It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[Bgreymane]

Here's a question. How large is the possibility of the r4 sdhc flashcard working with this?

 

[failzers]

Here's a question. How large is the possibility of the r4 sdhc flashcard working with this?

None.

 

[Snooli]

I suppose we will be stuck here with nothing more than a video of luma until 33c3. And that's december.

Here's a question. How large is the possibility of the r4 sdhc flashcard working with this?

None.

Don't rule it out yet. Anything with a changeable header is compatible (compatible does not mean it will have files for it developed). However, some card's, whose disguise game was not changed by a software update, might still be flashable, thus compatible.
So although there is a direct way of determining whether a flashcard is compatible, we can essentially roll a dice if it will be supported.

 

[failzers]

I suppose we will be stuck here with nothing more than a video of luma until 33c3. And that's december.


Don't rule it out yet. Anything with a changeable header is compatible (compatible does not mean it will have files for it developed). However, some card's, whose disguise game was not changed by a software update, might still be flashable, thus compatible.
So although there is a direct way of determining whether a flashcard is compatible, we can essentially roll a dice if it will be supported.

No, it's not just changing the header. We have to be able to completely take over the hardware, or else anything with a updatable firmware would work. But that's not how it works.

 

[zaqqaz00]

i have my doubts this magnet hax actually exists

 

[dpad_5678]

i have my doubts this magnet hax actually exists

Why? All of it makes perfect sense.

 

[failzers]

i have my doubts this magnet hax actually exists

Why? You have two very reputable people in the scene working on an exploit that is very clearly documented in the presentation, and is also in the bootrom itself. You'd have to be a dumbass to think this was fake.

 

[RedBlueGreen]

None.

Except we've been told that the developers are trying to get it working on cheaper cards so we shouldn't be encouraging people to buy Acekard or DSTwo right now, or discouraging certain cards since we're not the developers, don't know exactly what they're developing so we really can't say since it's not all worked out and reviewed.

 

[zaqqaz00]

Why? You have two very reputable people in the scene working on an exploit that is very clearly documented in the presentation, and is also in the bootrom itself. You'd have to be a dumbass to think this was fake.

I was going to reply something pretty nasty, but I guess i will let others see you for the dumbass that is you

 

[Shad0w136]

I was going to reply something pretty nasty, but I guess i will let others see you for the dumbass that is you

He is actually right, presentation actually shows the details in the Bonus Fail section, all the way at the end. https://sciresm.github.io/33-and-a-half-c3/

 

[pixelmasher]

Does anyone know what the person got in return for returning Nintendo's NTR card used for NTRBootHax that Nintendo forgot to take out of their console after repair?

 

[Snooli]

Does anyone know what the person got in return for returning Nintendo's NTR card used for NTRBootHax that Nintendo forgot to take out of their console after repair?

Noone has ever done that. This was discovered by decrypting the BootROM as described at the end of this presentation.

 

[pixelmasher]

Noone has ever done that. This was discovered by decrypting the BootROM as described at the end of this presentation.

I read someone mentioning it somewhere. I wanted more information if it was true.
I've seen the presentation by Myria and SciresM already. I'm not asking about B9S/SigHax. I'm asking about Nintendo's implementation.

 

[gamesquest1]

Afaik nobody even knew of the existence of the ntr recovery method until the boot rom was dumped and examined to find the secret cart id and button combo that the boot rom looks for

 

[Snooli]

Yes, and now we need a hero to take on a job at Nintendo to smuggle the Switch's recovery system.

 

[Starzcream]

Yes, and now we need a hero to take on a job at Nintendo to smuggle the Switch's recovery system.

Already being done...research is geeat.

 

[Deleted User]

I was going to reply something pretty nasty, but I guess i will let others see you for the dumbass that is you

haha. that's cute. someone thinks that they can outwit everybody.

SciresM and Normmatt, two of the Boot9Strap developers have discovered this NTR recovery method after dumping the bootROM.
They have literally no reason to lie, and it makes a lot of sense to have a recovery method this way because it requires a custom header and firmware on a card.

Please read the OP, and if you still don't get it then leave.

 

[zaqqaz00]

haha. that's cute. someone thinks that they can outwit everybody.

SciresM and Normmatt, two of the Boot9Strap developers have discovered this NTR recovery method after dumping the bootROM.
They have literally no reason to lie, and it makes a lot of sense to have a recovery method this way because it requires a custom header and firmware on a card.

Please read the OP, and if you still don't get it then leave.

I expressed an opinion politely. I don't have to leave this this thread or any other thread, if it bothers you or anybody else to read stuff that bothers them to the point that they are willing to denigrate such person, well they you and anybody else can just go jump in the lake if you get my drift you know what you can really do.
It seems that an atmosphere of blind following has developed and god help anybody that goes against this mad flow.
I don't appreciate being called names and if this forum falls to that level then let me tell you right now I can hold my own against the best of them.
And you can take that to the bank.

 

[Deleted User]

I expressed an opinion politely. I don't have to leave this this thread or any other thread, if it bothers you or anybody else to read stuff that bothers them to the point that they are willing to denigrate such person, well they you and anybody else can just go F.. themselves in the a$$.
It seems that an atmosphere of blind following has developed and god help anybody that goes against this mad flow.
I don't appreciate being called names and if this forum falls to that level then let me tell you right now I can hold my own against the best of them.
And you can take that to the bank.

I'm sorry, I just fail to see any way there can be a doubt about the legitimacy.

Sorry for getting so dicky, but please explain to me why you think what you said. Maybe I can help you understand in a more polite way than I tried earlier. Sorry again...

EDIT: leaving soon so will respond in the morning

 

[Silent Hell]

I expressed an opinion politely.

And then you replied to obvious sarcasm impolitely. That sarcasm was also filled with information that clearly displays the viability of the hax.

What legitimate reason do you have for doubting magnethax?