[Release]Pre9otherapp :- otherapp payload for pre 9.2 firmwares

Discussion in '3DS - Flashcards & Custom Firmwares' started by Kartik, Apr 5, 2018.

  1. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    INTRODUCTION:-
    This is a single payload which can be used on pre 9.2 firmwares to launch an arm9 payload from the sd card directly. This can be used by people who either have no browser or can't perform the mset exploit due to some reason + it simplies the whole process. Works on all regions, for all firmwares between 1.X and 9.3.

    USAGE:-

    Can be used along with *hax to execute an arm9 payload(should be named arm9.bin) from the root of the sd-card.
    This does not launch boot the hbl so a file named boot.3dsx is not required


    Sample steps to use with soundhax and safeb9sinstaller
    Steps:-
    1. Get the soundhax file for your console and region
    2. Get the arm9 payload, safeb9sinstaller in this case
    3. Download the otherapp.bin from the releases page
    4. Put all the files on the root of your sd(for safeb9sinstaller, just copy the arm9.bin from the zip)
    5. Launch soundhax
    If everything goes correctly you will be in safeb9sinstaller, this might/might not work on the first try.

    ADDITIONAL INFO:-

    This incorporates an edited version of svchax(memchunkhax) to gain arm11 escalation and brahma(firmlaunchhax) to gain arm9 escalation. I originally aimed to use udsploit + safehax but that combo didn't work out so I had to fall back to use this combo. Theoretically it is possible to make this work on lower/higher firmwares by replacing the arm11/arm9 exploits.

    CREDITS:-

    Most of the code used in this project from already existing projects. I would like to credit anyone who has aided in the development of BrahmaLoader, svchax, ctrulib and ninjhax2.x

    Massive thanks to my testers:- @Chromaryu, @MrJason005, @FrozenPhoenix, @saibotu and many others at my discord server

    DOWNLOAD:-

    The repo is here and binary can be obtained from here


    HELP:-

    Although we have tried to test it thoroughly, we couldn't test it on some firmwares. You can help this project by reporting if this works for you.
     
    Last edited by Kartik, May 16, 2018 at 6:14 PM
  2. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    Wanted to mention that this payload can be used both on n3ds/o3ds without needing to change any stuff.
     
  3. Plailect

    Plailect GBAtemp Advanced Fan

    Member
    8
    Jan 30, 2016
    United States
    This is awesome if it works properly on all the versions!
     
    _D1360_ and SCOTT0852 like this.
  4. ihaveamac

    ihaveamac GBAtemp Guru

    Member
    14
    Apr 20, 2015
    United States
    Tigard, OR
    I tested this on different versions and can say it works on every version 5.0 - 9.2 via soundhax. It doesn't work on 4.x or 8.1.0-0J New3DS.
    Warning: Spoilers inside!
     
    Last edited by ihaveamac, Apr 6, 2018
  5. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    Oh btw, I wrote this pointer_dumper which should print out the pointers required for firmlaunchhax. If you're on 8.1 or 4.X with luma installed, you can help this project by running the following binary on your 3ds and then sending me a screenshot. Instructions Press X and then A.
     

    Attached Files:

  6. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    I and @ihaveamac just got it work on a 8.1J system
     
    MrMcTiller likes this.
  7. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    Alright update, appears to be that 4.X doesn't like soundhax and can't run it. So for now, support for 4.X is broken. As for 8.1J, pointers have been added and firmlaunching works.
     
  8. thisisallowed

    thisisallowed 中国御宅族

    Member
    2
    Oct 8, 2015
    China
    Jinan, Shandong
    iirc only <=2.x has problems with soundhax, something else must be wrong
     
  9. Kazuma77

    Kazuma77 GBAtemp Maniac

    Member
    5
    May 11, 2008
    United States
    Fascinating. You mentioned that replacing the exploits could theoretically get it to work with higher versions. That would be nice -- just having 2 otherapp.bin files to deal with. This will be easy to add to my "One & Done" installer (technically, it already works with it -- just make a copy of "safehaxpayload.bin" and rename it to "arm9.bin" and it will work, you'll just have to delete "arm9.bin" manually, but the next update will add a line to delete it). Good stuff, except for the suggestion of using the outdated Safe B9S Installer. The installer is up to 0.0.8 now, OFI is it's current name, and it has added the ability to install FastBoot3DS. Better yet though, just use OldLoader to launch a fully automated script runner that will perform the installation and cleanup in one step. The more you automate, the less mistakes people make (this site has countless "I followed 'the guide', but..." threads, and zero "I used InScripted, but..." threads, I rest my case).
     
    Last edited by Kazuma77, Apr 24, 2018
  10. The Real Jdbye

    The Real Jdbye Always Remember 30/07/08

    Member
    16
    GBAtemp Patron
    The Real Jdbye is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Mar 17, 2010
    Norway
    Alola
    Nice work. An actual *hax payload for pre-9.0 firmwares would be more versatile (there is Ninjhax 1.x but that's Cubic Ninja only and the website/download for it seems to be gone), but this is still really useful. Makes it easy for people on lower firmwares to do things they otherwise wouldn't be able to easily, like make NAND backups pre-CFW.
     
  11. Kazuma77

    Kazuma77 GBAtemp Maniac

    Member
    5
    May 11, 2008
    United States
    Well, it's no longer maintained by Smealum, but there is this archived version of the Ninjhax 1.1b site for those who still have uses for it.
     
  12. The Real Jdbye

    The Real Jdbye Always Remember 30/07/08

    Member
    16
    GBAtemp Patron
    The Real Jdbye is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Mar 17, 2010
    Norway
    Alola
    That's good, so at least people who need it can still use it. There isn't a huge need for that nowadays since you can install CFW easily on those firmwares and run all the homebrew you want, but there are specific situations where you would want to run homebrew without installing CFW.
    It's kind of weird that *hax 2.x was never made to support earlier firmwares. You'd think it would be simple since most of the code needed for it is already in 1.x, and the entrypoints themselves do work on lower firmwares (at least 4.x and up), but maybe there is something different about the way 2.x works that makes it impossible to run on lower firmwares. Or maybe they just didn't prioritize it since 9.0-9.2 was fully hackable at the time through Gateway.
     
  13. Plailect

    Plailect GBAtemp Advanced Fan

    Member
    8
    Jan 30, 2016
    United States
    Added to the guide (for 5.X-8.X)
     
    lone_wolf323 and VzUh like this.
  14. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    4.0 support added! :)
     
  15. thisisallowed

    thisisallowed 中国御宅族

    Member
    2
    Oct 8, 2015
    China
    Jinan, Shandong
    What about 3.X? Soundhax still works there.
     
  16. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    Working on it!
     
  17. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    I and @ihaveamac got it work on 3.0 console
     
  18. Kartik
    OP

    Kartik Gbatemp advanced fan

    Member
    3
    Jun 6, 2015
    India
    github
    Afaik, pre9otherapp should now work on all firms b/w 1.X and 9.2. But I still need to fix soundhax for pre 3.0 firms for which I need some testers. If you happen to have an o3ds and don't care about downgrading to 2.X, plz contact me.
     
Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice