It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[Snooli]

Here's hoping this will work with the DSTwo+. Either way, it's impressive, and comical to see how bad Nintendo goofed leaving this in the bootrom. Maybe it'll even still be in the New 2DS XL's bootrom, allowing for a bootrom dump on day 1, lol.

THIS IS NOT AN UNPATCHED VULNERABILITY
People have to stop thinking about it that way. It looks way more like an easy recovery route for Nintendo repair centers.

 

[RedBlueGreen]

So can this restore a hardbricked system caused by flashing the wrong NAND type? I'm sure that's counted under any type of brick but I just want to make sure.

 

[Deleted member 381889]

So can this restore a hardbricked system caused by flashing the wrong NAND type? I'm sure that's counted under any type of brick but I just want to make sure.

Yes, any type of brick.

 

[Snooli]

So can this restore a hardbricked system caused by flashing the wrong NAND type? I'm sure that's counted under any type of brick but I just want to make sure.

Yes, most likely. SciresM even teased that it mght work on devices with NAND friend or missing altogether

 

[plushifoxed]

THIS IS NOT AN UNPATCHED VULNERABILITY
People have to stop thinking about it that way. It looks way more like an easy recovery route for Nintendo repair centers.

Booting from an NDS card in bootrom is not a vuln, no. Allowing NDS mode full bootrom access, however, pretty clearly is.

 

[Deleted member 381889]

Yes, most likely. SciresM even teased that it mght work on devices with NAND friend or missing altogether

...But Apache Thunder was the one who said that

 

[DKB]

2011: "It'll take years to crack the 3DS."

2012: First home brew.

2013: First flashcart.

2014: Brickwave.

2015: Hardmod mania.

2016: A9HL release. Can possibly unbrick without Hardmod.

2017: "bricked? lol all u need is a magnet and a flashcart to fix it"

My God have we come far.

 

[Snooli]

Booting from an NDS card in bootrom is not a vuln, no. Allowing NDS mode full bootrom access, however, pretty clearly is.

Think about it from the perspective of Nintendo. They have to have a backdoor to easily flash stock when they receive an RMA'd console. We just weren't supposed to find it.

 

[Mnecraft368]

will a 7.4kg pull neodymium magnet work?

 

[Snooli]

...But Apache Thunder was the one who said that

Sauce

--------------------- MERGED ---------------------------

2011: "It'll take years to crack the 3DS."

2012: First home brew.

2013: First flashcart.

2014: Brickwave.

2015: Hardmod mania.

2016: A9HL release. Can possibly unbrick without Hardmod.

2017: "bricked? lol all u need is a magnet and a flashcart to fix it"

My God have we come far.

Not even a 3DS flashcard. only a DSi, maybe even DS.

 

[Gamer4647]

2011: "It'll take years to crack the 3DS."

2012: First home brew.

2013: First flashcart.

2014: Brickwave.

2015: Hardmod mania.

2016: A9HL release. Can possibly unbrick without Hardmod.

2017: "bricked? lol all u need is a magnet and a flashcart to fix it"

My God have we come far.

Still took a while to make all these solutions and bypass Nintendo's constant flow of stability, lol.

 

[Deleted member 381889]

Sauce

That's a Bricked NAND/No SD Card. You said no NAND altogether.
Apache Thunder said that.

 

[dpad_5678]

What if it was a system with a failed hardmod stuck on the BSoD (as in the BSoD would always show up even with the wires disconnected from the system)?
Asking for...... a friend....

I am such a fucking idiot.

 

[DKB]

Sauce

--------------------- MERGED ---------------------------


Not even a 3DS flashcard. only a DSi, maybe even DS.

Gateway was shown/released in 2013.

 

[Deleted member 381889]

What if it was a system with a failed hardmod stuck on the BSoD (as in the BSoD would always show up even with the wires disconnected from the system)?
Asking for...... a friend....

I am such a fucking idiot.

If it's just a problem with the NAND chip, this will let you boot as long as you have a card and magnet around with you.
This can work even with the NAND chip physically removed.

 

[osaka35]

Welp, time buy up some broken 3ds on ebay

 

[Deleted User]

What if it was a system with a failed hardmod stuck on the BSoD (as in the BSoD would always show up even with the wires disconnected from the system)?
Asking for...... a friend....

I am such a fucking idiot.

Even though this may not be directly fixable, you could boot right into an EMUNAND to still use your system

 

[dpad_5678]

If it's just a problem with the NAND chip, this will let you boot as long as you have a card and magnet around with you.
This can work even with the NAND chip physically removed.

I have quite a few NDS flashcarts, but I was just curious because they were mentioning other situations very specifically, but I didn't see anything about a failed hardmod. My DAT0 and CMD (or CLK, wtf ever) pins are lifted/destroyed, thus resulting in a forever BSoD. Will this mean I'll actually be able to use CFW (of course I'd have to use EmuNAND) or just be able to boot into GM9/D9/etc?

Even though this may not be directly fixable, you could boot right into an EMUNAND to still use your system

Awesome! Thanks!

 

[Mnecraft368]

will a 7.4kg pull neodymium magnet work?

will this magnet work or not?

 

[dpad_5678]

will this magnet work or not?

No one can tell if you're being serious or not. That's why you didn't get a response.