Hacking News: New Stargate 3DS flashcart

[Apache Thunder]

Someone at this thread asked if the Stargate card works in DS mode with one of @Apache Thunder's r4-type card launchers. I believe he is curious in knowing if this bypasses the disabled DS mode when CFW is installed on the 3DS.

https://gbatemp.net/threads/r4-stag...other-cards-soon.416434/page-122#post-7944074



P.S. : I am not interested in purchasing a Stargate card. I would like to know if something like NTR Launcher works in overcoming the disabled NDS.

Not familiar with the Stargate card. Is it a CTR hybrid card or does all it do is have built in ntrboothax with a mode to switch to standard. If it's the latter then maybe. If it's other mode is CTR, then hell no. That won't work.

 

[TurdPooCharger]

Not familiar with the Stargate card. Is it a CTR hybrid card or does all it do is have built in ntrboothax with a mode to switch to standard. If it's the latter then maybe. If it's other mode is CTR, then hell no. That won't work.

http://www.stargate-3ds.com/
Link to PDF Manual
Their website states the cart supports ntrboothax / magnethax. However, DS mode is toggled by pressing and holding two physical selection buttons at the same time. Unless this toggling is done through something like an op-amp, this bit of info is troubling because this suggests switching between 3DS and DS modes is software based. I tried looking for disassembled pictures of this cart to verify if there is one or two NANDs. Two NANDs should mean separate firmwares for both 3DS and NDS.

I'm curious as to why DS mode fails on a Stargate cart after CFW is installed. My suspicion is that this bug was an intentional design. If this is indeed the case, that's a dick move forcing a 3DS user to choose between solely using Stargate or get punished by disabling nds capability for installing CFW, as if having CFW would be an act of betrayal to the Stargate company.

IF (really big if) your NTR Launcher can bypass this, I'd be all the more happy to know Stargate owners can give two big middle fingers to Stargate.

I rather no one bought these SG carts for a myriad of reasons, like that the micro SDXC max capacity is limited to 128 GB and that their previous Gateway model is mired with a bad reputation of poor customer support & intentional bricking.

 

[Apache Thunder]

NTR Launcher can't bypass that. NTR Launcher works in a manner similar to Launcher/Home Menu by loading the cart's rom and booting it. If the cart is in ntrboothax mode, there isn't a valid "NTR" rom for NTR Launcher to load. You're best bet is the stage2 launcher method, but this tends to not work on newer carts that "spoof" retail games.

What kind of firmware files does the cart use on SD card while in NDS mode? Can you link me to those? I can see if they are usable as a stage2 launcher.

EDIT: Nevermind found them. Looks to use a _ds_menu.dat file and it's not encrypted so I can try and convert that to an SRL you can install as DSiWare.

 

[Apache Thunder]

Try this:

https://mega.nz/#!HS5mDKRb!INpZ5Y4Pjdpy3Xb0nr_ULrKLaA-hP2F_ZaOO0KMI8jM

It's the firmware SRL converted to CIA. (note this will not work as is on a DSi. The arm9 binary needs modified to not start in secure area). This cart seems to use a modified version of WoodR4.

If WoodR4 boots up with this but with no GUI/Text and you can't do anything with it (even if cart is switched to NDS mode), then that means it's not able to access the cart's SD card. This is a common issue with newer SDHC carts. I've only ever seen WoodR4 work as a stage2 launcher for original R4 and maybe a few other pre-SDHC carts.

Note this could only possibly work if cart is in NTR mode or in ntrboothax mode. This will certainly not work when card is in CTR mode.

 

[TurdPooCharger]

NTR Launcher can't bypass that. NTR Launcher works in a manner similar to Launcher/Home Menu by loading the cart's rom and booting it. If the cart is in ntrboothax mode, there isn't a valid "NTR" rom for NTR Launcher to load. You're best bet is the stage2 launcher method, but this tends to not work on newer carts that "spoof" retail games.

What kind of firmware files does the cart use on SD card while in NDS mode? Can you link me to those? I can see if they are usable as a stage2 launcher.

EDIT: Nevermind found them. Looks to use a _ds_menu.dat file and it's not encrypted so I can try and convert that to an SRL you can install as DSiWare.

Oh, that would be wonderful news to users like @rahidrules in your R4 flashcart launcher thread. I don't own a Stargate and don't plan to get one. I reposted his inquiry here in case it helped those in his situation.

***
Off topic, not related to Stargate cart.

I have several questions I've been meaning to ask you, @Apache Thunder.

(1) Was NTR Launcher supposed to supersede all the other launchers listed on your thread? You once mentioned to @wormdood in this thread here,
that he should probably use that over the WoodR4Launcher.

(2) I'm a newcomer to 3DS homebrew and my only experience with flashcart is a R4i Gold 3DS RTS. Even with today's Luma3DS, is NTR Launcher required to bypass a white list blocking (really) old NDS flash carts?

(3) I've noticed the .app file in CIA DSiWare are really renamed .nds files. Did you know you can rename your NTR Launcher .app, swap it place of any other installed 3DS DSiWare, and it will launch with no problem? **Save data will not work for swapped game DSiWare with mismatch save data types & sizes.

Oh btw, there's an upcoming update for this gm9 script I've been working on. Giving you the heads up that my script's next update will involve your NTR Launcher.

Edit - I just read your last reply. (not me) but, someone will test file you posted!

 

[Apache Thunder]

Oh, that would be wonderful news to users like @rahidrules in your R4 flashcart launcher thread. I don't own a Stargate and don't plan to get one. I reposted his inquiry here in case it helped those in his situation.

***
Off topic, not related to Stargate cart.

I have several questions I've been meaning to ask you, @Apache Thunder.

(1) Was NTR Launcher supposed to supersede all the other launchers listed on your thread? You once mentioned to @wormdood in this thread here,
that he should probably use that over the WoodR4Launcher.

(2) I'm a newcomer to 3DS homebrew and my only experience with flashcart is a R4i Gold 3DS RTS. Even with today's Luma3DS, is NTR Launcher required to bypass a white list blocking (really) old NDS flash carts?

(3) I've noticed the .app file in CIA DSiWare are really renamed .nds files. Did you know you can rename your NTR Launcher .app, swap it place of any other installed 3DS DSiWare, and it will launch with no problem? **Save data will not work for swapped game DSiWare with mismatch save data types & sizes.

Oh btw, there's an upcoming update for this gm9 script I've been working. Giving you the heads up that my script's next update will involve your NTR Launcher.

1: Yes NTR Launcher replaces the functionality of stage2 launchers. Though it still needs a cart that has a valid rom for it to load. In instances like Stargate a stage2 launcher would have to be used to replace the missing NTR rom that would not be present on the cart when it's in ntrboothax mode.

2: No. You should be able to boot most modern ds flashcarts directly from Home Menu with current versions of Luma CFW. But many older carts that don't spoof retail games use arm7 code/ram entry address settings that TWL_FIRM doesn't like. There is a patch for this on DSi via Unlaunch and HiyaCFW now, however Luma doesn't patch this out of TWL_FIRM (at least the last time I checked it doesn't) so on 3DS you still need something like NTR Launcher to boot these carts.

 

[TurdPooCharger]

@Apache Thunder

*** In case you need clarification for point #3, if you go under GodMode9, and swap out a preinstalled DSiWare title's .app in 2:/title/00030004/<Title_ID>/content with NTR Launcher's .app (or any DSiWare .app/.nds for that matter) with matching name (ie, 00000000.app), that "injected" NTR Launcher will boot up at HOME Menu and work as intended in launching a cart. I tried this with my R4i cart.

 

[Apache Thunder]

@Apache Thunder

*** In case you need clarification for point #3, if you go under GodMode9, and swap out a preinstalled DSiWare title's .app in 2:/title/00030004/<Title_ID>/content with NTR Launcher's .app (or any DSiWare .app/.nds for that matter) with matching name (ie, 00000000.app), that "injected" NTR Launcher will boot up at HOME Menu and work as intended in launching a cart. I tried this with my R4i cart.

Oh I see. Not sure why one would want to do that. Homebrew CIA installers and what not allow putting NTR Launcher on the Home Menu as it's own title....

 

[TurdPooCharger]

Oh I see. Not sure why one would want to do that. Homebrew CIA installers and what not allow putting NTR Launcher on the Home Menu as it's own title....

The gm9 script I've been working on does homebrew title injections into 3DS system apps. If you're familiar with d0k3's GodMode9 H&S injector, it is based on that but includes the other CTRNAND titles (eShop, Activity Log, Mii Maker, etc.).

The last update included something called stealth injection that tries to hide your homebrew with the identity of the system title it's injected in. This is an attempt circumvent Nintendo's homebrew detection and banning.

My next update will expand this idea of stealth for CIA DSiWare, such as that for your NTR Launcher. Instead of it showing up as NTR Launcher in the Activity Log and Friend List whenever you use it, it'll show up as, lets say Zelda 4 Swords.

The last hurdle at this moment is coding for animated (0x23C0 bytes) vs non-animated (0x840 bytes) banner. For titles having a smaller sized banner, I'm now in the final stages of figuring out how to shift everything after banner (arm9i, arm7i, data) by an offset difference of (23C0 - 840 = 1B80, minimum).

** Edit - No copyright material will be infringed upon. Users will need to install their own copy of required official DSiWare titles in order for "stealth" injection to happen for CIA DSiWare homebrew.

 

[redunka]

The gm9 script I've been working on does homebrew title injections into 3DS system apps. If you're familiar with d0k3's GodMode9 H&S injector, it is based on that but includes the other CTRNAND titles (eShop, Activity Log, Mii Maker, etc.).

The last update included something called stealth injection that tries to hide your homebrew with the identity of the system title it's injected in. This is an attempt circumvent Nintendo's homebrew detection and banning.

My next update will expand this idea of stealth for CIA DSiWare, such as that for your NTR Launcher. Instead of it showing up as NTR Launcher in the Activity Log and Friend List whenever you use it, it'll show up as, lets say Zelda 4 Swords.

The last hurdle at this moment is coding for animated (0x23C0 bytes) vs non-animated (0x840 bytes) banner. For titles having a smaller sized banner, I'm now in the final stages of figuring out how to shift everything after banner (arm9i, arm7i, data) by an offset difference of (23C0 - 840 = 1B80, minimum).

** Edit - No copyright material will be infringed upon. Users will need to install their own copy of required official DSiWare titles in order for "stealth" injection to happen for CIA DSiWare homebrew.

Well, here's a couple more things that DSiWare injection may be useful for aside from hiding homebrew.

Such script (or a similar one) may be useful for The Guide's DSiWare Game Injection part.
Currently users have to navigate to DSiWare's folder in GM9 to replace SRL (.app) and savefile manually.
Though, I suppose that DSiWare system transfer method is becoming less popular now that seedminer method is available.

Another thing that DSiWare injection can be used for is this old practice of replacing DS Internet app with an exploitable game (usually Sudoku).
It wasn't really that popular, which is a shame, since it could be used as a safety net in case you accidently lose CFW (though, it's hard to do that accidently nowadays).
Of course, ntrboot is much better for recovering from unwanted CFW loss (as well as bricks), but it may still be useful for those who don't have a compatible flashcart.

 

[TurdPooCharger]

Such script (or a similar one) may be useful for The Guide's DSiWare Game Injection part.
Currently users have to navigate to DSiWare's folder in GM9 to replace SRL (.app) and savefile manually.
Though, I suppose that DSiWare system transfer method is becoming less popular now that seedminer method is available.

Wait? This one requires manually swapping files within the TWLN directory? This is definitely a job for GM9 script! I'll need to familiarize myself with how the DSiWare method of installing CFW works but do know there were exceptionally rare cases of users having to resort to this method as magnethax failed on them. Thanks for chiming in on this.

Another thing that DSiWare injection can be used for is this old practice of replacing DS Internet app with an exploitable game (usually Sudoku).
It wasn't really that popular, which is a shame, since it could be used as a safety net in case you accidently lose CFW (though, it's hard to do that accidently nowadays).
Of course, ntrboot is much better for recovering from unwanted CFW loss (as well as bricks), but it may still be useful for those who don't have a compatible flashcart.

This one will be a 3DS homebrew history and technical study lesson. If this one proves relevant enough and doable, a script may be warranted.

 

[rahidrules]

Holy crap it worked thank for reaching out to him @TurdPooCharger and thank you for the help and your hard work @Apache Thunder I tried all the launchers on the other forum and wasn't able to access it and the link you've provided was PERFECT! It works as of now and not noticing any issues either. I could of just installed some CIAs and played my DS and 3DS games but for some reason I just prefer using a flashcart and your launcher really helped so thank you thank you a lot!! There's a bunch of people out there with a StarGate 3DS facing the same issue and I think you just solved it, as of lately I had been using my Sky3DS flash cart for a couple 3DS games and my R4 for my DS games and CIAs for several GBA and a couple 3DS games so again really thanks so much!!!! Had this lying around since a couple months ago and thought to give it another shot.

 

[TimmyDL]

Try this:

https://mega.nz/#!HS5mDKRb!INpZ5Y4Pjdpy3Xb0nr_ULrKLaA-hP2F_ZaOO0KMI8jM

It's the firmware SRL converted to CIA. (note this will not work as is on a DSi. The arm9 binary needs modified to not start in secure area). This cart seems to use a modified version of WoodR4.

If WoodR4 boots up with this but with no GUI/Text and you can't do anything with it (even if cart is switched to NDS mode), then that means it's not able to access the cart's SD card. This is a common issue with newer SDHC carts. I've only ever seen WoodR4 work as a stage2 launcher for original R4 and maybe a few other pre-SDHC carts.

Note this could only possibly work if cart is in NTR mode or in ntrboothax mode. This will certainly not work when card is in CTR mode.

This Worked Perfectely, thank you so much!

 

[Iispoor]

http://www.stargate-3ds.com/
Link to PDF Manual
Their website states the cart supports ntrboothax / magnethax. However, DS mode is toggled by pressing and holding two physical selection buttons at the same time. Unless this toggling is done through something like an op-amp, this bit of info is troubling because this suggests switching between 3DS and DS modes is software based. I tried looking for disassembled pictures of this cart to verify if there is one or two NANDs. Two NANDs should mean separate firmwares for both 3DS and NDS.

I'm curious as to why DS mode fails on a Stargate cart after CFW is installed. My suspicion is that this bug was an intentional design. If this is indeed the case, that's a dick move forcing a 3DS user to choose between solely using Stargate or get punished by disabling nds capability for installing CFW, as if having CFW would be an act of betrayal to the Stargate company.

IF (really big if) your NTR Launcher can bypass this, I'd be all the more happy to know Stargate owners can give two big middle fingers to Stargate.

I rather no one bought these SG carts for a myriad of reasons, like that the micro SDXC max capacity is limited to 128 GB and that their previous Gateway model is mired with a bad reputation of poor customer support & intentional bricking.

I can try to acquire a Stargate cart and take photos after or during he dissembling process for you for the good of your curiosity? That should hopefully tell you whether the switch is hard modded or soft-modded in....and if it's hard modded well there you go, and i it's soft-modded, well maybe they forgot or didn't realize?

 

[TurdPooCharger]

I can try to acquire a Stargate cart and take photos after or during he dissembling process for you for the good of your curiosity? That should hopefully tell you whether the switch is hard modded or soft-modded in....and if it's hard modded well there you go, and i it's soft-modded, well maybe they forgot or didn't realize?

Nah man, save your money and buy yourself a large capacity micro SD card to install all the games you could ever want on HOME Menu.

 

[Smythius]

I can't find the answer in all these pages but if I already had CFW installed that doesn't work with the DS menu what exactly do I need to do to update or fix my custom FW so that I can use the Stargate card for DS games and it doesn't go to some strange language select menu and not work?

 

[SCOTT0852]

what exactly do I need to do to update or fix my custom FW so that I can use the Stargate card for DS games and it doesn't go to some strange language select menu and not work?

I don't think you can. It's not a CFW issue, it's an issue with the Stargate itself. Since the Stargate only got a single update right after it came out, it never got any additional updates to do things like making it still work when CFW is installed.

 

[Rictor]

the weird part is that the lenguage distorted screen is the actual lenguage screen of the game the cart is mimicking in ds mode ( alex rider stormbreaker as the icon when entering on ds mode )

 

[SCOTT0852]

the weird part is that the lenguage distorted screen is the actual lenguage screen of the game the cart is mimicking

I wouldn't be surprised if they just took the entire rom and used that to make sure the spoofing worked but then did some hacky things to actually load the flashcart menu.

 

[Smythius]

I don't think you can. It's not a CFW issue, it's an issue with the Stargate itself. Since the Stargate only got a single update right after it came out, it never got any additional updates to do things like making it still work when CFW is installed.

Actually got it figured out. Found a simple cia file to install that acts as a loader for the Stargate menu and gets you past the bugged language select screen and into the Stargate menu...