Hacking 3DS Injector

[CreativeMan]

Well a hacky way would be to have two loaders with different strings and let your firmlaunchhax code figure out what to inject based on if emunand is enabled or not.

Thanks for your reply yifan_lu, yeah that's what I thought... Need to check if it can be done in a clean way

In the latest release of AuReiNand, the system settings will display SYS or EMU based on which one you are booted into. I am sure the code for Aurora's implementation of the loader will show how she did it!

I just seen that thanks !

 

[mrmonotone]

One of the things I was wondering about was the patch loading. It seems like that elseif will get very large haha. It might be beneficial to restructure it. Would it be beneficial to have a patch system like cakes does with json?

 

[yifan_lu]

One of the things I was wondering about was the patch loading. It seems like that elseif will get very large haha. It might be beneficial to restructure it. Would it be beneficial to have a patch system like cakes does with json?

My original idea which would have taken too long to implement is a patch system with a stack based scripting language. For example you can express "find PATTERN and replace at offset" as well as "if ver==1 then offset=x, else if ver==2 then offset=y, else find PATTERN, replace at offset" or "find PATTERN using MASK and replace at offset with MASK" (mask is good for patching instructions with offsets that change). Maybe even "find PATTERN, if configval==1, then replace with X, else if configval==2 replace with Y" and so on.

Of course designing a language, a compiler to bytecode, and an interpreter is a lot of work. Especially since we want the language to be simple so the interpreter is small but featured enough to be able to capture any possible patch we want to do.

 

[mrmonotone]

My original idea which would have taken too long to implement is a patch system with a stack based scripting language. For example you can express "find PATTERN and replace at offset" as well as "if ver==1 then offset=x, else if ver==2 then offset=y, else find PATTERN, replace at offset" or "find PATTERN using MASK and replace at offset with MASK" (mask is good for patching instructions with offsets that change). Maybe even "find PATTERN, if configval==1, then replace with X, else if configval==2 replace with Y" and so on.

Of course designing a language, a compiler to bytecode, and an interpreter is a lot of work. Especially since we want the language to be simple so the interpreter is small but featured enough to be able to capture any possible patch we want to do.

Wouldn't that be a little bit of over engineering?

 

[yifan_lu]

Wouldn't that be a little bit of over engineering? I do not have really any experience writing on arm based systems, that is why I am asking.

The goal would be a) no need for hard coded patches and b) try to make sure patches don't need to be rewritten when a new fw comes out.

 

[cpasjuste]

@yifan_lu , Can we link the loader to ctrulib ? Like add a shell to debug ?

BTW, best stuff I've seen since a while on the 3ds , but you know that

Edit: if I want to hook svcDebugPrint, how would you find this function address ?

 

[mrmonotone]

The goal would be a) no need for hard coded patches and b) try to make sure patches don't need to be rewritten when a new fw comes out.

Is there a pre existing solution that exists that could be modified? Possibly from the PSP scene?

 

[polarbernd]

Is there a pre existing solution that exists that could be modified? Possibly from the PSP scene?

Did you mean something like the prx modules?

 

[yifan_lu]

@yifan_lu , Can we link the loader to ctrulib ? Like add a shell to debug ?

BTW, best stuff I've seen since a while on the 3ds , but you know that

Edit: if I want to hook svcDebugPrint, how would you find this function address ?

https://github.com/yifanlu/3ds_injector/issues/3

 

[Aurora Wright]

In the latest release of AuReiNand, the system settings will display SYS or EMU based on which one you are booted into. I am sure the code for Aurora's implementation of the loader will show how she did it!

I already wrote the currently booted NAND and FIRM in the config.bin. I just have the injector read it and act accordingly.

 

[CreativeMan]

I already wrote the currently booted NAND and FIRM in the config.bin. I just have the injector read it and act accordingly.

That's exactly what I did, checked how you did it that way, thanks for pointing it Aurora

 

[yifan_lu]

I already wrote the currently booted NAND and FIRM in the config.bin. I just have the injector read it and act accordingly.

Btw it might be cleaner if you fork 3ds_injector and then include it in your cfw as a git submodule. That way other devs might be able to use your patches.

 

[Aurora Wright]

Btw it might be cleaner if you fork 3ds_injector and then include it in your cfw as a git submodule. That way other devs might be able to use your patches.

This patch however is AuReiNand dependant (it reads its config file). In any case I intend to submit the memory searching algo I use to your repo, people found it to be faster than the one you used (it's a variant tuned for large alphabets and small patterns, I found it around).
(Thanks for all your work by the way, it's awesome!)

 

[yifan_lu]

This patch however is AuReiNand dependant (it reads its config file). In any case I intend to submit the memory searching algo I use to your repo, people found it to be faster than the one you used (it's a variant tuned for large alphabets and small patterns, I found it around).

I'm talking about in general; just nice open source practice (not copying source files but importing as git modules) but no pressure.

 

[polarbernd]

That's Teamwork Great job!

 

[daxtsu]

@yifan_lu, do you think it'd be possible to use this to allow applications to properly boot in 178MB memory mode on the N3DS, and possibly 80MB mode on the o3ds? Then CFWs wouldn't need "reboot patches" anymore, possibly.

 

[OttORoX]

Hi all, it's the first time that I write here.

Do you think that could be posible to introduce a screenshot feature like NTR has with this patching system?

Sorry if this is a stupid question, I have no coding skills.

 

[chaoskagami]

BTW, it's definitely possible to make a layeredFS replacement here. A good starting point would be porting SaltySD's patches to loader. I've been messing around with the code a bit - it is very neat stuff. Good job, @yifan_lu. Seriously.

(Also, the day of NTR's demise draws near. )

 

[tiduscrying]

BTW, it's definitely possible to make a layeredFS replacement here. A good starting point would be porting SaltySD's patches to loader. I've been messing around with the code a bit - it is very neat stuff. Good job, @yifan_lu. Seriously.

(Also, the day of NTR's demise draws near. )

Oh damn, that will be hella awesome. I've been working on the Taiko no Tatsujin 3DS translation and while NTR's layeredfs plugin works, it is just a hassle to always have to run it before running the game. Likewise with the DLC, but that's a whole other thing, I'm sure.

Seriously, the demise of NTR is really eminent. This loader is an incredible gift to this community, maan.

 

[mariogamer]

"
Currently, there is no support for FIRM building, so you need to do some steps manually. First, you have to add padding to make sure the NCCH is of the right size to drop in as a replacement. A hacky way is this patch which adds junk data. Play around with the size value to get the NCCH to be the exact same size as the one found in your decrypted FIRM dump."

How do I get this NCCH?