checks then ? they just do like smealum is doing at the moment but only pacing their work on the free games at the moment...

They use exploits in the code, that's how. The way things happen is that you find exploits and then exploit them. The way you're thinking is the opposite. You'd need to bypass the security checks before installing a custom firmware. If you think this is some big conspiracy on their part, trying to get as much money as possible before someone "leaks" a custom firmware, then that's pretty silly.

 

[Idaho]

They use exploits in the code, that's how. The way things happen is that you find exploits and then exploit them. The way you're thinking is the opposite. You'd need to bypass the security checks before installing a custom firmware. If you think this is some big conspiracy on their part, trying to get as much money as possible before someone "leaks" a custom firmware, then that's pretty silly.

Dude just study how smealum achieved his work and study how gateway did, they use the same flaw and both can modify the firmware using this flaw, it seems normal that soem people would like to make money out of this and Gateway did, I don't mind it as they're the first ones to make it possible for everyone and they provide good support, not like if they are bad or anything they just want money i'm okay with this I myself own a Gateway...

 

[justinkb]

Idaho, read my post and Aurora Wright's. Explains it. What you want isn't possible and will probably never be possible. Keyword here is encryption on the nand, which prevents CFW which survives power loss.

 

[Ennea]

they're using a custom firmware dude

They don't, "dude". The firmware isn't being modified. There's additional code run alongside everything else.

 

[Idaho]

Nothing to do with money, modern consoles have something called a "chain of trust": the boot process is divided in various phases, in each phase a piece of code authenticates the next one and then loads it. Unless you find a problem in one of the "authentication" processes, you can't replace anything. Old PSPs had such a bug in the very first piece of code that is executed, the "preIPL", this allowed custom firmware (and brick recovery via pandora). New PSPs had the bug fixed, but the key used by Sony to sign the OS "components" (I'm simplifying) was found out thanks to a PSP emulator embedded in the PS3 (lol) so you could just modify them, sign them and flash them back. Let's not even talk about Wii, which didn't have a proper "chain of trust", since the System Menu (last part in the boot process) wasn't even being authenticated prior to being loaded. Neither were the IOSes. So no hassles at all. PS3 had the signing key found out too because of a "math mistake" by Sony (they didn't sign properly). So you could modify, sign and flash back. X360 had no problems at all, so they basically had to glitch the processor with a chip (the processor basically gets "confused" until the authentication succeeds). No software mistakes. After this wall of text, the possibilities are:
- There's an "authentication" (signature verification) bug in one of the phases of the 3DS boot process (it could happen. decap must be performed to check)
- The signing key gets found out (no chance, unless a miracle happens haha)

Thanks for the info, didn't know about that, lets hope for someone to find a flaw around this then.

And I thought once you have control on the OS everything was done

They don't, "dude". The firmware isn't being modified. There's additional code run alongside everything else.

Oh well, so they don't know about the method smealum is using to modify the firmware ?

 

[weatMod]

Dude just study how smealum achieved his work and study how gateway did, they use the same flaw and both can modify the firmware using this flaw, it seems normal that soem people would like to make money out of this and Gateway did, I don't mind it as they're the first ones to make it possible for everyone and they provide good support, not like if they are bad or anything they just want money i'm okay with this I myself own a Gateway...

think of it like ps3 jailbreak ps jailbreak and psgroove and psfreedom exploited the ofw by a heap overflow but tit could not be installed , ps jailbreak was made free open source psgroove , but you still couldnt install a cfw, that didnt happen till later when geohot got the metldr keys

 

[RowanDDR]

AN UPDATE! See gateway site

"Public Beta release of GW 2.0b1"