Hacking (4.x only) CIA CFW Complete Guide

[Lord M]

If you have the GW cart, you don't need CFW. I use CFW because I don't want to buy a GW cart.

BTW I'm experimenting for installing CIAa on sysnand with a mod of CFW. Stay tuned ...

Hmm its not risky to install on SysNand?

 

[nop90]

Hmm its not risky to install on SysNand?

Retail titles are installed on the SD data of the sysnand (like the eshop does). If you try to install a system update on the sysnand, ... then yes, it's risky.

 

[Lord M]

Retail titles are installed on the SD data of the sysnand (like the eshop does). If you try to install a system update on the sysnand, ... then yes, it's risky.

And what utility you'll look for cia on sysnand with modded cfw?? that you can launch app and other immediately after turn on 3ds? XD

 

[nop90]

And what utility you'll look for cia on sysnand with modded cfw??

You can install CIA with a valid sign on the 3DS and have it on the home screen. If you update the FW they'll stay there, like happens for a 3DS buyed with a bundled game.

I don't play games so it's no use for me, I find more interesting the possibility to install sys update (or maybe in the future custom patchs ) on the sysnand; obviously without buying a Gateway.

 

[Lord M]

You can install CIA with a valid sign on the 3DS and have it on the home screen. If you update the FW they'll stay there, like happens for a 3DS buyed with a bundled game.

I don't play games so it's no use for me, I find more interesting the possibility to install sys update (or maybe in the future custom patchs ) on the sysnand; obviously without buying a Gateway.

If you are able to do to a modded cfw maybe you are able also to add plugin support like ntr cfw

 

[nop90]

If you are able to do to a modded cfw maybe you are able also to add plugin support like ntr cfw

The part of the cfw that starts the ctrserver (the one in the arm11_code.bin loaded pressing the L key) works like the ntr cfw plugins. So yes, it's possible to implement plugins for the CFW too.

I almost completeted the RE of boot.bin, but not started the RE of the arm11_code.bin part (I have the asm decompiled, but no time to analyze it).

My priority is to rewrite the code of the boot.bin using the framework of xerpi linux loader to make the cfw more stable. Then maybe I could try to make a arm 11 plugin to load regionthree and the HB service that enables the use of the HB Launcher.

But it's a long term project, at the actual speed it will took me about a year. Where are people that want try to do this in a shorter time?

 

[Lord M]

a year?? .__.

 

[nop90]

Yea. First family, dojo and work. Than playing with 3DS. It's only an hobby for me, and I can spend on it only a couple of hours in the we.

But really, if someone with some c coding skills and the basics of asm want to start studiyng hardly, he can master the code of the CFW in about a week (half of the code is RE and available on GovanifY site).

 

[Lord M]

you have a dojo? XD

 

[nop90]

My Iaido school has one.

 

[Wisenheimer]

I tried installing CFW to an SD card, but it does not seem to be working.

I got emuNand working fine with all my eShop purchases transferred (it looks like I might have lost some parts of the streetpass plaza and games data, but oh well).

However, I seem to be having no luck booting to the CFW. It restarts with a flash of a white screen and then blue on the top screen. I can't tell whether it is booting to the REDNAND I injected or not. Is there an easy way to tell whether it booted to the custom firmware or just rebooted the system?

All I know is that injecting .CIA files via the local network with the command line utility is not working. I suspect it's not booting to the CFW for some reason, but I suppose it could also be a problem with the network injection.

Does anyone have advice?

 

[jarmster]

If you have rebooted back to the home menu after launching the ds profile while holding L and getting the blue screen on top and lower screen flashes white.......you've booted the cfw.....run the bat to install devmenu. Make sure its in the same directory as the bat file.
Make sure you understand the instructions for installing devmenu and using the cfw...

 

[Wisenheimer]

If you have rebooted back to the home menu after launching the ds profile while holding L and getting the blue screen on top and lower screen flashes white.......you've booted the cfw.....run the bat to install devmenu. Make sure its in the same directory as the bat file.
Make sure you understand the instructions for installing devmenu and using the cfw...

I actually responded to the wrong thread, but I suppose here is as good of a place as any. Is there any way to check whether I am on CFW? I try injecting .cia files through the network and the terminal returns an error code. That is what makes me think it is not booting to CFW or it is somehow corrupted.

 

[nop90]

I actually responded to the wrong thread, but I suppose here is as good of a place as any. Is there any way to check whether I am on CFW? I try injecting .cia files through the network and the terminal returns an error code. That is what makes me think it is not booting to CFW or it is somehow corrupted.

Make a new folder and change the icon zoom in what you suppose to be the emunand. So you can see the differenze with the sysnand homemenu.

An error code in ctrclient may be for not correcty creating the title.db and import.db (to do only if don't have anything downloaded from eshop).

 

[Wisenheimer]

Make a new folder and change the icon zoom in what you suppose to be the emunand. So you can see the differenze with the sysnand homemenu.

An error code in ctrclient may be for not correcty creating the title.db and import.db (to do only if don't have anything downloaded from eshop).

Thank you for helping me narrow it down. Using the method you suggested implies I am correctly booting into the CFW (because the icon sizes change).

However, I am not sure how to proceed from there. I made the blank *.db documents, ran through the instructions, and now the dbs folder contains the import.db and title.db files with 3193 kb of information each.

I could transfer over my eShop files that I backed up, but I would rather keep those on the 9.5 emunand if possible. I just want the CFW for homebrew.

 

[nop90]

Thank you for helping me narrow it down. Using the method you suggested implies I am correctly booting into the CFW (because the icon sizes change).

However, I am not sure how to proceed from there. I made the blank *.db documents, ran through the instructions, and now the dbs folder contains the import.db and title.db files with 3193 kb of information each.

I could transfer over my eShop files that I backed up, but I would rather keep those on the 9.5 emunand if possible. I just want the CFW for homebrew.

Make a backup of the "Nintendo 3D" folder on the SD and the format the emunand. This will unlink the emunand from the sysnand (so you'll have two folders in the Nintendo 3D, one for the emunand and one for the sysnand). Copy back the original content of the Nintendo 3DS folder (that was wiped out during format) and than you can place the empy *.db file in the emuinand folder and continue with CFW setup.

Pay attention to not format your sysnand, and to don't have risk, should be bettere to use a second SD or make a complete backup of your SD with windiskimager. There are a lot of tutorial on unlinkung the two nand on the forum, read a bit befor starting the process.

 

[KazoWAR]

The part of the cfw that starts the ctrserver (the one in the arm11_code.bin loaded pressing the L key) works like the ntr cfw plugins. So yes, it's possible to implement plugins for the CFW too.

I almost completeted the RE of boot.bin, but not started the RE of the arm11_code.bin part (I have the asm decompiled, but no time to analyze it).

My priority is to rewrite the code of the boot.bin using the framework of xerpi linux loader to make the cfw more stable. Then maybe I could try to make a arm 11 plugin to load regionthree and the HB service that enables the use of the HB Launcher.

But it's a long term project, at the actual speed it will took me about a year. Where are people that want try to do this in a shorter time?

I wish i could understand asm better. what exactly does boot.bin do? does it just boot the emunand or does it also make the cfw patches? or is that done later in arm11_code.bin.

 

[nop90]

Boot.bin redirect and init nand, than patch it to run the cias.

The arm11_code.bin is something like a plugin that runs in the background the ctrserver listening on the wifi the command sent fron the ctrclient running on a PC.

 

[WateredFire19]

Is there any way to increase the success rate of acually booting CFW correctly?

 

[jackotrades]

That would be nice. I'm running about a 1 in 10 success rate on average.