Hacking 3DS Hacking Theory Thread

[synce]

Probably not a good idea to discuss hacking theory or methods on a public forum with Nintendo employees (patches anyone?)

In any case, cheers to anyone trying. The 3DS is completely unappealing right now, let's try to change that

 

[TankedThomas]

Anyone thought of using a hammer? Or how about a chainsaw? I guess if you want to hack it, a hacksaw would be perfect.

 

[popoffka]

Looking at the DS firmware built into 3DS dump right now.
Just like the original DS firmware, it's got my WiFi networks' name and my nickname in the end. However, unlike original DS firmware, which begins with some stuff and has got a checksum at 0x6, this firmware starts with 0x00 bytes (and the 0x6 byte is 0x00 too).
Will try to boot this firmware using emulators.

 

[Keva]

Ive been thinking about how to dump the ROM's and I thought that maybe a program could be launched from the current DS flashcards, load into the system memory then you could hot swap the flashcard for a 3DS cart and then dump the contents via WiFi?

I don't know if you'll need access to 3DS mode but it's just a theory

 

[doyama]

Ive been thinking about how to dump the ROM's and I thought that maybe a program could be launched from the current DS flashcards, load into the system memory then you could hot swap the flashcard for a 3DS cart and then dump the contents via WiFi?

I don't know if you'll need access to 3DS mode but it's just a theory

This trick isn't possible because the timings for cart swaps are now in the millisecond range. It used to be 'kinda' possible to swap carts when that timing was in the 2-5 second range in previous iterations.

Besides the main problem is to get the unsigned code to run on the 3DS natively. This basically involves exploiting something on the 3DS to trick it into doing so.

To get a dump of the rom at this point would involve wiring stuff directly onto the 3DS and monitoring how the system makes calls to the cartridge. There were some minor changes between the DS and the DSi in terms of order and how the calls are made. I suspect the same is true for the 3DS. Also though, while dumping the cart is 'interesting' at least to see how the system does calls to the cart and if there are any new calls, they would be basically useless to 100% of the users here.

 

[xakota]

Ive been thinking about how to dump the ROM's and I thought that maybe a program could be launched from the current DS flashcards, load into the system memory then you could hot swap the flashcard for a 3DS cart and then dump the contents via WiFi?

I don't know if you'll need access to 3DS mode but it's just a theory

This trick isn't possible because the timings for cart swaps are now in the millisecond range. It used to be 'kinda' possible to swap carts when that timing was in the 2-5 second range in previous iterations.

Besides the main problem is to get the unsigned code to run on the 3DS natively. This basically involves exploiting something on the 3DS to trick it into doing so.

To get a dump of the rom at this point would involve wiring stuff directly onto the 3DS and monitoring how the system makes calls to the cartridge. There were some minor changes between the DS and the DSi in terms of order and how the calls are made. I suspect the same is true for the 3DS. Also though, while dumping the cart is 'interesting' at least to see how the system does calls to the cart and if there are any new calls, they would be basically useless to 100% of the users here.

This. What we need is a way to write save files back to the 3DS, so we can test for overflows/crashes.

 

[jabato]

Im wondering .. what happened with darkfader(the first nds passme creator)?

 

[Schicksalsheld]

Look at his website, he's still alive but he doesn't do alot in the last time, i think he is busy whit his job or other real live related things...

 

[AlanJohn]

Well... I've heard rumors that the SCDS2 will get DSi mode capability soon... So maybe, just maybe, they can hack 3DS mode (In 3 years)

 

[doyama]

Ive been thinking about how to dump the ROM's and I thought that maybe a program could be launched from the current DS flashcards, load into the system memory then you could hot swap the flashcard for a 3DS cart and then dump the contents via WiFi?

I don't know if you'll need access to 3DS mode but it's just a theory

This trick isn't possible because the timings for cart swaps are now in the millisecond range. It used to be 'kinda' possible to swap carts when that timing was in the 2-5 second range in previous iterations.

Besides the main problem is to get the unsigned code to run on the 3DS natively. This basically involves exploiting something on the 3DS to trick it into doing so.

To get a dump of the rom at this point would involve wiring stuff directly onto the 3DS and monitoring how the system makes calls to the cartridge. There were some minor changes between the DS and the DSi in terms of order and how the calls are made. I suspect the same is true for the 3DS. Also though, while dumping the cart is 'interesting' at least to see how the system does calls to the cart and if there are any new calls, they would be basically useless to 100% of the users here.

This. What we need is a way to write save files back to the 3DS, so we can test for overflows/crashes.

Honestly that's putting the cart before the horse. We first need to determine how the innards of the 3DS actually work. System calls, NAND contents, memory locations, etc. Right now none of this is really known. Without this basic information you can't even begin to look for exploits. Work on the foundation then we can build the house.

 

[Warrior522]

Honestly that's putting the cart before the horse. We first need to determine how the innards of the 3DS actually work. System calls, NAND contents, memory locations, etc. Right now none of this is really known. Without this basic information you can't even begin to look for exploits. Work on the foundation then we can build the house.

Pardon my curiosity, but how long did this take for the DS?

 

[jabato]

First passme to run nds homebrew in slot 2 like 1 year, i think less.

 

[Knyaz Vladimir]

Decent flashcards in about 2-3 years. It's called the R4.

 

[koloss]

From the twitter of crediar:

Good news everyone! Thanks to Erant I now have working code to restore savefiles to 3DS games

and I can also continue playing Ridge Racer

 

[doyama]

From the twitter of crediar:

Good news everyone! Thanks to Erant I now have working code to restore savefiles to 3DS games

and I can also continue playing Ridge Racer

Good news indeed

However I want to temper this news for everyone out there. This does NOT mean we are magically going to get 'save game exploits' to enable 3DS mode. Note that it took 1 year before a save game exploit on Cooking Coach actually translated into a working product, the iEvo.

 

[TankedThomas]

Reading about the DS firmware being dumped from the 3DS is interesting to me for one reason: It appears the DS firmware has been edited for the 3DS. Instead of asking to shutdown, it asks if you want to return to the menu (which must mean the 3DS home menu). It's possible that the only edit was a simple text edit, but who knows? Maybe there's more to the edited firmware than that, however doubtful.

Anyway, if people have trouble finding exploits, they could always try brute force. By that, I mean a soldering iron. Surely if it gets too hot, it'll go apeshit. Dunno about a buffer overflow, but you'll see some results in the way of smoke, at least.

Someone make this happen. I want to see a video of this. No, I don't want to know if it will blend.

 

[linuxares]

hmm is their maybe a recovery mode like when you press all 4 direction on the dpad as it was on the Gamecube controller and the wii.

 

[Jaden.]

Wondering, what do you see in the screen when you get a Buffer Overflow?

 

[tj445]

Soldering Iron and then hitting your 3DS with a hammer will surely give you an exploit.
It was super-effective on mine because it now gives me a flashing-rainbow screen.

 

[JosJuice]

Reading about the DS firmware being dumped from the 3DS is interesting to me for one reason: It appears the DS firmware has been edited for the 3DS. Instead of asking to shutdown, it asks if you want to return to the menu (which must mean the 3DS home menu). It's possible that the only edit was a simple text edit, but who knows? Maybe there's more to the edited firmware than that, however doubtful.

It seems like there are a few other changes too. For example, the icon on the top screen that displays which screen GBA games will be played on (and the icon next to it that I've forgotten about) isn't there in the 3DS version of the DS firmware.