Homebrew ARM9Loader -- Technical Details and Discussion

  • Thread starter Thread starter Selver
  • Start date Start date
  • Views Views 581,104
  • Replies Replies 4,025
  • Likes Likes 42
Yeah, even if you can't decrypt firm0, firm1 and the secret sector. But you can.

Well, correct me if I'm wrong, but just firm0 and the secret sector will do, even encrypted. What makes the system to overwrite the firm0+a9lh with firm1 is a size or a key check (I don't remember it right now) if we put a working, standart firm0 without payload and give the system the proper key to decrypt it, it won't grab firm1 because firm0 will do, even if firm1 key is prepared to decrypt firm1 into pseudo-random garbage designed to jump into a payload.
 
Well, correct me if I'm wrong, but just firm0 and the secret sector will do, even encrypted. What makes the system to overwrite the firm0+a9lh with firm1 is a size or a key check (I don't remember it right now) if we put a working, standart firm0 without payload and give the system the proper key to decrypt it, it won't grab firm1 because firm0 will do, even if firm1 key is prepared to decrypt firm1 into pseudo-random garbage designed to jump into a payload.
Uh what ? You can do a a9lhax backup with what you asked me, as I said, I just said that you couldn't really decrypt it (well, only the FIRM partitions), and you couldn't decrypt the secret key sector without your OTP hash.
 
Uh what ? You can do a a9lhax backup with what you asked me, as I said, I just said that you couldn't really decrypt it (well, only the FIRM partitions), and you couldn't decrypt the secret key sector without your OTP hash.

But do I need to get them decrypted? I can't just backup them and make some little brew to overwrite them back when needed?
OTP hash is not a problem, if I got a9lh I already have my otp. A sha256 is not expensive this days.
 
But do I need to get them decrypted? I can't just backup them and make some little brew to overwrite them back when needed?
OTP hash is not a problem, if I got a9lh I already have my otp. A sha256 is not expensive this days.
You don't need to, it's just an extra to decrypt these.
 
  • Like
Reactions: Urbanshadow
To the experts : got my OTP, and a 9.2 sysnand / 10.x emunand system. A9lh NOT installed.

What if I do that :

1. D9 backup of 9.2 sysnand, emunandtool backup of 10.x emunand on computer, both WITH firm0/firm1.
2. Place 10.x emunand backup on SD, named NAND.bin, then a9lh installation (it should inject NAND.bin in sysnand, THEN install a9lh, right ?)
3. Inject 9.2 sysnand backup (from before a9lh installation) to emunand with emunandtool on computer.

Your thoughts ?
 
To the experts : got my OTP, and a 9.2 sysnand / 10.x emunand system. A9lh NOT installed.

What if I do that :

1. D9 backup of 9.2 sysnand, emunandtool backup of 10.x emunand on computer, both WITH firm0/firm1.
2. Place 10.x emunand backup on SD, named NAND.bin, then a9lh installation (it should inject NAND.bin in sysnand, THEN install a9lh, right ?)
3. Inject 9.2 sysnand backup (from before a9lh installation) to emunand with emunandtool on computer.

Your thoughts ?
did you ran a9lh.3dsx by sysnand?
 
Do you have secret_sector?

Why would I need it ? If a9lh installer sysnand inject function works as I think it does, it shouldn't be need.
As I understand it, if a NAND.bin file is found on SD, a9lh_install injects the full nand, THEN installs a9lh on sysnand. But I'd like a confirmation.
 
To the experts : got my OTP, and a 9.2 sysnand / 10.x emunand system. A9lh NOT installed.

What if I do that :

1. D9 backup of 9.2 sysnand, emunandtool backup of 10.x emunand on computer, both WITH firm0/firm1.
2. Place 10.x emunand backup on SD, named NAND.bin, then a9lh installation (it should inject NAND.bin in sysnand, THEN install a9lh, right ?)
3. Inject 9.2 sysnand backup (from before a9lh installation) to emunand with emunandtool on computer.

Your thoughts ?
Pretty sure that would remove A9LH from your sysNAND, and it'll "update" it to 10.6, meaning you'll be screwed.
https://gbatemp.net/threads/tutorial-swap-sysnand-and-emunand-arm9loaderhax-only.415724/

Follow that guide, don't restore FIRM0/FIRM1.
I also don't know what effects it'll give to your emuNAND. So better safe than sorry.
 
To my understanding, arm9loaderhax.3dsx is running in memory (ARM 9 or 11 ?). While running, if NAND.bin is found on SD, it injects it in sysnand, then automatically installs a9lh in sysnand.
That's why I don't think I'd be screwed (10.x sysnand without a9lh), and that's why I think this swap guide could be simplified.

But please correct me if I'm wrong, I'm learning.
 
Pretty sure that would remove A9LH from your sysNAND, and it'll "update" it to 10.6, meaning you'll be screwed.
https://gbatemp.net/threads/tutorial-swap-sysnand-and-emunand-arm9loaderhax-only.415724/

Follow that guide, don't restore FIRM0/FIRM1.
I also don't know what effects it'll give to your emuNAND. So better safe than sorry.
As this thought was stated on two threads, I'll reiterate the answer here:
https://github.com/delebile/arm9loa...payload_installer/installer/source/main.c#L43

A9LH installer restores NAND.bin before installing, so this could theoretically work.
However, it's unnecessarily dangerous and is only really worth trying on a hardmod.
 
  • Like
Reactions: Supster131

Site & Scene News

Popular threads in this forum