It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[Byokugen]

But the exploit has nothing to do with sleep mode, even if it uses the lid sensor that activates sleep mode.

So you are saying it has nothing to do with sleep mode even if you use the magnet trigger the SLEEP mode? Who knows

 

[nl255]

So you are saying it has nothing to do with sleep mode even if you use the magnet trigger the SLEEP mode? Who knows

No it doesn't have anything to do with the exploit. Using a magnet is merely the easiest way to fool the sleep mode sensor into thinking the lid is closed.

 

[Byokugen]

No it doesn't have anything to do with the exploit. Using a magnet is merely the easiest way to fool the sleep mode sensor into thinking the lid is closed.

But you need it for the exploit to start?

 

[nl255]

But you need it for the exploit to start?

Nope. You could take the 3ds apart and use a wire to temporarily short/bypass the sensor if you really wanted to.

 

[failzers]

Nope. You could take the 3ds apart and use a wire to temporarily short/bypass the sensor if you really wanted to.

Semantics

 

[Byokugen]

Nope. You could take the 3ds apart and use a wire to temporarily short/bypass the sensor if you really wanted to.

To activate the sleep mode :-P

 

[RedBlueGreen]

Call it "Wecan'tdecideonanamehax".

 

[Deleted member 381889]

is the name really important tho
it's like discussing which font to use in Nintendo Switch homebrew

 

[Cuphat]

The proper name for the exploit is "sighax".

 

[TheCyberQuake]

To activate the sleep mode :-P

You don't activate sleep mode. That would imply the system booting to home menu. Think of the lid sensor as just a button. It can activate different things. One thing it can activate is sleep mode, but with ntrboothax it detects the lid sensor as just an input. In order to activate sleep mode you would need to be in home menu (the system fully booted), which then uses the input from the lid sensor to activate sleep mode. If you don't fully boot to nand you can't activate sleep mode. This is why homebrew that loads at boot won't sleep with the lid closed.

 

[BL4Z3D247]

You don't activate sleep mode. That would imply the system booting to home menu. Think of the lid sensor as just a button. It can activate different things. One thing it can activate is sleep mode, but with ntrboothax it detects the lid sensor as just an input. In order to activate sleep mode you would need to be in home menu (the system fully booted), which then uses the input from the lid sensor to activate sleep mode. If you don't fully boot to nand you can't activate sleep mode. This is why homebrew that loads at boot won't sleep with the lid closed.

Though it's incorrect, to be fair, that's what it says in the OP.

Even though it doesn't use sleep mode it still uses the sleep sensor hence SleepHax. I thought it sounded better than MagnetHax as the 2DS won't need to use a magnet and NRTBootHax looks clunky to me. It was just a name suggestion.

 

[Shigure20]

First，thank you all of your work.
I want to ask a question. Can the MagnetHax hack all version and region？such as kor and china ver.

 

[proflayton123]

First，thank you all of your work.
I want to ask a question. Can the MagnetHax hack all version and region？such as kor and china ver.

KOR/TWN/CHN region yes as it says in the bible "Note that the new ntrboothax and hardmodmethods work on all devices, regions, and versions! This includes CHN and TWN region devices that were previously unhackable"

 

[TheCyberQuake]

Though it's incorrect, to be fair, that's what it says in the OP.

Even though it doesn't use sleep mode it still uses the sleep sensor hence SleepHax. I thought it sounded better than MagnetHax as the 2DS won't need to use a magnet and NRTBootHax looks clunky to me. It was just a name suggestion.

You say ntrboothax looks clunky, but how is it any worse than other exploits like arm9loaderhax? Also it isn't a sleep sensor, it's a lid sensor. Which gets used for more than just activating sleep mode (some games use it to do something in game)
Maybe I'm just weird and like exploits to sound a bit more technical than just sleephax, and with the 2ds not using a magnet magnethax just doesn't seem right. Which means I'll stick with ntrboothax as the preferred name

 

[Billy Acuña]

How about Ak2ihax?

 

[TheCyberQuake]

How about Ak2ihax?

With the fact that work is being done to add more carts than just ak2i, I'll have to say no to that name.

 

[SonicMC]

NTRBootSleepMaybeMagnentDSFlashcartofSometypeHax

 

[Stephano]

"Magnehax"
"Carthax"
Just some thoughts

 

[gamesquest1]

Welcome to this years "name hax idol"

 

[TheCyberQuake]

"Magnehax"
"Carthax"
Just some thoughts

Carthax I could see. Seemshow you are hacking a flashcart to the exploit the system.