It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[GerbilSoft]

One Time Programable memory.

Specifically, with regards to the 3DS, it contains various system-specific IDs and encryption keys. It's also used by arm9loader on New 3DS as an encryption key, which is why the OTP was needed for A9LH.

https://www.3dbrew.org/wiki/OTP_Registers has a description of the contents of the 3DS's OTP.

 

[DocKlokMan]

Hi there!
First of all, I would like to thank the developers for such a good job, and all those involved.
Now I have a question. I followed the 3ds.guide tutorial using the NTRboothax and an Acekard 2i to mod my O3DSXL. As a result, now I got a 3DS with luma and the starter pack installed and working. The only issue is that when I open Download Play app it ends openning the Homebrew Launcher. And when I open the Homebrew Launcher it gives me an error. Tried deleting DownloadPlay and installing again via update, but it gives the same errors. Did someone get this problem too? And how to solve that? Searching the web and forum, just found an error that opening HBlauncher it opens the DownlosdPlay. It's not the same problem but it may be related. If the post is on the wrong place, then sorry. And sorry for my bad english too.

Enviado de meu Redmi Note 3 usando Tapatalk

Open the Rosalina Menu and go to Miscellaneous Options > Switch the hb. title to hblauncher_loader. Then be sure to Save settings.

 

[TheCyberQuake]

Hi there!
First of all, I would like to thank the developers for such a good job, and all those involved.
Now I have a question. I followed the 3ds.guide tutorial using the NTRboothax and an Acekard 2i to mod my O3DSXL. As a result, now I got a 3DS with luma and the starter pack installed and working. The only issue is that when I open Download Play app it ends openning the Homebrew Launcher. And when I open the Homebrew Launcher it gives me an error. Tried deleting DownloadPlay and installing again via update, but it gives the same errors. Did someone get this problem too? And how to solve that? Searching the web and forum, just found an error that opening HBlauncher it opens the DownlosdPlay. It's not the same problem but it may be related. If the post is on the wrong place, then sorry. And sorry for my bad english too.

Enviado de meu Redmi Note 3 usando Tapatalk

Just open another app you rarely use, press L+dpad down+select to open Rosalina, select miscellaneous options, switch the hb. title to the current app, then save settings afterward.
Ninja'd by several minutes lol

 

[greatdini]

Open the Rosalina Menu and go to Miscellaneous Options > Switch the hb. title to hblauncher_loader. Then be sure to Save settings.

Just open another app you rarely use, press L+dpad down+select to open Rosalina, select miscellaneous options, switch the hb. title to the current app, then save settings afterward.
Ninja'd by several minutes lol

Thanks for the quick feedback! I will test it later when my son let go of the 3DS.

Enviado de meu Redmi Note 3 usando Tapatalk

 

[DocKlokMan]

No rush, @AnalogMan!
Just tag me when you have something ready!
Thank you very much, in advance!

PM sent.

 

[failzers]

Exactly why does the OP say that an MCU brick can't be fixed with this? The mcu brick is literally fixed by removing the battery for ten minutes. A9LH can even overwrite mcu firm, so why does this say that this cannot override mcu firm if this in boot-order loads before the mcu panics and before a9l loaded? Just because the tool for it isn't made yet, doesn't mean it's not possible. There is also only one confirmed MCU brick anyways, and that's yellows8.

Source: http://gbatemp.net/threads/release-3ds-rgb-led-test-program.441633/page-5#post-6689042

 

[Quantumcat]

Exactly why does the OP say that an MCU brick can't be fixed with this? The mcu brick is literally fixed by removing the battery for ten minutes. A9LH can even overwrite mcu firm, so why does this say that this cannot override mcu firm if this in boot-order loads before the mcu panics and before a9l loaded? Just because the tool for it isn't made yet, doesn't mean it's not possible. There is also only one confirmed MCU brick anyways, and that's yellows8.

Source: http://gbatemp.net/threads/release-3ds-rgb-led-test-program.441633/page-5#post-6689042

The MCU controls how power is delivered to the device. It can't start properly if the MCU is screwed up, bootloader or not.

 

[failzers]

The MCU controls how power is delivered to the device. It can't start properly if the MCU is screwed up, bootloader or not.

And that is easily remedied by removing the battery. The mcu doesn't have long-term persistent storage. After power is completely removed and disconnected from the battery, the problem is fixed.

 

[Nomelas]

The compatibility table is a bit confusing.
http://cfw.guide/ntrboot/compatibility

I wish there was a picture or link to the card they are talking about...

http://www.nds-card.com/ProShow.asp?ProID=146 for example... is this compatible?

also, how are the others "unofficially supported"? they aren't covered in the guide.

 

[KunoichiZ]

The compatibility table is a bit confusing.
http://cfw.guide/ntrboot/compatibility

I wish there was a picture or link to the card they are talking about...

http://www.nds-card.com/ProShow.asp?ProID=146 for example... is this compatible?

also, how are the others "unofficially supported"? they aren't covered in the guide.

Pictures of currently supported cards can be found in the README of this link.

 

[failzers]

The compatibility table is a bit confusing.
http://cfw.guide/ntrboot/compatibility

I wish there was a picture or link to the card they are talking about...

http://www.nds-card.com/ProShow.asp?ProID=146 for example... is this compatible?

also, how are the others "unofficially supported"? they aren't covered in the guide.

It's really not that confusing, if you click on the cards, it brings you to nds-card items that are those.

 

[TheCyberQuake]

And that is easily remedied by removing the battery. The mcu doesn't have long-term persistent storage. After power is completely removed and disconnected from the battery, the problem is fixed.

There are other ways to brick other than bad code in storage. A fried chip will brick the system. And AFAIK not all mcu bricks can be fixed by removing the battery.

 

[Cuphat]

http://www.nds-card.com/ProShow.asp?ProID=146 for example... is this compatible?

No.

also, how are the others "unofficially supported"? they aren't covered in the guide.

They are literal clones of cards that are supported.

 

[Nomelas]

Pictures of currently supported cards can be found in the README of this link.

It's really not that confusing, if you click on the cards, it brings you to nds-card items that are those.

"officially supported" I get that part, but I'm talking about the "unofficial clones" as they are... there's no link to them.

They are literal clones of cards that are supported.

http://www.nds-card.com/ProShow.asp?ProID=146 vs http://www.nds-card.com/ProShow.asp?ProID=149

looks pretty cloney to me.... I get it though, they are different "brands", which is why it's confusing.

 

[Cuphat]

"officially supported" I get that part, but I'm talking about the "unofficial clones" as they are... there's no link to them.



http://www.nds-card.com/ProShow.asp?ProID=146 vs http://www.nds-card.com/ProShow.asp?ProID=149

looks pretty cloney to me.... I get it though, they are different "brands", which is why it's confusing.

They both have labels ripping off the original R4, that doesn't mean they are remotely similar in hardware.

 

[Nomelas]

They both have labels ripping off the original R4, that doesn't mean they are remotely similar in hardware.

thanks, but again that does not make it easy for those who don't know the difference between clones, official cards, etc and what their own falls under. I thought it was a pretty simple request.

 

[Nirmonculus]

Will it break the flash cart if I use a non-compatible one, or nothing will happen?

 

[lone_wolf323]

Will it break the flash cart if I use a non-compatible one, or nothing will happen?

There may be a slight chance that it could work. But most likely you would be looking at a bricked flashcart.

 

[Raugo]

Thanks a ton, this helps a lot! And, yeah, you can install NTRboot via the flasher, but not recommended. We use the flasher for reverse engineering, and eventually (don't worry, won't take too long) this will make it into a proper installer.

Glad to help, if you need to test something I have two DSTT with the ES29LV400DB flash memory.

 

[Nirmonculus]

There may be a slight chance that it could work. But most likely you would be looking at a bricked flashcart.

Yeah, I was afraid of that. I have r4 3d 2012 from r4i3d.com

I'm not entirely sure if it would work because it is not on the list... I don't want to lose its use though. I have a ds lite, dsi, and new 3ds that I can use the cart with.