Hacking [Release]Pre9otherapp :- otherapp payload for pre 9.2 firmwares

Kartik

Well-Known Member
OP
Member
Joined
Jun 6, 2015
Messages
623
Trophies
0
Location
github
XP
1,900
Country
India
INTRODUCTION:-
This is a single payload which can be used on pre 9.2 firmwares to launch an arm9 payload from the sd card directly. This can be used by people who either have no browser or can't perform the mset exploit due to some reason + it simplies the whole process. Works on all regions, for all firmwares between 1.X and 9.3.

USAGE:-

Can be used along with *hax to execute an arm9 payload(should be named arm9.bin) from the root of the sd-card.
This does not launch boot the hbl so a file named boot.3dsx is not required


Sample steps to use with soundhax and safeb9sinstaller
Steps:-
  1. Get the soundhax file for your console and region
  2. Get the arm9 payload, safeb9sinstaller in this case
  3. Download the otherapp.bin from the releases page
  4. Put all the files on the root of your sd(for safeb9sinstaller, just copy the arm9.bin from the zip)
  5. Launch soundhax
If everything goes correctly you will be in safeb9sinstaller, this might/might not work on the first try.

ADDITIONAL INFO:-

This incorporates an edited version of svchax(memchunkhax) to gain arm11 escalation and brahma(firmlaunchhax) to gain arm9 escalation. I originally aimed to use udsploit + safehax but that combo didn't work out so I had to fall back to use this combo. Theoretically it is possible to make this work on lower/higher firmwares by replacing the arm11/arm9 exploits.

CREDITS:-

Most of the code used in this project from already existing projects. I would like to credit anyone who has aided in the development of BrahmaLoader, svchax, ctrulib and ninjhax2.x

Massive thanks to my testers:- @Chromaryu, @MrJason005, @FrozenPhoenix, @saibotu and many others at my discord server

DOWNLOAD:-

The repo is here and binary can be obtained from here


HELP:-

Although we have tried to test it thoroughly, we couldn't test it on some firmwares. You can help this project by reporting if this works for you.
 
Last edited by Kartik,

ihaveahax

Well-Known Member
Member
Joined
Apr 20, 2015
Messages
5,959
Trophies
2
XP
6,524
Country
United States
I tested this on different versions and can say it works on every version 5.0 - 9.2 via soundhax. It doesn't work on 4.x or 8.1.0-0J New3DS.
(Primarily tested versions where NATIVE_FIRM or soundapp were updated, anything else wouldn't affect the results.)

Works:
* 5.0.0-11
* 5.1.0-11
* 6.0.0-11
* 6.1.0-11
* 7.0.0-13
* 7.2.0-17
* 8.0.0-18
* 9.0.0-20

Doesn't work:
* 4.0.0-7 to 4.5.0-10 (immediate crash when running soundhax)
* 8.1.0-0J New3DS (hangs on text below)
Code:
Unblocked svcs
SUCCESS !!!
Unblocking access to all services
Initing brahma
00000000
00000000
000000ff
00000001
 
Last edited by ihaveahax,

Kartik

Well-Known Member
OP
Member
Joined
Jun 6, 2015
Messages
623
Trophies
0
Location
github
XP
1,900
Country
India
Oh btw, I wrote this pointer_dumper which should print out the pointers required for firmlaunchhax. If you're on 8.1 or 4.X with luma installed, you can help this project by running the following binary on your 3ds and then sending me a screenshot. Instructions Press X and then A.
 

Attachments

  • ram_dumper.zip
    93.6 KB · Views: 137

Kartik

Well-Known Member
OP
Member
Joined
Jun 6, 2015
Messages
623
Trophies
0
Location
github
XP
1,900
Country
India
This is awesome if it works properly on all the versions!
I tested this on different versions and can say it works on every version 5.0 - 9.2 via soundhax. It doesn't work on 4.x or 8.1.0-0J New3DS.
(Primarily tested versions where NATIVE_FIRM or soundapp were updated, anything else wouldn't affect the results.)

Works:
* 5.0.0-11
* 5.1.0-11
* 6.0.0-11
* 6.1.0-11
* 7.0.0-13
* 7.2.0-17
* 8.0.0-18
* 9.0.0-20

Doesn't work:
* 4.0.0-7 to 4.5.0-10 (immediate crash when running soundhax)
* 8.1.0-0J New3DS (hangs on text below)
Code:
Unblocked svcs
SUCCESS !!!
Unblocking access to all services
Initing brahma
00000000
00000000
000000ff
00000001

Alright update, appears to be that 4.X doesn't like soundhax and can't run it. So for now, support for 4.X is broken. As for 8.1J, pointers have been added and firmlaunching works.
 

Kazuma77

Well-Known Member
Member
Joined
May 11, 2008
Messages
1,035
Trophies
0
XP
865
Country
United States
Fascinating. You mentioned that replacing the exploits could theoretically get it to work with higher versions. That would be nice -- just having 2 otherapp.bin files to deal with. This will be easy to add to my "One & Done" installer (technically, it already works with it -- just make a copy of "safehaxpayload.bin" and rename it to "arm9.bin" and it will work, you'll just have to delete "arm9.bin" manually, but the next update will add a line to delete it). Good stuff, except for the suggestion of using the outdated Safe B9S Installer. The installer is up to 0.0.8 now, OFI is it's current name, and it has added the ability to install FastBoot3DS. Better yet though, just use OldLoader to launch a fully automated script runner that will perform the installation and cleanup in one step. The more you automate, the less mistakes people make (this site has countless "I followed 'the guide', but..." threads, and zero "I used InScripted, but..." threads, I rest my case).
 
Last edited by Kazuma77,

The Real Jdbye

*is birb*
Member
Joined
Mar 17, 2010
Messages
21,343
Trophies
3
Location
Space
XP
10,229
Country
Norway
Nice work. An actual *hax payload for pre-9.0 firmwares would be more versatile (there is Ninjhax 1.x but that's Cubic Ninja only and the website/download for it seems to be gone), but this is still really useful. Makes it easy for people on lower firmwares to do things they otherwise wouldn't be able to easily, like make NAND backups pre-CFW.
 

Kazuma77

Well-Known Member
Member
Joined
May 11, 2008
Messages
1,035
Trophies
0
XP
865
Country
United States
Nice work. An actual *hax payload for pre-9.0 firmwares would be more versatile (there is Ninjhax 1.x but that's Cubic Ninja only and the website/download for it seems to be gone), but this is still really useful. Makes it easy for people on lower firmwares to do things they otherwise wouldn't be able to easily, like make NAND backups pre-CFW.

Well, it's no longer maintained by Smealum, but there is this archived version of the Ninjhax 1.1b site for those who still have uses for it.
 

The Real Jdbye

*is birb*
Member
Joined
Mar 17, 2010
Messages
21,343
Trophies
3
Location
Space
XP
10,229
Country
Norway
Well, it's no longer maintained by Smealum, but there is this archived version of the Ninjhax 1.1b site for those who still have uses for it.
That's good, so at least people who need it can still use it. There isn't a huge need for that nowadays since you can install CFW easily on those firmwares and run all the homebrew you want, but there are specific situations where you would want to run homebrew without installing CFW.
It's kind of weird that *hax 2.x was never made to support earlier firmwares. You'd think it would be simple since most of the code needed for it is already in 1.x, and the entrypoints themselves do work on lower firmwares (at least 4.x and up), but maybe there is something different about the way 2.x works that makes it impossible to run on lower firmwares. Or maybe they just didn't prioritize it since 9.0-9.2 was fully hackable at the time through Gateway.
 

Kartik

Well-Known Member
OP
Member
Joined
Jun 6, 2015
Messages
623
Trophies
0
Location
github
XP
1,900
Country
India
Afaik, pre9otherapp should now work on all firms b/w 1.X and 9.2. But I still need to fix soundhax for pre 3.0 firms for which I need some testers. If you happen to have an o3ds and don't care about downgrading to 2.X, plz contact me.
 

marazzmatika

Naive guy
Member
Joined
Jul 10, 2018
Messages
145
Trophies
0
XP
267
Country
Russia
Cool! But my o3ds upgraded from 4.5.0-10E to 6.2.0-10E via cartridge showed up the srvinit() and then forced to close. Then I realised,that I can use older version and it worked for second attempt!

Also: srvinit() problem was in 4.5.0-10E and newer version of fw.

I think this information can help someone like mine to install b9s,even if they have bad pc,no $2,but old firmware updated via internet. Now I gonna wait for CTRTransfer image file to load,and hope that with update HBL will work. (Yeah,I can't boot HBL through Rosalina yet,It just loading so long)
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    Psionic Roshambo @ Psionic Roshambo: Hmm didn't know they made more Dusk Till Dawn movies watched part one on Pluto TV and they have...