Your quote is kinda weird ^^'
Didn't someone calculated this before ? And isn't the ARM9 entrypoint written somewhere in the FIRM header ?
Yes that is. Entrypoint is 0x08068000 IIRC, but your code must go over the FIRM1 (which decrypted to be garbage).
And BL instruction itself has some certain bits, so you might be able to calculate this possibility.
I wanna know how poor the brave is for the arm9loaderhax - to some extent.
UPDATE:
@Mrrraou WHAT? ARM instruction: 1/16=all conditions, or 1/256=a pure BL to whatever. 1/8=any B variants.
Thumb instruction: 1/32=pure BL to whatever, 1/32=pure B to whatever. Just ignore BX this time (1/1024, and Register?)
Though the possibility looks not so bad, considering the possibility to decrypt the first 4/2 bytes to a good jump,
That would not differs much between consoles (decrypted FIRMs are similar) but that does surely not the same to this average calculation.
Even you can try it cause it is decrypted using your key supplied. Any failed try on 3ds would lead to a reboot. (So i choose to go to bed)
UPDATE:
@Mrrraou I forgot to mention. The decrypted FIRM0 and FIRM1 must be started with "46 49 52 4D 00 00 00 00" that is "FIRM" and 4 00s.