It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[spiller]

I have a super card dstwo plus you guys think i can use this card

 

[Gamer4647]

I have a super card dstwo plus you guys think i can use this card

You'd have to reflash the card to use it for this, but most likely yes. It depends on whether you can change the header of the card. Right now though, the exploit is still in development and the supported flashcards are yet to be confirmed, so you can't currently run the exploit.

 

[Ryccardo]

(I have no idea what SPI booting would be used for, and its priority is *after* NAND, so it isn't very useful in cases where FIRM is valid but parts of CTRNAND are broken.)

Good old paperclip shorting one nand data line to the ground...

(Probably it's simpler to plug in a special wifi card for OS preinstallation, rather than a DS card and holding 3+1 buttons)

 

[SoslanVanWieren]

is this a boot ROM exploit as well meaning Nintendo can't patch it with a firmware update

 

[Ryccardo]

is this a boot ROM exploit as well meaning Nintendo can't patch it with a firmware update

Correct, old news

 

[Gamer4647]

It says "flaw in the bootrom" under How it Works in the main post.
Don't tell me you didn't notice.

 

[SoslanVanWieren]

they should put a note in that the old 2ds doesn't need a magnet

 

[Gamer4647]

they should put a note in that the old 2ds doesn't need a magnet

It's already under How it Works in the main post. A quote from zoogie mentioning the sleep switch was quoted there.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

 

[SoslanVanWieren]

if you already have a hacked 3ds dsiware hax is going to be cheaper then magnet hax unless your stupid and you have bricked a 3ds.

 

[failzers]

if you already have a hacked 3ds dishware hax is going to be cheaper then magnet hax unless your stupid and you have bricked a 3ds.

lol remember memchunkhax days? impossible not to get bricked.

 

[SoslanVanWieren]

This isn't an exploit it's how Nintendo unbricks and tests 3dses

 

[failzers]

This isn't an exploit it's how Nintendo unbricks and tests 3dses

it's an exploit because we can fuck with the part it loads from. Tell me it isn't an exploit when we are loading unintended software via the backdoor tendo left in.

 

[Gamer4647]

if you already have a hacked 3ds dishware hax is going to be cheaper then magnet hax unless your stupid and you have bricked a 3ds.

DsiWare would be cheaper, but it would involve a bunch of downgrading, installing a9lh, then upgrading. Downgrading is risky, especially when you go down to 2.1 on the New 3DS.
MagnetHax (this) would probably cost more since you have to have a flashcard and magnet, but it directly installs the CFW or whatever straight on.

lol, dishware

 

[SoslanVanWieren]

DsiWare would be cheaper, but it would involve a bunch of downgrading, installing a9lh, then upgrading. Downgrading is risky, especially when you go down to 2.1 on the New 3DS.
MagnetHax (this) would probably cost more since you have to have a flashcard and magnet, but it directly installs the CFW or whatever straight on.

lol, dishware

you can install bs9 straight from dsiware hax no downgrading needed

 

[Gamer4647]

you can install bs9 straight from dsiware hax no downgrading needed

Well idk where I've been then. I haven't hacked a 3DS yet, I just look at all the new things coming out.
MagnetHax will still be the way going forward though, since unlike DSiWare it'll be around a long time.

 

[failzers]

you can install bs9 straight from dsiware hax no downgrading needed

Yeah, but you can't unbrick systems like that. 3ds devs have literal stacks of bricked systems.

 

[Gamer4647]

Yeah, but you can't unbrick systems like that. 3ds devs have literal stacks of bricked systems.

Yeah, MagnetHax unbricks systems, so at some point you'd probably need it. Unbricks almost anything but hardware issues and N3DS 2.1. It even works on a corrupt NAND, or probably even without any NAND in.

 

[N7Kopper]

You'd have to reflash the card to use it for this, but most likely yes. It depends on whether you can change the header of the card. Right now though, the exploit is still in development and the supported flashcards are yet to be confirmed, so you can't currently run the exploit.

You also need to be able to modify the flashcard's Blowfish key. Most flashcards have them hardcoded, the ones that don't will most likely work.

it's an exploit because we can fuck with the part it loads from. Tell me it isn't an exploit when we are loading unintended software via the backdoor tendo left in.

Pedantically, the only exploit is sighax, which exploits the vulnerability in the bootrom's signature checking routines. If you had Nintendo's private keys, there would be no exploit at all.

 

[failzers]

Yeah, MagnetHax unbricks systems, so at some point you'd probably need it. Unbricks almost anything but hardware issues and N3DS 2.1. It even works on a corrupt NAND, or probably even without any NAND in.

I was saying Magnethax unbricks. I mean't you can't just install b9s to a bricked one currently

 

[SoslanVanWieren]

now i wonder if you could do something like the ds two and make a hacked 3ds more powerful by putting a cpu in a ds card