How to use BrowserHax on Firmware 10.7.0 and 11.0.0 and get your exploit games (ready for slowhax)

Discussion in '3DS - Flashcards & Custom Firmwares' started by clancy94, Nov 25, 2016.

  1. clancy94
    OP

    clancy94 GBAtemp Fan

    Member
    427
    103
    Oct 18, 2008
    Reddit user 'ASK-ABOUT-VETRANCH' from /r/3dshacks said it's cool that I post this here for more exposure.
    Link: https://www.reddit.com/r/3dshacks/comments/5eu9h2/how_to_successfully_use_browserhax_on_the_first/

    *EDIT* As of 27/11 Legends of Exidia is the only DSiWare game still available to buy/download in the eShop, so that's why it's the only one mentioned in the guide.

    Before reading this guide let's be clear that 10.7 is already downgradeable and doesn't need to wait for slowhax, this is just to fix browserhax as a homebrew entry point for some people who are getting the browser nag. People on 11.0 & 11.1 are not eligible for normal downgrade methods but are eligible for slowhax (when it's released), use this guide to download a DSiWare game (Legends of Exidia is the last one left) in preparation for slowhax & the before LoE is removed from the eShop too!

    Preface
    It should be noted that I did not discover this trick. I can't find the comment right now The comment that helped me with is is here. Its buried in a thread from a week month ago and provides a command to use on your router to bypass the version check. I am simply providing a full list of steps to do this.

    It should be noted that I have only tested this on one device on one firmware (N3DSXL 11.0.0-33U), and that I have set this up in one specific scenario. I cannot guarantee every configuration will work with this.

    This guide should work even if you have already had the browser nag (I know that I did). If it doesn't, you may need to do a system format (back up your data!) to be able to do this.

    I specified only 10.7 and 11.0 in the title because as far as I know, lower versions do not have the browser nag. If you are interested in putting homebrew on those, follow Plailect's guide exactly.

    Part 0: Preparation
    For this guide, you need the following:

    • Your 3DS on 10.7 or 11.0 firmware
    • An SD card loaded with the browserhax files described in Plailect's guide, plus a ropbin payload that is compatible with your device and firmware obtained from Smea's site.
    • A router you can SSH into with root access, or a rooted* Android device which you can use hotspotting on.
    • If you are using an Android phone, you need to install an app that lets you modify iptables. I used this.
    * note that I have only tested with a rooted device on Marshmallow 6.0.1, your success may vary.

    You should rename the ropbin payload you downloaded to browserhax_hblauncher_ropbin_payload.bin and place it in the root of the SD. I was getting stuck on a grey screen because the exploit couldn't get this payload, so if you have it already it should let it work fine.

    It may also be possible to do this if you have can create a hotspot on your laptop, however you will need to be able to use iptables or an equivalent.

    You will also need to make sure you have ctr-httpwn if you want to download an exploit game such as Steel Diver: Sub Wars or one of the DSiWare games in preparation for Slowhax. You will not be able to use the one packaged with the current browserhax kit because yellows8's stuff is being moved. There are mirrors set up for this and a fork of the project that lets you choose the mirror.

    Part 1: Connecting to your router/phone
    1. If you are connected to any networks on your 3DS other than the router you plan on using, remove them from your 3DS.
    2. Now, create the hotspot on your phone if you are using it, and connect your 3DS just like you normally would, without any DNS.
    3. Now, set up the iptableson the device of your choice:
      • If you are using your router, you need to SSH into it now. On Windows, you can use something like PuTTY. If you are on Mac, you should be able to use ssh through the Terminal Emulator. On Linux, just run your shell of choice and use ssh as normal. You will connect to it by entering the local IP address of your router, and (usually) port 22.
      • If you are using your phone, open the iptables app you installed.
      • Once you have done one of the above, you will need to run the following command: iptables -I FORWARD -d conntest.nintendowifi.net -j DROP.
      • If this executes successfully (no output usually means successful), you can proceed to the next part.
    Part 2: Using browserhax
    1. You can essentially do this like you normally would. Since the default browserhax page is down, you should use something like Plailect's mirror for it. I did this using the QR code, but entering the URL should work fine.
    2. Assuming everything went correctly, you should have entered the Homebrew launcher! If you are on 10.7, you should be able to follow Plailect's guide from here on out. Before that, skip to Part 5 of this guide.
    3. If you are on 11.0 and are interested in getting a DSiWare exploit game from the eShop (I believe only LoE remains, $7.99), or you would like to download a game from the eShop for an alternate secondary entrypoint to Menuhax, you need to go to Part 3. Otherwise if you are just interested in Homebrew for now, you can install Menuhax as per Plailect's guide, after going to Part 5 of this guide.
    Part 3: Using ctr-httpwn
    1. Do NOT install Menuhax. If you did, you need to delete it. It is not compatible with ctr-httpwn.
    2. Run ctr-httpwn from the Homebrew launcher and install it.
    3. Once done and you are back at the Homebrew launcher, press Start and then reboot directly into the home menu. If you do a normal reboot this will not work and you will have to re-do Part 2!
    4. Open the eShop like you normally would. It may take some time (especially if you are hotspotting on your phone) to load, so be patient.
      • If after waiting for a long time you receive a connection error, re-do Part 2, then do Part 4, and then finally come back and retry Part 3.
    5. Download whatever titles you need for your exploit and install. Do not install updates to these titles if prompted.
    6. If you have done Part 4 at all before this step (in case of an error), re-do Part 1.
    7. Get back into the Homebrew Launcher by re-doing part 2, then proceed to the conclusion.
    Part 4: Re-Allowing Access
    1. Now that we don't have to block Nintendo's stuff anymore, you need to remove the entry you created in iptables
    2. First, through whatever medium you were modifying, run the command iptables -L --line-numbers. You should get an output listing a bunch of rules.
      • If you are using the Android app to do this, you may need to clear the output screen between commands to see their output.
    3. Look for a line in the output which says Chain FORWARD. Below it you will find some forwarding rules. Look for the one with an IP that starts with 69. This is the custom rule we added. Remember the left-most number corresponding to the row of this rule.
    4. Run the command iptables -D FORWARD #, where # is the number of the row from the last step.
    5. Now you should be able to access everything without issues. You will still get nags from Nintendo stuff about updating and whatnot.
    Part 5: Conclusion
    1. You should probably do Part 4 now. It isn't necessary for Android devices (probably, do it anyways though).
    2. If you are on 10.7, go ahead and downgrade. What are you waiting for?
    3. If you are on 11.0, you can either set up Menuhax (note that you will have to delete it and re-install any time you want to use ctr-httpwn), or set up a different secondary entrypoint (steelhax, basehax, etc) and sit tight while we wait for the release of Slowhax for downgrading. Whatever you do, do NOT update at this point. It's probably safer to just disable WiFi.
    And that's pretty much everything! I hope that the guide is clear and I will try and clarify in the comments. Hopefully some more experienced users can help too. It may look long but in reality you can have your setup fully complete in 20 minutes, which is much quicker than the hours I spent trying to race against the nag like in Plailect's guide.
     
    Last edited by clancy94, Nov 26, 2016
  2. Miles54321

    Miles54321 GBAtemp Advanced Fan

    Member
    852
    331
    Dec 16, 2010
    Gateway Headquarters with SonyUSA
    Clancy94, I've got a question,

    I have a N3ds with Gateway 3.7 on
    - sysNand (V9.0.0-E)
    - emuNand (V11.2.0-E)

    How would I get Homebrew Launcher CIA for my N3ds without having to get Arm9/Luma3DS

    I've heard Luma3DS is better for homebrew but what homebrew is available for a Gateway N3DS Emu 11.2, SysN 9.0?

    Thanks :)
     
  3. clancy94
    OP

    clancy94 GBAtemp Fan

    Member
    427
    103
    Oct 18, 2008
    Did you try this guide? It hasn't been tested one 11.2 but doesn't mean it wouldn't work.

    Otherwise you'd be looking at one of these: https://3ds.guide/homebrew-launcher-(no-browser)

    I'd recommend just following Plailects guide from the start and getting luma3ds running, doesn't take too long and it's so much better than my old gateway


    Sent from my iPhone using Tapatalk
     
  4. Yandere-chan

    Yandere-chan The One and Only

    Member
    356
    187
    Nov 11, 2016
    United States
    Hidden in your NAND
    Does this work on 11.2?
     
  5. KunoichiZ

    KunoichiZ GBAtemp Guru

    Member
    8,535
    3,599
    Mar 16, 2012
    United States
    Browserhax does not work and the method that showhax uses was patched in 11.2, so no.
     
  6. clancy94
    OP

    clancy94 GBAtemp Fan

    Member
    427
    103
    Oct 18, 2008
    As I said, hasn't been tested but worth a shot. Get back to me and I'll update the op accordingly with your results :P


    Sent from my iPhone using Tapatalk
     
  7. karloz25

    karloz25 GBAtemp Fan

    Member
    336
    50
    Dec 11, 2010
    United States
    i am super new to the exploitable 3ds scene, i use to do R4i cards.

    So at the end of this tutorial, what will be accessible to me? nand? 3ds pirated games playable? homebrew apps?

    Thanks.
     
  8. clancy94
    OP

    clancy94 GBAtemp Fan

    Member
    427
    103
    Oct 18, 2008
    This will basically give you access to the Homebrew launcher which you will want to use to buy Legends of Exidia and download Steel divers sub wars from the eshop (you can't access the eshop on anything but the latest firmware usually), then with the release of slowhax in December you'll be able to downgrade your 3ds giving it access to your nand then installing a CFW (custom firmware). With CFW installed you can install homebrew apps such as Freeshop which is a hacked version of the eShop and you'll be able to play games for free, and online without risk of ban :)


    Sent from my iPhone using Tapatalk
     
    Last edited by clancy94, Nov 26, 2016
  9. Hanafuda

    Hanafuda GBAtemp Advanced Maniac

    Member
    1,917
    699
    Nov 21, 2005
    United States
    Is this why I can't get browserhax to work following plailect's guide on a 10.7 N3DS? I was successful on another one about 7-8 weeks ago (same model, SM3DLand bundle) but this time I followed the updated guide to edit the 1st bookmark, etc., with the new URL but I get a "must update to use browser" popup before the page opens, every time.
     
  10. fodder

    fodder STARMAN

    Member
    803
    287
    Aug 3, 2014
    United States
    Yeah, they patched browserhax on 10.7 not too long after you did it and now you need to do this to do it

    Sent from my LG-H901 using Tapatalk
     
  11. Hanafuda

    Hanafuda GBAtemp Advanced Maniac

    Member
    1,917
    699
    Nov 21, 2005
    United States
    Well that blows. But thx for confirming.
     
  12. clancy94
    OP

    clancy94 GBAtemp Fan

    Member
    427
    103
    Oct 18, 2008
    But at least you can still do it :) just a bit more effort


    Sent from my iPhone using Tapatalk
     
    Hanafuda likes this.
  13. MrHaqs

    MrHaqs Member

    Newcomer
    48
    6
    Jun 12, 2016
    So i followed this guide and got stuck on the computer ssh thing. putty always gives me an error when i try to connect to my routers local ip how do i fix this??
     
  14. Serenity23

    Serenity23 Newbie

    Newcomer
    1
    0
    Nov 26, 2016
    United States
    Stupid question but have you enabled SSH on your router?
     
  15. MrHaqs

    MrHaqs Member

    Newcomer
    48
    6
    Jun 12, 2016
    its sky its already enabled
     
  16. UranusKiller

    UranusKiller TranceMaster

    Member
    960
    3
    Feb 9, 2009
    Redcar, England, UK.
    Exact same issue, cant connect.
     
  17. MrHaqs

    MrHaqs Member

    Newcomer
    48
    6
    Jun 12, 2016
    ;_;
     
  18. REDALiCE

    REDALiCE Member

    Newcomer
    29
    9
    Aug 14, 2012
    United States
    How would you even enable SSH on the MI424WR-GEN3I model router?
     
  19. fodder

    fodder STARMAN

    Member
    803
    287
    Aug 3, 2014
    United States
    This guide worked quite well for me (used my android phone as a hotspot for the brower nag bypass)

    BUT

    I personally needed to set a 2nd access point (my router) because my android hotspot didnt allow ctr-httpwn to download for some reason

    Like once in the HBC I turned off my android hotspot so my 3DS connected to my router

    — Posts automatically merged - Please don't double post! —

    Okay, still doing DSiWare downgrade, managed to downgrade to 9.2.0-20U successfully while using the browser has a HBC entrypoint
     
    clancy94 likes this.
  20. Jayro

    Jayro MediCat USB and Mini Windows 10 Developer

    Member
    GBAtemp Patron
    Jayro is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,224
    2,861
    Jul 23, 2012
    United States
    Octo Canyon
    How much is Legends of Exidia? I bought Field Runners for $5 on the eShop.