Hacking [Release]Pre9otherapp :- otherapp payload for pre 9.2 firmwares

[Kartik]

INTRODUCTION:-
This is a single payload which can be used on pre 9.2 firmwares to launch an arm9 payload from the sd card directly. This can be used by people who either have no browser or can't perform the mset exploit due to some reason + it simplies the whole process. Works on all regions, for all firmwares between 1.X and 9.3.

USAGE:-

Can be used along with *hax to execute an arm9 payload(should be named arm9.bin) from the root of the sd-card.
This does not launch boot the hbl so a file named boot.3dsx is not required

Sample steps to use with soundhax and safeb9sinstaller
Steps:-

1. Get the soundhax file for your console and region
2. Get the arm9 payload, safeb9sinstaller in this case
3. Download the otherapp.bin from the releases page
4. Put all the files on the root of your sd(for safeb9sinstaller, just copy the arm9.bin from the zip)
5. Launch soundhax

If everything goes correctly you will be in safeb9sinstaller, this might/might not work on the first try.

ADDITIONAL INFO:-

This incorporates an edited version of svchax(memchunkhax) to gain arm11 escalation and brahma(firmlaunchhax) to gain arm9 escalation. I originally aimed to use udsploit + safehax but that combo didn't work out so I had to fall back to use this combo. Theoretically it is possible to make this work on lower/higher firmwares by replacing the arm11/arm9 exploits.

CREDITS:-

Most of the code used in this project from already existing projects. I would like to credit anyone who has aided in the development of BrahmaLoader, svchax, ctrulib and ninjhax2.x

Massive thanks to my testers:- @Chromaryu, @MrJason005, @FrozenPhoenix, @saibotu and many others at my discord server

DOWNLOAD:-

The repo is here and binary can be obtained from here


HELP:-

Although we have tried to test it thoroughly, we couldn't test it on some firmwares. You can help this project by reporting if this works for you.

 

[Kartik]

Wanted to mention that this payload can be used both on n3ds/o3ds without needing to change any stuff.

 

[Plailect]

This is awesome if it works properly on all the versions!

 

[ihaveahax]

I tested this on different versions and can say it works on every version 5.0 - 9.2 via soundhax. It doesn't work on 4.x or 8.1.0-0J New3DS.

Spoiler

(Primarily tested versions where NATIVE_FIRM or soundapp were updated, anything else wouldn't affect the results.)

Works:
* 5.0.0-11
* 5.1.0-11
* 6.0.0-11
* 6.1.0-11
* 7.0.0-13
* 7.2.0-17
* 8.0.0-18
* 9.0.0-20

Doesn't work:
* 4.0.0-7 to 4.5.0-10 (immediate crash when running soundhax)
* 8.1.0-0J New3DS (hangs on text below)

Unblocked svcs
SUCCESS !!!
Unblocking access to all services
Initing brahma
00000000
00000000
000000ff
00000001

 

[Kartik]

Oh btw, I wrote this pointer_dumper which should print out the pointers required for firmlaunchhax. If you're on 8.1 or 4.X with luma installed, you can help this project by running the following binary on your 3ds and then sending me a screenshot. Instructions Press X and then A.

 

[Kartik]

This is awesome if it works properly on all the versions!

I and @ihaveamac just got it work on a 8.1J system

 

[Kartik]

This is awesome if it works properly on all the versions!

I tested this on different versions and can say it works on every version 5.0 - 9.2 via soundhax. It doesn't work on 4.x or 8.1.0-0J New3DS.

Spoiler

(Primarily tested versions where NATIVE_FIRM or soundapp were updated, anything else wouldn't affect the results.)

Works:
* 5.0.0-11
* 5.1.0-11
* 6.0.0-11
* 6.1.0-11
* 7.0.0-13
* 7.2.0-17
* 8.0.0-18
* 9.0.0-20

Doesn't work:
* 4.0.0-7 to 4.5.0-10 (immediate crash when running soundhax)
* 8.1.0-0J New3DS (hangs on text below)

Unblocked svcs
SUCCESS !!!
Unblocking access to all services
Initing brahma
00000000
00000000
000000ff
00000001

Alright update, appears to be that 4.X doesn't like soundhax and can't run it. So for now, support for 4.X is broken. As for 8.1J, pointers have been added and firmlaunching works.

 

[thisisallowed]

iirc only <=2.x has problems with soundhax, something else must be wrong

 

[Kazuma77]

Fascinating. You mentioned that replacing the exploits could theoretically get it to work with higher versions. That would be nice -- just having 2 otherapp.bin files to deal with. This will be easy to add to my "One & Done" installer (technically, it already works with it -- just make a copy of "safehaxpayload.bin" and rename it to "arm9.bin" and it will work, you'll just have to delete "arm9.bin" manually, but the next update will add a line to delete it). Good stuff, except for the suggestion of using the outdated Safe B9S Installer. The installer is up to 0.0.8 now, OFI is it's current name, and it has added the ability to install FastBoot3DS. Better yet though, just use OldLoader to launch a fully automated script runner that will perform the installation and cleanup in one step. The more you automate, the less mistakes people make (this site has countless "I followed 'the guide', but..." threads, and zero "I used InScripted, but..." threads, I rest my case).

 

[The Real Jdbye]

Nice work. An actual *hax payload for pre-9.0 firmwares would be more versatile (there is Ninjhax 1.x but that's Cubic Ninja only and the website/download for it seems to be gone), but this is still really useful. Makes it easy for people on lower firmwares to do things they otherwise wouldn't be able to easily, like make NAND backups pre-CFW.

 

[Kazuma77]

Nice work. An actual *hax payload for pre-9.0 firmwares would be more versatile (there is Ninjhax 1.x but that's Cubic Ninja only and the website/download for it seems to be gone), but this is still really useful. Makes it easy for people on lower firmwares to do things they otherwise wouldn't be able to easily, like make NAND backups pre-CFW.

Well, it's no longer maintained by Smealum, but there is this archived version of the Ninjhax 1.1b site for those who still have uses for it.

 

[The Real Jdbye]

Well, it's no longer maintained by Smealum, but there is this archived version of the Ninjhax 1.1b site for those who still have uses for it.

That's good, so at least people who need it can still use it. There isn't a huge need for that nowadays since you can install CFW easily on those firmwares and run all the homebrew you want, but there are specific situations where you would want to run homebrew without installing CFW.
It's kind of weird that *hax 2.x was never made to support earlier firmwares. You'd think it would be simple since most of the code needed for it is already in 1.x, and the entrypoints themselves do work on lower firmwares (at least 4.x and up), but maybe there is something different about the way 2.x works that makes it impossible to run on lower firmwares. Or maybe they just didn't prioritize it since 9.0-9.2 was fully hackable at the time through Gateway.

 

[Plailect]

Added to the guide (for 5.X-8.X)

 

[Kartik]

4.0 support added!

 

[thisisallowed]

What about 3.X? Soundhax still works there.

 

[Kartik]

What about 3.X? Soundhax still works there.

Working on it!

 

[Kartik]

Working on it!

I and @ihaveamac got it work on 3.0 console

 

[Kartik]

Afaik, pre9otherapp should now work on all firms b/w 1.X and 9.2. But I still need to fix soundhax for pre 3.0 firms for which I need some testers. If you happen to have an o3ds and don't care about downgrading to 2.X, plz contact me.

 

[marazzmatika]

Cool! But my o3ds upgraded from 4.5.0-10E to 6.2.0-10E via cartridge showed up the srvinit() and then forced to close. Then I realised,that I can use older version and it worked for second attempt!

Also: srvinit() problem was in 4.5.0-10E and newer version of fw.

I think this information can help someone like mine to install b9s,even if they have bad pc,no $2,but old firmware updated via internet. Now I gonna wait for CTRTransfer image file to load,and hope that with update HBL will work. (Yeah,I can't boot HBL through Rosalina yet,It just loading so long)

 

[RivalSnooze]

This doesn't seem to work on my Old 3DS XL Firmware 5.1.0-10E, I get an Srvint crash. Any ideas on how to fix this?