Hacking Curious About Something

[Boot_8046]

Might be a dumb question, but just from curiosity, can I flash the unbricked 2.1 emuNAND to my sysNAND to reobtain my OTPs and keep a9lh?
I've already have them in various places and backups but again, I'm just curious cause it is an o3DS OS in a n3DS a9lh... (I know there is an option to this in D9 and keep a9lh but idk)...

 

[solress]

yes you can, it's just a partition in the FIRM after all

 

[Boot_8046]

yes you can, it's just a partition in the FIRM after all

WOW, what a quick response..!
well, i already know that, but i thought that maybe because its an o3ds os in a n3ds maybe it changes something...

 

[The Real Jdbye]

Might be a dumb question, but just from curiosity, can I flash the unbricked 2.1 emuNAND to my sysNAND to reobtain my OTPs and keep a9lh?
I've already have them in various places and backups but again, I'm just curious cause it is an o3DS OS in a n3DS a9lh... (I know there is an option to this in D9 and keep a9lh but idk)...

When flashing 2.1 you have to remove A9LH. CFW is unable to boot 2.1.

 

[Boot_8046]

When flashing 2.1 you have to remove A9LH. CFW is unable to boot 2.1.

yeah but cant i just flash it through the keep a9lh option..?

 

[solress]

yeah but cant i just flash it through the keep a9lh option..?

but you won't be able to boot without cfw

 

[Ryccardo]

yeah but cant i just flash it through the keep a9lh option..?

No, because there's no "non-CFW" arm9 homebrew that just loads the kernel from ctrnand and launches it...

 

[Zan']

Actually if you already have A9LH you don't really need to reflash 2.1 sysNAND (eith keeping A9LH) to reobtain your OTP.
It's possible doing this by patching the otp locking through cfw and basically gerring the OTP on any firmware version through A9LH cfw patch. (I don't think anyone did this, but it's theoretically possible)
But except that you are safe either flashing a 2.1 NAND backup via Decrypt9 (Keep A9LH) get OTP and flash back the old one.

Edit: nvm you may not be able to use Keep A9LH.

 

[Boot_8046]

oh, thx for the info guys

 

[mashers]

Actually if you already have A9LH you don't really need to reflash 2.1 sysNAND (eith keeping A9LH) to reobtain your OTP.
It's possible doing this by patching the otp locking through cfw and basically gerring the OTP on any firmware version through A9LH cfw patch. (I don't think anyone did this, but it's theoretically possible)

No, I don't believe this is possible. By the time CFW has been launched and had the opportunity to patch anything, the OTP is already locked. The only way to patch it AFAIK would be to hack the bootloader.

 

[Zan']

No, I don't believe this is possible. By the time CFW has been launched and had the opportunity to patch anything, the OTP is already locked. The only way to patch it AFAIK would be to hack the bootloader.

You are mistaken.
If that was the case 2.1 FW wouldn't be able to access the OTP.
A9LH executes before your fw was even loaded. Therefore OTP locking is likely fw based.
Therefore you could possibly even write an A9LH tool to load up the OTP and dump it.

Edit: OTP is locked by Arm9, which we have access to. Through exploits on firmwares below 3.0 which didn't protect the OTP region it was possible to acquire the OTP there.
Therefore it is indeed possibly be either cfw patches (on sysNAND) or directly from Arm9 through A9LH.

 

[mashers]

You are mistaken.
If that was the case 2.1 FW wouldn't be able to access the OTP.
A9LH executes before your fw was even loaded. Therefore OTP locking is likely fw based.
Therefore you could possibly even write an A9LH tool to load up the OTP and dump it.

Edit: OTP is locked by Arm9, which we have access to. Through exploits on firmwares below 3.0 which didn't protect the OTP region it was possible to acquire the OTP there.
Therefore it is indeed possibly be either cfw patches (on sysNAND) or directly from Arm9 through A9LH.

Good point about it being FW based due to being able to capture it in 2.1. So would CFW patches to capture it from 9.2 need to be written to FIRM?

 

[ihaveahax]

You are mistaken.
If that was the case 2.1 FW wouldn't be able to access the OTP.
A9LH executes before your fw was even loaded. Therefore OTP locking is likely fw based.
Therefore you could possibly even write an A9LH tool to load up the OTP and dump it.

Edit: OTP is locked by Arm9, which we have access to. Through exploits on firmwares below 3.0 which didn't protect the OTP region it was possible to acquire the OTP there.
Therefore it is indeed possibly be either cfw patches (on sysNAND) or directly from Arm9 through A9LH.

I'm pretty sure kernel9loader locks the OTP before it jumps to the arm9 binary. so once arm9loaderhax happened, the region has been locked.

 

[Deleted-379826]

You sure he's able to do that he mentioned he's gonna put it from an o3ds onto a n3ds

 

[Zan']

I'm pretty sure kernel9loader locks the OTP before it jumps to the arm9 binary. so once arm9loaderhax happened, the region has been locked.

3dbrew says Arm9 locks the OTP by writing 0x2 to Sysprot. (Source)
Protection seems to be from Firm though. Therefore you can possibly still read a locked OTP.
I believe the OTP protection (including Arm9 Locking) is based on the FIRM, which we can manipulate.
We have everything to everything that locks/protects the OTP, therefore we should be able to read it out even on higher firmwares as long as we bypass the protections, which A9LH should let us do, since it's executed before FIRM is loaded, therefore we can patch OTP protection.
The OTP being locked should be possible to prevent as well; even though I don't think that matters for this case. (Staying with the way 2.1 FW can access the OTP. At that point the Arm9 should have locked OTP already.)
I am not a Dev, but this is what I understood from readup and what I am guessing. If this is indeed entirely different please proof your point.
(Also, at the point of A9LH people would already have their OTP, which makes this method of getting the OTP basically useless since it is required to install the requirement for this way. If it is possible.)

Edit: FIRM1 may be completely executed before payload is loaded. I guess that was your point. That would mean it would indeed require writing to the actual FIRM1 partition.
In which case A9LH execution may actually happen after OTP has been locked.
Which would mean, that you would have to install a 2.1 FIRM with payload.

 

[cearp]

can people please stop with ambiguous thread titles...
you could at least have said 'curious about restoring 2.1 backup' or something.