It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[Gamer4647]

:v

O3DS/2DS normally can't boot when shell is closed (or slider/magnet are set). Start+Select+X+hold power bypasses.

So that's what you meant. Oh.

Ah okay. Do you still need the magnet and Start+Select+X on N3DS then, or does it just boot?

The magnet is still needed so it can be in sleep mode and so that you can reach the buttons.

3DS and 2DS don't boot in sleep mode at all normally, but from the New models where the Power button is on the outside, they now normally turn on in sleep mode. By normally, I mean without attempting the exploit - just a regular boot.

 

[pandavova]

Will you need a DS Lite for flashing a new firmware to a supported™ Flashcard? Or will there be a Installer.cia™?

 

[dpad_5678]

Will you need a DS Lite for flashing a new firmware to a supported™ Flashcard? Or will there be a Installer.cia™?

I doubt you would need a DS Lite for this, since no flashcarts are blocked on boot. Maybe the original R4 might need to be flashed with DS/Lite, but then again @Apache Thunder was able to get an original R4 to launch on 3DS systems without modifying that cart at all so probably not.

 

[pandavova]

I doubt you would need a DS Lite for this, since no flashcarts are blocked on boot. Maybe the original R4 might need to be flashed with DS/Lite, but then again @Apache Thunder was able to get an original R4 to launch on 3DS systems without modifying that cart at all so probably not.

I meant the part of flashing the "hax" to the card... Not the card itself...

 

[dpad_5678]

I meant the part of flashing the "hax" to the card... Not the card itself...

I know what you mean. I was saying that I doubt we'd need a DS/Lite to install the hax to the card because we've figured out how to interface with it even the oldest R4 known to man on the newest 3DS system.

 

[Deleted User]

I doubt you would need a DS Lite for this, since no flashcarts are blocked on boot. Maybe the original R4 might need to be flashed with DS/Lite, but then again @Apache Thunder was able to get an original R4 to launch on 3DS systems without modifying that cart at all so probably not.

I believe the original R4 has an issue with the banner data so it doesn't load. Even with his slot 1 loader

 

[Snooli]

It must be card that has flashable banner data

 

[Deleted User]

It must be card that has flashable banner data

Yes because the banner is in the header

 

[pandavova]

It must be card that has flashable banner data

How do you know if your card has it?

 

[dpad_5678]

I believe the original R4 has an issue with the banner data so it doesn't load. Even with his slot 1 loader

 

[Deleted User]

Can't watch it but I assume it proves me wrong. I guess it is good news as well

 

[Snooli]

Not really, it just shows the R4 being used with a 3DS. Unfortuantely, we can't change the header on it.

 

[dpad_5678]

Not really, it just shows the R4 being used with a 3DS. Unfortuantely, we can't change the header on it.

I was showing @blujay that the OG R4 works on the 3DS.

 

[GerbilSoft]

I meant the part of flashing the "hax" to the card... Not the card itself...

Decrypt9WIP has had Acekard2i firmware flashing for a few months now, so it should be doable on a 3DS.

 

[Giodude]

Im hearing any brick, but what about an mcu brick? Isnt that hardware related?

 

[Deleted User]

Im hearing any brick, but what about an mcu brick? Isnt that hardware related?

I heard earlier in the thread that sighax works with an MCU brick

 

[Giodude]

I heard earlier in the thread that sighax works with an MCU brick

Oh wow, this is something to be hyped about. An unpatchable entrypoint, more unpatchable than a hardmod somehow.

 

[dpad_5678]

Oh wow, this is something to be hyped about. An unpatchable entrypoint, more unpatchable than a hardmod somehow.

It's pretty crazy. It's literally the first thing the system does [check X+Start+Select] when you turn it on (of course after the MoBo powers on). It's the holy grail of unpatchable.

 

[Seliph]

Whoa, cool.
Can't you already fix a brick if you load a backup from one of your payloads like decrypt9 or am I wrong?

 

[Deleted User]

Whoa, cool.
Can't you already fix a brick if you load a backup from one of your payloads like decrypt9 or am I wrong?

This allows for Blue Screen of Death and MCU brick fixes