Tutorial More-or-less Catch-All Tutorial

[Sgt. Lulz]

Note: This guide won't be actively maintained anymore due to superior alternatives cropping up. Everything in it should still be valid, but it's definitely not the best way of doing some things, and some things might not be clear and concise enough.

This guide only applies to 3DS system versions 4.0-10.3, and the CFW process only applies to system versions 4.0-9.2.
The general roadmap is: Browserhax & Menuhax > emuNAND prep > CakesFW > Unlinking. The last sections of the guide are optional and deal with important homebrew and MultiNAND creation, respectively. Downgrading is only necessary for 9.3+ systems, and Upgrading is entirely optional.
If a system firmware update has been released and you're on a firmware above 9.8 and below latest firmware, you need to set the blocker DNS before proceeding. You can read about this in the 'DNS Bypass' section of this guide.

BROWSERHAX:
1. Download the Homebrew Starter Kit from https://smealum.github.io/ninjhax2/starter.zip
2. Place the contents in the root of your SD card
3. Visit http://yls8.mtheall.com/3dsbrowserhax_auto.php and follow the instructions. Sliderhax.php requires you to zoom in and tap the rightmost end of the slider, the rest are automatic.
Repeat Step 3 as needed to open the Homebrew Menu.

MENUHAX (REQUIRES FIRMWARE VERSION ABOVE 9.0):
1. Open the Homebrew Menu.
2. Open the Menuhax_Manager app.
3. Install.
4. You're done.

OPTIONAL: Hit 'Setup a built-in Home Menu 'Basic' color theme' to use a different theme with Menuhax.​

To activate: Hold L while starting up your 3DS to open the Homebrew Menu.

CAUTION: Don't change your Home Menu theme after installing this, UNDER ANY CIRCUMSTANCES. Doing so will uninstall Menuhax and render it unusable. You can, however, install custom themes by dropping body_LZ.bin and bgm.bcstm into the menuhax_manager folder and selecting Install custom theme.

DNS Bypass:

System Versions 9.9 and above force you to update to use the Browser, as it checks with Nintendo's servers if the console is on the latest firmware to prevent exploitation. 10.3 is the last fully exploitable firmware, but it's not the latest, and as such requires the DNS block.
DON'T OPEN THE 3DS INTERNET BROWSER IF YOU'RE NOT ON THE LATEST FIRMWARE AND ARE ABOVE 9.8, YOU'LL RENDER IT COMPLETELY UNUSABLE. FOLLOW THE STEPS BELOW BEFORE YOU TRY TO DO SO.
IF THE BROWSER NAGS YOU AFTER SETTING UP THE DNS, THAT MEANS YOU HAVEN'T USED THE BROWSER SINCE UPGRADING TO 9.9. Use a different entrypoint like Ninjhax, Smashhax or OoT3Dhax.
N3DS USERS: IF YOU ENTER THE BROWSER REALLY QUICK UPON TURNING THE CONSOLE ON, YOU SHOULD BE ABLE TO OUTRUN THE UPDATE NAG, BUT TRYING THE DNS FIRST IS STILL ADVISABLE.

To change your DNS settings to bypass this:
1. Open System Settings.
2. Go to Internet Settings > Connection Settings. Edit your main connection settings.
3. Set Auto-Obtain DNS to 'No' and enter 107.211.140.065 under both DNS slots.
4. Do this for all your other connections, if any.


DOWNGRADING/UPDATING:

FAIR WARNING: Even though this is mostly safe now, you're still advised to exercise caution, specially on N3DS systems.
NOTE: DELETE 000400102002CA00.cia FROM THE PACKAGE IF YOUR CONSOLE IS A JAPANESE N3DS.

Spoiler: Downgrading/Updating to 9.2

REQUIREMENTS:

• sysUpdater + Libkhax build (Taken from this post)
• Having your 3DS charging during the process
• Update package: I can't help you with this.

However, I can give you the checksums for known tested downgrade packages:

Spoiler: Package checksums

O3DS 9.2.0-20U:

MD5: 879f437d7c78f09ae565f79f5aa9c421
SHA-1: ccc272c495a84aa49f8db2da6072a79a73053e19​

O3DS 9.2.0-20E:

MD5: caec3e015bc065dd0ca512f219c8fc3c
SHA-1: 63f0e83892af0f43d159685b4d775e09360552e4​

O3DS 9.2.0-20J:

MD5: a7c14f50e553d99d93efd3a8dd4f8b9d
SHA-1: 422af53b07c270d65bf443d09736f3d1c540641c​

N3DS 9.2.0-20U:

MD5: e5f40c3b155cfd12ef38be35d2e81d2e
SHA-1: 377c140377fb6cf31a0c032c4e1196cc521f87fe​

N3DS 9.2.0-20E:

MD5: 6dcca8fcbc9a28c82c2a4e5182f3acf8
SHA-1: e7c77bf205137167f1f1befa0c4db9d879a21a2e​

N3DS 9.2.0-20J:

MD5: f46677696ed4bf0e182de5a8168b7542
SHA-1: c9a1aaf4a4923fb5e065546da5c4a4da37aafdb2​

These checksums may change over time. If that's the case, a quick search of the md5 sum you got should tell you whether or not the package is good or not.

1. Extract sysUpdater to your /3ds/ folder.
2. Extract the updates/ folder to your SD card root.
3. Run sysUpdater from Menuhax/Browserhax and press Downgrade (9.3+ users)/Update (4.0-8.1 users).
4. Pray.
5. If all went well, you should now be on 9.2.0-20. If you're getting a black screen, you know the gist: You've got a brick. Try recovery (L+R+UP+A while turning the console on). If it doesn't work, restore your backup, and if you don't have one OR don't have a hardmod to restore it with, tough luck.
6. Reinstall Menuhax to reflect your new firmware version by following the installation instructions above again.
7. Follow the Setting up CFW guide.

If you're getting a black screen on boot, try restarting with the SD card out of the console and then insert it and change the theme to wipe Menuhax.

INSTALLING CUSTOM FIRMWARE:

Spoiler: Setting up CFW

REQUIREMENTS:

• Homebrew Menu Starter Kit
• CTRBootManager
• CakesFW (Use v128 as a fallback if the latest doesn't work)
• EmuNAND9
• Decrypt9
• Universal Inject Generator
• FBI
• slot0x25KeyX.bin: Can't help you with that, look it up.
• slot0x11key96.bin: See above.
• firmware.bin & cetk:
  
  O3DS: https://raw.githubusercontent.com/mid-kid/CakesForeveryWan/master/firmurl, Rename 00000049 to firmware.bin
  N3DS: https://raw.githubusercontent.com/mid-kid/CakesForeveryWan/master/firmurln3ds, Rename 0000001F to firmware.bin​
• Custom boot.cfg:
  
  Spoiler

  // Boot menu configuration
  boot_config =
  {
     // Default timeout in secondes
     // If timeout = -1, disable autoboot
     timeout = 3;
  
     // Some devices (n3ds?) seems to have
     // some timing problems when using timeout=0 (autoboot).
     // You may increase this value to improve boot success rate.
     // Default delay (8) should be good for o3ds, 2 seems good for n3ds
     autobootfix = 8;
  
     // if timeout = 0 (autoboot),
     // hold this key to enter the menu
     // keycode list : https://goo.gl/4XLDIL
     recovery = 2; // SELECT
  
     // Default boot entry
     default = 0;
  
     // Boot menu entries (11 max)
     entries =
     (
       {
         title  = "CakesFW";
         path = "/Cakes.dat";
         offset = "0x12000";
       },
       {
         title  = "HomeBrewMenu";
         path = "/HBL8.3dsx";
       }
     );
  };

1. Place the cakes/ folder, slot0x25KeyX.bin, slot0x11Key96.bin and Cakes.dat in your SD card's root. Place firmware.bin and cetk in cakes/. Place 3DS/EmuNAND9 and Decrypt9WIP/ into the 3ds/ folder. Extract starter.zip to the SD card's root if not already present.
2. Open EmuNAND9 from the Homebrew Menu
2a. (Optional, but highly reccomended) EmuNAND Manager Options > Dump SysNAND to NAND.bin (In case you ever end up needing a hardmod)
3. Eject your SD card by pressing SELECT and physically ejecting
4. Back up all the contents of your SD card to your PC and place NAND.bin somewhere secure away from the backup
5. Insert your SD card back in the console and press B
6. Select Complete EmuNAND Setup and follow the instructions. THIS WILL FORMAT YOUR ENTIRE SD CARD.
7. Switch the console off and restore your SD card backup
8. Rename the Homebrew Menu's boot.3dsx to HBL8.3dsx and drop CTRBootManager's boot.3dsx and paste the boot.cfg in the spoilers above into your SD card root
9. (9.0-9.2 only) Menuhax should now lead you to the CTRBootManager screen. From here, you can launch Cakes or the Homebrew Menu.
10. Open Decrypt9WIP from the Homebrew Menu
11. EmuNAND options > Health&Safety Dump
12. Extract Universal Inject Generator anywhere on your computer
13. Drag hs.app from your SD card root and FBI.cia into the input/ folder
14. Run go.bat on Windows/go.sh on Linux/OSX
15. Rename FBI_inject_with_banner.app to hs.app and place it into the SD card root
16. Open Decrypt9WIP
17. EmuNAND options > Health&Safety Inject
18. Reboot.
19. Open CakesFW. (4.0-8.1 USERS USE THIS LINK: http://dukesrg.no-ip.org/3ds/rop?LoadROP.dat&Cakes.dat )
20. Select Patches > Enable all. Press START.
21. More options > Toggleable options > Enable autoboot. Press START. Press B.
22. Boot CFW.
23. You're done: You now have a linked EmuNAND.

If you're getting a boot loop while booting Cakes, emuNAND booting is triggering Menuhax due to the theme payload still being present. Try holding/not holding the button combination you set to not trigger Menuhax.
4.0-4.5 USERS: FBI requires 5.0 firmware MINIMUM to boot, so go to System Settings in emuNAND and perform a System Update. DON'T EXIT SYSTEM SETTINGS ONCE YOU'RE INSIDE, IT'LL KICK YOU OUT TO SYSNAND.
If you're getting a black screen while booting Cakes, try deleting config.dat, firmkey.bin and firmware_patched.bin from the cakes/ folder and repeat steps 21-24.

IF YOU'RE EXPERIENCING PROBLEMS, REVIEW YOUR STEPS AND REDOWNLOAD THE REQUIRED FILES BECAUSE IT'S VERY LIKELY YOU DID SOMETHING WRONG

Spoiler: Unlinking NANDs

Here are some things you should know:
You will not be able to play DSiWare/GBA VC titles directly from EmuNAND (although you do have to install them to both NANDs anyway), but:
• It's a lot safer
• It makes SysNAND and EmuNAND act as completely different systems
• It fixes that obnoxious giftwrap glitch
• It allows you to change themes freely without changing it in SysNAND and ruining your Menuhax

As for which NAND to format, that's entirely up to you. The unformatted one will keep all the data of your old system, whereas the formatted one will be completely wiped and become a blank slate. This includes NNID, Friend Code, all games and DLC, etc.

Go with formatting SysNAND if:
• You'd like to transfer all your SysNAND content to EmuNAND
• You'd like to keep using your NNID in the eShop on EmuNAND
• You want to keep your Friend Code in EmuNAND
Go with formatting EmuNAND if:
• You'd like to keep all your SysNAND content in SysNAND
• You don't have an NNID linked, OR:
• You don't mind having to modify SysNAND to access the eShop on it

Your NNID, if any, will be transferred over to the unformatted NAND, and the process of transferring it back is convoluted. Transferring your Friend Code back and forth is impossible.
PLEASE UNDERSTAND THAT THIS PROCESS IS COMPLETELY IRREVERSIBLE.

REQUIREMENTS:

• TinyFormat

1. Put the TinyFormat folder inside the 3ds/ folder in the archive in your SD card's 3ds/ folder.
2. Boot up the NAND you'd like to format.
3. Open the Homebrew Menu through Browserhax.
4. Open TinyFormat.
5. Follow the onscreen instructions.
6. Reboot your formatted NAND.
7. Perform First Time Setup.
8. SysNAND and EmuNAND are now two seperate entities. As long as you're ABSOLUTELY SURE you're in EmuNAND, it's safe to run System Update. Since CakesFW doesn't have a version string patch, just check if Health & Safety is gone and FBI has taken its place. That should be the most immediate sign that you're in EmuNAND.
9. (SysNAND formats only.) Set up your entrypoints again so that you'll be able to return to EmuNAND.

Spoiler: The final touches to CFW

NOTE: You should install FBI.cia after creating a new emuNAND to prevent it getting wiped with by a system update.
NOTE 2: Exiting System Settings will kick you back into sysNAND, so be careful.
NOTE 3: Change your emuNAND theme after unlinking to erase Menuhax from it.
NOTE 4: As stated above, CakesFW doesn't have a version string patch, so just check if Health & Safety is gone and FBI has taken its place. That should be the most immediate sign that you're in EmuNAND.
Some software I reccomend:

• Rinnegatamante's CHMM
• NTR CFW
• FTBrony
• GYTB
• Yellows8's Homebrew Menu .CIA (Requires editing on the payload .bin to make it read HBL8.3dsx instead of boot.3dsx, simple find and replace, can be done even by Notepad++)
• microSD Management (Which actually works on O3DS too)
• PlayCoinSetter
• An exploitable version of the Internet Browser
• Flashcart Whitelist
• SaveDataFiler

I can't link some of this software due to dubious legality and compliance with forum rules, so figure that out yourself.

Spoiler: Creating and using multiNANDs

As of ~Build 123, CakesFW has support for loading multiple emuNANDs, or multiNANDs, for short. This means you're not limited to just sysNAND and emuNAND, and can create up to 4 emuNANDs on one SD card. This isn't strictly necessary, but might be considered useful by some.

REQUIREMENTS:

• CakesFW v123 or above
• Multi emuNAND Creator
• A previously set up emuNAND

1. Open Muli emuNAND Creator.
2. Set the Nintendo 3DS Model to your console's model.
3. Extract NAND. Save emuNAND.bin to any folder.
4. Back up your SD card.
5. Select the NAND number/slot you want to inject to.
6. Inject emuNAND.bin. THIS WILL FORMAT YOUR ENTIRE SD CARD.
7. Restore your SD card backup.

This will create a multiNAND linked to your first emuNAND on your SD card. To select a different emuNAND, go to More options > Select emuNAND in the CakesFW menu, accessible by holding L whilst booting CakesFW. To unlink, simply follow the Unlinking NANDs guide again, running TinyFormat on the new emuNAND.

Spoiler

To anyone noticing that a certain Pastebin guide looks an awful lot like this one: Yeah, I wrote that spinoff based off this very guide.

 

[Uziskull]

We really need to sticky a thread containing this info, so that no more of these keep popping up. It's somewhat annoying.

 

[Pikasack]

One thing: I'm pretty sure there's a primary DNS and a secondary DNS...

Other than that, great guide!

 

[Sgt. Lulz]

One thing: I'm pretty sure there's a primary DNS and a secondary DNS...

Other than that, great guide!

Nice catch, and only a minute in. Edited.

 

[MasterLel]

Note: you don't have to be on 10.3 to use the latest o3ds browserhax, it also works on 10.2
edit: by the way can we use the youtube app if we use the tubehax dns or it will redirect us?

 

[Damon_girl]

Since 10.3 is the current version, it won't matter if I update from 10.1 right? I know it's better to stay on lower firmware, but I want to access the eshop + a permanent way of having homebrew forever by installing ironfall.

 

[MasterLel]

Since 10.3 is the current version, it won't matter if I update from 10.1 right? I know it's better to stay on lower firmware, but I want to access the eshop + a permanent way of having homebrew forever by installing ironfall.

Well if you can wait a week more before updating to be sure that memchunks support 10.3, it's better... but if you need to update, do it

oh and, if you have a n3ds, then don't update

 

[Sgt. Lulz]

Note: you don't have to be on 10.3 to use the latest o3ds browserhax, it also works on 10.2
edit: by the way can we use the youtube app if we use the tubehax dns or it will redirect us?

#1: Paraphrasing from Yellows8's Browserhax page at http://yls8.mtheall.com/3dsbrowserhax.php, sorry.
#2: No, I guess I should've pointed that out. I'll edit that in.

Since 10.3 is the current version, it won't matter if I update from 10.1 right? I know it's better to stay on lower firmware, but I want to access the eshop + a permanent way of having homebrew forever by installing ironfall.

My reccomendation would be not to, as there's a very specific exploit that has been said to only work on 10.1 and below. I'm fairly certain eShop spoofing is possible again with the latest Homebrew Launcher package. If it doesn't work out in testing, I suppose updating's the only way.

I'll be editing the guide to tell those lucky peoples still on 9.2 Firmware exactly what to do.

 

[Damon_girl]

#1: Paraphrasing from Yellows8's Browserhax page at http://yls8.mtheall.com/3dsbrowserhax.php, sorry.
#2: No, I guess I should've pointed that out. I'll edit that in.



My reccomendation would be not to, as there's a very specific exploit that has been said to only work on 10.1 and below. I'm fairly certain eShop spoofing is possible again with the latest Homebrew Launcher package. If it doesn't work out in testing, I suppose updating's the only way.

I'll be editing the guide to tell those lucky peoples still on 9.2 Firmware exactly what to do.

Really? I read that eshop spoofing wasn't brought back. You can only download an old version of ironfall with the eshop app, but only on 10.3. But if you want to test it then go ahead. I could be wrong.

 

[MasterLel]

Really? I read that eshop spoofing wasn't brought back. You can only download an old version of ironfall with the eshop app, but only on 10.3. But if you want to test it then go ahead. I could be wrong.

10.2 is also supported

 

[Damon_girl]

10.2 is also supported

Oh right lol. Sadly I'm on 10.1. I probably should have updated to 10.2 when I had the chance but I didn't want to lose themehax.

 

[nero99]

Since 10.3 is the current version, it won't matter if I update from 10.1 right? I know it's better to stay on lower firmware, but I want to access the eshop + a permanent way of having homebrew forever by installing ironfall.

Look into snshax. Aparrantly its let's you downgrade from 10.1 to 9.0-9.2 if you're on a o3ds. Do that, you can get home brew on your emunand and be able to access the eshop.

 

[Goombi]

Sorry to ask on another thread but that one might get more attention:
I can't get the 10.3 http://yls8.mtheall.com/browserhax_fright_tx3g.php to work, I get kicked back to Home Menu with the "An error occured" error message. Same problem on my brother N3DS 10.3.0-28E. Anyone with a New 3DS on latest firmware can detail the steps it followed?
I cleaned the savedatas and Ironhax/Menuhax are booting fine so that's not the starter pack.
I even hosted myself browserhax_fright_tx3g with no luck.

 

[MasterLel]

Oh right lol. Sadly I'm on 10.1. I probably should have updated to 10.2 when I had the chance but I didn't want to lose themehax.

I did it, and lost homebrew access for like 1 month or more, so...

 

[Damon_girl]

Look into snshax. Aparrantly its let's you downgrade from 10.1 to 9.0-9.2 if you're on a o3ds. Do that, you can get home brew on your emunand and be able to access the eshop.

I thought that only worked on the N3DS!

 

[adiktus]

On 9.9, I sadly cannot download the old IronFall without updating.

 

[nickerous]

Can you get street passes from Hotspot if the tubehax DNS is in your connection settings? I would think so, since it is a different connection. I'm guessing the browser is not safe to open if you are at a hotspot? Would you get an update nag and/or unusable browser just by being in that hotspot?

 

[Sgt. Lulz]

Sorry to ask on another thread but that one might get more attention:
I can't get the 10.3 http://yls8.mtheall.com/browserhax_fright_tx3g.php to work, I get kicked back to Home Menu with the "An error occured" error message. Same problem on my brother N3DS 10.3.0-28E. Anyone with a New 3DS on latest firmware can detail the steps it followed?
I cleaned the savedatas and Ironhax/Menuhax are booting fine so that's not the starter pack.
I even hosted myself browserhax_fright_tx3g with no luck.

Have you tried clearing cookies and cache?
99% of the time, this is the culprit and a quick clear and retry will make it work.

 

[Suwazo]

Seeing as SNS seems to be quite confidently a New 3DS only thing, I don't really see any reason why I should update my old 3DS to 10.3. That way I can get Browserhax back. And I really don't want to wait for a 10.4 to suddenly appear that fixes the stuff they've now made ridiculously public.

 

[Goombi]

Have you tried clearing cookies and cache?
99% of the time, this is the culprit and a quick clear and retry will make it work.

Unfortunately I tried it several times. That is really weird.