Homebrew OoT3DHax PowerSave Edition

[LordIgnis]

This Post is to help those people who like me (until recently) had no easily accessible way to load the Homebrew Launcher without either buying online a copy of CubicNinja or Sky3DS(to use a ROM of CubicNinja) or finding some annoyingly complex way to run linux off a partition of your computers hard-drive just to have access to making a working Smashhax Beacon on a 3DS running 10.x Firmware (Also didn't have a backup plan for another hax* such as Themehax before updating their console)

After searching online for days trying to find some way around this lack of exploitation for the newest 3DS firmware I came to the Conclusion that the only way to regain access to the Homebrew Launcher was through OoTHax. Unfortunately its a Secondary exploit after using something like NinjaHax to get the initial load of the homebrew running to access the installer. Remembering that Gateway itself had a tutorial somewhere on how to use a hacked Save file exploit on OoT to launch the gateway Firmware that could be injected to the cartridge version of the game via Datel's 3DS Powersave Device. This sparked the idea to do the same thing with the OoTHax. My only problem was getting that Save File that was prepatched with the OoTHax data. Thankfully in another thread I got a reply from the User: zoogie, with a link to exactly what I needed to solve my problem. a US version of the OoTHax Save File.

Now I cannot confirm this will work for all 3DS users, as I only have the Payloaded save files for (U) OoT games withing the 9.9-10.3 Firmware Range. but ALL the steps for installing OoT3DHax, up until actually installing the hack via Homebrew are the same
- Download the installer from the github https://github.com/meladroit/oot3dhax_installer
- Put the Installer files on your SD/MicroSD in the /3ds folder
- (the 2.5hax version of OoTHax on the github apparently doesn't need the payload.bin on the root of your SD but I had it there just incase)
Then from there is where I took the save file from @zoogie and placed it in my Powersaves Local Save folder
C:\Users\NAMEHERE\Powersaves3DS
I made a quick backup of my LoZ OoT game and basically just renamed the Hax*Save file to the same as my backup aside from the (N3DS_x.xU_hax25) at the end (because that is the name of the backup that the powersave application reads) then proceeded to restore the hax backup to my Game Card and from there just ran the exploit like you would after installing it directly from the installer
-Open the Game
-Load the First Save file named Idleway(whatever the hell the rest of the name says)
-After the file loaded, Press A and let the exploit do its thing

Now I noticed it takes significantly more time loading the Homebrew Launcher through this method than it did before when I used to run it through TubeHax but realistically, who gives a damn about the loading speed of the launcher when you actually have access to it in the first place from now on.

I realize this is quite the alot to read through, but for some people it is exactly what they need and I appreciate those who took the time to read through this, and I hope it helped you as much as it helped me

Thanks again to @zoogie for uploading the save file for me to use for this to be possible

*Note: The files Below are ALL the save files for Only Old and New 3DS's from Firmwares 9.9-10.3(U) Running Hax2.5...... If you need a (U) save file that isn't for a version I've already uploaded, Msg me and I will add the save to the appropriate file*
- Any other region files should be able to be found on @Filo97 's post here: https://gbatemp.net/threads/oothax-powersaves-file.402554/

*EDIT* After some Testing I have found that the 10.7 Haxx Payload allows homebrew access on 11.0 firmware https://www.dropbox.com/s/lahaxklyfwwvc4d/10.7-11.0 Old&New3DS OoTHax.zip?dl=1
This is the Download link to the files for the US version of OoT

 

[dj-tiny]

Does anyone have a Eur save?

 

[Blancfire]

Is it possible to ask for someone for a hacked save for O3DS 10.1.0-27U? Browserhax is dead for me at this point and I just really want an alternate entry point so I can install Yellows8's MenuHax... This is the only other option I have available since Cubic Ninja's impossible to find here.

 

[Matthew Doyle]

Is it possible to ask for someone for a hacked save for O3DS 10.1.0-27U? Browserhax is dead for me at this point and I just really want an alternate entry point so I can install Yellows8's MenuHax... This is the only other option I have available since Cubic Ninja's impossible to find here.

I am also on 10.1.0-27U on a 2ds, I hope that means it may work for us

 

[OMGitsBlank]

Omg I've been racking my brain all weekend with this XD.


I now know how to decrypt/encrypt the save, can replace the files (with some limitations same size), and resign the save to be used with powersave dongle. Even though I can do all of that I still can't get past the various checksums the save file itself has and upon launching OoT it just formats the save.


Can I please get a oothax 2.1 USA powersave dump(or any save dongle r4i/NDS adapter/etc) for an old 9.9.0-26u that way I can research further into an all in one solution. In the meantime I'll try to work with op's save dump .


Here's the files needed to create the save

• https://gbatemp.net/attachments/oot3dhax_installer_offline-zip.28171/
• http://www.mediafire.com/download/nmz771n1gb97ak7/Themehax_Installer_offline_v1.2.zip

Use the otherapp payload from themeHax installer POST5_U_20480_usa_9221.bin


And the USA save


Thanks


Edit-
I modded op's save file and no luck in changing it's payload the in game checksums still think it's corrupt. I just need more data -_-

 

[CrazyDude10119]

I did everything thing in the instructions and when I press A it does its thing but then stops at a red lower screen and a black top screen. Can anybody help my fix this. Btw I'm on version 10.2.0-28u and I didn't quite understand the part about where exactly to drag the installer so I put it with the rest of the normal items on the micro as card so yeah

 

[phase]

The installer has officially moved to https://github.com/phase/oot3dhax_installer, which includes the new payloads and supports the newer versions.

 

[Lucky Dearly]

Is it possible to ask for someone for a hacked save for O3DS 10.1.0-27U? Browserhax is dead for me at this point and I just really want an alternate entry point so I can install Yellows8's MenuHax... This is the only other option I have available since Cubic Ninja's impossible to find here.

I'd like that too myself

 

[CrazyDude10119]

The installer has officially moved to https://github.com/phase/oot3dhax_installer, which includes the new payloads and supports the newer versions.

Which files exactly do I put on my
3ds sd card? I just put in the whole 3ds/oot3dhax_installer folder in the sd card and when I run the program on my 3ds, it's does its thing and then just stops on a red bottom screen and a black top screen. I'm on version 10.2.0-28u. If anyone can tell me if I'm doing something wrong that would be greatly appreciated, thank you

 

[Blancfire]

This might sound a bit farfetched but would it be possible for someone who can run the exploit into HBL to essentially use Powersaves to restore a cart to a clean state (backing up after doing the save wipe) then proceed to use the installer to apply the hax for specific models/firmware and create backups with the hax applied?

I'm thinking this could work out unless OoT3DHax absolutely requires the cart to be in the 3DS still even after getting into HBL.

 

[Swinky]

I am going to experiment with this later.

I have a O3DS on 9.5.0-22, so I can use the browser exploit to install OoT3DHax.

I also have a Powersaves dongle. They use to be easy to get at Gamestop or Target. I got mine when it first hit the stores.

Anyways, I will be backing up my O3DS 10.1.0-27 OoT3DHax save and seeing if this method indeed does work when restoring a OoT3DHax save.

If so, I will share it with y'all who have Powersaves.

 

[OMGitsBlank]

This might sound a bit farfetched but would it be possible for someone who can run the exploit into HBL to essentially use Powersaves to restore a cart to a clean state (backing up after doing the save wipe) then proceed to use the installer to apply the hax for specific models/firmware and create backups with the hax applied?

I'm thinking this could work out unless OoT3DHax absolutely requires the cart to be in the 3DS still even after getting into HBL.

Yes after you got into hbl you don't require the Exploited cart to remain in the system.


This is the most likely solution those of us here will get we just need someone kind enough to spend the time doing it.


Furthermore if we could get any one with any save dongle (maybe even SKY3DS user) to provide the raw encrypted savefile (you can check the file by opening it in a hex editor and looking for the string value ZELDA if that pops up you have an unencrypted file and idk if it will work. I Do know how to encrypt it back so maybe it will).

I am going to experiment with this later.

I have a O3DS on 9.5.0-22, so I can use the browser exploit to install OoT3DHax.

I also have a Powersaves dongle. They use to be easy to get at Gamestop or Target. I got mine when it first hit the stores.

Anyways, I will be backing up my O3DS 10.1.0-27 OoT3DHax save and seeing if this method indeed does work when restoring a OoT3DHax save.

If so, I will share it with y'all who have Powersaves.

If you could also make one for old 9.9.0-26u you would be my hero

 

[Swinky]

Yes after you got into hbl you don't require the Exploited cart to remain in the system.


This is the most likely solution those of us here will get we just need someone kind enough to spend the time doing it.


Furthermore if we could get any one with any save dongle (maybe even SKY3DS user) to provide the raw encrypted savefile (you can check the file by opening it in a hex editor and looking for the string value ZELDA if that pops up you have an unencrypted file and idk if it will work. I Do know how to encrypt it back so maybe it will).




If you could also make one for old 9.9.0-26u you would be my hero

I don't a 3DS running that firmware, but I can indeed make a save for it. Guess you'll be a tester, haha.

I'm going to do some work for my class then come back in a few and mess around with this.

 

[OMGitsBlank]

I don't a 3DS running that firmware, but I can indeed make a save for it. Guess you'll be a tester, haha.

I'm going to do some work for my class then come back in a few and mess around with this.

I have no problems being a tester thanks for doing this.

 

[Swinky]

I have no problems being a tester thanks for doing this.

Here it is. Put the save in the directory C:\Users\(username)\Powersaves3DS

First, back up your save if you want to.
Then, delete all save data on OoT (Boot up OoT3D while holding A,B,X,Y at the same time until dialog pops up)


Finally, use Powersaves to restore the save I've provided you.

Load up the save (it should be under Slot 3), and interact with the game in anyway (open the items menu. I personally have had 100% success booting up the exploit doing that).

Please note that OoT3DHax does not work with Hax 2.5. I recommend installing menuhax with the new menuhax manager 2.0. It downloads the 2.5 payload straight from Smea's github.io.


Download: https://www.mediafire.com/?3onn2t334dn6t6t


If this works, I will make other saves for others

Edit: Make sure you have boot.3dsx and the 3ds directory on the root of your sd card. (download these from here: https://smealum.github.io/ninjhax2/starter.zip)

 

[OMGitsBlank]

Here it is. Put the save in the directory C:\Users\(username)\Powersaves3DS

First, back up your save if you want to.
Then, delete all save data on OoT (Boot up OoT3D while holding A,B,X,Y at the same time until dialog pops up)


Finally, use Powersaves to restore the save I've provided you.

Load up the save (it should be under Slot 3), and interact with the game in anyway (open the items menu. I personally have had 100% success booting up the exploit doing that).

Please note that OoT3DHax does not work with Hax 2.5. I recommend installing menuhax with the new menuhax manager 2.0. It downloads the 2.5 payload straight from Smea's github.io.


Download: https://www.mediafire.com/?3onn2t334dn6t6t


If this works, I will make other saves for others

Edit: Make sure you have boot.3dsx and the 3ds directory on the root of your sd card. (download these from here: https://smealum.github.io/ninjhax2/starter.zip)

Hmm this is a little odd so I restored your save unmodified and my game says it's corrupted and formats itself.


So I took apart the save and it has a different encryption key from both mine and the one posted by the OP.


Anyway so I went ahead and rencrypted with my key and the file grew by 0x9c bytes thus powersave won't restore it (for good reason). So I probably messed up my process I'll try again in a bit (have stuff to do in town) .


Can I ask you if you were using a USA cart? Other than that I don't have a clue why your encryption key is different from mine or OP's



Thanks for trying I'll update you in a bit I have to do stuff around town

 

[Swinky]

Hmm this is a little odd so I restored your save unmodified and my game says it's corrupted and formats itself.


So I took apart the save and it has a different encryption key from both mine and the one posted by the OP.


Anyway so I went ahead and rencrypted with my key and the file grew by 0x9c bytes thus powersave won't restore it (for good reason). So I probably messed up my process I'll try again in a bit (have stuff to do in town) .


Can I ask you if you were using a USA cart? Other than that I don't have a clue why your encryption key is different from mine or OP's



Thanks for trying I'll update you in a bit I have to do stuff around town

Yeah. I used a US cart.

That's weird as hell.

I'll look into it a bit more.

I got this cart when OoT first came out. I don't know if there were different cart versions in the future or not.

 

[Critichart]

Can somebody confirm is this works? looks like i found a gold mine in this p?ost thank you but yeah, i guess this is the only method i have since i can't acccess to the launcher.

Also i wanted to ask, wich file did you download? the one from the link avove or this "Second-degree Hax installer for 3DS"? thanks again i guess i'll try this method! i'm 9.9-26u do you think it'll work?

EDIT-

Well nvm is it necessary to have that Powersave thing? ugh looks like i'll never gonna use homebrew again ;____;

 

[Lucky Dearly]

yeah or Cyber Egg if you have a Japanese 3DS

 

[OMGitsBlank]

Yeah. I used a US cart.

That's weird as hell.

I'll look into it a bit more.

I got this cart when OoT first came out. I don't know if there were different cart versions in the future or not.

Sorry I took so long to get back with the results.


Yeah so I re-did the process and checked the file and still no-go. I did learn changing the encryption key breaks some(all???) checksum in place ;___;.


Did you test making one for your O3DS 10.1.0-27?


@phase

Have you used 3dsfuse before? If so do you know if it can write/modify complete save files(entire images) correctly(checksums mostly)? Also is it a windows program or a 3ds app?

Can somebody confirm is this works? looks like i found a gold mine in this p?ost thank you but yeah, i guess this is the only method i have since i can't acccess to the launcher.

Also i wanted to ask, wich file did you download? the one from the link avove or this "Second-degree Hax installer for 3DS"? thanks again i guess i'll try this method! i'm 9.9-26u do you think it'll work?

EDIT-

Well nvm is it necessary to have that Powersave thing? ugh looks like i'll never gonna use homebrew again ;____;

I Can't confirm anything due to not being able to restore but I can confirm that op's save encryption is the same as mine and that should allow it to work on my cart if it had the right payload for my system.


You do need to have a save dongle to restore these saves, but you don't necessarily need to have powersave.


So to remove the wrapper powersave adds to the save file for use with other save dongles is this (assuming they don't add thier own wrapper/checksums etc)

* I WILL NOT TAKE ANY RESPONSABILTY FOR YOUR ACTIONS BEYOND THIS POINT IF YOU FOLLOW THESE ACTIONS DO AT YOUR OWN RISK. REMEMBER BY DOING ANYTHING NOT INTENDED FOR YOUR SAVE DONGLE SUCH AS MODIFYING A SAVE OR CORRUPTING ONE CAN BRICK YOUR CART YOU HAVE BEEN WARNED.


1. Get a hex editor (I use HxD)
2. Open a powersave save in hex editor
3. go to edit menu and click 'select block'
4. Click the length radio button and enter 9c(hex) or 156(dec)
5. Click okay
6. Press delete on your keyboard
7. Save file with new name to indicate the changes (like 'wrapperRemoved' or 'justSaveFile' etc)
8. Make sure the file length in hex editor has exactly 0x20000 (hex bytes) any more or less and you messed up. REDO THE PROCESS FROM THE BEGINNING OR RISK BRICKING YOUR CART.
9. Restore your new save with a non-powersave dongle (like r4i save dongle or NDS adapter plus etc...)
10. Test

You can also check the save file (encryption key, specific files, and etc) using 3DSExplorer (rencrypting or changing the encryption needs a different program)


@Ignisflame


Can you help me out by making a 2.1 OoTHax for 9.9.0-26u because we have the same encryption key on our OoT cart?





Edit--

yeah or Cyber Egg if you have a Japanese 3DS

There are alot more save dongles than that like r4i save dongle, NDS adapter plus, etc. Even a SKY3ds(granted it saves just like a real cartridge and gets encrypted idk if it does tho) could use these files.