Hacking Using custom launcher.dat with Gateway Go

[Slushie3DS]

Hm, if it crashes with smea's Launcher.dat I'd maybe ask around on #3dsdev, I'm sure someone might be able to help there. Although I haven't heard any reports on if this has worked successfully on a 2DS yet though.

If it doesn't, he definitely needs to change his ReadMe. It clearly states it will not work on N3DS, but it will work on 3DS, 3DS XL, and 2DS. I will poke in there tomorrow morning.

 

[Apache Thunder]

Yes, I have taken the Launcher.dat file from the download link in the ReadMe, tested it on go.gateway-3ds.com; I've taken the Launcher.dat from your hub, tested it on go.gateway-3ds.com; I've taken the unlaunch.dat from your hub, tested it on go.plxhack.us. They all resulted in the usual crash, but no magical black screen. I wish I could test if it is just my cartridge, but I have no other games at my disposal. I don't really know why it would be my cartridge, other than that it is made for the region my 2DS is made for, and that it was around when firmware was below 4.5. The worst of luck right now, is all. I appreciate the help.

Have you tried a QR code method? I think it's the "cleanest" method of activating the exploit as scanning a QR code from the camera will launch the browser and it won't load anything else except the URL the QR code pointed it to. You can generate QR codes to any URL you want via this site:

http://goqr.me/#t=url

It's what I used. Much faster way of getting into the exploit on a regular basis.

(use the camera activated via the shoulder buttons, not the camera app on the home menu. )

 

[Slushie3DS]

Have you tried a QR code method? I think it's the "cleanest" method of activating the exploit as scanning a QR code from the camera will launch the browser and it won't load anything else except the URL the QR code pointed it to. You can generate QR codes to any URL you want via this site:

http://goqr.me/#t=url

It's what I used. Much faster way of getting into the exploit on a regular basis.

I had not thought about that! I will try it out in a moment.

Actually, a question just popped into my mind. Does this only work for flashcarts? Or could I go online, buy say... Smas Bros. in Japan, and run it?

 

[Apache Thunder]

Well if you are using Smealum's region free exploit, I don't think you can use QR codes. Going to the camera might close out the Download play app. Not sure if someone tried it in this way. But for the standard booting into gateway mode it has worked and should work with custom launchers too so long as they are not dependent on hijacking other apps.

 

[Slushie3DS]

Well if you are using Smealum's region free exploit, I don't think you can use QR codes. Going to the camera might close out the Download play app. Not sure if someone tried it in this way. But for the standard booting into gateway mode it has worked and should work with custom launchers too so long as they are not dependent on hijacking other apps.

I went to test it, and yeah, it does hijack the Download Play app.

I'm still curious as to if this only works with flashcarts.

 

[Apache Thunder]

I recall the shoulder button camera is an applet. So activating Download Play app, then home menu back and using camera to scan QR code should still work. Download play is an app and both the camera and web browser are applets. So the camera applet will just close and the web browser applet will load with Download Play still running.

In theory it should still work.

 

[zoogie]

I recall the shoulder button camera is an applet. So activating Download Play app, then home menu back and using camera to scan QR code should still work. Download play is an app and both the camera and web browser are applets. So the camera applet will just close and the web browser applet will load with Download Play still running.

In theory it should still work.

regionthree works just fine through the camera qr applet.

 

[Slushie3DS]

regionthree works just fine through the camera qr applet.

I recall the shoulder button camera is an applet. So activating Download Play app, then home menu back and using camera to scan QR code should still work. Download play is an app and both the camera and web browser are applets. So the camera applet will just close and the web browser applet will load with Download Play still running.

In theory it should still work.

 

[Apache Thunder]

Your using the wrong QR gen mode. Make sure you selected the URL option before trying to gen a QR code. You might have been put on the default "text" QR code generator. (the little "globe" icon" is the URL mode. )

 

[Slushie3DS]

Your using the wrong QR gen mode. Make sure you selected the URL option before trying to gen a QR code. You might have been put on the default "text" QR code generator. (the little "globe" icon" is the URL mode. )

I had mistyped my URL, kek. It did work, however. Sadly, I still was given the routine error and crash. I wish Smea wasn't so distant.

 

[duke_srg]

Guys I have a solution for browser exploit that can be easily hosted on any web server with no server-side vode requirements. PLUS custom launcher filename can be passed in URL. Refer to http://gbatemp.net/threads/release-static-html-javascript-gw-multilauncher.379080/ for the source and my mirror link.

 

[flarn2006]

By "we may RE it", you mean other people will do the work for you, right?

Other people such as Yifan Lu?

EDIT: I just noticed this thread had 10 pages. Sorry if someone already posted this.

 

[krisztian1997]

Hmmm... Idea here. I've seen some launchers that load .bin files. Would it be possible to make a Launcher.dat for this, to load a .bin file?

Why you need that ? It takes a minute to edit the exploit to load a .bin instead of .dat, the extension doesn't matters because its a binary file.
Or you mean a launcher.dat which executes a bin... That a bit harder because you need to get kernel stuffs to can use more ram, 16kb for rop+code is not enought for complex code

 

[Slushie3DS]

This is a video of what is happening, like I promised, shinyquagsire23: https://vid.me/Oo6J

Device Shown: 2DS
Device Firmware: 8.1.0-19U (US Device)
Game Shown: Nintendogs + Cats - Golden Retriever And New Friends (US Game)
Game Firmware Needed: 1.0.0U
Browser Version: 1.7567
Tested Using: Launcher.dat with go.gateway-3ds.com & unlaunch.dat with go.plxhack.us
Hypothesis I: Running a game with such low firmware requirements is not able to create the same effect.
Hypothesis II: Running a game with the same region as the device will not be able to create this same effect.

 

[Sizednochi]

Device Firmware: 8.1.0-19U (US Device).

Correct me if I'm wrong, but doesn't Regionthree only works on 9.0 - 9.4?

 

[Slushie3DS]

Correct me if I'm wrong, but doesn't Regionthree only works on 9.0 - 9.4?

Hopefully, that is the case. I could have swore that Smea stated on his Twitter that it should work on 8.0-9.4, but 6.0-7.0 would have problems. Also, I think that Shiny has been making it more compatible.

 

[krisztian1997]

I have succesfully dumped 64kb of data from RAM. YAY

 

[Slushie3DS]

I have succesfully dumped 64kb of data from RAM. YAY

Can we get some pictures or a video of it happening? It's all very exciting.

 

[krisztian1997]

Can we get some pictures or a video of it happening? It's all very exciting.

Nothing really interesting on the 3ds because it crashes after the dump, I only looked a bit over what I dumped, but I think its 0x010000 bytes after 0x18370000 (looks like the GSP of spider, but I am not sure)

 

[shutterbug2000]

I have succesfully dumped 64kb of data from RAM. YAY

Would you mind posting or PM'ing me the launcher.dat? Would like to poke around !