Homebrew Need help with luma emunand

[Deleted User]

Could I use my N2DSXL to run hbmenu on my O3DSXL and then extract the movable.sed and then use dsiwarehax from there?

 

[RHOPKINS13]

I dont think you get the point of this. You HAVE to have CFW in order to even make and run a emunand. Which in turn defeats the purpose of it as you would have cfw.

Meh, actually what he wants to do is possible, just kinda stupid.

I'm not sure why you want to use EmuNAND and keep CFW off your SysNAND, but if you insist...

You can install B9S, and don't copy Luma's .firm file to your NAND. Your system will boot with the SD card in it, but without it you'll end up with just a black screen. To get back to your stock sysnand, you'll need to uninstall B9S.

I think if you have a ntrboot flashcart, you may be able to use that to boot Luma's .firm file rather than the one for SafeB9SInstaller. That would allow you to leave your SysNAND 100% stock, and switch between SysNAND and EmuNAND by using a magnet on boot.

You can follow the 3ds.hacks.guide page to install B9S (Boot9Strap).

Creating an emunand will wipe the rest of your SD card, so backup anything important first.

Once you have B9S installed, you need to create your emuNand. You can do this with GodMode9: https://github.com/d0k3/GodMode9/releases
Download the latest GodMode9 release ZIP file, put the GodMode9.firm file on the root of your SD card and rename it boot.firm. Throw it in your 3DS, power cycle and you should launch GodMode9. In the More -> SD Card Format menu you should be able to create your EmuNand. Shut down your 3DS and take out the card.

Download the latest Luma3DS: https://github.com/AuroraWright/Luma3DS/releases
Extract the latest ZIP and put the .firm file on your SD card. Once again, throw boot.firm on the root of your SD card. Throw it back in your 3DS.

Hold down SELECT while turning on your 3DS to get to the options menu. It should come up without holding SELECT as this is your first time booting Luma, but holding it down just in case won't hurt. From the menu, you should be able to select your emunand, and hit the Start button to save.

Congrats, you're in CFW on your EmuNand, and your SysNand is stock aside from B9S being installed.

 

[Deleted User]

Meh, actually what he wants to do is possible, just kinda stupid.

I'm not sure why you want to use EmuNAND and keep CFW off your SysNAND, but if you insist...

You can install B9S, and don't copy Luma's .firm file to your NAND. Your system will boot with the SD card in it, but without it you'll end up with just a black screen. To get back to your stock sysnand, you'll need to uninstall B9S.

I think if you have a ntrboot flashcart, you may be able to use that to boot Luma's .firm file rather than the one for SafeB9SInstaller. That would allow you to leave your SysNAND 100% stock, and switch between SysNAND and EmuNAND by using a magnet on boot.

You can follow the 3ds.hacks.guide page to install B9S (Boot9Strap).

Creating an emunand will wipe the rest of your SD card, so backup anything important first.

Once you have B9S installed, you need to create your emuNand. You can do this with GodMode9: https://github.com/d0k3/GodMode9/releases
Download the latest GodMode9 release ZIP file, put the GodMode9.firm file on the root of your SD card and rename it boot.firm. Throw it in your 3DS, power cycle and you should launch GodMode9. In the More -> SD Card Format menu you should be able to create your EmuNand. Shut down your 3DS and take out the card.

Download the latest Luma3DS: https://github.com/AuroraWright/Luma3DS/releases
Extract the latest ZIP and put the .firm file on your SD card. Once again, throw boot.firm on the root of your SD card. Throw it back in your 3DS.

Hold down SELECT while turning on your 3DS to get to the options menu. It should come up without holding SELECT as this is your first time booting Luma, but holding it down just in case won't hurt. From the menu, you should be able to select your emunand, and hit the Start button to save.

Congrats, you're in CFW on your EmuNand, and your SysNand is stock aside from B9S being installed.

Thanks, but I want it from the hbmenu (or at least something that doesn't require internet or a game card)
I know it's stupid, but that's what i'm looking for.

 

[RHOPKINS13]

Seriously though, I can't imagine any good reason for wanting to go through the above. Tons of people use 3DS with CFW to play online, and as long as you're not pirating an unreleased game or using cheats your likelihood of a ban is near zero. So unless you have a real need for it, like really badly wanting to bypass the 300 title limit or maybe having separate emunands for you and a sibling, or maybe you're a developer and want to play with code in emunand and not brick your sysnand, don't bother.

 

[Deleted User]

Seriously though, I can't imagine any good reason for wanting to go through the above. Tons of people use 3DS with CFW to play online, and as long as you're not pirating an unreleased game or using cheats your likelihood of a ban is near zero. So unless you have a real need for it, like really badly wanting to bypass the 300 title limit or maybe having separate emunands for you and a sibling, or maybe you're a developer and want to play with code in emunand and not brick your sysnand, don't bother.

Exactly. I'm a developer and I want to write code and use it on luma. (Sounds stupid but by this I mean code that REQUIRES luma)

 

[RHOPKINS13]

Thanks, but I want it from the hbmenu (or at least something that doesn't require internet or a game card)
I know it's stupid, but that's what i'm looking for.

Without requiring a game card, if you want to keep CFW off your SysNAND your only option really is to go through the steps I listed. And whenever you want to boot stock, you'd have to uninstall B9S. Totally unnecessary though.

--------------------- MERGED ---------------------------

Basically just go through the guide and install B9S. Then BEFORE setting up Luma use GodMode9 to create your EmuNand on your SD. Then set up Luma and make sure when you first boot you go into options and have it boot EmuNand instead of SysNand.

 

[Deleted User]

Without requiring a game card, if you want to keep CFW off your SysNAND your only option really is to go through the steps I listed. And whenever you want to boot stock, you'd have to uninstall B9S. Totally unnecessary though.

--------------------- MERGED ---------------------------

Basically just go through the guide and install B9S. Then BEFORE setting up Luma use GodMode9 to create your EmuNand on your SD. Then set up Luma and make sure when you first boot you go into options and have it boot EmuNand instead of SysNand.

But will that work on ofw?

 

[RHOPKINS13]

But will that work on ofw?

Use whatever method from the guide you can that will install B9S. Once B9S is installed, your OFW really won't matter.

Actually, I just realized you're on 11.8, you really need to update to the latest version and either use seedminer, ntrboot, or hardmod to get B9S installed.

With seedminer, once you've gotten your exploited DSiWare save set up, it won't be too much of a hassle to switch between having B9S installed and not.

 

[Deleted User]

Use whatever method from the guide you can that will install B9S. Once B9S is installed, your OFW really won't matter.

Actually, I just realized you're on 11.8, you really need to update to the latest version and either use seedminer, ntrboot, or hardmod to get B9S installed.

With seedminer, once you've gotten your exploited DSiWare save set up, it won't be too much of a hassle to switch between having B9S installed and not.

1. I thought seedminer was called dsiwarehax
2. So You're saying install b9s and then uninstall b9s?
3. Does this work with ninjhax?

 

[RHOPKINS13]

1) No, dsiwarehax is for DSi consoles
2) I'm saying install B9S and setup and use your emuNand, and when or if you ever decide to go back to SysNand uninstall B9S in order to do so. Then you can reinstall B9S whenever you want to get back to your emuNand.
3) No, Ninjhax doesn't work on firmware above 11.6, and even if it did it wouldn't be able to get you into EmuNand or CFW at all.

 

[Deleted User]

1) No, dsiwarehax is for DSi consoles
2) I'm saying install B9S and setup and use your emuNand, and when or if you ever decide to go back to SysNand uninstall B9S in order to do so. Then you can reinstall B9S whenever you want to get back to your emuNand.
3) No, Ninjhax doesn't work on firmware above 11.6, and even if it did it wouldn't be able to get you into EmuNand or CFW at all.

No, ninjhax does work. it's ninjhax2 so it does. Im just too lazy to use 'ninjhax2' instead of 'ninjhax'

--------------------- MERGED ---------------------------

1) No, dsiwarehax is for DSi consoles
2) I'm saying install B9S and setup and use your emuNand, and when or if you ever decide to go back to SysNand uninstall B9S in order to do so. Then you can reinstall B9S whenever you want to get back to your emuNand.
3) No, Ninjhax doesn't work on firmware above 11.6, and even if it did it wouldn't be able to get you into EmuNand or CFW at all.

Also, can I do this WITHOUT bruteforcemovable?

--------------------- MERGED ---------------------------

Instead, Could I install luma on my 11.10 O3DSXL instead? thats what i'm kinda going for but I wanted to use an EmuNand on OFW ninjhaxed 11.8.0-41U N2DSXL if possible.

 

[RHOPKINS13]

No, ninjhax does work. it's ninjhax2 so it does. Im just too lazy to use 'ninjhax2' instead of 'ninjhax'

You're going to have to show me what you're talking about. Ninjhax 2.9 doesn't work above 11.6. So unless you know of another ninjhax that I don't know about (highly doubtful) ninjhax won't work.

Also, can I do this WITHOUT bruteforcemovable?

Sure, buy a ntrboot flashcart.

Instead, Could I install luma on my 11.10 O3DSXL instead? thats what i'm kinda going for but I wanted to use an EmuNand on OFW ninjhaxed 11.8.0-41U N2DSXL if possible.

You can install Luma on whatever 2DS/3DS you want. Go for it, you can install it on both.

There's really no need to use emunand. If you're playing with code and you're afraid you're going to break something, just make sure you have a good nand backup beforehand.

 

[Deleted User]

You're going to have to show me what you're talking about. Ninjhax 2.9 doesn't work above 11.6. So unless you know of another ninjhax that I don't know about (highly doubtful) ninjhax won't work.



Sure, buy a ntrboot flashcart.


You can install Luma on whatever 2DS/3DS you want. Go for it, you can install it on both.

There's really no need to use emunand. If you're playing with code and you're afraid you're going to break something, just make sure you have a good nand backup beforehand.

I (Again) Don't want to use ntrboothax with a flashcart. Stupid question, but can you ntrboothax with a save game buffer overflow in a ds game?

--------------------- MERGED ---------------------------

--------------------- MERGED ---------------------------

You're going to have to show me what you're talking about. Ninjhax 2.9 doesn't work above 11.6. So unless you know of another ninjhax that I don't know about (highly doubtful) ninjhax won't work.



Sure, buy a ntrboot flashcart.


You can install Luma on whatever 2DS/3DS you want. Go for it, you can install it on both.

There's really no need to use emunand. If you're playing with code and you're afraid you're going to break something, just make sure you have a good nand backup beforehand.

Nope ninjhax2 on 11.8.0 exists. proof: https://drive.google.com/file/d/1hESTmo3lN8mmuya-C5eK_dBwl7c2RrMe/view?usp=sharing and https://drive.google.com/file/d/1dH2r58tSEtmyGA7Qso7XIRP6JLFYkf6m/view?usp=sharing

 

[RHOPKINS13]

I (Again) Don't want to use ntrboothax with a flashcart. Stupid question, but can you ntrboothax with a save game buffer overflow in a ds game?

I was telling you what your options are. If you don't want to have to use seedminer and bruteforce moveable.sed then you're going to either need a ntrboot flashcart, or (much more difficult and completely unnecessary) a hardmod. Read the fucking guide.

Nope ninjhax2 on 11.8.0 exists. proof: https://drive.google.com/file/d/1hESTmo3lN8mmuya-C5eK_dBwl7c2RrMe/view?usp=sharing and https://drive.google.com/file/d/1dH2r58tSEtmyGA7Qso7XIRP6JLFYkf6m/view?usp=sharing

That's not ninjhax! That's the Homebrew Launcher! Which ANY entrypoint will get you to, you don't need, nor can you even use, ninjhax!

 

[KleinesSinchen]

*sigh* I was literally stunned when reading how this thread continued.

Meh, actually what he wants to do is possible, just kinda stupid.
I'm not sure why you want to use EmuNAND and keep CFW off your SysNAND, but if you insist...
You can install B9S, and don't copy Luma's .firm file to your NAND. Your system will boot with the SD card in it, but without it you'll end up with just a black screen. To get back to your stock sysnand, you'll need to uninstall B9S.

What’s the point of installing B9S (=NAND modification on the FIRM0/1 partitions) and not copying boot.firm to the CTRNAND? This is a bad idea. If the SD card corrupts or dies, the console will not boot until providing an SD with valid boot.firm. If the SD reader dies, it will turn the console into a paperweight.
The guide is good as it is and omitting steps can be dangerous.

Use whatever method from the guide you can that will install B9S. Once B9S is installed, your OFW really won't matter.
Actually, I just realized you're on 11.8, you really need to update to the latest version and either use seedminer, ntrboot, or hardmod to get B9S installed.
[…]

Ntrboot is completely independent from the official firmware (version). You can even overwrite your NAND with garbage and still use ntrboot. It is started instead of the software on the NAND.
Hardmod (which I don’t recommend) works on any official firmware… but requires the user to actually know the version in order to choose the correct file.
=========

I (Again) Don't want to use ntrboothax with a flashcart. Stupid question, but can you ntrboothax with a save game buffer overflow in a ds game?

@sc39 Your ideas remind me of “Keep the cake and eat the cake.”
For firmware versions > 11.3 there are the following methods to gain full system control

• Seedminer → Requires online and updating to latest firmware
• ntrboot → Requires ntrboot flashcart
• hardmod → Requires advanced soldering skills (I don’t recommend doing so; dangerous and inferior to ntrboot)

No public software exploits exist¹ that would allow loading CFW from HB Launcher and booting into EmuNAND without modifying actual NAND.

============
About Ninjahax: The website https://smealum.github.io/ninjhax2/ provides QR codes up to the version 11.9 (I don’t see a reason why it should be impossible to update the Ninjahax payloads for higher versions if needed – but it’s pretty much pointless anyway).
============

I really understand you in not wanting permanent modification on a system. I feel the same for some consoles and would never, ever install anything on them. The problem is that what you want seems impossible to me with all the restrictions of what you don’t want.

These are all the options I can think of:

• Change your mind in some way and accept installing B9S:
  • Get an ntrboot flashcart. If money is a problem: They are available from about $5 on. It still don’t know how to boot into EmuNAND without modification on the SysNAND.
  • Get temporary access to WiFi, update and use the Seedminer method.
• Get another console with firmware ≤ 11.3 for the offline Soundhax method. Especially the old type consoles are pretty cheap at the moment. More expensive than an ntrboot cart, but this will keep your main console a virgin while getting full access on a secondary device.
• Only use userland homebrew.
  • If you update the console to the latest firmware you could install Steel Diver: Sub Wars and use the Steelhax installer from HB Launcher to eliminate the need for Ninjahax.

If anybody on the forum knew how to achieve your goal, they would have told you by know (there were a lot of people watching your thread yesterday). I think it is pretty safe to assume that this cannot be achieved with the restrictions you gave.

Sorry for the negative reply, I’m at a loss with this.

Spoiler: My best idea to keep the cake and eat it

I have read that you don't want to buy a flashcart. I will still provide this for reference if you change your mind or somebody else with similar ideas stumbles upon this thread.

• ntrboot into GodMode9
  • Answer the question about the embedded essentials backup with “No”
  • Create an image of the unmodified SysNAND (full) and store it on multiple locations.
• Ntrboot into SafeB9SInstaller
  • Do the normal guide/setup
  • Answer the question about embedded essentials backup with “Yes” next time booting GodMode9. Create another NAND image like the guide advises and store this in multiple locations as well.
  • Profit from full CFW installation with SysNAND and EmuNAND
• Restore virgin NAND image whenever you want – undoing everything

__________________
¹ The demonstration on the 36c3 event [It’s not safe on the streets – especially for your 3DS] shows that the fix for “safehax” on firmware 11.4 and above is actually incomplete and can be circumvented by exploiting a system app in userland ARM11. However I did not follow this further and don’t know if any practical implementation is public. Even if this was the case it would mean starting SafeB9SInstaller – which you do not want.
Current Luma3DS versions do not support any other entrypoints besides B9S. Starting from HB Launcher is not intended and not possible.
My guess is that – in theory – a CFW implementation like you wish it would be possible on the basis of the Streetpass exploit in the video. But I very, very much doubt this is gonna happen as B9S is like the “Holy Grail” of console modding giving full system control milliseconds after turning on.

 

[izy]

*sigh* I was literally stunned when reading how this thread continued.

But can he boot rxtools though

You know that cfw that got discontinued and doesnt support higher than 11.6 plus the fact it always had heavy issues.

I'm scared he wants to dev on this console but clearly didnt take the time to do basic research anything and took the mule approach to everyone's answers.

I understand about not wanting to mod a console but b9s is so minimal and if anything protects his console more once it's done.

 

[Deleted User]

But can he boot rxtools though

You know that cfw that got discontinued and doesnt support higher than 11.6 plus the fact it always had heavy issues.

I'm scared he wants to dev on this console but clearly didnt take the time to do basic research anything and took the mule approach to everyone's answers.

I understand about not wanting to mod a console but b9s is so minimal and if anything protects his console more once it's done.

Thanks, but no. I already tried that and it gives me a black screen and forces me to force reboot my console.
If you want, I can send images of the weird thing pasta cfw does when I try to boot it.

--------------------- MERGED ---------------------------

*sigh* I was literally stunned when reading how this thread continued.


What’s the point of installing B9S (=NAND modification on the FIRM0/1 partitions) and not copying boot.firm to the CTRNAND? This is a bad idea. If the SD card corrupts or dies, the console will not boot until providing an SD with valid boot.firm. If the SD reader dies, it will turn the console into a paperweight.
The guide is good as it is and omitting steps can be dangerous.


Ntrboot is completely independent from the official firmware (version). You can even overwrite your NAND with garbage and still use ntrboot. It is started instead of the software on the NAND.
Hardmod (which I don’t recommend) works on any official firmware… but requires the user to actually know the version in order to choose the correct file.
=========



@sc39 Your ideas remind me of “Keep the cake and eat the cake.”
For firmware versions > 11.3 there are the following methods to gain full system control

• Seedminer → Requires online and updating to latest firmware
• ntrboot → Requires ntrboot flashcart
• hardmod → Requires advanced soldering skills (I don’t recommend doing so; dangerous and inferior to ntrboot)

No public software exploits exist¹ that would allow loading CFW from HB Launcher and booting into EmuNAND without modifying actual NAND.

============
About Ninjahax: The website https://smealum.github.io/ninjhax2/ provides QR codes up to the version 11.9 (I don’t see a reason why it should be impossible to update the Ninjahax payloads for higher versions if needed – but it’s pretty much pointless anyway).
============

I really understand you in not wanting permanent modification on a system. I feel the same for some consoles and would never, ever install anything on them. The problem is that what you want seems impossible to me with all the restrictions of what you don’t want.

These are all the options I can think of:

• Change your mind in some way and accept installing B9S:
  • Get an ntrboot flashcart. If money is a problem: They are available from about $5 on. It still don’t know how to boot into EmuNAND without modification on the SysNAND.
  • Get temporary access to WiFi, update and use the Seedminer method.
• Get another console with firmware ≤ 11.3 for the offline Soundhax method. Especially the old type consoles are pretty cheap at the moment. More expensive than an ntrboot cart, but this will keep your main console a virgin while getting full access on a secondary device.
• Only use userland homebrew.
  • If you update the console to the latest firmware you could install Steel Diver: Sub Wars and use the Steelhax installer from HB Launcher to eliminate the need for Ninjahax.

If anybody on the forum knew how to achieve your goal, they would have told you by know (there were a lot of people watching your thread yesterday). I think it is pretty safe to assume that this cannot be achieved with the restrictions you gave.

Sorry for the negative reply, I’m at a loss with this.

Spoiler: My best idea to keep the cake and eat it

I have read that you don't want to buy a flashcart. I will still provide this for reference if you change your mind or somebody else with similar ideas stumbles upon this thread.

• ntrboot into GodMode9
  • Answer the question about the embedded essentials backup with “No”
  • Create an image of the unmodified SysNAND (full) and store it on multiple locations.
• Ntrboot into SafeB9SInstaller
  • Do the normal guide/setup
  • Answer the question about embedded essentials backup with “Yes” next time booting GodMode9. Create another NAND image like the guide advises and store this in multiple locations as well.
  • Profit from full CFW installation with SysNAND and EmuNAND
• Restore virgin NAND image whenever you want – undoing everything

__________________
¹ The demonstration on the 36c3 event [It’s not safe on the streets – especially for your 3DS] shows that the fix for “safehax” on firmware 11.4 and above is actually incomplete and can be circumvented by exploiting a system app in userland ARM11. However I did not follow this further and don’t know if any practical implementation is public. Even if this was the case it would mean starting SafeB9SInstaller – which you do not want.
Current Luma3DS versions do not support any other entrypoints besides B9S. Starting from HB Launcher is not intended and not possible.
My guess is that – in theory – a CFW implementation like you wish it would be possible on the basis of the Streetpass exploit in the video. But I very, very much doubt this is gonna happen as B9S is like the “Holy Grail” of console modding giving full system control milliseconds after turning on.

I know it's stupid because nobody cares about EmuNand nowdays. Still, would ntrboothax work with a REAL game using save game buffer overflows?

 

[lone_wolf323]

Thanks, but no. I already tried that and it gives me a black screen and forces me to force reboot my console.
If you want, I can send images of the weird thing pasta cfw does when I try to boot it.

--------------------- MERGED ---------------------------


I know it's stupid because nobody cares about EmuNand nowdays. Still, would ntrboothax work with a REAL game using save game buffer overflows?

no. you cannot just magically cause something like that to happen.

 

[Deleted User]

no. you cannot just magically cause something like that to happen.

Why? I just want to know.

--------------------- MERGED ---------------------------

BTW I just woke up like an hour ago, so i'm a bit tired. Just know it might take a minute before I see your post.

--------------------- MERGED ---------------------------

I was telling you what your options are. If you don't want to have to use seedminer and bruteforce moveable.sed then you're going to either need a ntrboot flashcart, or (much more difficult and completely unnecessary) a hardmod. Read the fucking guide.


That's not ninjhax! That's the Homebrew Launcher! Which ANY entrypoint will get you to, you don't need, nor can you even use, ninjhax!

Sorry I forgot: https://drive.google.com/file/d/1TqI2KmeWMo-u2Hvc1igVsVb1OnefK_Mz/view?usp=sharing and https://drive.google.com/file/d/1sWPTKPVIbW40oPIimy14GSWXozxN5dhc/view?usp=sharing

 

[KleinesSinchen]

I know it's stupid because nobody cares about EmuNand nowdays. Still, would ntrboothax work with a REAL game using save game buffer overflows?

NTR-001 is the model number of the very first DS model. NTRboot refers to booting from a very special NTR (=DS) cartridge. This is not a TWL (DSi or DSi enhanced cart) and not a CTR (3DS cart).

Turning on a 2|3DS it does this (somewhat pseudocode):

If (Start+Select+X+Power are pressed && sleep mode is triggered){
    If (Slot-1 contains NTR cart with valid signature){
           Start(Slot-1)
    }
}
elseif (FIRM0 contains software with valid signature) {
             Start(FIRM0)
}
elseif (FIRM1 contains software with valid signature) {
             Start(FIRM1)
}
else{
             Show 8046 bootrom error
}

Luckily for us the check for valid signature is buggy and the signature can be spoofed. This is the exploit that allows both, overwriting FIRM0 and FIRM1 with custom code (B9S) and booting from flashcarts containing custom code.
As you can see in my crappy pseudocode, ntrboot happens before anything else and has nothing to do with save exploits. This is – as far as I know – an intentional backdoor that Nintendo used to unbrick devices with their own, properly signed, repair cart.