Misc ROM Hack Trojans and DS

[Draedon]

Hello forum members! I just registered to ask you about the trojans that existed on the Nintendo DS. I would like to learn more about them and save them on my computer to disassemble them and figure out how they work. I have already looked at some forum posts and found 2 trojans which are taihen and romloader but I found out that there are 4 more which are Mario Party DS and Dragon Quest IX and I also saw firmwarerewriter and
firmwarerewriter2 which could brick the DS. I am not sure if these 4 trojans exist and I would like to ask you if anyone knows about them and I would also like to scan them on virustotal.com.

 

[Moseii]

Thread 'How can I found the DS Trojans Horses ?'

T

Thread 'How can I found the DS Trojans Horses ?'

Mar 10, 2023

CrashMe, better known as DSBrick, is a trojan horse created in 2005 by Darkfader and distributed on Nintendo DS under the name "r0mloader" or "taihen" depending on the version.
There were 2 versions of CrashMe.
The malware pretended to be either a ROM patcher or a visionary of hentai photos (Japanese pornographic drawings).

Once the trojan was executed, it deleted the firmware, subsequently preventing the poor DS from booting.
Then he would then display either a brick wall or the said porn drawings.

Quickly, the discredited developer will...

• Theraptor33
• Replies: 17
• Forum: Nintendo DS

• 

 

[Draedon]

Yes I have already had time to read this post on the forum. The author of this post also seems to have been unable to find the 4 trojans I wrote about.

 

[SylverReZ]

I would like to learn more about them and save them on my computer to disassemble them and figure out how they work.

Don't think we're allowed to share malware samples, regardless, if obsolete and can be easily recoverable with the necessary tools. It's still considered destructive.

 

[Draedon]

Yes but could you provide the hash of these files so I can find them on virustotal.com? I'm curious how antivirus detected these files.

Post automatically merged: Jun 11, 2025

Tomato123 wrote in that thread that he has both trojans but I never realized which ones. Did he mean taihen and romloader or Mario Party DS and Dragon quest ix? By the way I read another thread and the author wrote that he found a link through which Dragon quest ix was distributed but he couldn't say where he got the link from. So this link he probably took from the Japanese forum I found it on the Internet and there was this link. It was kind of like a DS owada.

fake Zelda trojan
it was just a dual screen image with a brick wall and text over the top saying: "ZELDA will be out when its out so shut the fuck up - skip the small fry!"

 

[rvtr]

Tomato123 wrote in that thread that he has both trojans but I never realized which ones. Did he mean taihen and romloader or Mario Party DS and Dragon quest ix?

Would be taihen and r0mloader. The other two versions have not been dumped to my knowledge. Though I will have to look into the owata hash you posted in the other thread.

 

[Draedon]

Oh, I see you're into viruses like me! I hope you can find OWATA because I couldn't but it is on virus total and in the Kaspersky Lab database it was first scanned in 2009 on virus total and in 2016 by Kaspersky. The last scan for virustotal was done by me in 2025 and someone before me at kaspersky in 2024. This hash is the last hope to prove the existence of this file. If it helps you, here is all the information I managed to get:

It was discussed in 2007 on a Japanese forum and they called this virus something like Kurami. One person told me what he saw:

Hash： uBsjAeG79z 67,108,864 1dd8d82b8e60cfedce057abd2febc6fb

File name: [NDSROM] ついに流出！！！ DRAGONQUEST IX DQ9 ドラゴンクエスト ドラクエナイン. nds

THIS FILE IS NO LONGER ON THE INTERNET ANYWHERE, PLEASE DON'T BAN ME!!!! Kinda like he specified the size name and hash. Good luck finding it! If you find it, contact me: 6f726e6974697368656540676d61696c2e636f6d. Hex (coded)

fake Zelda trojan
it was just a dual screen image with a brick wall and text over the top saying: "ZELDA will be out when its out so shut the fuck up - skip the small fry!"
And two viruses about which there is no information:
Chlamydia trachomatis and Chronical. It's not clear what they were doing or where they were.

Hmm:
File name:[NDS][070517](ROM) カスタムビートバトル ドラグレイド.zip
Size:78.638.142
After unzipping, the file size was: 134 217 728
CRC: 19E80D12
If you look at the ROM information in DeSmuME V0.6.0, it says

Game Name: LUMINOUSARC
Code: ANIJKX
Manufacturer: 22603
Size: 7
ARM9 Size: 545540
ARM7 Size: 2360
Data: 548664

 

[Draedon]

Would be taihen and r0mloader. The other two versions have not been dumped to my knowledge. Though I will have to look into the owata hash you posted in the other thread.

did you manage to find it?

 

[Draedon]

Would be taihen and r0mloader. The other two versions have not been dumped to my knowledge. Though I will have to look into the owata hash you posted in the other thread.

Hey, do you still remember me? My friend and I, who were saving malware to different systems, just found DS Owata! Where should we put it?

 

[rvtr]

Hey, do you still remember me? My friend and I, who were saving malware to different systems, just found DS Owata! Where should we put it?

I'd try archive.org. I'll put up a link on my site as well.

 

[Draedon]

I'd try archive.org. I'll put up a link on my site as well.

What is your website?
Oh, I didn't notice that link. I thought your site was the one with the article about "CrashME."

 

[rvtr]

That's RGD. I'm an admin for that wiki, and I'd personally advise against uploading there. The article is good (assuming you were the one who made edits earlier today), but actual downloads are a bit iffy. That's only my personal opinion though.

 

[Draedon]

That's RGD. I'm an admin for that wiki, and I'd personally advise against uploading there. The article is good (assuming you were the one who made edits earlier today), but actual downloads are a bit iffy. That's only my personal opinion though.

Oh, it's you after all! Yes, I'm adding a little information about what I find. I have another Trojan, but for the PSP. Do you need it? PSPBricker.A.

In general, I recorded several videos on YouTube about NDS Bricker's, and in the end, they are not endless. So I suspect that we will only see each other again if I find another Trojan on NDS.

Post automatically merged: Apr 19, 2026

That's RGD. I'm an admin for that wiki, and I'd personally advise against uploading there. The article is good (assuming you were the one who made edits earlier today), but actual downloads are a bit iffy. That's only my personal opinion though.

Heh-heh, I think I left a hash of the ovata on your wiki. He who seeks shall always find

So, to answer the most important question I've asked myself my whole life: are the pictures in Ovata different from the pictures in Taihen?

The answer is no

 

[rvtr]

Oh, it's you after all! Yes, I'm adding a little information about what I find. I have another Trojan, but for the PSP. Do you need it? PSPBricker.A.

I don't do PSP stuff, but that'd be great for archive.org. Someone out there surely might need it.