Hacking NTRPack: PC-less b9s install using ntrboot

[failzers]

Phone is technically a pc, not all phones have SD, and o3ds SD won't fit in a phone without using otg cable and a USB SD reader

You would have to be looking extremely hard to find a full sd. I go to multiple tech stores, and i could count the full sd items i've seen on one hand. Literally everything there is microsd with an adapter.

And i don't buy phones that don't have microSD support, i don't wanna get jypped into buying another phone just for more internal storage.

 

[greenDarkness555]

@TheCyberQuake This pack is amazing! Thanks for sharing!
I made an "Instructions" folder with text files that are named after each step of the process. Assuming someone makes it to step 5. they should be able to view the instructions in GM9.
Edit: The file names have been shortened and organized by folder.

 

[TheCyberQuake]

You would have to be looking extremely hard to find a full sd. I go to multiple tech stores, and i could count the full sd items i've seen on one hand. Literally everything there is microsd with an adapter.

And i don't buy phones that don't have microSD support, i don't wanna get jypped into buying another phone just for more internal storage.

o3ds and o3ds xl came with a standard SD by default. So unless the user upgraded from a standard SD to a microSD in an adapter o3ds users won't be able to put their SD card in my phone. And when I upgraded my SD card I bought a 64GB standard SD. Standard SD is still extremely easy to find everywhere I've looked because cameras don't use microSD, and microSD in an adapter can be extremely finicky (the adapters just don't last long in many cases).
Why is everyone so fixated on this idea? Yes it would be easier to just copy from a phone via microSD, but I've designed this to try to be compatible with every circumstance you come across. If you limit yourself to the phone's microSD not every device you come across will work.
If you don't like the way I do it, then just make your own thing. I've already explained my reasoning as to why I've done things certain ways multiple times in this thread.

 

[TheCyberQuake]

I've finished incorporating all currently planned features. At this point I just need some testers for EUR and JPN who are willing to uninstall cfw and reinstall using a beta version of the pack. PM me if you have a EUR or JPN region console to test on.
With this pack update coming, it will only have full support EUR/USA/JPN 9.6.0 - 11.5.0. Anything other than that will simply fail dumping dspfirm.cdc, but that can be done with DSP1.3dsx still.

 

[Quantumcat]

I have a few consoles that are yet to have CFW installed. Eur region. Happy to test.

 

[DocKlokMan]

After just spending several hours researching and testing, I can conclude that with how godmode9 currently works, there is no possible way to use either find or find -f in order to properly find the correct mset .app file for dspfirm extraction.
As a remedy, I've instead opted to simply attempt a copy from set paths for each of the 3 main regions with the flags to ignore errors, and then use whatever got copied as the extraction file.

# attempt to copy mset .app from known paths
#9.6.0 - 11.5.0
cp -w -o -s 1:/title/00040010/00021000/content/0000004d.app 9:/mset.app #USA
cp -w -o -s 1:/title/00040010/00022000/content/0000003d.app 9:/mset.app #EUR
cp -w -o -s 1:/title/00040010/00020000/content/00000048.app 9:/mset.app #JPN

# Verify previous file copy, if failed unsupported region or firmware was used
find 9:/mset.app NULL

# LZSS reverse-compress .code to code.bin
extrcode 9:/mset.app 9:/code.bin

With this it will support everything from 9.6.0 to the latest firmware. You likely won't find anything lower than that in the wild anyway. If I could get previous mset versions downloaded (3dnus can't grab them anymore, maybe nintendo removed them from their servers) I could begin testing those for offsets and their correct paths, but wouldn't be able to actually make use of them until we got if statements.
Edit: actually with if statements it would be easy to use find commands as well. I could just open up one of the two .app files using find -f and imgmount, checking if a .code is found, and if not proceeding to mount the other .app using find instead. It would also be possible to have differing offsets for other regions and firmwares. Though it would be even easier if d0k3 added a way to find an offset within a file by finding a hex match.

What's wrong with the find -f command? If it does not work on a EUR or JPN console, can you tell me why and I can possibly suggest some corrections. As far as I know, for JPN systems 00020000 will always be the first folder, for USA consoles 00021000 is always first and for EUR consoles 00022000 is always first. So is the issue the .app files? Is it not always the first one listed for EUR or JPN?

 

[TheCyberQuake]

What's wrong with the find -f command? If it does not work on a EUR or JPN console, can you tell me why and I can possibly suggest some corrections. As far as I know, for JPN systems 00020000 will always be the first folder, for USA consoles 00021000 is always first and for EUR consoles 00022000 is always first. So is the issue the .app files? Is it not always the first one listed for EUR or JPN?

The issue is that there are two .app files in the system settings folder, and only one of them has a .code. So if you try to use either find or find -f, for some regions it will pull the correct .app and others it won't. From what I can tell whichever is first/last varies both between regions and between mset version. Like for JPN one version had the first .app pulled be the correct, but then next update it was the second one. So find and find -f both won't universally work across region nor mset versions. If we had if statements we could potentially just mount one of them, test for a .code, and if not mount the other. But without flow control I don't see any feasible way to currently do it without a set list.

 

[TheCyberQuake]

Public beta for NTRPack 2.0 is now live. Anyone willing to uninstall b9s and CFW to test is welcome. Looking for any bugs and feedback on possible changes before being pushed as an official release. Check OP for details.

 

[izumo]

2.0 Public Beta
I believe update 2.0 is pretty much ready for release, but I would like to verify it doesn't have bugs. Anyone willing to uninstall their b9s and cfw to test this and give feedback are welcome. So far USA consoles are already well tested, I'm more looking for EUR and JPN region system, though all are welcome. All info needed will be in the spoiler below.

Spoiler: 2.0 Beta Details

https://drive.google.com/open?id=0B2Yhg2D4TmuLS1dEN0RKcFJYNW8
Additions/Changes:
New process does entire install process from gm9. Special build of gm9 used that automatically starts the install script
dspfirm dumping from MSET for EUR/JPN/USA
Went from 3 scripts down to only one


Delete /3ds/dspfirm.cdc, and use one of the cfw uninstall scripts from https://3ds.guide/uninstall-cfw to ensure a clean test (may not be necessary for all testers).
The ntrboot file is now boot.firm instead of the previous ntrboot.firm, so if you are using the old version that boots ntrboot.firm you can simply rename SD/boot.firm to ntrboot.firm

Usage:
Use ntrboot using the magnet. It should launch gm9 and start running the install script
Once luma configuration appears, select "Show nand in system settings" and "Patch ARM9 access", press start
Open download play and set it to be .hb, then save.

This is fantastic! 2.0 public beta
Three tests with OLD 3ds 11.5 JPN All went well without problems

I would be happy if you could include CTRXplorer on this

 

[Kazuma77]

The fact that this page is linked regularly in this forum and on the 3DS assistance discord (which is less tolerant of piracy-related discussion and links to copyright material) would suggest otherwise. Get your facts straight next time.

My facts are straight. Those are copyrighted files. Your statistics on the site's acceptance/allowance only confirm that it's being turned a blind eye to. If I included those two files in anything I released here, people would raise Hell with me for including copyrighted material, and you know it. And what's with the large images? This isn't facebook.

The issue is that there are two .app files in the system settings folder, and only one of them has a .code. So if you try to use either find or find -f, for some regions it will pull the correct .app and others it won't. From what I can tell whichever is first/last varies both between regions and between mset version. Like for JPN one version had the first .app pulled be the correct, but then next update it was the second one. So find and find -f both won't universally work across region nor mset versions. If we had if statements we could potentially just mount one of them, test for a .code, and if not mount the other. But without flow control I don't see any feasible way to currently do it without a set list.

I've observed the same problem. A potential workaround would be to find both as different variables, and then try to extract the file from each (using the -o parameter so that the one that fails doesn't stop the script). However, there's still the issue of varying offsets with different versions of firmware. I have yet to find anything that has matching offsets on both 11.5 and 9.2, unfortunately. I think we're looking at 11.x only without a search command.

 

[DocKlokMan]

The issue is that there are two .app files in the system settings folder, and only one of them has a .code. So if you try to use either find or find -f, for some regions it will pull the correct .app and others it won't. From what I can tell whichever is first/last varies both between regions and between mset version. Like for JPN one version had the first .app pulled be the correct, but then next update it was the second one. So find and find -f both won't universally work across region nor mset versions. If we had if statements we could potentially just mount one of them, test for a .code, and if not mount the other. But without flow control I don't see any feasible way to currently do it without a set list.

Ah, I see. This should do it then:

# GodMode9 "Dump DSP"
# Dumps DSPFirm from 11.5 MSET
# last changed: 20170909
# author: AnalogMan

set SUCCESSMSG "DSPFIRM.CDC Dumped successfully"

# Find MSET title for region & try to dump Reverse-LZSS Decompressed .code

# Find base title folder
find -f 1:/title/00040010/0002?000 MSET1

# Test first APP file
find -f $[MSET1]/content/*.app MSET2
extrcode -o -s $[MSET2] 9:/code.bin

# Test second APP file
find $[MSET1]/content/*.app MSET2
extrcode -o -s $[MSET2] 9:/code.bin

# Extracts DSPfirm from code.bin to dspfirm.cdc
set ERRORMSG "DSPFIRM did not pass SHA check!\nIs this v11.5 firmware?"
inject 9:/code.bin@19A1C0:C25C 0:/3ds/dspfirm.cdc
sha 0:/3ds/dspfirm.cdc 8e213f3e71d2e3e45d1169bac6465a70eabeb22b303f1fa6d7679370ffad0f54

 

[jaysea]

Tried your new 2.0 beta package on 2ds.
It doesn't ntrboot nor does it boot when having b9s installed. It does boot as payload in luma or godmode9 though.

EDIT: compiled gm9 1.3.7 with your installscript and flashed the ntr version to the ntrcard. It does everything but extract the dsp from the mset.app. Therefor I just copied my dspfirm.cdc to the 3ds folder and removed the dump dsp part from the script. Now it works perfectly.
I am on 11.2 btw

 

[Kazuma77]

Ah, I see. This should do it then:

# GodMode9 "Dump DSP"
# Dumps DSPFirm from 11.5 MSET
# last changed: 20170909
# author: AnalogMan

set SUCCESSMSG "DSPFIRM.CDC Dumped successfully"

# Find MSET title for region & try to dump Reverse-LZSS Decompressed .code

# Find base title folder
find -f 1:/title/00040010/0002?000 MSET1

# Test first APP file
find -f $[MSET1]/content/*.app MSET2
extrcode -o -s $[MSET2] 9:/code.bin

# Test second APP file
find $[MSET1]/content/*.app MSET2
extrcode -o -s $[MSET2] 9:/code.bin

# Extracts DSPfirm from code.bin to dspfirm.cdc
set ERRORMSG "DSPFIRM did not pass SHA check!\nIs this v11.5 firmware?"
inject 9:/code.bin@19A1C0:C25C 0:/3ds/dspfirm.cdc
sha 0:/3ds/dspfirm.cdc 8e213f3e71d2e3e45d1169bac6465a70eabeb22b303f1fa6d7679370ffad0f54

That's exactly what I was suggesting, more or less. It will work back to 9.6 (9.6 to 11.4 used the same version). It won't work if you want to add the 9.0 offsets though. The way he's doing it now would allow for this without branching. Though he would need to use different temporary filenames like "oldmset.app" and "oldcode.bin" to apply the right offset. Though I guess it's not hard finding a game (or ROM with me owning a Sky+) to update to that range with. Not that I have a use for this. I've decided against removing files from my new AIO to release it here anyway. It defeats the point of making an AIO if it's not one anymore. Now, standalone script runners, OTOH, well, two words -- CBM9 menu.

 

[OrGoN3]

What o.O whyd you quote me i
All i did was link the guide.

Kitty is proving it's safe to link to Plailect's guide.

 

[Deleted User]

The fact that this page is linked regularly in this forum and on the 3DS assistance discord (which is less tolerant of piracy-related discussion and links to copyright material) would suggest otherwise. Get your facts straight next time.





View attachment 98128

wtf did you quote me for???

 

[Quantumcat]

wtf did you quote me for???

To show whatsisname (ignored now, long overdue) that there is no issue linking https://3ds.guide/ntrboot

 

[Deleted User]

To show whatsisname (ignored now, long overdue) that there is no issue linking https://3ds.guide/ntrboot

hmm ok...

 

[MrMcTiller]

Public beta currently available for next update, see bottom of post for details
Welcome to NTRPack, the drag-and-drop method of setting up ntrboot for PC-less b9s installation!
Or I guess more accurately, PC-less AFTER an initial setup on PC

Updates:
1.2:
-Simplified process by moving actions around and combining scripts. Now only requires booting ntrboot once
-Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience

I designed this pack in order to easily carry only a few things and still be ready to exploit any console as quickly as possible
This pack includes everything you need to get someone started with CFW and homebrew, all within 30mb, meaning it should easily fit on any modern SD card.

To get started, you'll need to use the version of boot9strap_ntr that loads ntrboot.firm instead of the standard boot.firm. This version is included in the pack as well within the ntrboot folder.
Tools:
If you keep these four items on you, you will be able to hack any 3ds without using a PC:
1. Flashcard with microSD:
You'll obviously need a compatible flashcard in order to use ntrboot. The microSD within the flashcard will act as the source SD
2. Magnet:
Self explanatory. The magnet you will use to activate ntrboot.
3. microSD to SD adapter:
Allows you to use your flashcard microSD in systems that require a standard SD
4. Screwdriver bit:
A small screwdriver bit used to unscrew systems that have the SD covered by the back plate

Setup:
If you don't already have the specialty version of boot9strap_ntr (within the ntrboot folder) flashed to your flashcard, use the provided boot9strap_ntr.firm with ntrboot_flasher
Copy the contents within the SD folder to the root of your flashcard microSD. Remember, the CONTENTS of the SD folder, not the folder itself.

Usage:
1. Turn off the target systems
2. Remove the target system's SD card and replace with source SD (the SD card from your flashcard)
3. Insert flashcard into target system, place the magnet and boot ntrboot (X+Start+Select+Power). The target system should boot into safeb9sinstaller
4. follow any prompts to complete the install process (should take less than a minute)
5. Once the SigHaxed FIRM installs, press A to continue. The console should reboot into godmode9
7. Once godmode9 boots, press home, go to "More...", then "Scripts...". Select copy_ntrboot, and accept any prompts that pop up.
7. Once the script completes, press R+B, then remove the source SD and replace with target SD
8. Select "[9:] RAMDRIVE" to open it.
9. Scroll to "paste_ntrboot.gm9", select it, then select "Execute GM9 script". Accept any prompts the show up
10. Once the script completes, press the start to reboot the system.
11. The console should boot into Luma3DS configuation. Check these options then press start:
-"Show NAND or user string in System Settings"
-"Patch ARM9 access" - required for 3dsx versions of homebrew like FBI
12. Once you system boots to home menu, open download play.
13. Push L+Down+Select to open Rosalina. Go to "Miscellaneous options...", then select "Switch the hb. title to current app."
14. Once that completes, push b and select "Save settings", then press b twice to exit rosalina menu.
15. Press home, close download play, then re-open it.
16. You should now be met with a blue screen with "DSP1 - zoogie" at the time. Let it run until it completes. Instead of pushing Start or B when prompted, press home, close the app then power off the 3ds.
17. Hold start and power on the 3ds to boot into godmode9
18. Once godmode9 boots, press home, select "More...", then select "Scripts..."
19. Select finalize and follow any prompts or instructions it gives, accepting them all
20. When asked to relock, accept
21. If you wish to make a nand backup (some users may not have enough space to do so), go back to the "Scripts..." once more and run "Backup SysNAND"
22. Press start to reboot the 3ds.

The process can very easliy be memorized and completed in under 5 minutes.
All homebrew will run as a 3dsx from HBL (which is set to download play). No CIA installations to worry about! Future CIA installs still possible with FBI.3dsx

Included homebrew:
freeShop
BootNTRSelector
FBI
JKSM
Luma Updater
FTPD
Themely

I also decided to remove a lot of the homebrew from the homebrew starter kit as most of it is pretty much deprecated and are replaced by luma functionality.
Also includes a few custom themes by default

Credits:
@Ryccardo for the version of boot9strap_ntr that loads ntrboot.firm instead of boot.firm
@squall14716 for giving me the original idea
Creators of all homebrew used. They've made some seriously great stuff!
And of course anyone that helped bring us ntrboot. Without that this would not even be possible!

In the future I'm hoping to replace the NTRPack.zip with a python script that will automatically download the latest versions of homebrew used. But for now it is a pack.

Demonstration video will be posted as well in the future!

Download:
https://mega.nz/#!AJM0WA4Q!t8exGf0olBk1kwiUQc6sQM3hPjC7JePadrPheSPrSXc
2.0 Public Beta
I believe update 2.0 is pretty much ready for release, but I would like to verify it doesn't have bugs. Anyone willing to uninstall their b9s and cfw to test this and give feedback are welcome. So far USA consoles are already well tested, I'm more looking for EUR and JPN region system, though all are welcome. All info needed will be in the spoiler below.

Spoiler: 2.0 Beta Details

https://drive.google.com/open?id=0B2Yhg2D4TmuLS1dEN0RKcFJYNW8
Additions/Changes:
New process does entire install process from gm9. Special build of gm9 used that automatically starts the install script
dspfirm dumping from MSET for EUR/JPN/USA
Went from 3 scripts down to only one


Delete /3ds/dspfirm.cdc, and use one of the cfw uninstall scripts from https://3ds.guide/uninstall-cfw to ensure a clean test (may not be necessary for all testers).
The ntrboot file is now boot.firm instead of the previous ntrboot.firm, so if you are using the old version that boots ntrboot.firm you can simply rename SD/boot.firm to ntrboot.firm

Usage:
Use ntrboot using the magnet. It should launch gm9 and start running the install script
Once luma configuration appears, select "Show nand in system settings" and "Patch ARM9 access", press start
Open download play and set it to be .hb, then save.

I am confused on how to Flash boot9strap_ntr to my flashcard

 

[sweatbox]

Tested the beta of Version 2 on my o3ds 11.4.0E. It Was on a9lh that I removed in first place.

Ntr boot worked with the acekard 2i very well and the Script installed B9S, Luma and so on very well. Minus the last Part of dumping the dsp. That had missed the sha value.

 

[Khim09]

Hello, I just visit here again to see what's new and I see version 2.0 beta, hurray.

I am used to 1.2 now, but reading 2.0, I've learned that it is much easier than 1.2. Now I'm confused which version to use as I can do steps on version 1.2 blindfolded plus without any problems occurring after installation US/JP/EU. Please help.