Hacking [RELEASE] Regionthree: Region Free loader for 3DS/2DS/xl from 9.0~9.4, Sky3DS Users, regionfree!!

[gnmmarechal]

https://github.com/smealum/regionthree/

As the tittle says, this has become a reality.

¿What does this mean?

-Now, we can play any legit cart game regardless the region of both the console or the cart, it will load without any objection.

-Sky3DS and QQ3DS Users are finally able to load any region ROM now.

Sky3DS proof (thanks to DjoeN:

Spoiler

Japanese Smash Bros Cart on an EUR 3DS console proof:



How to use

• Download Launcher.dat from the repo (or compile it yourself) : https://github.com/smealum/regionthree/raw/master/Launcher.dat
• Copy Launcher.dat to the root of your SD card
• Insert the game you want to run into your 3DS and power it up
• Open the "Download Play" application
• Hit the home menu button, but do not exit the Download Play application (keep it running in the background)
• Open the Web Browser applet
• Go to Gateway's exploit page (not linking directly to it here because not a fan of their whole piracy thing they've got going)
• Wait a few seconds; screen should turn black and after a bit your game should boot up !

FAQ

• Does this work on the latest firmware version ? Yes, 9.4 is supported.
• Does this work using a Sky3DS or QQ3DS Flashcards? Yes, they will load, but the process is a very random game, because foreign region games for your 3DS will not show their banner; this means that you will need to change the game with the button totally blind, but it will load of course.
• Does this let me run homebrew and/or roms ? No, it just lets you run legit physical games from other regions.
• Do I need to connect to the internet every time I want to use this ? Yes, or you can use an Android app that hosts the exploit (php server), there are some here in the temp, such as Go! Android!
• Do I need a flashcart/game/hardware for this ? No.
• Will this work on my New 3DS ? No, at the moment this only works on 3DS, 3DS XL and 2DS models.
• Will it ever work on the New 3DS ? Maybe. I don't plan on working on it, like, ever, but the code is out there now so...
• Will this break or brick my 3DS ? No. There's virtually 0 chance of that happening, all this runs is run of the mill usermode code, nothing dangerous. Nothing unusual is written to your NAND, nothing permanent is done. With that in mind, use at your own risk, I won't take responsibility if something weird does happen.
• Do you take donations ? No, I do not.
• How does it work ? See below.

Technical stuff


Basically we use GW's entrypoint to get ROP (not code execution, either userland or kernel) under spider (that's what the browser applet is called). From there, we use the GPU DMA vuln to take over the download play application (this is done by overwriting the GSP interrupt handler funcptr table). The download play application has access to the ns:s service (spider does not), and we use that service to launch our out-of-region game.
For more detail on the webkit/spider exploit, visit http://yifan.lu/2015/01/10/reversing-gateway-ultra-first-stage-part-1/
For more detail on the GPU DMA exploit, visit http://smealum.net/?p=517
To build the ROP, use Kingcom's armips assembler https://github.com/Kingcom/armips



Credits

• All ROP and code written on this repo written by smealum.
• ns:s region free booting trick found by yellows8.
• Neatly packaged spider exploit by Gateway.
• Bond697, sm, yifanlu for working on the GW payload so I wouldn't have to.
• Myria for helping with testing.

https://twitter.com/smealum/

smealum.net

Does this work on 9.5.0-22?

 

[lPolarisl]

Don't know if Regionthree cause this but it seems that using Regionthree breaks the miiverse and friends applications on your 3ds.
Just noticed today that I can longer use them as they just load without booting up.
Has anybody else using the exploit had this happen to them?

I tried out regointhree once to launch an E game on an E console, my friend list still works...

 

[Straga]

Majora's Mask 3D EUR doesn't works on my 3DS XL JAP.

 

[lPolarisl]

... Isn't Majora's Mask out only on friday ?

 

[gamesquest1]

... Isn't Majora's Mask out only on friday ?

yeah people got it early and sent it to twitch streamers so they can catch viewers

 

[infernogott]

Is this the only way to play legal imports?

I own a Gateway. Do I need to do this on Emunand or Sysnand? I'm on 4.5 on Sysnand and 9.5 on Emunand

 

[gamesquest1]

Is this the only way to play legal imports?

I own a Gateway. Do I need to do this on Emunand or Sysnand? I'm on 4.5 on Sysnand and 9.5 on Emunand

you can enter classic mode with gateway to play legit imports too, then you dont have to use the web browser every time you want to change games

 

[infernogott]

Thanks! Works great in classic mode!

 

[MyJoyConRunsHot]

"Will this work on my New 3DS ?
No, at the moment this only works on 3DS, 3DS XL and 2DS models.
Will it ever work on the New 3DS ?
Maybe. I don't plan on working on it, like, ever, but the code is out there now so..."
This exploit is extremely useless then.

 

[hippy dave]

That post was extremely useless.

 

[Duo8]

"Will this work on my New 3DS ?
No, at the moment this only works on 3DS, 3DS XL and 2DS models.
Will it ever work on the New 3DS ?
Maybe. I don't plan on working on it, like, ever, but the code is out there now so..."
This exploit is extremely useless then.

like u :^)

 

[NeoPhythe]

has anyone tried this on a 9.0.0-20E n3ds XL yet ?

(and yes, i am away it has stated that it willnot work above, but has anyone actually tried this yet?)

 

[MeisterFenster]

It will work on a N3DS, the problem is that we don't have an exploit to launch it. But the basics (get Downloadplay to launch a cart with nss service call) would also work on a n3ds.

 

[MrEdgeworth]

For those having trouble or are confused about getting regionthree working with Sky3DS, I wrote up a step-by-step guide here: http://www.reddit.com/r/SKY3DS/comments/2u5h87/using_regionthree_to_bypass_region_restrictions/

Hopefully it can help some people.

"Copy the Launcher.dat to the root of your 3DS SD Card, NOT your Sky3DS SD Card."

Omg, I am an imbecile. It's been two hours I try to make it work and this was the problem.

Thank you so much buddy!

 

[unknownnumber]

Is someone going to update regionthree as soon as it's possible to use it one the n3ds?

 

[MyJoyConRunsHot]

like u :^)

:^)

Is someone going to update regionthree as soon as it's possible to use it one the n3ds?

Smea says the code is out there. Unfortunately, no-one seems to have picked it up to work on, at least not publicly.

What I wonder is if its possible to inject region firmwares into imported systems.

 

[xerosagas]

:^)


Smea says the code is out there. Unfortunately, no-one seems to have picked it up to work on, at least not publicly.

What I wonder is if its possible to inject region firmwares into imported systems.

This is what I'm waiting on, personally.

 

[sniperseyes]

This is what I'm waiting on, personally.

You and me both.

 

[skullpanda86]

http://pastebin.com/yNyjeuG1 <--- Hope this out some,regionthree NTSC-J compatibility list tested with with 2DS

 

[Slushie3DS]

This is what I'm waiting on, personally.

You and me both.

It is somewhat 'possible'. Check here.