It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[failzers]

Yeah, but if it could be lower, might as well ask why not make it cheaper. That is pretty much what's happening with working on adding more cards to the support list. More variety should hopefully lead to more accessibility along with a lower price gate.

I wouldn't buy a card that couldn't also play games, dunno about you. atleast with the acekard it still works after flash.

 

[KytuzuEX]

Obviously, I checked before even posting.
I posted anyway because who knows by chance?

I saw like "variant this variant that", and had some resemblance on the name.
So, still I tried. Thanks for the answers.

 

[GravitySuitCollector]

I wouldn't buy a card that couldn't also play games, dunno about you. atleast with the acekard it still works after flash.

At that point, I'd consider it more along the lines of a tool than a flashcart, similar to buying a special screwdriver to just open your system that one time to adjust the disc laser/install a modchip.

 

[mvmiranda]

@Lia @nl255 @annson24
My Acekard2i (HW-81) arrived and I programmed it properly (took a backup first, of course).

I think I will not be able to fix those 3DS without a valid NAND because as soon as I press power it turns on with a blue screen (it doesn't matter if I press along with START+SELECT+X, alone or any other button combo).
I guess not having part of the NAND that "controls/contains" the exploit makes it useless to me.

Any ideas?

 

[Deleted member 381889]

@Lia @nl255 @annson24
My Acekard2i (HW-81) arrived and I programmed it properly (took a backup first, of course).

I think I will not be able to fix those 3DS without a valid NAND because as soon as I press power it turns on with a blue screen (it doesn't matter if I press along with START+SELECT+X, alone or any other button combo).
I guess not having part of the NAND that "controls/contains" the exploit makes it useless to me.

Any ideas?

The bootrom has the flaw. It's impossible that because your NAND is gone, the flaw is gone.
Perhaps you're just not holding the magnet in the correct place.

 

[Cuphat]

@Lia @nl255 @annson24
My Acekard2i (HW-81) arrived and I programmed it properly (took a backup first, of course).

I think I will not be able to fix those 3DS without a valid NAND because as soon as I press power it turns on with a blue screen (it doesn't matter if I press along with START+SELECT+X, alone or any other button combo).
I guess not having part of the NAND that "controls/contains" the exploit makes it useless to me.

Any ideas?

The bootrom is not stored on NAND. If done properly, this method triggers before the blue screen. You just need to make sure the magnet (or sleep switch on 2DS) is in place and the cart is flashed and properly seated.

 

[chile_unlock]

I comment my results.
3ds class ok
3ds xl
New 3ds xl ok
2ds on black screen.
I do not find the form in any 2ds, some solution open a real video of 2ds with this method to believe.
Greetings.

 

[mvmiranda]

Bingo!
It worked! I moved the magnet a bit on top of the B button after paying attention to where the speaker holes on the top screen were and voilá... Decrypt9!
Will try a CTRTransfer and see what happens!

 

[Deleted member 381889]

Bingo!
It worked! I moved the magnet a bit on top of the B button after paying attention to where the speaker holes on the top screen were and voilá... Decrypt9!
Will try a CTRTransfer and see what happens!

Wooo!

 

[failzers]

I comment my results.
3ds class ok
3ds xl
New 3ds xl ok
2ds on black screen.
I do not find the form in any 2ds, some solution open a real video of 2ds with this method to believe.
Greetings.

English. Also do you mean you can't get it to boot? There's a sleep switch instead of a magnet there. just hold the button combo and use the cart still.

 

[annson24]

That file is for those unable to even launch GodMode9 straight from B9S or NTRBootHax, it's not an update about the CTRNAND transfer.

Thanks for the info, but honestly speaking, I never had one of those problems metioned above after unbricking several units already. What I did was, instead of booting directly to gm9 with ntrboot, I install b9s first with ntrboot then proceed on chainloading gm9 with luma3ds. I don't know if it has anything to do with the issue, but I had a 100% success rate with it.

Sent from my SM-G950F using Tapatalk

 

[chile_unlock]

English. Also do you mean you can't get it to boot? There's a sleep switch instead of a magnet there. just hold the button combo and use the cart still.

The sleep switch is fine, but it still does not work, I run the button sequence but nothing

 

[mvmiranda]

Both Auto CTRNAND Transfer and Forced CTRNAND Transfer failed :/
Something with failing when dumping SecureInfo_A...

 

[annson24]

The sleep switch is fine, but it still does not work, I run the button sequence but nothing

Maybe the flashcart isn't properly placed in the 2ds. Sometimes the contacts of the 2ds gets dirty or sometimes corroded and a few cartridges can't be read properly anymore. Try to place the ntrboot cart then try the combination twice. If it doesn't work, remove the cart and replace it to the slot in a different manner then repeat to do the combination. Do this until it works or until you get tired of it. If it works then good for you, if it's the latter then reoly back, we'll try to help as much as we can.

Sent from my SM-G950F using Tapatalk

 

[chile_unlock]

Thanks for the info, but honestly speaking, I never had one of those problems metioned above after unbricking several units already. What I did was, instead of booting directly to gm9 with ntrboot, I install b9s first with ntrboot then proceed on chainloading gm9 with luma3ds. I don't know if it has anything to do with the issue, but I had a 100% success rate with it.

Sent from my SM-G950F using Tapatalk

Give me your files for 2ds, greetings

--------------------- MERGED ---------------------------

Friends uploaded the video with the detail.

 

[annson24]

Give me your files for 2ds, greetings

--------------------- MERGED ---------------------------

Friends uploaded the video with the detail.

The files for 3ds and 2ds are just the same. After turning on the 2ds for 3 seconds, remove the button conbination and disable the sleep switch.

Sent from my SM-G950F using Tapatalk

 

[chile_unlock]

The files for 3ds and 2ds are just the same. After turning on the 2ds for 3 seconds, remove the button conbination and disable the sleep switch.

Sent from my SM-G950F using Tapatalk

Nothing even crying can be a good option

 

[annson24]

Nothing even crying can be a good option

Please be informed that when the sleep is triggered (in old 3ds, when the magnet is in place; and in old 2ds, when the sleep switch is enabled) you won't be able to turn the 3ds/2ds on at all with just the power button. You can only turn it on if 1. You do the button combination first, or 2. You remove the magnet/disable the sleep switch.

Now if your 2ds powers on while sleep is triggered, then you might have a faulty sleep switch.

Edit: clarified.

Sent from my SM-G950F using Tapatalk

 

[TheCyberQuake]

Please be informed that when the sleep is triggered (in 3ds, when the magnet is in place; and in 2ds, when the sleep switch is enabled) you won't be able to turn the 3ds/2ds on at all. You can only torn it on if 1. You do the button combination, or 2. You remove the magnet/disable the sleep switch.

Now if your 2ds powers on while sleep is triggered, then you might have a faulty sleep switch.

Sent from my SM-G950F using Tapatalk

Actually in my testing it will power on with the lid sensor activated, at least for my n3ds xl.

 

[Quantumcat]

Actually in my testing it will power on with the lid sensor activated, at least for my n3ds xl.

It's different between old and new. In new you can press the button with the lid closed, so it will turn on and just go straight to sleep mode. But in old 3DS and 3DS XL you can't press the power button with the lid closed.