NTRCardHax Progress?

Discussion in '3DS - Flashcards & Custom Firmwares' started by seb5049, Jan 28, 2016.

  1. seb5049
    OP

    seb5049 GBAtemp Regular

    Member
    116
    65
    Feb 25, 2015
    So I assume this way to get emunand on 10.3 sysnand that Gateway is teasing probably involves ntrcardhax. I have a few questions about it:


    1. Is anybody other than the gateway team working with ntrcardhax? Since gateway is closed source, you would probably have to use a gateway card unless somebody else makes it open source.

    2. When is the exploit triggered? If I have to load a ds game every time I want to go to emunand, it would get quite annoying.

    3. What "Special DS hardware" will ntrcardhax work on? Is it all DS flashcards or something more specific?
     


  2. DrCrygor07

    DrCrygor07 Italian Wario Ware bootleg©

    Member
    1,706
    632
    Sep 4, 2014
    Italy
    I think that this was already achieved by privates, and it will not be used as an entry point, but only to dump bootrom or I don't know, keys. I think that it's like a gateway card, where you can flash some codes. Don't quote me on that.
     
  3. Woody8275

    Woody8275 GBAtemp Advanced Fan

    Member
    635
    91
    Sep 4, 2013
    when did gateway say they would have CFW on 10.3
    I thought they were working on a safer downgrade method
     
  4. seb5049
    OP

    seb5049 GBAtemp Regular

    Member
    116
    65
    Feb 25, 2015
    http://imgur.com/BvJXB0X That's what was there last time I checked the website, but now they've updated it saying they are making a safer way to downgrade, perhaps using ntrcardhax instead of memchunkhax2?
     
    Last edited by seb5049, Jan 28, 2016
  5. HarEllis6202

    HarEllis6202 GBATemp OldFag

    Member
    508
    122
    Feb 19, 2015
    United States
    Michigan
    -snip-

    With the new firmware update we would like to STRONGLY ADVISE AGAINST UPDATING yoursysnand to any version higher than 10.3 (i.e. 10.4 or higher), as we will not be able to support sysnand firmware version 10.4 or higher anytime soon.
     
  6. andre104623

    andre104623 GBAtemp Advanced Fan

    Member
    681
    214
    Apr 9, 2014
    United States
    Philadelphia, PA
    Gateway said this is one of the things there working on. I do believe there will be native 10.3 support as well but only time will tell
     
  7. Vappy

    Vappy GBAtemp Advanced Maniac

    Member
    1,507
    1,154
    May 23, 2012
    @Kitlith and @173210 are both posting some progress, here http://gbatemp.net/threads/ntrcardhax-downgrading-questions.412717/ and here http://twitter.com/173210/with_replies respectively.
    That's why plutoo said in the talk that he wouldn't recommend it, because of the inconvenience. Still, once you've got ARM9 execution, you can safely downgrade, or (less safely) set up arm9loaderhax.
    Any flashcart that can be updated with a header that can be modified. So far, the AK2i and SuperCard DSTwo are all but confirmed to work for it.
     
  8. ShadowOne333

    ShadowOne333 GBAtemp Guru

    Member
    7,112
    4,504
    Jan 17, 2013
    Mexico
    What is this NTR Card hax that many people seem to be bringing up lately?
    Anyone could please explain it?
     
  9. Vappy

    Vappy GBAtemp Advanced Maniac

    Member
    1,507
    1,154
    May 23, 2012
     
  10. Suiginou

    Suiginou (null)

    Member
    565
    588
    Jun 26, 2012
    Gambia, The
    pc + 8
    Last edited by Suiginou, Jan 30, 2016
    Vappy likes this.
  11. Kitlith

    Kitlith Advanced Member

    Newcomer
    88
    68
    Jan 29, 2016
    United States
    Trapped between a rock and a hard place
    I'd like to clarify on that. The AK2i is all but confirmed *in theory* because we can manipulate the header however we want. In practice, we'll see what we'll need. Unless there's some weirdness where stuff can change, and we can tell based on what the 3DS sends to the cartridge, this *should* be enough. Please don't hype or quote.

    The DSTWO is all but confirmed for an entirely different reason. The DSTWO has a built-in processor/FPGA that apparently can be modified. This is the vein that @173210 is working in. I know nothing else about this. Ask him if you want more details.

    Finally, the first statement is too general for my tastes at the moment. This may be true, it may not be. It may end up being different for different cards. But, if we can only access 0x200 bytes, where the normal header is located, and no more, then it is likely that it cannot be used. Again, there may be cases where we can work around this. I don't know yet. Also, in order to modify the header, we have to know how to write to the header of the flashcart. So even if it would work in theory, if we haven't figured out how to modify the header (even though the card updates may do so) we cannot use it.

    Also, don't credit me. I just wanted to document this little mentioned exploit. It just so happens that to document it, one needs to put the pieces together to actually exploit it. Funny how that works. :P
     
    Vappy likes this.
  12. shinyquagsire23

    shinyquagsire23 SALT/Sm4sh Leak Guy

    Member
    1,964
    3,238
    Nov 18, 2012
    United States
    Las Vegas
    K9lhax needs ARM9, but it still basically requires a hardmod to do anyhow. So it's either collecting some pieces of info and saving an extra downgrade or gathering a safe NAND backup and setting up for a buffered k9lhax to get the hash.
     
    Vappy likes this.
  13. Toiry921

    Toiry921 Maki Best Girl

    Member
    265
    168
    Dec 10, 2015
    United States
    ラブライブ
    Pneumaticat likes this.
  14. Normmatt

    Normmatt Former AKAIO Programmer

    Member
    2,142
    544
    Dec 14, 2004
    New Zealand
    So I looked into the AK2i code I have and apparently (based on some code comments) AK2i's protect writes to the area of flash that the header is. Old AK2's however don't. I'll have to have a play and see if i can actually write to that area or not on AK2i's.
     
  15. 173210

    173210 GBAtemp Regular

    Member
    245
    600
    Jan 22, 2014
    Japan
    There's no progress since I lost my DSTWO :/
     
  16. Zidapi

    Zidapi GBAtemp Psycho!

    Member
    3,033
    1,817
    Dec 1, 2002
    But Acekard 2.1 won't run on a 3DS without using @Apache Thunder's Slot-1 Launcher. Wouldn't that pose a problem?
     
    Last edited by Zidapi, Feb 29, 2016
  17. Normmatt

    Normmatt Former AKAIO Programmer

    Member
    2,142
    544
    Dec 14, 2004
    New Zealand
    That probably wouldn't work anyway as you don't control the first program the DSTWO's mips processor starts with. Ejecting the cart would cause the cart to reboot and lose the custom cart emulation...

    Doesn't matter... the header is read long before the cart is blocked in sysmenu...
     
    Zidapi likes this.
  18. 173210

    173210 GBAtemp Regular

    Member
    245
    600
    Jan 22, 2014
    Japan
    Why should I eject the cart? Anyway, switching from TWL_FIRM to NATIVE_FIRM may trigger reboot. That's the problem, I think.
     
  19. Zidapi

    Zidapi GBAtemp Psycho!

    Member
    3,033
    1,817
    Dec 1, 2002
    Good to know. Red Face standing by.
     
    Ronhero likes this.
  20. Normmatt

    Normmatt Former AKAIO Programmer

    Member
    2,142
    544
    Dec 14, 2004
    New Zealand
    Because you need to in order to trigger ntrcardhax.....