Homebrew Clarification Thread - What is going on?

[Deleted User]

Enlighten me, what's the topic?

Okay, so I think the main aim of the thread is to speculate about the upcoming downgrade method.

 

[Uziskull]

Enlighten me, what's the topic? As far as I can tell the op didn't require any responses, yet here we are at page 69

So far, nothing other than some updates, as you'd expect.

 

[Syphurith]

Yes, no ETA for guys donating their effort on free plans. It you do need that, go ahead to ask GW about ETA.
@Mrrraou Sorry i don't know who else to tag for this. I've several questions.
1.What is the timing when arm9loaderhax take place? I mean, the "garbage" is arm9bin IIRC, and this mainly contains the process9.
However I don't know if that is the ARM9 FIRM section, or just Process9.
2.Could bootrom ever been in the memory? The chip executes it, thus I suppose it has ever been loaded into memory.
But it is then wiped out from there. And I don't know when that is supposed to happen.
To my understanding, ARM9 deals with all crypto stuffs. NAND image itself is encrypted with console-unique key, so ARM9 is started ahead ARM11.
It might be? Boot->Init Bootrom Crypto->NAND and peripherl inited->Load Firm ARM9->Call arm9loader->Process9 Loaded->ARM11 launch->Foreground?
Also to note, to drive a NAND as HDD, you need FTL, and 3ds surely implemented this. Well not very relative.
3.The Key#2 that inferred in arm9loaderhax, is said to be "decrypted" in the slides.
I just wanna know if that is just loaded from decrypted NAND image, or is decrypted using another key?
4.It seems current theory is only for N3DS. There doesn't seem to be an arm9loader inside O3DS that with decryption.
Hope my questions could be viewed by some guys that have the ability to answer some.

 

[hacksn5s4]

when it comes out i can play Pokemon x or oras romhack with out needing to swap saves and don't need card unless sd gets courrpted

 

[ketal]

Speculating with no (or low) knowledge about how those haxes work is not speculation, it's guessing..

 

[hacksn5s4]

the old 3ds with kernal should be able to emulate better then psp old 3ds is more powerful then psp

 

[BurningDesire]

the old 3ds with kernal should be able to emulate better then psp old 3ds is more powerful then psp

Dude we have a virtual boy emulator and it cant even handle that lol

 

[Deleted User]

Dude we have a virtual boy emulator and it cant even handle that lol

For 3DS or PSP? Because mGBA is working absolutely perfectly on the 3DS.

 

[hacksn5s4]

thats because is early stage i compared the specs old 3ds has more ram then the psp old 3ds also has dual core cpu and the psp only has one

 

[BurningDesire]

For 3DS or PSP? Because mGBA is working absolutely perfectly on the 3DS.

the o3ds. It works fine on N3ds but nothing works on old anymore

 

[Deleted User]

the o3ds. It works fine on N3ds but nothing works on old anymore

Nintendo did the right thing to bring out a more powerful 3DS model.

 

[hacksn5s4]

the psp can emulate ps1 games and its less powerful then old 3ds we will get stuff running ful speed on old when kernel comes out and devs can make there emulators make use of it
smea showed specs of old 3ds in his talk and there better then psp

 

[Pandaxclone2]

Lets not start a spec comparison debate that's been done about a hundred times over by now.

 

[Mrrraou]

Yes, no ETA for guys donating their effort on free plans. It you do need that, go ahead to ask GW about ETA.
@Mrrraou Sorry i don't know who else to tag for this. I've several questions.
1.What is the timing when arm9loaderhax take place? I mean, the "garbage" is arm9bin IIRC, and this mainly contains the process9.
However I don't know if that is the ARM9 FIRM section, or just Process9.
2.Could bootrom ever been in the memory? The chip executes it, thus I suppose it has ever been loaded into memory.
But it is then wiped out from there. And I don't know when that is supposed to happen.
To my understanding, ARM9 deals with all crypto stuffs. NAND image itself is encrypted with console-unique key, so ARM9 is started ahead ARM11.
It might be? Boot->Init Bootrom Crypto->NAND and peripherl inited->Load Firm ARM9->Call arm9loader->Process9 Loaded->ARM11 launch->Foreground?
Also to note, to drive a NAND as HDD, you need FTL, and 3ds surely implemented this. Well not very relative.
3.The Key#2 that inferred in arm9loaderhax, is said to be "decrypted" in the slides.
I just wanna know if that is just loaded from decrypted NAND image, or is decrypted using another key?
4.It seems current theory is only for N3DS. There doesn't seem to be an arm9loader inside O3DS that with decryption.
Hope my questions could be viewed by some guys that have the ability to answer some.

1. arm9loaderhax takes place after the firmware decryption keyslot key are cleared, so right when jumping to the decrypted firm data.
2. No, it is: Powering on -> Bootrom -> arm9loader decryption -> jumps to arm9loader -> FIRM decryption -> keyslot clearing -> ARM9 jumping to ARM9 entrypoint; ARM11 jumping to ARM11 entrypoint -> Kernel9 loaded; Kernel11 loaded -> Running Process9 ; Starting ARM11 services (fs, pxi, am, ldr, pm) -> Running Process9 ; PM runs NS -> Running Process9; NS runs Home Menu
3. I don't know how you could decrypt it. I don't even know if these keys are publicly known.
4. There isn't any arm9loader on O3DS. But it would be useless anyway to have that on O3DS since we already have 9.5+ emuNAND.

 

[Syphurith]

1. arm9loaderhax takes place after the firmware decryption keyslot key are cleared, so right when jumping to the decrypted firm data.
2. No, it is: Powering on -> Bootrom -> arm9loader decryption -> jumps to arm9loader -> FIRM decryption -> keyslot clearing -> ARM9 jumping to ARM9 entrypoint; ARM11 jumping to ARM11 entrypoint -> Kernel9 loaded; Kernel11 loaded -> Running Process9 ; Starting ARM11 services (fs, pxi, am, ldr, pm) -> Running Process9 ; PM runs NS -> Running Process9; NS runs Home Menu
3. I don't know how you could decrypt it. I don't even know if these keys are publicly known.
4. There isn't any arm9loader on O3DS. But it would be useless anyway to have that on O3DS since we already have 9.5+ emuNAND.

Thanks for reply. SO, the arm9loader loads a different binary from NAND, and this isn't FIRM? Eh.. And, that isn't included in NAND FAT16 Xorpad section. This makes it harder to implement, doesn't it? You can not decrypt it currently. You can place your own code after the FIRM0 to ensure it isn't decrypted as GARBAGE, however finding a key to generate the garbage to contain a jump and no infinite loop/code with severe damage, needs quite plenty of trails - even you don't know if the key is decrypted again.. Orz.

 

[hacksn5s4]

i thnk were gonna have to wait a few weeks for this to come out

 

[Mrrraou]

Thanks for reply. SO, the arm9loader loads a different binary from NAND, and this isn't FIRM? Eh.. And, that isn't included in NAND FAT16 Xorpad section. This makes it harder to implement, doesn't it? You can not decrypt it currently. You can place your own code after the FIRM0 to ensure it isn't decrypted as GARBAGE, however finding a key to generate the garbage to contain a jump and no infinite loop/code with severe damage, needs quite plenty of trails - even you don't know if the key is decrypted again.. Orz.

arm9loader loads FIRM from NAND. But arm9loader is decrypted and loaded by the bootloader. And the keyslot is cleared, because the payload is executed after arm9loader. So you can't regenerate the decryption keys. And the problem, is that you have to bruteforce to have something bootable and that does "what you want".

 

[hacksn5s4]

what are keys needed for

 

[peteruk]

what are keys needed for

open up 9.5+ emuNAND for N3DS

 

[hacksn5s4]

too many combnations tho it will take you more then a life time to crack it