It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[zirogx2]

Now announcing toaster hax. All you need is a toaster a metal stylus and a 3ds fused with a hand grenade and you can generate infinate lfcsb's

Sent from my ONEPLUS A3000 using Tapatalk

 

[Selver]

Yes, most likely. SciresM even teased that it mght work on devices with NAND friend or missing altogether

Consider:
bootrom detects key combo, loads from the cartridge.
Cartridge loads CFW (e.g., luma w/ EmuNAND support), so all access to NAND redirect to SD card.
result is that the actual SysNAND is never needed, nor indeed even accessed....

--------------------- MERGED ---------------------------

They lied. I tried with my bricked 2ds and it doesn't boot a regular DS game

Of course not. This is one reason you need to reflash the flashcart... the encryption is different, for example....

 

[Garou]

sorry, can't bother to read 24 pages but does this mean we can install b9s to 11.4 devices? no more userland exploit needed?

 

[Urbanshadow]

sorry, can't bother to read 24 pages but does this mean we can install b9s to 11.4 devices? no more userland exploit needed?

Version of firmware doesn't matter, it works up to and including ver 256.256 devices (Where magnet trick is available: so far the video only shows 3DSXL)

 

[Garou]

Version of firmware doesn't matter, it works up to and including ver 256.256 devices (Where magnet trick is available: so far the video only shows 3DSXL)

that's what I thought
great news. have a friend that mindlessly updated to 11.4 upon buying a new system and I'm too lazy to do system transfer to his device. this way I can just ask him to wait until this has been released

 

[RedBlueGreen]

Version of firmware doesn't matter, it works up to and including ver 256.256 devices (Where magnet trick is available: so far the video only shows 3DSXL)

You can use the magnet on any released 3DS model. The sensor is under the B button. I tried with a fridge magnet and did make the console sleep. This is the spot for the N3DS, N3DS XL, and obviously O3DS XL. I believe the O3DS is the same since the N3DS and XL sensors are in the same spot.

 

[SciresM]

Us: Not releasing yet because we don't want people to have to buy a bunch of expensive flashcarts if it can work on more types/cheaper ones.

People: Quick, buy up expensive flashcarts in advance, despite not being able to use it for a while anyway! Also, let's insist certain types of carts work, despite not actually knowing (and some of what I'm seeing people say is wrong)!

Nice.

 

[RedBlueGreen]

Us: Not releasing yet because we don't want people to have to buy a bunch of expensive flashcarts if it can work on more types/cheaper ones.

People: Quick, buy up expensive flashcarts in advance, despite not being able to use it for a while anyway! Also, let's insist certain types of carts work, despite not actually knowing (and some of what I'm seeing people say is wrong)!

Nice.

It's cool that you're trying to help and advising against buying expensive flashcarts. I know I'd rather wait then shell out money for something that isn't necessary.

Out of curiosity what is some of this wrong information? Is it about the process like bootrom access, or about flashcart compatibility?

 

[Snooli]

Us: Not releasing yet because we don't want people to have to buy a bunch of expensive flashcarts if it can work on more types/cheaper ones.

People: Quick, buy up expensive flashcarts in advance, despite not being able to use it for a while anyway! Also, let's insist certain types of carts work, despite not actually knowing (and some of what I'm seeing people say is wrong)!

Nice.

While I fully understand you, you misjudged the market. AK2i went up in price by 50% ever since the video was released. No wonder people try to stock up on Ak2i before it gets even more expensive. And considering the other option is a DStwo, acekard for $30 looks cheap, let alone for $20.
Besides Normmatt didn't look very optimistic about other flashcards on IRC

 

[RedBlueGreen]

While I fully understand you, you misjudged the market. AK2i went up in price by 50% ever since the video was released. No wonder people try to stock up on Ak2i before it gets even more expensive. And considering the other option is a DStwo, acekard for $30 looks cheap, let alone for $20.
Besides Normmatt didn't look very optimistic about other flashcards on IRC

I think the point is that $30+ dollars or whatever price is still expensive if there's the possibility of it running on a $10 cart. That's also excluding prices for priority and express shipping, which from China can be really expensive.

 

[hoist20032002]

Makes me curious IF it could unbrick my 2DS without sd card (relative stole 128gb sd card with all files).

 

[SciresM]

While I fully understand you, you misjudged the market. AK2i went up in price by 50% ever since the video was released. No wonder people try to stock up on Ak2i before it gets even more expensive. And considering the other option is a DStwo, acekard for $30 looks cheap, let alone for $20.
Besides Normmatt didn't look very optimistic about other flashcards on IRC

It's not a misjudgement, it's an explicit statement that it won't release only compatible on a single expensive cart.

Which means the market now is meaningless.

 

[RedBlueGreen]

It's not a misjudgement, it's an explicit statement that it won't release only compatible on a single expensive cart.

Which means the market now is meaningless.

Could any flashcart with an updateable firmware have the potential for compatibility. Not expecting a solid yes or know, just curious if there's a chance.

 

[Snooli]

So what are the chances of this working on something like R4 gold or R4 sdhc? Or generaly anything cheaper than an AK2i.

 

[YamiZee]

Ok but what are the chances that the Switch has something like this as well. Aren't they using similar systems not to mention they are owned by the same company and this was not discovered before the Switch had been released. Not that we have any chances of exploiting such a thing at this point in time. But who knows, it could even be the same button combination.

 

[Snooli]

[10:30] (+Normmatt) i need a Sky3DS+ lol

--------------------- MERGED ---------------------------

Ok but what are the chances that the Switch has something like this as well. Aren't they using similar systems not to mention they are owned by the same company and this was not discovered before the Switch had been released. Not that we have any chances of exploiting such a thing at this point in time. But who knows, it could even be the same button combination.

100%
This looks more like a backdoor than an exploit.
There surely is some easy way to reflash the entire Switch in Nintendo repair facilities.

 

[RedBlueGreen]

[10:30] (+Normmatt) i need a Sky3DS+ lol

What exactly is the relevance here? There doesn't seem to be anything related to this actual situation. Do you think he's implying sky3ds+ will work?

I see this being very unlikely. If it's true that this requires an NTR card then sky3ds+ shouldn't work because 3DS cartridges are CTR, not NTR. I assume the official repair carts assuming rumours were true would've been a special NTR (DS) cartridge like the Pokémon Mystery Gift cartridges.

 

[Snooli]

What exactly is the relevance here? There doesn't seem to be anything related to this actual situation. Do you think he's implying sky3ds+ will work?

He is currently on IRC, I will try to dig out contex for that line. He is after some key, which can be extracted from a sky3ds+

 

[RedBlueGreen]

He is currently on IRC, I will try to dig out contex for that line. He is after some key, which can be extracted from a sky3ds+

If that's what it is he probably needs whatever it is that emulates retail cartridges. I'm just speculating so assume what I say is false, but if he needs that information couldn't he potentially get it from an older red/blue button Sky3ds since they also emulate real cartridges?

 

[SKGleba]

I got a fake r4i gold ds clone which costed me bout 4$....
IT MUST WORK