Homebrew The bootroms

[Suiginou]

Please tell this is just a language gap and when you said "he" you meant "it"

Please tell me that you don't actually think you're funny.

 

[Xenon Hacks]

Please tell me that you don't actually think you're funny.

That wasn't sarcasm on my part :/ they way you worded that it sounded like you managed to pull bootrom keys

 

[chaoskagami]

That wasn't sarcasm on my part :/ they way you worded that it sounded like you managed to pull bootrom keys

Rei does indeed have devkits. I assume they're hacked, but then again, I don't know.

People seem to underestimate the difficulty of modifying devkits though. Right now, according to people I talk with on #Cakey the most ideal exploit on devkits at the moment is MSET. You can't necessarily a9lh a devkit. The secret sector is different, and the method of calculating keys to clobber is more than likely different.

This is made worse by the large majority of people who have devkits being NDA'd.

 

[dark_samus3]

Rei does indeed have devkits. I assume they're hacked, but then again, I don't know.

People seem to underestimate the difficulty of modifying devkits though. Right now, according to people I talk with on #Cakey the most ideal exploit on devkits at the moment is MSET. You can't necessarily a9lh a devkit. The secret sector is different, and the method of calculating keys to clobber is more than likely different.

This is made worse by the large majority of people who have devkits being NDA'd.

the arm9loaderhax keyfinder should do just fine on devkits, actually. The method is essentially the exact same, downgrade to low FW, grab OTP, decrypt secret sector, use the key bruteforcer to find a new key (using the dev FW), encrypt secret sector with new key #2, add stage1 at the proper place and flash it all to the device

 

[chaoskagami]

the arm9loaderhax keyfinder should do just fine on devkits, actually. The method is essentially the exact same, downgrade to low FW, grab OTP, decrypt secret sector, use the key bruteforcer to find a new key (using the dev FW), encrypt secret sector with new key #2, add stage1 at the proper place and flash it all to the device

Well, straight from the horse's mouth. It's a tad more involved for the first person who decides to try it, but possible.

 

[Suiginou]

the arm9loaderhax keyfinder should do just fine on devkits, actually. The method is essentially the exact same, downgrade to low FW, grab OTP, decrypt secret sector, use the key bruteforcer to find a new key (using the dev FW), encrypt secret sector with new key #2, add stage1 at the proper place and flash it all to the device

"dev FW"? NATIVE_FIRM and SAFE_MODE_FIRM are the same across all devices, retail as well as dev, as far as I'm aware.

 

[dark_samus3]

"dev FW"? NATIVE_FIRM and SAFE_MODE_FIRM are the same across all devices, retail as well as dev, as far as I'm aware.

iirc, dev FW is signed differently, meaning they won't be able to run on retail, and vice versa, which means for a9lh on a dev unit, you'll need to use one of their FWs

 

[dankzegriefer]

Please tell this is just a language gap and when you said "he" you meant "it"

Why?

 

[Swiftloke]

When this thread isn't just memes and shitposts, I feel like I'm learning stuff. I have little to no knowledge of low-level hardware/software, so this is all a really interesting read. If there's anything to test hardware-wise, I have a O3DS XL that I killed with a failed hardmod, so if that could be of use to anyone, just let me know.

Re-reading this thread I feel the same so let's keep it on topic please I'm really enjoying reading this.

 

[PabloMK7]

What about those Blue BootROM screens? Are the BootROMs locked after or before those can happen?

 

[Halvorsen]

What about those Blue BootROM screens? Are the BootROMs locked after or before those can happen?

I'm pretty sure they're locked still.

 

[dark_samus3]

What about those Blue BootROM screens? Are the BootROMs locked after or before those can happen?

They're probably locked... We won't know until we either A. Exploit it from that blue screen or B. Get it through other means and RE the blue screen code

 

[PabloMK7]

Isn't the code section of the bootroms accesible? Maybe they have some sort of debug port so they can make tests if an unit is broken.

 

[astronautlevel]

Isn't the code section of the bootroms accesible? Maybe they have some sort of debug port so they can make tests if an unit is broken.

Some of the bootrom is unprotected, and you're correct that it contains mostly functions used in protected bootrom.

 

[TR_mahmutpek]

I hope 1-2 month after we:

 

[HiD]

Out of curiosity, how much a decap would cost ?

 

[runetoonxx2]

Btw what would bootromhax do for us

 

[Aletron9000]

Btw what would bootromhax do for us

give us the secret keys so we can decrypt and encrypt stuff that can usually only be done on the 3ds on a computer

 

[runetoonxx2]

give us the secret keys so we can decrypt and encrypt stuff that can usually only be done on the 3ds on a computer

Ooo so basically give us cias like a month before release due to us being able to decrypt titles

 

[Aletron9000]

Ooo so basically give us cias like a month before release due to us being able to decrypt titles

no, more like, you can fully decrypt and encrypt games on a computer
generate encrypted title keys from decrypted title keys without a 3ds
encrypted title keys to decrypted title keys without a 3ds
etc.

I think some slot0x??Key?.bin files