Homebrew DS(i) Mode hacking progress thread

[Zidapi]

and I dunno where he fabricated "it may not be possible" from - how I read it is it's certainly POSSIBLE but would likely be extremely difficult to pull off.

Fabricated? Fuck off.

Fabricated meaning to lie or make something up, deals with absolutes, that can be proven by supporting evidence as false. I made no absolute claims, I didn't say it was impossible, nor did Smealum.

Based on what he said, and the language he used, I was able to determine that "it may not be possible".

Here is what he said, I've emboldened the language used that led me to make the statement I did.

Please feel free to post any evidence you have that implies otherwise. Especially if you have quotes from someone more knowledge than Smea who it was definitely possible as your reply claims.

- ...but that's more or less limited to homebrew. basically the problem remains that the game will try to access data from a non-existant gamecard. you could potentially force it to run in twl instead of ntr and redirect rom and save to sd or nand, it the game might not even run due to some funky memory mapping differences. (something to do with mirrors iirc)

GBA VC is a hardware-based emulator.

Please don't use the term emulator in this context, GBA games are not emulated on the 3DS. Implying otherwise only confuses people unnecessarily.

 

[froggestspirit]

Not sure if anyone saw this, I found it while poking around http://pastebin.com/qVHNjDbD

 

[smealum]

fwiw my point was that i dont really know if such redirection is possible as i'm not super knowledgeable about the stuff the DSi added to the DS at all. that being said, homebrew is definitely possible, and beyond that i guess if AGB_FIRM somehow directs the slot2 bus to some part of FCRAM then TWL_FIRM can probably do the same... and if it does that's an easy way to load extra data right there. (remember how early DS piracy relied on slot2 ? same concept)

 

[CeeDee]

fwiw my point was that i dont really know if such redirection is possible as i'm not super knowledgeable about the stuff the DSi added to the DS at all. that being said, homebrew is definitely possible, and beyond that i guess if AGB_FIRM somehow directs the slot2 bus to some part of FCRAM then TWL_FIRM can probably do the same... and if it does that's an easy way to load extra data right there. (remember how early DS piracy relied on slot2 ? same concept)

he sneezed guys

 

[froggestspirit]

fwiw my point was that i dont really know if such redirection is possible as i'm not super knowledgeable about the stuff the DSi added to the DS at all. that being said, homebrew is definitely possible, and beyond that i guess if AGB_FIRM somehow directs the slot2 bus to some part of FCRAM then TWL_FIRM can probably do the same... and if it does that's an easy way to load extra data right there. (remember how early DS piracy relied on slot2 ? same concept)

I'm guessing that part would have to be patched into the TWL_FIRM, and even then, it'd probably be situational per game, similar to how the GBA games had different save formats, some being un-supported.

 

[Billy Acuña]

tl;dr - no one (outside of the naysayers) said it was impossible, just extremely difficult, wait for some months/years and we might see it happen.

Not dificult at all, just they are not interested to work on it.

 

[Aurora Wright]

I'm guessing that part would have to be patched into the TWL_FIRM, and even then, it'd probably be situational per game, similar to how the GBA games had different save formats, some being un-supported.

The Slot-2 flashcarts relied on heavy game patching (which was done on a PC), and almost with every new game the patcher (and/or the firmware on the flashcard) needed to be updated. I doubt anyone would be as dedicated as making a patcher for DS games (flashcard companies were that dedicated because they got a lot of money from it).

 

[Billy Acuña]

Please don't use the term emulator in this context, GBA games are not emulated on the 3DS. Implying otherwise only confuses people unnecessarily.

Yeah, hardware-based emulador it's like Tempgba emulator on DSTwo, 3DS literally runs GBA natively

 

[Apache Thunder]

Ok some progress report. I spent a good day testing this with Steveice10. TuxSH also helped with this. (mainly trying patches on the Launcher SRL on TwlBg)

I believe sig checks for DSi SRLs (DSiWare) have been patched out. (Anything using SHA1 hashes I believe have been patched)

Even got a patch that disables the DS Cart White list function entirely so any old DS flashcart (that isn't blocked by save chip detection) to work! I personally tested this by patching the relevent data in the FIRM binary of TWL_FIRM. (after fixing hashes, repacking, and re-encrypting. This works from emunand!)

https://gist.github.com/Steveice10/8a6965c59192ac970832

So those inclined to try it may do so. I have the pre-patched TWL_FIRM CIA. But obviously I'm not going to share it here.

I tested this by modifying the banner of a DSi game. Some random blackjack game.

This breaks the SHA1 HMAC hash for the banner section (which is signed by the way, so it's protected the same way as the rest of the SRL). This causes it to not show up on home menu. But that's good. I just started it from DevMenu instead and it boots! So the sig check worked on allowing a custom banner. (though Home Menu won't let you see it. ). This means one can probably edit other sections of the SRL (and maybe build a custom one or do some cool things like modifying Sudoku to have access to Slot-1. .

This may or may not make it's way into CFW. Just note not to modify TWL_FIRM on sysnand. Unless you don't plan on booting any DS games outside of CFW. Doing it on Emunand will work provided you are not using rxTools as your CFW. Patches may be slightly different for n3DS version of TWL_FIRM. But I think the only difference with that is title id and encryption of Arm9 section.

Dev TWL apps like TWLNandFiler still don't work though. Those are probably broken for other reasons that aren't sig related. Maybe size or header settings retail consoles don't like with that one.

 

[Supster131]

Ok some progress report. I spent a good day testing this with Steveice10.

I believe sig checks for DSi SRLs (DSiWare) have been patched out. (Anything using SHA1 hashes I believe have been patched)

Even got a patch that disables the DS Cart White list function entirely so any old DS flashcart (that isn't blocked by save chip detection) to work! I personally tested this by patching the relevent data in the FIRM binary of TWL_FIRM. (after fixing hashes, repacking, and re-encrypting. This works from emunand!)

https://gist.github.com/Steveice10/8a6965c59192ac970832

So those inclined to try it may do so. I have the pre-patched TWL_FIRM CIA. But obviously I'm not going to share it here.

I tested this by modifying the banner of a DSi game. Some random blackjack game.

This breaks the SHA1 HMAC hash for the banner section (which is signed by the way, so it's protected the same way as the rest of the SRL). This causes it to not show up on home menu. But that's good. I just started it from DevMenu instead and it boots! So the sig check worked on allowing a custom banner. (though Home Menu won't let you see it. ). This means one can probably edit other sections of the SRL (and maybe build a custom one or do some cool things like modifying Sudoku to have access to Slot-1. .

This may or may not make it's way into CFW. Just note not to modify TWL_FIRM on sysnand. Unless you don't plan on booting any DS games outside of CFW. Doing it on Emunand will work provided you are not using rxTools as your CFW. Patches may be slightly different for n3DS version of TWL_FIRM. But I think the only difference with that is title id and encryption of Arm9 section.

Dev TWL apps like TWLNandFiler still don't work though. Those are probably broken for other reasons that aren't sig related. Maybe size or header settings retail consoles don't like with that one.

Is it on that iso site?

 

[Apache Thunder]

No. I haven't posted it anywhere yet... I might do so tomorrow maybe. It's getting late here.

But honestly it would be better off being in a CFW like rxTools. RxTools has code to patch twl_firm stuff. You can ask the rxTools team to add this if there's demand for it.

 

[Supster131]

No. I haven't posted it anywhere yet... I might do so tomorrow maybe. It's getting late here.

But honestly it would be better off being in a CFW like rxTools. RxTools has code to patch twl_firm stuff. You can ask the rxTools team to add this if there's demand for it.

Well, I'd rather stick with reiNAND.

(Also, you kidding me? People working on rxTools take forever, even if there were demand, I wouldn't see it anytime soon from them.)

 

[Apache Thunder]

Well CakesFW added AGB_FIRM patching. (not sure if they added any patches yet. They just got the initial support for it added in one of the newer builds) Maybe they can add TWL_FIRM patching too?

 

[Supster131]

Well CakesFW added AGB_FIRM patching. (not sure if they added any patches yet. They just got the initial support for it added in one of the newer builds) Maybe they can add TWL_FIRM patching too?

Maybe one day I'd still want to give it a shot on my own (if you're fine with it, of course).

 

[FR0ZN]

Ok some progress report. I spent a good day testing this with Steveice10. TuxSH also helped with this. (mainly trying patches on the Launcher SRL on TwlBg)

I believe sig checks for DSi SRLs (DSiWare) have been patched out. (Anything using SHA1 hashes I believe have been patched)

Even got a patch that disables the DS Cart White list function entirely so any old DS flashcart (that isn't blocked by save chip detection) to work! I personally tested this by patching the relevent data in the FIRM binary of TWL_FIRM. (after fixing hashes, repacking, and re-encrypting. This works from emunand!)

https://gist.github.com/Steveice10/8a6965c59192ac970832

So those inclined to try it may do so. I have the pre-patched TWL_FIRM CIA. But obviously I'm not going to share it here.

I tested this by modifying the banner of a DSi game. Some random blackjack game.

This breaks the SHA1 HMAC hash for the banner section (which is signed by the way, so it's protected the same way as the rest of the SRL). This causes it to not show up on home menu. But that's good. I just started it from DevMenu instead and it boots! So the sig check worked on allowing a custom banner. (though Home Menu won't let you see it. ). This means one can probably edit other sections of the SRL (and maybe build a custom one or do some cool things like modifying Sudoku to have access to Slot-1. .

This may or may not make it's way into CFW. Just note not to modify TWL_FIRM on sysnand. Unless you don't plan on booting any DS games outside of CFW. Doing it on Emunand will work provided you are not using rxTools as your CFW. Patches may be slightly different for n3DS version of TWL_FIRM. But I think the only difference with that is title id and encryption of Arm9 section.

Dev TWL apps like TWLNandFiler still don't work though. Those are probably broken for other reasons that aren't sig related. Maybe size or header settings retail consoles don't like with that one.

How do I find that patches.md document on my own on github? I've clicked every possible button on steveice github page, but I can't find it.

 

[zoogie]

How do I find that patches.md document on my own on github? I've clicked every possible button on steveice github page, but I can't find it.

Have you tried clicking on the link in that post?
(github and gist are treated separately if that's what you mean. no relation)

 

[FR0ZN]

Have you tried clicking on the link in that post?

Yes but I want to know the origin of this document. How to find it in the first place. But I just noticed we are talking about gist here and not github itself

 

[TuxSH]

Yes but I want to know the origin of this document. How to find it in the first place. But I just noticed we are talking about gist here and not github itself

Well, it's a "secret gist" from Steveice, so..

 

[Apache Thunder]

Yo, just confirmed that my prepatched TWL_FIRM FIRM binary works with rxTools. I stripped out the ExeFS header from the patched FIRM file from my CXI and placed that in rxTools/data folder replacing the existing one. My modified BlackJack DSi game even shows up on the home menu now. (in CakesFW with prepatched TWL_FIRM installed directly to sysnand, it wouldn't show up. One would have to boot it from devmenu) Curious as to why rxTools allows Home Menu to show it. None then less, it boots teh game despite the sig broken SRL. So it can work from rxTools. Someone should as them to add it to their source code.

 

[dubbz82]

Yo, just confirmed that my prepatched TWL_FIRM FIRM binary works with rxTools. I stripped out the "Magic" FIRM header from the patched FIRM file and placed that in rxTools/data folder replacing the existing one. My modified BlackJack DSi game even shows up on the home menu now. (in CakesFW with prepatched TWL_FIRM installed directly to sysnand, it wouldn't show up. One would have to boot it from devmenu) Curious as to why rxTools allows Home Menu to show it. None then less, it boots teh game despite the sig broken SRL. So it can work from rxTools. Someone should as them to add it to their source code.

Spiffy. This means theoretically loading dsi homebrew from dsi modes home menu, no?