It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[d0k3]

It says:

unknown device: FF90C11F
This is broken. (TT)

Looks like a fake or somehow not supported. Can't say for sure right now.

 

[pixelmasher]

There are different types. Let me give you something...
https://transfer.sh/AGuJ3/DSTT_FakeRecovery_v1.17.zip

Load the Fake Checker from your flashcart, it will tell you if it's compatible.

EDIT: and don't try anything fishy with that flasher. It will most likely not have the result you expect.

I just saw your edit. I would expect it to brick it. You mean it won't?

 

[d0k3]

I just saw your edit. I would expect it to brick it. You mean it won't?

In that case, your expectation maybe true .

 

[mvmiranda]

@Lia @gamesquest1
I'd like to share with you guys (and everyone else who might help as well) my brick case
I have a O3DS classic with a completely broken NAND (unsuccessful downgrade method due to faulty SD who backed up a garbage NAND as well and that NAND was flashed using hardmod).

I can successfully use the magnethax and boot Decryt9 but if I try to do a CTRNAND Transfer it always fails, either with no error message (normal method) or with a SecureInfo_A not found (forced method).

Any advises?

 

[MrJason005]

@Lia @gamesquest1
I'd like to share with you guys (and everyone else who might help as well) my brick case
I have a O3DS classic with a completely broken NAND (unsuccessful downgrade method due to faulty SD who backed up a garbage NAND as well and that NAND was flashed using hardmod).

I can successfully use the magnethax and boot Decryt9 but if I try to do a CTRNAND Transfer it always fails, either with no error message (normal method) or with a SecureInfo_A not found (forced method).

Any advises?

Can you try godmode9 for the ctrtransfer?

 

[mvmiranda]

Can you try godmode9 for the ctrtransfer?

I see no option in GoodMode9!
Where is it?

PS:I'm not used to GoodMode9 as I always used Decrypt9!

 

[MrJason005]

I see no option in GoodMode9!
Where is it?

PS:I'm not used to GoodMode9 as I always used Decrypt9!

https://3ds.guide/9.2.0-ctrtransfer

 

[Quantumcat]

Is GodMode9 fixed for CTR transfers yet? Last I heard there was a bug that made it not work if a system was too messed up. But Decrypt9 does have this bug.

 

[annson24]

There are different types. Let me give you something...
https://transfer.sh/AGuJ3/DSTT_FakeRecovery_v1.17.zip

Load the Fake Checker from your flashcart, it will tell you if it's compatible.

EDIT: and don't try anything fishy with that flasher. It will most likely not have the result you expect.

If we try to use the checker with a clone, should we expect the same result as checking an actual dstt?

Sent from my SM-G950F using Tapatalk

 

[mvmiranda]

https://3ds.guide/9.2.0-ctrtransfer

Is GodMode9 fixed for CTR transfers yet? Last I heard there was a bug that made it not work if a system was too messed up. But Decrypt9 does have this bug.

If I try with GodMode9 it doesn't do anything...
I choose "Transfer..." and it just returns to the CTRNAND file selection.

 

[pixelmasher]

If I try with GodMode9 it doesn't do anything...
I choose "Transfer..." and it just returns to the CTRNAND file selection.

You can try the nightlies. Not sure if anything's been fixed.

 

[annson24]

Crap, just realized I lost my DSTT files, now I can't boot it up, can't check if it's legit or a clone one. It only displays a blank cartridge when inserted in my 3ds.

edit: is this a good way to check if my dstt is legit?

 

[gamesquest1]

first try flashing a random 3ds's nand backup, this should fix the general nand layout, now as has already been said try decrypt9 the n3ds->o3ds downgrade process was more "thorough" than a normal ctrtransfer as it replaced more of the nand than is usually needed, but even then I'm thinking the "safety checks" might just cause it to fail anyway as ctrnand will be undecryptable, a way around this would be generating a ctrnand xorpad, then dumping the unencrypted ctrnand from another system and encrypting it and inserting it back into the nand,

again not sure if you could just import a decrypted ctrnand with no xoring required but the general idea is to manually fix the nand as much as possible to the point decrypt9/godmode9 can pass the basic safety checks and do a proper ctrtransfer

 

[d0k3]

If I try with GodMode9 it doesn't do anything...
I choose "Transfer..." and it just returns to the CTRNAND file selection.

Off topic, but @AnalogMan is currently working on a universal rescue script. Will be finished soon, I think.

 

[annson24]

Thank you @d0k3 got the checker working with my 3ds.

Spoiler

 

[pixelmasher]

Crap, just realized I lost my DSTT files, now I can't boot it up, can't check if it's legit or a clone one. It only displays a blank cartridge when inserted in my 3ds.

edit: is this a good way to check if my dstt is legit?

Wow, that brought back memories. I remember using that page to check my card and also using their TTi checker to confirm it was a legit card.

You can use RetroGameFan files to run it. You obviously found a way to run it.
@d0k3 Do you happen to have a later version of the checker? I think that version pre-dates my card.

 

[mvmiranda]

first try flashing a random 3ds's nand backup, this should fix the general nand layout, now as has already been said try decrypt9 the n3ds->o3ds downgrade process was more "thorough" than a normal ctrtransfer as it replaced more of the nand than is usually needed, but even then I'm thinking the "safety checks" might just cause it to fail anyway as ctrnand will be undecryptable, a way around this would be generating a ctrnand xorpad, then dumping the unencrypted ctrnand from another system and encrypting it and inserting it back into the nand,

again not sure if you could just import a decrypted ctrnand with no xoring required but the general idea is to manually fix the nand as much as possible to the point decrypt9/godmode9 can pass the basic safety checks and do a proper ctrtransfer

I'll try this and if it fails, will wait for @AnalogMan's script (as pointed out by @d0k3.

PS: messing around my "stashes" I found a 2DS in the same situation and a couple of N3DS XL boards laying around (probably black screen issues). Let's mine and see if any gold comes out of it.

Thx guys!

 

[zoogie]

Do you mind telling us what r4iGold this is?
http://www.r4wood.com/pages/R4i-Gold.html
(mine is top-row, far right. the really old one)
And could you tell us the number just above the rightmost bin on the back? Mines a 5 lol.
(I also have a brand new one that works though at least)

I can actually get it to dump, restore, and flash by changing this 0xA7.... value to 0.
https://github.com/kitling/flashcar...f8dea8aa2aec65a45c/devices/r4igold3ds.cpp#L88
Unfortunately, the patch feature just results in a corrupted card, but at least I can restore it. Shouldn't be much trouble for the ntrboot devs to fix this card since the read/write functions obviously work.

I got it working

https://gist.github.com/zoogie/51856a507bf380fc38d82a87855e265f
So happy

 

[Raugo]

@d0k3 The ntrboohax flasher for dstt use the DSTTFlashwriter? Because the version in the DSTT_FakeRecovery is old, the newer version is here https://www.linfoxdomain.com/nintendo/ds/?mode=fileinfo&fileid=2543 and support more chips.

 

[DocKlokMan]

I'll try this and if it fails, will wait for @AnalogMan's script (as pointed out by @d0k3.

PS: messing around my "stashes" I found a 2DS in the same situation and a couple of N3DS XL boards laying around (probably black screen issues). Let's mine and see if any gold comes out of it.

Thx guys!

What console do you have? New, old, USA, EUR, JPN?