Hi,

I spent almost two hours on this earlier today, so I figured I'd spare others the effort and provide some pointers for people in a similar situation like me.

Background: smea will release a new way to run ARM11 userland homebrew on the 3DS using a game called Ironfall ( https://twitter.com/smealum/status/627282448343171072 ), which is available for free on the eshop. This new approach will still require Cubic Ninja, but only once for installation instead of each time the system is booted. This is useful for a number of reasons, one being that it will probably make it easier to obtain a CN cartridge for one-time use. A drawback is that accessing the eshop normally requires being on the latest system version, and as most of you will know so far no total-control exploits are publicly known for system versions more recent than 9.2.

IMPORTANT NOTES:
- The exploit is not yet public, but chances are Ironfall might be taken down from the eshop before the exploit goes live, so you should get the game ASAP.
- Don't get rid of your Cubic Ninja cartridge yet, because it will be required for the installation of the exploit.
- Any of the "facts" I'm presenting about the yet-unpublished exploit may as well be humbug. I don't have any "insider-information", but you can see for yourself how likely any of them are by reading smea's tweets. In particular, it's not clear whether Ironhax will be supported on anything earlier than 9.9. There's no harm in getting the game before it gets taken down anyway, though, even if Ironhax ends up not being compatible with your system version.

How to:
- Get Cubic Ninja if you haven't already. You'll eventually need it for the exploit installation anyway. Install Ninjhax (any version).
- Get the "CFW" PastaCFW (it's not really a CFW, but whatever, it'll be useful regardless)
- Get the FBI CIA installer
- Get the Free multi patcher
- Copy Pasta, FBI and FMP to your 3DS SD card. Alternatively to physically accessing the SD card, you can use ftbrony to transfer the files over network to your 3DS.
- Run Ninjhax and start PastaCFW. This will reboot the system with patched out signature-checks.
- Re-run Ninjhax (without rebooting the system manually!) and start FBI. Navigate to the FMP CIA on your SD card and install it. There should be no error message. Return to hbmenu by pressing START.
- Run PastaCFW again to reboot the system while keeping the signature checks disabled.
- Your home menu should now have a new icon for FMP. Select and run FMP to enable eshop spoofing.
- Return to the home menu, start the eshop. Download Ironfall.

Hint: Once installation is complete, you can dump and decrypt the Ironfall title from your 3DS:
- Downloading Decrypt9 (TODO: link)
- Downloading Brahma (TODO: link)
- Start Brahma through Ninjhax. Start Decrypt9 through Brahma. Press R to "Dump NAND" (to save some SD space, you can also just dump the "NAND partition", but all offsets given in the following will refer to "Dump NAND").
- Transfer the resulting NAND.bin to your computer.
- Use Decrypt9 to create a FAT16 xorpad. Apply it to your NAND.bin dump and extract the file "nand:/private/movable.sed".
- Dump the SD card's "Nintendo 3DS" folder to your 3ds (from the title subdirectory, only the 00040000/0015b100 (EUR!) subsubfolder is needed
- Run Decrypt9's sdinfo_gen.py on the Nintendo 3DS folder. Start Decrypt9 and select "SD padgen". This will generate a number of xorpads on your SD card. Copy all the ones starting with "title.00040000.0015b100." to your computer (should be 5 files in total).
- Apply the xorpads to the corresponding encrypted files. In particular, 00000000.app should be interesting.
- Run ncchinfo_gen.py on the decrypted game, copy ncchinfo.bin to your 3DS's SD card and generate xorpads on it via Decrypt9.
- Apply the resulting xorpads to decrypt the second encryption layer.
- Congratulations, you've got a decrypted Ironfall dump now!

My hope is to find a way to find a way to install an Ironfall dump on a 3DS even without signature patching and stuff. This would allow to install it on any 3DS even if it ever gets removed from the eshop.

Hope this helps some people get started.

 

[Intronaut]

but Ironfall cant be launched in sysnand 9.2 without firmware spoof

 

[neobrain]

Derp. I suppose that makes this whole thing a fair amount less useful

 

[Pecrow]

Hi,

Hint: Once installation is complete, you can dump the Ironfall title from your 3DS so that you can later re-install it (or install it on other 3DSs) even if it ever gets removed from the eshop.

Hope this helps some people get started.

how do you dump the title? Im on n3ds 9.2 pasta and gateway

 

[DjoeN]

You could have also spoofed the eshop in sysnand 9.0/9.2 and installed Ironfall from the eshop
Much easier, just going to an url (or scan a qr-code) wait till dat file is downloaded, wait a few seconds, close browser, look at crash error, enter eshop, download.

 

[neobrain]

how do you dump the title? Im on n3ds 9.2 pasta and gateway

You can use Decrypt9 to dump the NAND, decrypt the NAND, extract the title NCCH in the encrypted dump, and decrypt the title.

--------------------- MERGED ---------------------------

You could have also spoofed the eshop in sysnand 9.0/9.2 and installed Ironfall from the eshop
Much easier, just going to an url (or scan a qr-code) wait till dat file is downloaded, wait a few seconds, close browser, look at crash error, enter eshop, download.

.. that is the whole point of this post. Are you saying there is an easier way to do this with Cubic Ninja than what I explained?

 

[JoostinOnline]

You just described how to download anything from the eShop. Sorry, but we've all been doing that for months.

 

[neobrain]

You just described how to download anything from the eShop. Sorry, but we've all been doing that for months.

Good for you, I guess. But yeah, that's exactly what I've described.

 

[tivu100]

Me think, you still need firm-launch to run Ironfall on 9.0 and 9.2?! If so, you still need CN even after ironhax release, to first launch firmlaunch on Pasta CFW then launch ironhax?! It's like you need a (higher right & kernel-exploit) homebrew launcher to launch another homebrew launcher.

I guess it's good for homebrew developers who don't want to update their <= 9.2 consoles but have access to Smealum latest exploit to work on homebrews. However, for average user, it's not freehax on 9.0 & 9.2 (yet?). This is regarding Pasta CFW, not rxTools with Pasta (which's still waiting for N3DS support release).

 

[marc00077]

I can confirm ironfall doesn't boot because its not compatible with 9.2. The Nintendo 3DS logo with the backgroud red "waves" animation keeps running indefinitely. The tutorial does what it says btw I have Ironfall downloaded and installed on sysnand

 

[neobrain]

Thanks for confirming, marc00077

To clarify: the original goal of this tutorial is to be able to obtain a CIA file from the downloaded title that can be used once/if Nintendo takes down Ironfall from the eshop. It's not quite there yet, and I overestimated the potential for other uses by not bothering to check whether Ironfall even works on 9.2. Anyway, I'm hoping to figure out how to achieve the original goal (or at least figure out why it's not possible, if it isn't).

 

[duffmmann]

Thanks for confirming, marc00077

To clarify: the original goal of this tutorial is to be able to obtain a CIA file from the downloaded title that can be used once/if Nintendo takes down Ironfall from the eshop. It's not quite there yet, and I overestimated the potential for other uses by not bothering to check whether Ironfall even works on 9.2. Anyway, I'm hoping to figure out how to achieve the original goal (or at least figure out why it's not possible, if it isn't).

It doesn't even matter though, the new Ironfall hack will still block cfw loading like Ninjhax 2.0. It'd be awesome to have access to pasta without having a specific game in your New 3DS' game slot (so you can free it up for something such as a DS flash cart), but Ironfall does not actually look to be that answer.

 

[neobrain]

It doesn't even matter though, the new Ironfall hack will still block cfw loading like Ninjhax 2.0. It'd be awesome to have access to pasta without having a specific game in your New 3DS' game slot (so you can free it up for something such as a DS flash cart), but Ironfall does not actually look to be that answer.

If that's a concern to you, this thread is not for you.

 

[Vappy]

(or install it on other 3DSs)

Would that even work? Surely you'd need sig checks patched out if it was installed as a .cia? I know there are 'legit' .cias that work without sig checks patched, but those are only the preinstalled bundle games.

 

[neobrain]

Would that even work? Surely you'd need sig checks patched out if it was installed as a .cia? I know there are 'legit' .cias that work without sig checks patched, but those are only the preinstalled bundle games.

That's part of what I'm still trying to figure out

 

[duffmmann]

If that's a concern to you, this thread is not for you.

I guess that makes me curious then why you make a thread explaining how to not update and download the game. The only reason not to update beyond 9.5 at this point are piracy related purposes such as CFWs. Otherwise, you can update to the latest fw and download this title if you're legit only interested in homebrew purposes unless i missed something about this new hack being restricted up to a certain fw.

 

[Mr. Prince]

Sorry, but this guide is useless now: https://twitter.com/smealum/status/628308513048039424

 

[gamefan5]

Since ironhax does the exact same thing as Ninjhax, it is implied that CN will not be needed.

 

[Vappy]

Since ironhax does the exact same thing as Ninjhax, it is implied that CN will not be needed.

Only if Ironfall has some way of importing an exploited save file, which I'm pretty sure it doesn't. Smealum could turn around with a surprise method of doing so, but going by what we know for sure, it seems that CN/OoT are still going to be needed.
I'm still interested to know if there's a way to install Ironfall and have it loadable from unpatched sysNAND without needing to download it from the eShop, because if so then after it inevitably gets pulled and the exploit patched, having a way to install it to new systems would be plenty valuable.

 

[gamefan5]

Only if Ironfall has some way of importing an exploited save file, which I'm pretty sure it doesn't. Smealum could turn around with a surprise method of doing so, but going by what we know for sure, it seems that CN/OoT are still going to be needed.
I'm still interested to know if there's a way to install Ironfall and have it loadable from unpatched sysNAND without needing to download it from the eShop, because if so then after it inevitably gets pulled and the exploit patched, having a way to install it to new systems would be plenty valuable.

I honestly think it is another method, but we'll see at the end of the week. I hinestly think using either OoT or CN would defeat the purpose of making it "free".

EDIT: Check twitter. Smealum confirmed CN or OoT will NOT be needed for this.