These keys are generated with Key #2 and you overwrute Key #2 with a garbage key to exploit this. So, while the keys are still set in the keyslots, you can't use themp, because they are garbage.
and when nintendo change the keys, we will have to wait and do all of this stuff again? would it be harder, or just the same more work? i mean... if whatever made n3ds emunand 9.5+ so difficult, can't they just do that again, but... better/more?
Currently to use emuNAND 9.6+ you have to have a sysNAND 9.6+ and to exploit memchunkhax2+ntrcardhax. (To USE it.)
But that's for N3DS, since O3DS can use Emunand 10.3 (atm) on sysnand 9.2? (not saying that 10.4 will work on O3DS if they fix the ntrcardhax and change keys (if for now, we all know Nintendo, sometimes there thinking in a very wierd way!))
Couldn't someone just dump the NAND 0x12c00 sector, firmlaunch into a modified 9.6 NATIVE_FIRM that doesn't do the keyslot cleanup, generate a xorpad from there to decrypt the 0x12c00 sector and thus be able to decrypt 9.6+ firmwares?
Of course that's for N3DS, I'm not sure that Nintendo could ever block emuNAND on O3DS.
No, the OTP are locked.
It requires to install a special per-console sector on NAND.
Soooooo couldnt someone run Sysupdater on an O3DS on and downgrade to abuse the flaw? Or is there no complete 3.0 backup anywhere?
Not on THAT iso site. This issue was you couldnt run a browser or Cubic before 4.5(afaik) so no dumps exist yet.
ROP for 1.0 cubic ninja exists, but i digress. Also OTP is per console so you'd need to half-boot your n3ds somehow into 3x and obtain OTP. Or try the various other seemingly unlikely methods.
