Homebrew NDS profile ROP payload as .3ds?

Searinox

"Dances" with Dragons
OP
Member
Joined
Dec 16, 2007
Messages
2,061
Trophies
1
Age
36
Location
Bucharest
XP
2,088
Country
Romania
DISCLAIMER: I normally would post this in the flashcart board, but since it deals more with flashcart issues than software development, and since homebrew users rely on it too to some extent, I will ask here.

I also normally wouldn't ask for this because I normally don't make requests since well, nobody has to honor them anyway.

I also normally don't have a use myself for this, but I know someone who could use it, and I imagine both people here and back on the flashcart board could have some use for it.

Now then...

I'd like to ask if anyone kindly could make a 3DS file that writes the DS mode exploit used to trigger everything from CFWs to flashcarts and whatnot.

The reason I'm asking this is for a few scenarios, where the new 4.5-9.2 exploit is launched and the person in question has either the CFW package or a Gateway/MT card but does not own an NDS flashcart. Rebooting into enhanced sysNAND mode after downgrade and then running that file would entirely remove the need for a DS card.

I realize that yes, people can either go to an exploit site or host one on a smartphone and use it everytime, but a 3DS file that writes the data to profile removes the need for both website hassle and a secondary card and I think could benefit a lot of people. The exploit source already exists so I'd imagine it's not too a hassle. Thank you.
 

loco365

Well-Known Member
Member
Joined
Sep 1, 2010
Messages
5,457
Trophies
0
XP
2,927
But how do you run a .3ds file if you don't have a flashcard? All 3DS flashcards come with a DS-mode card anyways, so if you run the 3DS to install the file, you'll probably have a DS card to use with it.
 

Searinox

"Dances" with Dragons
OP
Member
Joined
Dec 16, 2007
Messages
2,061
Trophies
1
Age
36
Location
Bucharest
XP
2,088
Country
Romania
You launch the web exploit and use GW's launcher.dat to downgrade, and then to boot enhanced sysnand mode. Red Card isn't needed for that. Then you simply replace the launcher with say, the CFW one, and you've set up CFW with zero flashcards.
 

Rinnegatamante

Well-Known Member
Member
Joined
Nov 24, 2014
Messages
3,162
Trophies
2
Age
28
Location
Bologna
Website
rinnegatamante.it
XP
4,748
Country
Italy
DISCLAIMER: I normally would post this in the flashcart board, but since it deals more with flashcart issues than software development, and since homebrew users rely on it too to some extent, I will ask here.

I also normally wouldn't ask for this because I normally don't make requests since well, nobody has to honor them anyway.

I also normally don't have a use myself for this, but I know someone who could use it, and I imagine both people here and back on the flashcart board could have some use for it.

Now then...

I'd like to ask if anyone kindly could make a 3DS file that writes the DS mode exploit used to trigger everything from CFWs to flashcarts and whatnot.

The reason I'm asking this is for a few scenarios, where the new 4.5-9.2 exploit is launched and the person in question has either the CFW package or a Gateway/MT card but does not own an NDS flashcart. Rebooting into enhanced sysNAND mode after downgrade and then running that file would entirely remove the need for a DS card.

I realize that yes, people can either go to an exploit site or host one on a smartphone and use it everytime, but a 3DS file that writes the data to profile removes the need for both website hassle and a secondary card and I think could benefit a lot of people. The exploit source already exists so I'd imagine it's not too a hassle. Thank you.

Post sourcecodes.
 

CalebW

Fellow Temper
Member
Joined
Jun 29, 2012
Messages
638
Trophies
0
Location
Texas
XP
535
Country
United States
You launch the web exploit and use GW's launcher.dat to downgrade, and then to boot enhanced sysnand mode. Red Card isn't needed for that. Then you simply replace the launcher with say, the CFW one, and you've set up CFW with zero flashcards.
I don't think that the browser exploit write to the nds profile, so, the CFW launcher would not work.
 

Searinox

"Dances" with Dragons
OP
Member
Joined
Dec 16, 2007
Messages
2,061
Trophies
1
Age
36
Location
Bucharest
XP
2,088
Country
Romania
The browser exploit doesn't write to the DS profile. It launches the GW launcher, which can then launch ehnanced sysnand mode. From there, the Red GW could launch a 3ds file that writes the DS profile exploit. Basically a .3ds version of GW_INSTALLER.NDS.
 

JustPingo

Well-Known Member
Member
Joined
Jan 11, 2015
Messages
497
Trophies
0
Age
23
XP
1,071
Country
France
I would love to see that happenning though since my Blue Card is not working on my 4.5 3DS to install DS Profile exploit, but Browser Exploit does.
 

Korin

Well-Known Member
Member
Joined
Jan 10, 2015
Messages
127
Trophies
0
Age
33
XP
224
Country
I would love to see that happenning though since my Blue Card is not working on my 4.5 3DS to install DS Profile exploit, but Browser Exploit does.
If you have another DS mode flash cart (I use my DsTwo) you can usually install it through that, though I would try and find information on specific flashcards first.
 

JustPingo

Well-Known Member
Member
Joined
Jan 11, 2015
Messages
497
Trophies
0
Age
23
XP
1,071
Country
France
If you have another DS mode flash cart (I use my DsTwo) you can usually install it through that, though I would try and find information on specific flashcards first.


The fact is that the only other one I own doesn't work, even with flashcardtimewarp xD
 

Korin

Well-Known Member
Member
Joined
Jan 10, 2015
Messages
127
Trophies
0
Age
33
XP
224
Country
The fact is that the only other one I own doesn't work, even with flashcardtimewarp xD
Just to make sure you're doing this all right, you've got the launcher.dat on your SD card (Internal), the gateway installer on your blue card's micro sd right?
Then you're starting the blue card, running the installer (It completes?)
Then going to the settings on your 3ds and selecting "DS Profile"?

I haven't heard of that not working before.
 

JustPingo

Well-Known Member
Member
Joined
Jan 11, 2015
Messages
497
Trophies
0
Age
23
XP
1,071
Country
France
Just to make sure you're doing this all right, you've got the launcher.dat on your SD card (Internal), the gateway installer on your blue card's micro sd right?
Then you're starting the blue card, running the installer (It completes?)
Then going to the settings on your 3ds and selecting "DS Profile"?

I haven't heard of that not working before.


No, the blue card just doesn't work.

On booting Deep Labyrinth:


Same with crappy R4i clone.

Oh, and I haven't mentioned that I use a downgraded console.
 

iwasaperson

Well-Known Member
Newcomer
Joined
Aug 1, 2013
Messages
81
Trophies
0
Age
38
XP
177
Country
United States
No, the blue card just doesn't work.

On booting Deep Labyrinth:


Same with crappy R4i clone.

Oh, and I haven't mentioned that I use a downgraded console.

You could try installing the cia to run all DS carts to SysNAND (BACKUP YOUR NAND)
 

cearp

瓜老外
Developer
Joined
May 26, 2008
Messages
8,690
Trophies
2
XP
8,248
Country
Tuvalu
Launcher.dat programs can have 100% nand access, so sure, it is possible to install the ds exploit via one of those (unless i am overlooking something) - but at the moment people have not figured how to get their own code working with GW's new web exploit. and even so, i don't think there is enough need for it for someone to go to the effort of creating it.
but sure it's a nice idea
 

The Real Jdbye

*is birb*
Member
Joined
Mar 17, 2010
Messages
22,874
Trophies
4
Location
Space
XP
13,037
Country
Norway
You launch the web exploit and use GW's launcher.dat to downgrade, and then to boot enhanced sysnand mode. Red Card isn't needed for that. Then you simply replace the launcher with say, the CFW one, and you've set up CFW with zero flashcards.
The red card is needed to run the .3ds though. :unsure:
 

Aurora Wright

Well-Known Member
Member
Joined
Aug 13, 2006
Messages
1,550
Trophies
3
XP
4,403
Country
Italy
Launcher.dat programs can have 100% nand access, so sure, it is possible to install the ds exploit via one of those (unless i am overlooking something) - but at the moment people have not figured how to get their own code working with GW's new web exploit. and even so, i don't think there is enough need for it for someone to go to the effort of creating it.
but sure it's a nice idea
The Rop chain isn't on nand, but on the ds-mode nvram.
I think it's technically doable since the 4.5 exploits achieve full control over arm9 and arm11, but no code for writing to nvram has been released (I think).
 
  • Like
Reactions: cearp

Vappy

Well-Known Member
Member
Joined
May 23, 2012
Messages
1,508
Trophies
2
XP
2,571
Country
at the moment people have not figured how to get their own code working with GW's new web exploit.
Yifanlu has reversed it least as far as getting usermode exec with gspwn, and has done a writeup of most of it on his blog. If ssspwn as a whole doesn't give access to cfg:nor then gspwn by itself won't, but if he continues to make progress, it might be possible.
 
  • Like
Reactions: cearp

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    SylverReZ @ SylverReZ: @K3N1, That's why you don't put metal onto railroad tracks.