[Release] ARM9 Kernel homebrew on < 9.2

Discussion in '3DS - Homebrew Development and Emulators' started by Roxas75, Jan 22, 2015.

  1. Roxas75
    OP

    Roxas75 GBAtemp Advanced Fan

    Member
    518
    1,381
    Oct 9, 2010
    Italy
    Hi guys!
    Introduction:
    Like many other people, I started my research on the last Gateway Ultra release, for my own curiosity on how the exploit works itself and to take a look at their code.
    It was not actually difficult to go a bit deep, and also thanks to yfan_lu for his great explanation.
    So i've seen he actually posted his method to run arm11 code, and I thought on this solution to make arm9 code execution possible.
    I thought that using some of the GW payloads and manipulate them a bit was an easy solution for that, becouse they coded their payloads to make the same code be loaded with different firmware versions, and this should not contain any illegal thing (i'm ready to remove everything if i'm wrong).

    So, what is this?
    It's a simple and basic homebrew template to compile homebrews that will run on the arm9 kernel, like the we've seen time ago, through the new Web Browser vulnerability; I look at this as an useful thing, tools like the Multi-Decryptor can be potentially ported.
    The code will run at 0x08000000, and it can load payloads up to 600kb, so the old 22kb size is not a problem anymore.
    The main difference is that this runs on the kernel, not on Process9, so actually all the FS functions should be broken at this rate, someone should write a good library to interact with the SD.
    I could test this only on a 4.X system, so i put it here to let you guys test then give me feedback on other firmware versions, then i'll update it and put the new download in the OP. :)
    And the same is for the framebuffers location, it's possible that they change too in different firmwares.

    Since Gateway probably added checks on the Launcher.dat, i suggest to use other methods to run the web exploit, i like this solution that's offered by an user here on GBAtemp :
    http://dukesrg.no-ip.org/3ds/go

    Download
    Here is the download, looking for grat works: Download Here!

    Enjoy!
     
    marc00077, Margen67, Kakkoii and 20 others like this.
  2. Slushie3DS

    Slushie3DS Cold Beverage Lover

    Member
    707
    294
    Jan 9, 2015
    United States
    Well done! I'm sure people will put this to good use!
     
    Margen67 likes this.
  3. minipablo

    minipablo Member

    Newcomer
    41
    15
    Aug 3, 2014
    Another step towards a stable cfw. Yay!
     
    Margen67 likes this.
  4. Apache Thunder

    Apache Thunder I have cameras in your head!

    Member
    4,110
    4,063
    Oct 7, 2007
    United States
    Levelland, Texas
    Things sure are starting to snowball now. Can't wait to see that multitool decryptor ported over. Will have no reason to use 4.5 by that point.

    Oh and CFW would be great I suppose. :P
     
    Margen67, lampdemon and SLiV3R like this.
  5. Sizednochi

    Sizednochi GBAtemp Advanced Fan

    Member
    651
    406
    Dec 16, 2012
    Brazil
    HERE LIES GATEWAY
     
    Margen67 likes this.
  6. Roxas75
    OP

    Roxas75 GBAtemp Advanced Fan

    Member
    518
    1,381
    Oct 9, 2010
    Italy
    Don't expect any cfw any soon, this is just to make some kind of tools runnable on newer firmwares. It's much different. :)
     
  7. minipablo

    minipablo Member

    Newcomer
    41
    15
    Aug 3, 2014
    But plz they deserve it 60€ for a freaking flashcard
     
    Margen67 likes this.
  8. Roxas75
    OP

    Roxas75 GBAtemp Advanced Fan

    Member
    518
    1,381
    Oct 9, 2010
    Italy
    They actually are the ones who made all of this possible. I think 60€ is the right price for this.
     
    piratesephiroth and MaNiAlJoWo like this.
  9. naxil

    naxil GBAtemp Advanced Fan

    Member
    740
    96
    Oct 26, 2011
    Italy
    Roxas75 this can be used for launch any launcher.dat?
     
  10. minipablo

    minipablo Member

    Newcomer
    41
    15
    Aug 3, 2014
    But i mean in the good old nds times you bought a 15€ flashcard and you had ∞ games and 0 problems
     
    TUWieZ likes this.
  11. krisztian1997

    krisztian1997 GBAtemp Fan

    Member
    369
    146
    Dec 14, 2013
    Romania
    I would never buy their product after what they did some time ago with the brick code, I can't trust someone who wants to kill my console just because they think that its ok.
     
  12. minipablo

    minipablo Member

    Newcomer
    41
    15
    Aug 3, 2014
    I really miss games like mario y Luigi viaje al centro de bowser among others...
    Now back on topic:
     
  13. Sizednochi

    Sizednochi GBAtemp Advanced Fan

    Member
    651
    406
    Dec 16, 2012
    Brazil
    It would be nice to launch MT-Card's launcher.dat on 9.2 just for emuNAND
     
    Margen67 and Dartz150 like this.
  14. Apache Thunder

    Apache Thunder I have cameras in your head!

    Member
    4,110
    4,063
    Oct 7, 2007
    United States
    Levelland, Texas
    The closest you'll get to that in this day and age is the Sky3DS/QQ3DS (they are both identical hardware wise) will be the closest you can get. They can't run custom homebrew like Gateway, but can boot most games you throw at it. But those carts days are numbers. The current iterations of them aren't updatable so when Nintendo blocks them in a firmware update, you have to buy a whole new card once/if one becomes available.

    I'd highly advise you not buy a sky3DS or any card that operates like one until one comes out that has update-able firmware. Gateway's red card has a flashable FPGA chip and despite that, it's still cheaper then Sky3DS. Unlike gateway though, they'd need an extra USB device that connects to the PC to "flash" it to a new firmware as you can't do that on the 3DS. (would require custom homebrew code execution)

    I'm sure it would be super easy to make one with a flash-able chip that works like the current Sky3DS. Then with a linker device via USB, it can be flashed to work again on future fw updates. That would be the "proper" competitor to Gateway.

    Maybe like the DSTWO, the card can simply be flashed to new firmware via a specific file placed on the microSD card, so wouldn't need a external device. Just plug it into the 3DS for a specific amount of time and there you go. Even if the 3DS refuses to recognize a card, it would still provide power to it if it's in the slot.

    Sky3DS has shown no indication of having this feature though. Since once the red button "workaround" came out, they had to release a whole new card to remove the arbitrary 10 game limit they imposed.

    But until a clone that has this feature comes along, I believe they are a bad investment as they are not future proof at all. Especially at the crazy high prices they are currently selling at.
     
  15. Xenon Hacks

    Xenon Hacks GBAtemp Guru

    Member
    7,111
    3,410
    Nov 13, 2014
    United States
    Forgive my ignorance but what can this allow homebrew devs to do that they cant already?
     
    Margen67 likes this.
  16. Apache Thunder

    Apache Thunder I have cameras in your head!

    Member
    4,110
    4,063
    Oct 7, 2007
    United States
    Levelland, Texas
    Arm9 gives you full control over the console including the ability to cancel out encryption checks and to generate xorpads to decrypt existing content. Arm9 control is required for anyone ambitious enough to attempt a CFW. ;)

    Tools like the VOiD Mulitool used to decrypt SD/Rom content requires Arm9 control as that chip handles the cryptography of the console. Arm9 is pretty much the head hancho, the boss so to speak. All other components of the 3DS must listen to what Arm9 tells it to do. Take control of it, and you take control of the whole system. ;)
     
    Margen67, zfreeman and Slushie3DS like this.
  17. Xenon Hacks

    Xenon Hacks GBAtemp Guru

    Member
    7,111
    3,410
    Nov 13, 2014
    United States
    That means someone can make a homebrew app that rips decrypted saves from card2 games and stores them on the sd like read/write?
     
    Margen67 likes this.
  18. Apache Thunder

    Apache Thunder I have cameras in your head!

    Member
    4,110
    4,063
    Oct 7, 2007
    United States
    Levelland, Texas
    Pretty much. Although SaveDataFiler already does that and that only needed Arm11 control/Userland. Not sure how that program works. Save encryption is is most likely userland as the game itself needs to be able to decrypt/encrypt it's own save files.
     
    Margen67 likes this.
  19. Arras

    Arras GBAtemp Guru

    Member
    5,876
    2,709
    Sep 14, 2010
    Netherlands
    And on basically every single console before that, you paid a ton and it was far from easy. The DS was the exception, not the rule, simply because it was so incredibly popular and flashcards were so easy to make eventually.
     
    zhdarkstar likes this.
  20. Xenon Hacks

    Xenon Hacks GBAtemp Guru

    Member
    7,111
    3,410
    Nov 13, 2014
    United States
    So can an app made for ninjhax or an app that runs through the browser exploit do this?
     
    Margen67 likes this.