Full Guide Release!

https://plailect.github.io/OTP/

All regions now supported!

If you appreciate this guide and the work I put into maintaining it, I accept donations through both Bitcoin and PayPal.

If you felt like the guide helped you out then I'd really appreciate it! If I get enough I may buy a 2DS for testing hardware stuff so I don't break another N3DS.

If the guide didn't help you out then I'm really sorry about that

 

[daxtsu]

This is too mainstream now.

It's the destiny of the 3DS scene. Nothing wrong with that.

 

[Mrrraou]

It's the destiny of the 3DS scene. Nothing wrong with that.

However, dumping bootrom is not :^)

 

[daxtsu]

However, dumping bootrom is not :^)

Not yet anyway. What advantages would we have by even dumping the bootrom, aside from understanding the boot process entirely?

 

[mrmonotone]

Not yet anyway. What advantages would we have by even dumping the bootrom, aside from understanding the boot process entirely?

nothing right now unless you know what you are doing or someone releases something. i just did it for fun. the guide was great.

 

[Mrrraou]

Not yet anyway. What advantages would we have by even dumping the bootrom, aside from understanding the boot process entirely?

Getting all the keys stored in bootrom, being able to decrypt the OTP, all that stuff.
And seriously, besides chip decapping, no public exploit is known to dump it. (well, one is, but it's really hardcore and seems impossible.)

--------------------- MERGED ---------------------------

nothing right now unless you know what you are doing or someone releases something. i just did it for fun. the guide was great.

We're talking about bootrom, not OTP. It's offtopic, yeah.

 

[daxtsu]

nothing right now unless you know what you are doing or someone releases something. i just did it for fun. the guide was great.

I wasn't talking about the OTP. I know what the advantages of that are. I already benefit from it.

Getting all the keys stored in bootrom, being able to decrypt the OTP, all that stuff.
And seriously, besides chip decapping, no public exploit is known to dump it. (well, one is, but it's really hardcore and seems impossible.)

I see. Probably not quite as useful as the OTP itself though. Hopefully we'll see the bootrom get dumped anyway, just so we know every aspect of the 3DS security has been demolished, even if it has no practical end-user use.

 

[Mrrraou]

I wasn't talking about the OTP. I know what the advantages of that are. I already benefit from it.



I see. Probably not quite as useful as the OTP itself though. Hopefully we'll see the bootrom get dumped anyway, just so we know every aspect of the 3DS security has been demolished, even if it has no practical end-user use.

The OTP contains the console unique keys, so that would mean you could do all the decryption and encryption for your 3DS on your PC.

 

[daxtsu]

The OTP contains the console unique keys, so that would mean you could do all the decryption and encryption for your 3DS on your PC.

I hadn't considered that. It'd be cool to see a program like uh..what was it called..ONoeSchwarzeneger or whatever it was for the Wii, which could create a fresh NAND directly from NUS/CDN given unique keys and a settings.txt (secureinfo_A in the 3DS's case). It'd be a lot easier to unbrick consoles that had their OTPs dumped and decrypted that way.

 

[SomeGamer]

So I've got an Old and a New 3DS, both are on 9.2E, both have working CFWs but none of them has a hardmod. I have 3DS carts ranging from launch titles to recent ones, including CN and OoT. How safe it would be to get the OTP and which one should I begin with?

 

[hackotedelaplaqu]

I build arm9loaderhax with my otp.bin and launched it from hl.
Now I'm stuck at "Eploiting arm9..."
I'm affraid to reboot. Is it safe ?

 

[Naked_Snake]

im getting

"sysNAND.bin
error file is to small!
NAND Restore: failed!"

 

[mrmonotone]

So I've got an Old and a New 3DS, both are on 9.2E, both have working CFWs but none of them has a hardmod. I have 3DS carts ranging from launch titles to recent ones, including CN and OoT. How safe it would be to get the OTP and which one should I begin with?

i just did it took me awhile just follow the steps exactly. not hard.

 

[DeathChaos]

So I've got an Old and a New 3DS, both are on 9.2E, both have working CFWs but none of them has a hardmod. I have 3DS carts ranging from launch titles to recent ones, including CN and OoT. How safe it would be to get the OTP and which one should I begin with?

Not very safe,you should downgrade your emuNAND first just to ensure it is successful, then you can flash this NAND over sysNAND, but there is a chance that even after everything is successful your sysNAND might randomly brick for no real reason, it should be easy to do, but the chances of bricking are higher than say, downgrading.

 

[daxtsu]

So I've got an Old and a New 3DS, both are on 9.2E, both have working CFWs but none of them has a hardmod. I have 3DS carts ranging from launch titles to recent ones, including CN and OoT. How safe it would be to get the OTP and with which one should I begin with?

O3DS is easier to dump the OTP with (less steps), and is slightly easier to get out of 2.1 with, since you can update with a game card to 4.x to use MSET to restore your NAND backup with Decrypt9 (but you can also use the web browser in 2.1 to launch Decrypt9).

That said, it's around the same difficulty level for O3DS and N3DS, especially with the automated scripts, but just do not update the N3DS via game card. Use the spider exploit (yes, the N3DS will run Spider on 2.1) to run decrypt9 to get back to 9.x.

 

[mrmonotone]

im getting

"sysNAND.bin
error file is to small!
NAND Restore: failed!"

I am receiving that as well. Are you trying to restore sysnand after getting otp?

 

[Mrrraou]

I build arm9loaderhax with my otp.bin and launched it from hl.
Now I'm stuck at "Eploiting arm9..."
I'm affraid to reboot. Is it safe ?

It is safe to reboot.

 

[Naked_Snake]

I am receiving that as well. Are you trying to restore sysnand after getting otp?

i havnt even downgraded sysNAND yet because of this error

 

[SomeGamer]

i just did it took me awhile just follow the steps exactly. not hard.

Not very safe,you should downgrade your emuNAND first just to ensure it is successful, then you can flash this NAND over sysNAND, but there is a chance that even after everything is successful your sysNAND might randomly brick for no real reason, it should be easy to do, but the chances of bricking are higher than say, downgrading.

O3DS is easier to dump the OTP with (less steps), and is slightly easier to get out of 2.1 with, since you can update with a game card to 4.x to use MSET to restore your NAND backup with Decrypt9 (but you can also use the web browser in 2.1 to launch Decrypt9).

That said, it's around the same difficulty level for O3DS and N3DS, especially with the automated scripts, but just do not update the N3DS via game card. Use the spider exploit (yes, the N3DS will run Spider on 2.1) to run decrypt9 to get back to 9.x.

Thanks for the encouragements! Do I still need to do hex editing? And if I follow the instructions, how much is the chance of bricking?

 

[hackotedelaplaqu]

It is safe to reboot.

Thanks.
Ok this time it installed. (messages about firm and sectors=.
Now black screen. Still safe to reboot ?

 

[mrmonotone]

i havnt even downgraded sysNAND yet because of this error

strange i would try deleting the nand and copying it back over