Hacking [WIP] KARL3DS - Kernel access on N3DS via Ninjhax + Loadcode

[Apache Thunder]

I have pretty much confirmed Gateway is at fault. I was able to update my 4.3 sysnand to 4.5 using CIAs while in Gateway mode. The same could not be done using 6/7+ FW installs, so it's definitely Gateway is doing with newer firmwares that's messing up the update process.

 

[WulfyStylez]

Like I said before, signed CIAs can be installed with only arm11 kernel access, no firm rebooting or patching required. Bootstrap would let you make an installer like that once it's done.

 

[Zidapi]

Like I said before, signed CIAs can be installed with only arm11 kernel access, no firm rebooting or patching required. Bootstrap would let you make an installer like that once it's done.

Would we be able to kick the 3DS into safe mode to allow us to install system updates via .cia while still preventing people from installing ROMs via .cia to the homescreen?

 

[WulfyStylez]

Would we be able to kick the 3DS into safe mode to allow us to install system updates via .cia while still preventing people from installing ROMs via .cia to the homescreen?

Shrug. No need to do that when you can bypass the updater entirely anyways.

 

[dubbz82]

Shrug. No need to do that when you can bypass the updater entirely anyways.

Until if/when there's a way to safely update the system (i.e. update it and keep our exploits intact)

 

[WulfyStylez]

Until if/when there's a way to safely update the system (i.e. update it and keep our exploits intact)

I'm just talking about bringing less-than-9.2 people to 9.2. Updating and keeping 9.2 exploits intact is possible at the moment, but it might not be possible for long.

 

[Apache Thunder]

How does the system update menu work anyway? Are predownloaded updates from internet stored as CIAs? If so, I can just dump the official CIAs from SSB as they are still signed and unmodified sysnand will accept them.

I suppose I can wait for Kart3DS to advance far enough to allow this. I don't see the harm in at least allowing CIA installs. Since any CIAs not signed won't boot anyways.

 

[WulfyStylez]

broe shit i'm an idiot. CIAs don't have any RSA signing I guess. Well, you can still only install stuff with signed tmds, so that'd limit piracy to games preinstalled on systems.
But yeah, anyways, system updates are actually partially installed by the time you get an update notification. Initializing an update like that just finalizes the install of the relevant titles. Thus they're stored in title/tik/tmd format.

 

[Xenon Hacks]

broe shit i'm an idiot. CIAs don't have any RSA signing I guess. Well, you can still only install stuff with signed tmds, so that'd limit piracy to games preinstalled on systems.
But yeah, anyways, system updates are actually partially installed by the time you get an update notification. Initializing an update like that just finalizes the install of the relevant titles. Thus they're stored in title/tik/tmd format.

I guess that's sort of good news still would prefer full unrestricted CIA installation

 

[Apache Thunder]

There might be unrestricted CIA installation. But ones that don't install signed content won't help you much in Karl3DS. What you're wanting is unrestricted CIA booting.

I'm assuming the TMDs and what not that is downloaded using 3DNUS/UppdateCDN are signed so Karl3DS shouldn't have issues installing them.

 

[Xenon Hacks]

There might be unrestricted CIA installation. But ones that don't install signed content won't help you much in Karl3DS. What you're wanting is unrestricted CIA booting.

I'm assuming the TMDs and what not that is downloaded using 3DNUS/UppdateCDN are signed so Karl3DS shouldn't have issues installing them.

Think this can be spoofed?
Not too big on technical stuff something along the lines of, launch signed cia open browser launch something using spider which swaps the current running title too what you want?

 

[Xenon Hacks]

Kind of like hot swapping on the 360 too run modded content on a "legit" disc but using spider too force that swap.

 

[codychaosx]

well mm3d comes preinstalled on the eur limited edition so that would make for a legit cia

 

[Apache Thunder]

Lucky them. That means nothing for us USA consoles, because I don't think the CIA will work on US consoles even though it's legit because of the region locking and trying to change that will break the signing of the content. US versions of the bundle didn't have it preinstalled.

USA pirates got the short end of the stick...everyone else...was actually a benefit because they have a physical copy instead which I think I would prefer over a digital release because I like to actually own my games and not "lease" them in a DRM locked down device (even though it doesn't really matter now that I have exploited the console. )

 

[cearp]

with bundled games some sets some with a download code (like for eur albw bundle) which is the 'worst' option for us because the cia will be linked to your console.
then, some sets have physical editions, like the super root taisen ux japan bundle, good because the game is physical, and not tied to one console.
and then, the best one (only for us pirates) is the preinstalled game, so we can make a nice cia that will play without any patches, and can system transfer (of course, only on your region...)
physical is better than digital, but having a 'generic' digital version is the best since you have the most choice and power

very sad for usa region that they don't get mm3d preinstalled, japan and europe do, i really wonder the reason for difference. thankfully i don't usually use usa region

 

[codychaosx]

USA would still get a "legit" MH4U cia from the exclusive n3ds

 

[gudenau]

I must say, thanks for making the c code. It will come in handy for me later.

 

[froggestspirit]

I actually prefer that the MM3DS did not come with MM pre installed, that way you could still own a physical copy without wasting the money for a digital one. (only if you're like me and prefer a physical copy).

 

[Hashtastrophe]

I actually prefer that the MM3DS did not come with MM pre installed, that way you could still own a physical copy without wasting the money for a digital one. (only if you're like me and prefer a physical copy).

But you could still just buy a physical copy if you wanted. Not like including the digital would have made the N3DS (much) more expensive.

They could have at least included it as a download code, because then you could trade/sell it if you already preordered a copy of the game

 

[cearp]

That's actually a good question. Likely not on non-MSET-based exploits? Imma check right now and see if it's broken as-is though. Lemme just break my fingers rebooting when I crash.

EDIT: Nope, bugged as of right now.

bugged on mset and web? or you only have this stuff with mset right now?
and do you think a fix is viable?