Ah, I didn't even know this thing was needed for/worked on .cias. Although apparently my exheader was also decrypted wrong somehow, so that probably played a role somewhere. Either way, I compiled a version of Smash without the romFS just as a quick test to see if it even gets past the pulsing loading screen, actually worked. And it showed signs of the code working as well, like the system rebooting and the 3D turning off by itself. I'll go ahead and try it with the romFS now to see how that goes.

EDIT: Nope, seems the romFS build also failed, even with injection. Used this to build:

Code:

makerom -f cxi -target t -desc ecapp:5 -rsf RSF-CIA.rsf -o smash.cxi -exheader exheader.bin -code exefs/code-decmp.bin -romfs romfs.bin -icon exefs/icon.icn -banner exefs/banner.bnr
wine Exinjector.exe -rom smash.cxi -exheader exheader.bin -sd
makerom -f cia -target t -content smash.cxi:0:0 -o smash.cia

I think I'll keep trying to get the non-romFS version not crashing and telling me to turn off my 3DS. Not sure what it could be at this point though...

EDIT: Tried it without exinjector (but with a valid exheader this time), just crashes before the reboot. So looks like that did something.

EDIT: OK, I did a test and loaded up a code.bin which just did an infinite loop, doesn't crash now. Let me just do a reverse test to see if the RSF changes I did were the real culprits in the first place