Hacking [Release] 3DSafe: In-NAND PIN lock for 3DS

[mashers]

Yeah, that is how Aurora's fork handhelds both screeninit and no-screeninit.

Ok, thanks. I'll look into it

 

[mashers]

Yeah, that is how Aurora's fork handhelds both screeninit and no-screeninit.

Ok, I've had a look at Aurora's fork and there's a problem. Her fork works with bootctr9 because the A9LH payload itself doesn't need screen init. It doesn't display anything, so doesn't care whether screen init happens or not. 3DSafe, however, needs screen init. I can't just not init the screen to get bootctr9 to work.

I'll have to either look into optionally de-initing the screen before booting the payload, or forking bootctr9 to make screen init optional.

 

[MadMageKefka]

Ok, I've had a look at Aurora's fork and there's a problem. Her fork works with bootctr9 because the A9LH payload itself doesn't need screen init. It doesn't display anything, so doesn't care whether screen init happens or not. 3DSafe, however, needs screen init. I can't just not init the screen to get bootctr9 to work.

I think the former would be a good idea, personally. I, for example, use BootAnim9 which does not have built in screen init (unless it got added and I am unaware). Letting people choose would be best I think.

 

[mashers]

I think the former would be a good idea, personally. I, for example, use BootAnim9 which does not have built in screen init (unless it got added and I am unaware). Letting people choose would be best I think.

I agree. I'll look into de-initing the screen before anything else as that would allow it to work with any payload regardless of whether or not it inits the screen. I don't know if it's possible to do it, however,

 

[mashers]

@Billy Acuña
Ok, I've got it so it turns the backlight off but I haven't yet figured out how to fully de-init the screen itself. I can't get bootctr9 to work - I just get an error saying "Error found in config file". Would you mind testing with the attached payload?

• Copy the payloads from the archive attached to THIS POST to /a9lh on your SD card
• Rename your arm9loaderhax.bin (the one which runs bootctr9) to arm9loaderhax_noscreeninit.bin
• Boot 3DSafe and enter your PIN
• Press X to boot SafeA9LHInstaller
• Press SELECT to install this test version

Then power off and try again. It should turn off the backlight before booting the payload at arm9loaderhax_noscreeninit.bin. It works for me in that I no longer see the Luma splash screen, but I can't test with bootctr9 due to the above error. If you can let me know if that works then I'd really appreciate it!

ALL - please note that this is not an official release. It's a test version. Please don't install it yet.

Thanks!

 

[mashers]

Ok, hold up. I've just got bootctr9 working and it seems to work fine even with the official 0.5 release of 3DSafe. I set it up to boot Luma from /luma.bin as the default. After I enter my PIN and press START to boot the payload, I see the bootctr9 loading page with the ascii graphics, then after a delay I see the Luma splash screen and it boots to the home menu. Is that not what's happening for you @Billy Acuña?

 

[capito27]

btw, mashers, if someone for some reason forgets their pin and loses their otp dump, a hardmod is enough to recover.

 

[gamesquest1]

btw, mashers, if someone for some reason forgets their pin and loses their otp dump, a hardmod is enough to recover.

if they have a nand backup from before they installed this then sure

 

[capito27]

if they have a nand backup from before they installed this then sure

nope, no need of a backup, because stage2 of the current a9lh implementation is always in plaintext, so they could totally overwrite it.

 

[gamesquest1]

nope, no need of a backup, because stage2 of the current a9lh implementation is always in plaintext, so they could totally overwrite it.

shhhhh some thief is totally going to be made up you told them that XD....thats it @mashers put a random seed in there and force people to compile their own build

but yeah i guess needing a hardmod would eliminate most would be thieves ability to bypass the lock

 

[capito27]

shhhhh some thief is totally going to be made up you told them that XD....thats it @mashers put a random seed in there and force people to compile their own build

how would that be of any use ? keep in mind that the payload is in clear text, it can be generated differently for everyone, that wouldn't change the fact that it's cleartext ^^'

tbh, this is more useful for legit cases of lost pin + otp.bin.

 

[mashers]

btw, mashers, if someone for some reason forgets their pin and loses their otp dump, a hardmod is enough to recover...

...no need of a backup, because stage2 of the current a9lh implementation is always in plaintext, so they could totally overwrite it.

Interesting. I didn't know that. So you could literally hard mod, dump the NAND, hex edit in a new stage2 payload, rewrite the NAND and boot? If that's possible then I think we're dealing with a more determined thief than average

 

[gamesquest1]

how would that be of any use ? keep in mind that the payload is in clear text, it can be generated differently

yeah I realized what you meant after writing that post hence the edit, but yeah probs good as a last chance recovery method

 

[capito27]

Interesting. I didn't know that. So you could literally hard mod, dump the NAND, hex edit in a new stage2 payload, rewrite the NAND and boot? If that's possible then I think we're dealing with a more determined thief than average

well, you don't even need to dump nand, an hex editor can open the disk and directly write to nand at the right offset, takes about 30 seconds to load the drive, go the the right offset, copy a new payload, overwrite the current one and saving

--------------------- MERGED ---------------------------

Interesting. I didn't know that. So you could literally hard mod, dump the NAND, hex edit in a new stage2 payload, rewrite the NAND and boot? If that's possible then I think we're dealing with a more determined thief than average

or simply someone who lost their pin + otp.bin and doesn't want to own a 200 bucks paper weight

 

[mashers]

yeah I realized what you meant after writing that post hence the edit, but yeah probs good as a last chance recovery method

well, you don't even need to dump nand, an hex editor can open the disk and directly write to nand at the right offset, takes about 30 seconds to load the drive, go the the right offset, copy a new payload, overwrite the current one and saving

I didn't think of doing it directly to the disk. Ok, well I'm not going to document it as a recovery method. The idea is that this is as bulletproof as possible. I suppose the user could cover all of the hardmod solder points in superglue so it can't be hardmodded...

or simply someone who lost their pin + otp.bin and doesn't want to own a 200 bucks paper weight

Yes, well I'll bear it in mind if I get tagged in a post / PMed with a message saying "I FORGOT MY PIN AND LOST MY OTP NOW MASHERS OWES ME A NEW 3DS"

 

[capito27]

I suppose the user could cover all of the hardmod solder points in superglue so it can't be hardmodded...

ever heard of solvants ? http://www.supergluecorp.com/?q=removingsuperglue.html

 

[mashers]

ever heard of solvants ? http://www.supergluecorp.com/?q=removingsuperglue.html

Wouldn't that damage the PCB as well?

 

[capito27]

Wouldn't that damage the PCB as well?

if you don't drop the whole bottle but use a cotton bud to apply it carefully, it wouldn't

 

[noctis90210]

@mashers what version of safea9lh should we use, the old one or the v2?

 

[capito27]

@mashers what version of safea9lh should we use, the old one or the v2?

the V2