Hacking Yifanlu releases 3ds cfw Cosmo3DS

[Akira]

Waiting for Shadowtrance's reply..please make my day

Waiting for you to make it work, so I can ask you directly LOL. Sorry for being noob guys Q_Q I'm stalking you ........

 

[Shadowtrance]

Waiting for Shadowtrance's reply..please make my day

What more can i say? I'm not bloody spoon feeding people anymore for anything.
There's plenty of info around on how to region change, now it's just even better with yifan lu's loader replacement in play.

 

[Pecrow]

I tried this for days a while back to get it to work, but it did not work. All i have done today is some tests with NNIDs and SecureinfoA files, for example, I tried injecting into my emunand a few different secureafiles but kept the serial number the same, and I get the error of "You cannot use this NNID on this System". So it is more then just the serial number that gets assigned to the nnid, either way, still does not work, lol

 

[ootnes2]

What more can i say? I'm not bloody spoon feeding people anymore for anything.
There's plenty of info around on how to region change, now it's just even better with yifan lu's loader replacement in play.

To clarify, region changing works fine (albiet using pre-yifan's method), it is the eshop fix that yifan introduced that people have not been able to get to work

 

[Shadowtrance]

Well i never did say i used an nnid at all, all i said was i got the region change done and work and was able to go on the eshop. That's it.

 

[yifan_lu]

Sorry I've been unclear. The eshop fix is for those who already performed the region change as detailed here http://yifan.lu/2015/04/22/opening-up-cardboard-crafting-an-american-new-3ds-non-xl/

It's a very complicated process and requires an O3DS. For the willing it's here https://gist.github.com/yifanlu/e80db121d38aceb8cca0e03cefd5853b but don't bug me about it because I don't even remember half the steps lol.

 

[ootnes2]

Well i never did say i used an nnid at all, all i said was i got the region change done and work and was able to go on the eshop. That's it.

@Dartz150 on page 5 of this thread suggested an nnid was necessary, to clarify, they are incorrect?

 

[Svaethier]

For some reason putting a jpn secureinfo file on my SD root makes my emunand and sysnand unbootable even after I take the file off my SS card so I need to restore both to use them :/

 

[Pecrow]

@Dartz150 on page 5 of this thread suggested an nnid was necessary, to clarify, they are incorrect?

I tried clearing out my nnid by injecting a clean file. So now on my emunand i have no NNID,,, and I get the exact same error... 007-2001 .... I would assume that NNID is not required then or atleast has no effect

 

[ootnes2]

Sorry I've been unclear. The eshop fix is for those who already performed the region change as detailed here http://yifan.lu/2015/04/22/opening-up-cardboard-crafting-an-american-new-3ds-non-xl/

It's a very complicated process and requires an O3DS. I will update this thread with directions http://gbatemp.net/threads/3ds-injector.420545/ but note that you need some level of skills to even understand the directions. Maybe someone can write a more noob friendly version in the future.

A number of people have region changed by just injecting a secureinfo_a, to put things to rest @yifan will your eshop fix work for them (either with or without nnid)? Also is it o3ds only or will it hypothetically work with n3ds?

 

[Pecrow]

I think It should work with new as well..Looking into those links I see the following, but understand nothing... oh the issues of being dumb...

Spoiler: Patches for eShop:

• Patches for eShop to work are needed every time you wish to connect to eShop on your region-swapped NNID linked console. This is because officially your legacy account is still in another region (and eShop application errors on this) even though your NNID is in the right region and only the NNID account is used for eShop. This also patches the update checks so you can enter eShop on 9.2.

Also, here's a couple more patches (9.2U) that may help people doing region swaps:

Set Serial in NNID and ACT
write(0xfffffd5,tuple(map(ord, "N3DS_SERIAL_HERE\0")),pid=0x7)
write(0x0013E74C,tuple(map(ord, "N3DS_SERIAL_HERE\0")),pid=0x22)
The purpose of this is to get your console to make requests with your N3DS serial and not the O3DS serial from your SecureInfo

Block Update Requests
write(0x0010DD28, (0x00, 0x20, 0x08, 0x60, 0x70, 0x47), pid=0x25)
Better patch than what's found in the other thread. The other patch may fail once in a while. This should always work.

Patch Country to US
write(0x001314F8, (0x06, 0x9A, 0x03, 0x20, 0x90, 0x47, 0x55, 0x21, 0x01, 0x70, 0x53, 0x21, 0x41, 0x70, 0x00, 0x21, 0x81, 0x70, 0x60, 0x61, 0x00, 0x20), pid=0x25)
Make RETURN requests respond with US instead of JP. This is needed AFTER you complete a NNID transfer to your japanese console since SOAP will still say your country is "JP" even though your account works in US eshop.
If you want to modify this to work with other region, here's the (lovingly) hand crafted assembly code

Code:
0:9a06 ldr r2,[sp,#24]2:2003 movs r0,#34:4790 blx r2
6:2155 movs r1,#85 ; 0x558:7001 strb r1,[r0,#0]
a:2153 movs r1,#83 ; 0x53
c:7041 strb r1,[r0,#1]
e:2100 movs r1,#010:7081 strb r1,[r0,#2]12:6160 str r0,[r4,#20]14:2000 movs r0,#0
(Note that your code is at MAX 0x16 bytes or you'll overwrite important stuff. Hence why I wrote this in assembly)

After a successful NNID transfer to your other region console, you must run those commands every time you want to access the eshop.


Also, can someone try to do these patches and create a new NNID. Then reboot, do the patches, and open eshop? I think it may allow eshop to work.

A heads up apology on butchering your hard work, but can someone translate that to a dumb-english please?

edit---

Wait, is this not the guide? https://gbatemp.net/threads/how-to-create-a-north-american-non-xl-new-3ds.387818/

NVM

 

[Pecrow]

I have been trying to launch succesfully the cosmo3ds cfw, but it ends on black screen on launch. Must be doing something wrong

 

[Svaethier]

After a successful downgrade into a jpn 9.2 from a US 9.2 rednand boots but after injecting the secure info file into it rednand becomes bricked it seems :/

 

[yifan_lu]

Sorry, took me a while to find my notes. It's here https://gist.github.com/yifanlu/e80db121d38aceb8cca0e03cefd5853b but don't expect me to explain it since I don't even remember.

 

[Pecrow]

Thank you for sharing, I wont be able to do it but still, thank you for sharing

 

[Svaethier]

I tried clearing out my nnid by injecting a clean file. So now on my emunand i have no NNID,,, and I get the exact same error... 007-2001 .... I would assume that NNID is not required then or atleast has no effect

Have you tried using tinyformat to format your emunand/rednand?

 

[Pecrow]

I have yes, But I think I was looking into the wrong thing... yifan's loader should do the trick, I wasnt able to find reinand's exact firmware.bin matching the sha1 to try the exact steps to replace the loader, to see if that does the trick. Ill wait for it to be included in rainand or until someone shares a modified firmware.bin with her loader.

 

[democracy]

So anyone know how to block updates yet with this exciting new loader? I thought this was one of the new exciting feature of this framework

 

[Queno138]

Correct me if I'm wrong, but I think a edited secureinfo only works with a CFW with its signatures patched

 

[Mazamin]

Correct me if I'm wrong, but I think a edited secureinfo only works with a CFW with its signatures patched

Not if it's legit