Homebrew [RELEASE] OTPHelper - OTP dumping & downgrade helper

[d0k3]

OTPHelper is a small tool designed for helping with the downgrade and OTP dumping processing. OTPHelper won't handle the process alone (that's not even possible), but it will help to make downgrading and OTP dumping simpler, more streamlined and more safe. Use this tool in conjunction with @Plailect's guide.

Source code: https://github.com/d0k3/OTPHelper
Binaries: https://github.com/d0k3/OTPHelper/releases
Last Stable Version: https://github.com/d0k3/OTPHelper/releases/tag/v0.85


FEATURES:
OTPHelper aims to simplify these processes, as described in Plailects guide.

• Actual dumping of the OTP.bin (0x100 or 0x108, only on FW < 3.0) included for convenience. Not shown in the screenshots, this is in the ARM9.bin.
• Generate OTP0x108.bin from OTP.bin (on FW 9.0+), if you forgot getting that file the first time around.
• Unbricking the FW 2.1 EmuNAND (N3DS only). This does, in one step, what would otherwise require: two NAND XORpads, the emuNAND_bricked.bin backup on your PC, 3DSFAT16Tool, hex-editing the header of the emuNAND_bricked.bin and writing back the fixed emuNAND_bricked.bin backup via Decrypt9WIP. So, much faster.
• Includes EmuNAND/SysNAND Backup&Restore, CTRNAND Dump&Inject, FIRM Dump&Inject and Padgen features from Decrypt9WIP for convenience.
• Multiple safety clamps in place to make this as safe as possible.
• Various options to restore your SysNAND to working order in case something goes wrong.

If you're going to try this, make sure you read everything below, give us feedback, and also vote here!


WARNING:
No use in beating around the bush, stuff like this is dangerous by nature and there will never be complete safety. There are bricked consoles, and you may even encounter one if you did nothing wrong. I am not responsible for any problems caused by this and I'm still recommending a NANDmod to everyone doing the whole downgrade process. Keep in mind that this is based on bugs and holes in Nintendos own FW and that nobody is perfect.


HOW SAFE IS THIS?
You read the warning above? Good! As of now, there are no known issues with 0.71 (I'll update if anything comes up) and we get only positive feedback. Furthermore, v0.71 (compared to v0.5) adds multiple safety checks that prevent typical user mistakes, so this version protects you from yourself, too. This is safer than it ever was and has been tested succesfully by several people, but, regardless of OTPHelper version and/or downgrading method: Bricks are still not impossible. This gist of this: If you cannot afford or do a hardmod yourself and/or if a brick of your 3DS would be your absolute worst nightmare - don't do it, it is not worth it for you. Everyone who can live with the risk (which *might* be pretty small by now), go ahead.


TESTER CREDITS:
Thank these fearless people:

• @Damian666 and @Apache Thunder for testing and verifying EmuNAND unbricking
  
• @dark_samus3, @Skaterdie, @piratesephiroth and @Swiftloke for testing and verifying OTP.bin dumping
• @liomajor and @tivu100 for helping ironing out some quirks
• @al3x_10m (O3DS) for testing the One Click Setup feature
• @al3x_10m, @Supster131 and @Wolfvak for tons of help testing the downgrade checker

 

[Naked_Snake]

If I hadn't of already dumped mine this would have been beautiful 2 weeks ago lol

 

[Keizel]

Very useful, thanks @d0k3

 

[DjoeN]

Great to see easier tools for helping to get OTP, Still i hope for you ppl with hardmods will test this for you!

 

[Februarysn0w]

thank you for your NICE releae. This is useful to install arm9haxloader to new console.

by the way you looks professional about nand and emunand, so I really want to ask you this question.
Can I restore emunand backup to sysnand? Are there any difference bfw both nand dump image?

 

[MajinCubyan]

Great job, if only I had waited til today I could try this on my n3ds. But I have two o3ds that I will test this on and let you know how it goes.

 

[DeathChaos]

This is amazing, I'll tag this for when I get my O3DS XL back from hardmodding and attempt to dump my OTP.

 

[d0k3]

Great job, if only I had waited til today I could try this on my n3ds. But I have two o3ds that I will test this on and let you know how it goes.

This is amazing, I'll tag this for when I get my O3DS XL back from hardmodding and attempt to dump my OTP.

Let me know how it goes. This tool will be a lot more helpful for N3DS, though, as it streamlines some stuff that would otherwise be a pain to do manually.

 

[Just Passing By]

Nice job. It's a simple tool, but it gets the job done. I'd help test but I don't have a hardmod

 

[d0k3]

thank you for your NICE releae. This is useful to install arm9haxloader to new console.

by the way you looks professional about nand and emunand, so I really want to ask you this question.
Can I restore emunand backup to sysnand? Are there any difference bfw both nand dump image?

I can't give you a 100% safe reply for that, that depends on what you did with your EmuNAND before. Normally, if you didn't do any modifications to it, it should be safe to inject a EmuNAND dump over SysNAND. Don't do this if you have no other means of going back (NANDmod, A9LH) though.

 

[capito27]

(N3DS only) According to the above, upgrade your system to a version >= 9.x and switch back to slot 0x5 (upgrade might not work though).

well, you get a softbrick from going to O3DS 7.X home menu on N3DS (simply the menu asks you to discover miiverse but fails miserably and prevents you to start any application, a reboot doesn't fix it) and going any higher than 8.0 O3DS included produces a hardbrick on N3DS, so you can't even run the arm9 payload to switch keyslot crypto at all. hope this helps

 

[d0k3]

well, you get a softbrick from going to O3DS 7.X home menu on N3DS (simply the menu asks you to discover miiverse but fails miserably and prevents you to start any application, a reboot doesn't fix it) and going any higher than 8.0 O3DS included produces a hardbrick on N3DS, so you can't even run the arm9 payload to switch keyslot crypto at all. hope this helps

Understood, that means the option to switch back the crypto to slot 0x5 is useless, and so is the option to inject the N3DS header. Will think about removing these two. They might still be useful for fixing mistakes, though.

 

[dark_samus3]

I can't give you a 100% safe reply for that, that depends on what you did with your EmuNAND before. Normally, if you didn't do any modifications to it, it should be safe to inject a EmuNAND dump over SysNAND. Don't do this if you have no other means of going back (NANDmod, A9LH) though.

So, I'm going back down to 2.1 to test, but looking through the repo, it seems the framebuffer addresses are incompatible with the browser exploit for 2.1... it'd probably be a good idea to check somehow (maybe check crypto stuff since it doesn't work on 2.x) which version the person is on, and adapt the framebuffer to there... if you need the addresses

#define TOP_SCREEN0 (u8*)(0x181E6000)
#define TOP_SCREEN1 (u8*)(0x18273000)
#define BOT_SCREEN0 (u8*)(0x1848F000)
#define BOT_SCREEN1 (u8*)(0x184C7800)

otherwise the otp dump options are kinda useless

 

[TR_mahmutpek]

Good work. I will try it if it reach stable. Very thanks

 

[d0k3]

So, I'm going back down to 2.1 to test, but looking through the repo, it seems the framebuffer addresses are incompatible with the browser exploit for 2.1... it'd probably be a good idea to check somehow (maybe check crypto stuff since it doesn't work on 2.x) which version the person is on, and adapt the framebuffer to there... if you need the addresses

#define TOP_SCREEN0 (u8*)(0x181E6000)
#define TOP_SCREEN1 (u8*)(0x18273000)
#define BOT_SCREEN0 (u8*)(0x1848F000)
#define BOT_SCREEN1 (u8*)(0x184C7800)

otherwise the otp dump options are kinda useless

Alright, thanks. I'm unsure about how to test crypto stuff, though.... Any other ideas on how to find out safely if we're on 2.1?
Another idea would be to use these framebuffers for the GW Launcher.dat only. As I understand, the GW Launcher.dat is the only payload working on 2.1 & the GW Launcher.dat is also pretty much useless on more recent FW versions. Correct?

 

[dark_samus3]

Alright, thanks. I'm unsure about how to test crypto stuff, though.... Any other ideas on how to find out safely if we're on 2.1?
Another idea would be to use these framebuffers for the GW Launcher.dat only. As I understand, the GW Launcher.dat is the only payload working on 2.1 & the GW Launcher.dat is also pretty much useless on more recent FW versions. Correct?

actually the gateway.dat doesn't work from 2.1 (I had some bad info from someone else) but there is a spider exploit for 2.x called 2xrsa: https://github.com/b1l1s/2xrsa which needs those framebuffers to work...

 

[Swiftloke]

Saw this in github, was wondering when I'd come out, features etc. Good job! I'll test the OTP dumper on my o3ds.
Wait, what's the emuNAND header got to do with al9h on o3ds?

 

[d0k3]

actually the gateway.dat doesn't work from 2.1 (I had some bad info from someone else) but there is a spider exploit for 2.x called 2xrsa: https://github.com/b1l1s/2xrsa which needs those framebuffers to work...

Does that load the .bin or the .dat? I will find some way of correctly setting the framebuffers, will need to think it over, though.

 

[dark_samus3]

Does that load the .bin or the .dat? I will find some way of correctly setting the framebuffers, will need to think it over, though.

the .bin... no other changes are needed, just framebuffers

 

[Plailect]

Once it's working and confirmed stable this will be exactly what the community needs. The OTP guide can be made easier than ever, and perhaps after that a9lhax can be made the new standard.