Homebrew safefirmraunchhax - new Arm9 exploit discussion

[SRKTiberious]

So I guess 9.2 is dead and 11.2 is the new heaven.

Since we were only using 9.2 for access to ARM9, this is to be expected.

Similarly, we only go to 2.1 for dumping the OTP. If there were any way to get that data without being on such an old firmware, then the 2.1 downgrade method would be obsolete as well, and we'd be able to simply install A9LH from 11.2.

See, the guide's core goals are, in order:

1. Retrieve OTP data (unique to each console, which is why there's the big red warning about bricking with other OTPs)
2. Use OTP and access to install A9LH

Any other steps taken, such as ARM11 access, are done in pursuit of the first goal not yet completed. This is also why the DSiWare games were important. DS mode has full ARM9 access, so getting an exploit to run code in that environment was crucial, since you need ARM9 to install 2.1 firmware, allowing us to get the OTP easily. Now, of course, we can just safehax and get ARM9 access that way.

Naturally, if there happened to be some kind of exploit found to break the permissions and dump OTP anyway on whatever firmware, then that would be what we'd CTRTransfer to, or if it happened to be on 11.2, then there could be a single app to dump OTP and then install A9LH.

 

[Soulsilve2010]

There is probably something wrong with your computer.
I would suggest you would try another computer.

I have been having some issues with my laptops wireless lately.I redownloaded again,gonna try one more time.

Edit:I ran my pcs drive repair on my sd card and now the files can be copied.So it was really an issue with my sd cards file system.

 

[Elaugaufein]

Most people on N3DS 11.2 don't even really need to go to 2.1 now really they could do OTPless a9lh albeit with a tiny brick risk. They could then dump the OTP with SigHax when / if it comes out for the small handful of stuff that's useful for.

 

[uyjulian]

Since we were only using 9.2 for access to ARM9, this is to be expected.

Similarly, we only go to 2.1 for dumping the OTP. If there were any way to get that data without being on such an old firmware, then the 2.1 downgrade method would be obsolete as well, and we'd be able to simply install A9LH from 11.2.

See, the guide's core goals are, in order:

1. Retrieve OTP data (unique to each console, which is why there's the big red warning about bricking with other OTPs)
2. Use OTP and access to install A9LH

Any other steps taken, such as ARM11 access, are done in pursuit of the first goal not yet completed. This is also why the DSiWare games were important. DS mode has full ARM9 access, so getting an exploit to run code in that environment was crucial, since you need ARM9 to install 2.1 firmware, allowing us to get the OTP easily. Now, of course, we can just safehax and get ARM9 access that way.

Naturally, if there happened to be some kind of exploit found to break the permissions and dump OTP anyway on whatever firmware, then that would be what we'd CTRTransfer to, or if it happened to be on 11.2, then there could be a single app to dump OTP and then install A9LH.

If somebody dumps arm9 bootrom and releases it publicly (bootrom dumping was described at 33c3 but dumps weren't released), we wouldn't need the OTP, we would just need to insert a crafted signature into our firmware that launches whatever payload we want.
That way, we can get boot-time custom firmware without downgrading; just replace firmware with custom firmware and off we go!

After stuff is figured out publically, all we would need to do is:
1. put files on SD card
2. go to Nintendo 3DS Sound, and run soundhax
3. soundhax loads fasthax
4. safefirmlaunchhax uses fasthax exploit to load an arm9 binary
5. that arm9 binary inserts the FIRM into the NAND
6. restart the 3DS

Boom, now custom firmware is installed after launching the soundhax! Few-click installation :-)
Another thing that would be nice is that FBI would be automatically installed after custom firmware is installed.

 

[Bros.Life]

Since we were only using 9.2 for access to ARM9, this is to be expected.

Similarly, we only go to 2.1 for dumping the OTP. If there were any way to get that data without being on such an old firmware, then the 2.1 downgrade method would be obsolete as well, and we'd be able to simply install A9LH from 11.2.

So, what would you recommend me to do? I have menuhax installed in 9.2 plus Luma CFW and EmuNand on 11.2. Everything worked and works fine so far. Do you think I need to change to the newest method? Could my hax become obsolote in the future or be patched?

Thanks

 

[SRKTiberious]

So, what would you recommend me to do? I have menuhax installed in 9.2 plus Luma CFW and EmuNand on 11.2. Everything worked and works fine so far. Do you think I need to change to the newest method? Could my hax become obsolote in the future or be patched?

Thanks

Personally, I wouldn't recommend anything at the moment. I haven't been on a setup like that for some time now, so I don't want to give you any advice that might brick you.

I will say, however, that the menuhax/RedNAND combination is obsolete as far as running CFW is concerned. A9LH is a single-run setup, and offers 100% boot rate and faster boot times (due to being SysNAND-based), and can be updated at will, as an A9LH Luma3DS setup will block overwriting A9LH during the process.

You could, though it might be redundant, even continue to run a RedNAND even with A9LH, and up until just recently, I did just that.

 

[Zidapi]

@AHP_person While I still think you're an asshole for the whole rxTools debacle, I have to give credit where credit is due. This is an impressive achievement. Congratulations.

 

[Soulsilve2010]

I can confirm this works on 11.0.0-33u O3DS.I am now in the process of reinstalling my tickets.

 

[Xiphiidae]

been having no luck with waithax and safehax even on the newest builds but just tried this safehax with fasthax re-integrated and it didn't work either
UNTIL
i used oot3dhax instead of soundhax then it worked first try! on 11.0.0-33U

Same here. Switched to oot3dhax (*hax 2.7) and it worked first try.

 

[uyjulian]

Same here. Switched to oot3dhax (*hax 2.7) and it worked first try.

Try soundhax while your oot cartridge is set in your 3DS
Check out https://github.com/TiniVi/safehax/issues/5

 

[HSTurtle]

Also works on the old 3ds 11.2 U!

 

[Xiphiidae]

Try soundhax while your oot cartridge is set in your 3DS
Check out https://github.com/TiniVi/safehax/issues/5

Just tried this out, and yeah, it worked. Strange. Good to know that soundhax isn't an issue, then.