Homebrew ARM9Loader -- Technical Details and Discussion

[runetoonxx2]

the possibilities are endless with a9lh, I'm seeing a lot of talk about getting decrypt9 to function with more stuff now that we have a9lh.

Soo like a hard mod but not

 

[Just Passing By]

the possibilities are endless with a9lh, I'm seeing a lot of talk about getting decrypt9 to function with more stuff now that we have a9lh.

Oh really? Can you give an example?

 

[runetoonxx2]

In case we brick sysnand we just boot emunand to fix it?

 

[Just Passing By]

I heard that it is possible to be able to do that once something gets developed, but I want to know what else can be accomplished with a9lh.

 

[Apache Thunder]

In case we brick sysnand we just boot emunand to fix it?

Yes. As long as the A9L payload itself stored on NAND isn't destroyed, you can brick ctr_nand partition and still be able to use A9L to boot emunand.

 

[Svaethier]

I heard that it is possible to be able to do that once something gets developed, but I want to know what else can be accomplished with a9lh.

Something like a bootmii equivalent

 

[lettuce]

Can some kind soul, compile arm9loaderhax for me??

 

[runetoonxx2]

<3 the super speedy boot times can't wait for whnat arm9loaderhax can bring us next

--------------------- MERGED ---------------------------

Hopefully upgrade sysnand soon xD

 

[Svaethier]

<3 the super speedy boot times can't wait for whnat arm9loaderhax can bring us next

--------------------- MERGED ---------------------------

Hopefully upgrade sysnand soon xD

Build 3.5 with the upgraded sysnand thing means you can upgrade sysnand to 10.5 without fear of messing your 3ds up.

 

[Mrrraou]

About the booting with no sd card thing: would it be feasible to change a9l's behaviour when no payload is found, so instead of shutting down, it firmlaunched sysnand with no patches? I understand the firm partitions are corrupted, but could it use the copy from the nand filesystem? Or would that be all too much code to squeeze in?

Not enough space in NAND and in the payload to do this, and most CFW devs wouldn't want this behavior, I guess.

 

[Sgt. Lulz]

I have a few questions:
#1, is it actually impossible for Nintendo to reset the 0x96 keystore through a system update?
#2, is it possible to write-protect sectors/partitions on the NAND or are workarounds the only way?
Not that I intend on updating sysNAND, but I'm definitely curious.

 

[Mrrraou]

I have a few questions:
#1, is it actually impossible for Nintendo to reset the 0x96 keystore through a system update?
#2, is it possible to write-protect sectors/partitions on the NAND or are workarounds the only way?
Not that I intend on updating sysNAND, but I'm definitely curious.

1. I don't think it can be modified with the update methods they are using.
2. It should be possible, but would require patching the FIRM for this.

 

[Vappy]

I have a few questions:
#1, is it actually impossible for Nintendo to reset the 0x96 keystore through a system update?
#2, is it possible to write-protect sectors/partitions on the NAND or are workarounds the only way?
Not that I intend on updating sysNAND, but I'm definitely curious.

#1, even if they can, it can just be dumped again? #2 has already been done, it's implemented in AuReiNand.

 

[Urbanshadow]

Someone could help me a bit with understanding how to generate the OTP for N3ds without downgrading (the keyscrambler reverse engineering way)?

From what I found, the OTP is something like:

slot0x25KeyX.bin + OTP hash + Generated KeyY

But then to generate key Y it's needed a little bit of brute-forcing.

 

[Just Passing By]

So I have a question about the Reinand mod. I was wondering, so since now whenever I turn on my 2ds I'm supposedly on sysnand, if I were to brick it, would my whole system be dead? I'm confused because it's on 10.3 right now and I never updated. I know this is nooby, but humor me.

 

[daxtsu]

So I have a question about the Reinand mod. I was wondering, so since now whenever I turn on my 2ds I'm supposedly on sysnand, if I were to brick it, would my whole system be dead? I'm confused because it's on 10.3 right now and I never updated. I know this is nooby, but humor me.

Unless you've specifically set up AuReiNand to boot to sysNAND, it's booted you into your emuNAND (basically it looks for a file on the SD card that you have to go out of your way to make). So if you screw anything up, it's just your emuNAND right now.

Edit: Also, if you don't have that specific file, sysNAND will only boot if you hold L (to launch with a FIRM from 10.x) or L & R (to launch with a FIRM from 9.0).

 

[3xkrazy]

So what is suppose to happen on screen after scanning the QR code? I successfully downgraded my n3DS J to 2.x, but when I scan the QR code, my 3DS just freezes. The internet connection is fine, as it passed the connection test under system settings. Is the QR code provided region specific or universal?

 

[Mrrraou]

it's implemented in AuReiNand.

Not really. Aurora just implemented the non-updating of the FIRM partitions (which is a patch from delebile). But a CIA with enough privileges (ARM11 kernel, for example) could break a9lh as well.

--------------------- MERGED ---------------------------

Someone could help me a bit with understanding how to generate the OTP for N3ds without downgrading (the keyscrambler reverse engineering way)?

From what I found, the OTP is something like:

slot0x25KeyX.bin + OTP hash + Generated KeyY

But then to generate key Y it's needed a little bit of brute-forcing.

The OTP should encrypted with some kind of AES, and it contains the console unique keys. So it's definitely not the OTP.
Only the OTP hash is needed to install a9lhax.

 

[Urbanshadow]

The OTP should encrypted with some kind of AES, and it contains the console unique keys. So it's definitely not the OTP. Only the OTP hash is needed to install a9lhax.

Ok, I dont actually know how to get that, but I have some flashbacks of reading something like that somewhere. To the batcave again. (Is it time to remove my xmas hat?)

 

[daxtsu]

But a CIA with enough privileges (ARM11 kernel, for example) could break a9lh as well.

Probably one more reason for sticking with emuNAND for now, over a sysNAND environment.