Jump to content

Nintendo 3DS

Conéctate para seguir esto  

143 archivos

  1. 3DS Battery Checker

    Check your 3DS battery.
    by Core_2_Extreme.
  2. 3DS ROM Tool

    'rom_tool' is a command line tool designed to check/manipulate CTR Cartridge Image (CCI) files, usually referred to in the 3DS Scene as "3DS ROM dumps".
    Its major use is to reduce the size of CCI files (trimming) by removing dummy bytes(and being able to restore them again). Trimmed CCI files are compatible with the Gateway 3DS flash cart, and associated clones.

  3. 3DS Ropkit

    This is a codebase intended to be used with userland title exploits in general for Nintendo 3DS.
    The exploit would use the scripts here for locating the required ROP addrs. Then in the .s, it would include "ropkit_ropinclude.s", and if this is an regular-application "ropkit_boototherapp.s".
    Currently this is only usable with GCC with the "-x assembler-with-cpp" build option.
    This requires ropgadget_patternfinder.
    This handles booting the otherapp *hax payload, various defines are required.
    This automatically handles locating each 0x1000-byte page in .text used with the payload in physmem, across the entire APPLICATION memregion. Hence, this bypasses the codebin physmem randomization added with v10.4, which was later enabled for more titles with v11.0.
    by yellows8.
  4. 3DS Video

    This is a program for converting videos to the 3DS.
    Source Video - Choose the video you want to convert Video Folder - Folder to place converted video in (e.g. 3DS video folder) Format - Type of 3D video, or 2D video Quality - Quality (31 is lowest, 1 is max) Advanced... - Show advanced options (replace Quality with Bitrate & FPS) Bitrate - Bitrate of converted video Framerate - Framerate of converted video Notes:
    The included ffmpeg.exe is 32-bit. If you have a 64-bit CPU, you may want to replace it.
    *Fixed: Simple Mode now rounds down the original framerate to the nearest integer and uses a maximum of 30 fps by BelowZero
    *Fixed problem with Progressbars when the program was canceled before
    *Fixed MsgBox prompt in Simple Mode
    *Simple Mode now takes over the original framerate to a max of 30 fps by BelowZero
    *Conversion of very short Testfiles works correctly now by BelowZero
    *Added choice of the duration of the test file option by BelowZero
    *Added media infos by BelowZero
    *Added test file option by BelowZero
    *Added several audio options by BelowZero
    *Enabled upscaling of video framerate by BelowZero
    *Added keep aspect ratio option by amzg
    *Improved progress bars by BelowZero 
    *GUI rewrite by amzg
    *Mirrored input option fixed by amzg
    *Progress bars added by BelowZero and amzg
    *New error if destination folder has spaces
    *GUI is disabled while converting
    *Added mirrored input option
    *Added option for 480x240 resolution (default is still 400x240)
    *More bug fixes (thanks to amzg, xxNathanxx and Guy.brush at GBATemp)
    *Remembers video folder
    *Source tidied a bit
    *Fix splitting 3D video (thanks to Stylpe at GBATemp)
    *Fixing (some of) the bugs of v0.2
    *Added auto-splitting of files
    *Added "Advanced..." options
    *Fixed bugs of v0.1
    *Initial release
    by SifJar.
  5. 3ds_browserhax_common

    This repo is for intended for any 3DS title which has some form of web browser. This repo is for generating ROP-chains for use with the previously mentioned targets: no browser exploit(s) are contained in this repo. Browser exploits seperate from this repo can use this for the actual ROP-chain + any required ROP gadgets etc.
    Supported titles and versions
    The versions below are listed in the following format: browserver titlever sysver. Which browserver(target title + version of the title) to use is automatically determined by checking the user-agent. Due to this, when accessing hax with this, the New3DS system web-browser must be set to use the normal user-agent, not the mobile user-agent(the mobile user-agent is the same for all versions).
    Also note that with the system web-browser, only the last number in the system-version(X.X.X-NUPVER) actually matters for the browser version. Loading arm11code with the Old3DS browser is only supported with >=v5.0 NATIVE_FIRM, if you want to use pre-v5.0 NATIVE_FIRM with this you would have to modify the source. Normally doing so isn't needed since the *hax payloads don't support system-versions that old anyway.
    Only the USA, EUR, and JPN browsers are supported(with the exception listed below): the main ExeFS codebin are all identical for these regions, unlike the other regions.
    Note that for CHN and TWN the loader(with 3ds_arm11code_chntwn.s) is broken(the menustub fails to auto-locate APT_GetServHandle due to older homemenu/ctrsdk code).
    Old3DS system Internet Browser(spider):
    1.7412 v6 2.0.0-2..2.1.0-3 1.7455 v1024 2.1.0-4..3.0.0-6 1.7498 v2050 4.0.0-7..4.5.0-10 1.7538 v0 4.2.0-9..4.5.0-10 This is the first version of the CHN+KOR (and probably TWN) browser. This is supported for CHN and KOR. 1.7552 v3075 5.0.0-11 / v3088/7.0.0-13 (v3088 main ncch is the same as v3075, only the manual CFA was updated) (that is, 5.0.0-11..7.0.0-13) 1.7567 v4096 7.1.0-16..9.5.0-22 1.7585 v5121 9.5.0-23..9.8.0-25 1.7610 v6149 9.9.0-26..10.1.0-27 CHN, KOR, and TWN are also supported for this. 1.7616 v7168 10.2.0-28..10.5.0-30 CHN, KOR, and TWN are also supported for this. 1.7622 v8192 10.6.0-31 CHN, KOR, and TWN are also supported for this. 1.7625 v9232 10.7.0-32..11.0.0-33 CHN, KOR, and TWN are also supported for this. Handled the same way as 1.7622. 1.7630 v10240 11.1.0-34 New3DS system Internet Browser(SKATER):
    1.0.9934 v10 9.0.0-20..9.2.0-20 1.1.9996 v1027 9.3.0-21..9.5.0-23 1.2.10085 v2051 9.6.0-24..9.8.0-25 1.3.10126 v3077 9.9.0-26..10.1.0-27 KOR is also supported for this. 1.4.10138 v4096 10.2.0-28..10.3.0-28 KOR is also supported for this. 1.5.10143 v5121 10.4.0-29..10.5.0-30 KOR is also supported for this. 1.6.10147 v6144 10.6.0-31 KOR is "supported" for this but it's not tested. 1.7.10150 v7184 10.7.0-32..11.0.0-33 KOR is also supported for this. 1.8.10156 v8192 11.1.0-34 Exploit testing
    If you want to test a browser exploit on an unsupported browser version just to see if it at least crashes, you can use this: "URL?browserver={ver}". Where ver is one of the browservers listed in 3dsbrowserhax_common.php, such as "85" for New3DS or "7" for Old3DS(without quotes), or whatever versions the exploit page supports.
    Usage with seperate exploits
    With php, this repo can be used with the following:
    Include config based on browserhax_cfg_example.php, see that file for details. Include 3dsbrowserhax_common.php. Set the global $ROPHEAP variable to an address under the process which the ROP-chain can use for storing arbitrary data(for example, this could be memory where data was sprayed for non-ROP-chain data, since that data isn't needed anymore at this point). Call generate_ropchain(). This generates a ROP-chain which can be included in JS via the $ROPCHAIN global variable. To generate a binary-only ROP-chain instead, set the $generatebinrop global variable to value 1 before calling generate_ropchain(). The ROP-chain data can now be used for generating the final html/js, for example: "var ropchain = unescape($ROPCHAIN);" This can be used before the above ROP-chain data, for use as a ROP NOP-sled: "unescape($NOPSLEDROP);" This can be used for spraying the stack-pivot gadget address, like for vtable funcptrs: "unescape($STACKPIVOT);" This can be used when the exploit requires using the "pop {pc}" gadget: "$somestr.= genu32_unicode($POPPC);" Configuration
    See above regarding the cfg file.
    By default, when $ropchainselect wasn't initialized by browserhaxcfg_handle_urlparams(), it will set $ropchainselect to value0 and $arm11code_loadfromsd to value2. When this is with a spider version prior to system-version v7.1, $ropchainselect will be set to value1. Next, regardless of browser-version, it then calls browserhaxcfg_handledefault().
    Values for $ropchainselect:
    0: This "ROP-chain" is just an address for THROW_FATALERR. Hence, throw_fatalerr() will be triggered when the above browserhaxcfg_handledefault() path is executed when browserhaxcfg_handledefault() doesn't initialize $ropchainselect. 1: <=v4.x arm9hax also implemented by oot3dhax under EXECHAX=3, see 3dsbrowserhax_common.php generateropchain_type1(). 2: ARM11-code loading via gspwn, see $arm11code_loadfromsd below. The payload should be position-independent-code without any GOT, since the payload is loaded to R-X memory where the address varies per title version. The payload is called with r0 set to an address of a structure mainly containing funcptrs for various functions in the process, see generateropchain_type2(). r1 is initialized too for a relocated stack address if the payload needs it. The max payload filesize is 0x8000-bytes. At the start of this ROP-chain, the sub-screen colorfill is set to display yellow, at the end it's set to display gray. 3: Read the contents of a file then dump it to SD. This uses OPENFILEDIRECTLY. 3dsbrowserhax_common.php must be modified in order to use this, see generateropchain_type3(). At the start of this ROP-chain, the sub-screen colorfill is set to display red, at the end it's set to display blue. 4: This uses the service-access-control bypass fixed with system-version v7.0, then it uses NSS:RebootSystem. This can be used for region-free on system-versions below v7.0. This was originally implemented a while after the regionfree method with NSS:RebootSystem was originally discovered: http://3dbrew.org/wiki/3DS_System_Flaws#Standalone_Sysmodules Values for $arm11code_loadfromsd:
    0: The arm11code payload is embedded in the ROP-chain data itself. 1: The arm11code payload is loaded from SD via this filepath: "sdmc:/arm11code.bin". 2: The arm11code payload is downloaded by requesting a binary with http, see the above example config and ropgen_httpdownload_binary() in 3dsbrowserhax_common.php. The binary is downloaded to SD, once it's finished with that the file has all-zeros written to it, then it attempts to delete the file(which doesn't actually delete the file, unknown why). Browserhax usage info
    How each exploit is triggered depends on the exploit, see the documentation for the seperate exploit for that. As said below, just triggering the exploit successfully is all that's really needed besides SD "/boot.3dsx".
    3DS Webkit exploits can be quite unstable. When a webkit exploit is very unstable, formatting the browser savedata is recommended if you haven't done so before with the current exploit URL. If you want, from hblauncher-payload booted via browserhax you could install exploit(s) listed here: http://3dbrew.org/wiki/Homebrew_Exploits
    You can have the browser auto-load the exploit page if you return to Home Menu from that page. For exploits which automatically trigger, you may have to disable wifi/etc before attempting to load the page in order to return to Home Menu successfully before the exploit actually triggers.
    Homebrew Launcher
    This codebase is mainly intended for loading an arbitrary arm11code payload, at a vaddr which varies per title/version. Homebrew-launcher can be booted via this arm11code payload, with the loader included with this repo. The spider version of this loader automatically locates the required addresses and such on-the-fly. The New3DS web-browser is supported by this too, without anything that's system-version/region specific(besides the data loaded from the payload). The loader determines whether it's running under spider or SKATER by checking the New3DS flag loaded via NS(command 0x01020000 http://3dbrew.org/wiki/NS_and_APT_Services). Therefore, do not use this payload on Old3DS outside of spider, and on New3DS do not use this loader outside of SKATER.
    In some cases on Old3DS, a crash/"hang" may occur with an orange or white bottom-screen. If it ever returns to Home Menu when the bottom-screen was orange, then a reboot is required.
    This loader will initially try to load the hblauncher ropbin payload from SD-card "/browserhax_hblauncher_ropbin_payload.bin". This is separate from the otherapp payload.
    If loading from SD fails, this loader will then automatically detect the required payload, then download it with HTTP. This latter method is highly recommended(unless this method doesn't work well for the user): with a "/boot.3dsx" on SD card, there's zero other setup/user-input needed once the browserhax is triggered successfully.
    When loading the payload with both of the above methods fails, a crash will be triggered.
    Hanging/crashing at an gray-bottom-screen means *hax payload loading failed, normally this is due to network issues(you should reboot your system when this happens).
    The loader for Old3DS runs actual native code under the context of Home Menu, if you really want to run your own code under Home Menu you can modify that code in the loader. This code runs very early in the Home Menu process boot.
    Screen colors
    When using browserhax the bottom-screen colorfill will be set to various colors in the following order:
    Yellow: Browser ROP started running, this also means the exploit itself worked fine. Gray: This colorfill is set right before jumping to the initial arm11code binary, for running native code for the first time. Orange: This is set after the *hax payload was successfully loaded into memory via HTTP/SD. White: This is set by the *hax payload itself when it starts running. Credits
    megazig for helping with APT(for APT stuff once the Home Menu code in the loader starts running) during the initial + eventually successful Old3DS Home Menu takeover implementation.
  6. 3DSBank

    Have you hit the 300 title limit on your 3DS, and/or want more than 300 titles, but don't want to make an EmuNAND (or 2nd one), or use another SD card?
    The answer, is 3DSBank!
    With this, you can store your Nintendo 3DS folder into a bank, and select or create another one to use, containing your other titles (and themes, and badges).

    Adding custom names
    The custom names can be defined in 3DSBank/3DSBank.ini like so:
    [3DSBANK] SLOT_NAME_0 = Favorites SLOT_NAME_1 = More Fav. SLOT_NAME_2 = Homebrew Games etc.... Credits
    DrStraightface: Updated source to allow custom naming of folders, and having currently active folder selected on startup.
    by RocketRobz.
  7. 3DSController

    A 3DS homebrew application which allows you to use your 3DS as a wireless controller for Windows.
    Setup and Usage
    Firstly, if you want to be able to register the circle pad or touch screen as a joystick you will need to install vJoy. However, if you just want to use keyboard buttons, this is not necessary.
    Extract the archive and copy the executable in the 3DS directory with the extension that applies to your loader: 3DSController.3dsx and 3DSController.smdh for Ninjhax, 3DSController.3ds for flashcards, or 3DSController.cia for CFWs, into your 3DS's SD card or flashcard's micro SD card.
    Copy the file 3DS/3DSController.ini to the root of your 3DS's SD card, and change the line that says IP: to match your computer's local IP.
    If you are unsure of your local IP address, run 3DSController.exe and it will tell you.
    Run 3DSController.exe on your computer. If you are prompted, make sure to allow it through your firewall.
    Start the application on your 3DS, there is no GUI, it will automatically try to connect to the IP address you put in 3DSController.ini.
    If it wasn't able to read the IP from 3DSController.ini, it will notify you and quit.
    Otherwise, you should just see a black screen, this is a good sign. To see if it works, open Notepad and press some buttons on the 3DS, they should show up. You can also test if the joystick works by going to Configure USB Game Controllers in Control Panel, it shows up as vJoy.
    If using version 0.4 or above you can press L, R and X to bring up the keyboard. Press L, R and X again to close it.
    If using version 0.6 or above, up to 16 joystick buttons are available. If you wish to use more than 8, you need to configure vJoy. Search in your start menu for vJoyConfig and set buttons to 16.
    If using Ninjhax press Start and Select to return to the Homebrew Loader, otherwise you can just exit with the Home button.
    Setup and Usage (Linux)
    -For keyboard emulation Follow the Windows instructions, but use 3DSController.py instead of the EXE.
    -For Joystick emulation, first, install python-uinput. BEWARE: The latest release of this library as of the writing of this tutorial is 0.10.2 which is broken for most updated systems. Download the master branch directly.
    Make sure that uinput module is running. You can do it from cosole like so: #!sudo modprobe uinput
    Then, follow the Windows instructions, but use 3DSController_gamepad.py instead of the EXE.
    May work on OS X too, but this is not tested.
    Find the line Port: 8889 and change it to your desired port, do this for both the 3DS's 3DSController.ini and the PC's 3DSController.ini.
    To use custom key bindings, just change the PC's 3DSController.ini file, it should be straight forward.
    Configuration (Linux)
    The configuration for the keyboard emulation is in 3DSController.py, not the INI.
    The configuration for the joystick emulation is in 3DSController_gamepad.py, not the INI.
    Make sure that you are using the 3DS and PC application from the same release, Make sure your 3DS has internet access (turn on the switch on the side of the 3DS so that an orange light shows) and is on the same network as your PC, Make sure that the 3DSController.ini is in the root of your 3DS's SD card (not flashcard micro SD), Make sure that the 3DSController.ini has the local IP of your computer, not your public IP, Make sure your firewall isn't blocking the application, Try using a different port (change the port for both the 3DS and PC's .ini file), by CTurt.
  8. 3DSend

    Graphical interface under Windows and Linux allowing to install cias easily! : D
    What is 3DSend?
    3DSend is a Windows and Linux multi-platform utility allowing to install cias stored on a PC directly on a 3DS via FBI or any other application which can install cias thanks to a link or a QR code.

    The main features of the application are:
    The installation of CIAs from a PC on the same local network. An integration of TinyDB. A history to allow you to choose QR codes from the old ones generated. A choice of server port for people with a particular network configuration. The strong points of 3DSend:
    Better performance compared to competitors (optimized application loading). Also works without internet access, only a local network is necessary (except for TinyDB). Works under Windows and Linux.
  9. 3DShell

    3DShell (pronounced 3D-Shell) - is a multi-purpose file manager GUI for the Nintendo 3DS.
    The program is currently in its early stages and lacks many features that are currently in development. More information will be given once the program matures.
    This program's design elements are clearly inspired by CyanogenMod's built in file manager, and so I take no credit for that.
    Current features:
    Storage bar (at the very top, just beneath the current working directory). Precise battery percentage using mcu::hwc Creating new folders Renaming files/folders File/folder deletion Copy/Cut files and folders Multi-select items for delete/cut/copy (using Y button) FTP server (Press select or tap the ftp icon to toggle) Image preview (If the image is around 400 * 480 which is the size of both screens, the image will be split in half and displayed. Have a look at the screenshots below). Support for the following image formats. PNG, JPG, GIF[un-animated], TGA (untested ->) HDR, PIC, PNM, PSD) Zip file extraction. Searching for directories (allows you to quickly visit a directory by clicking the search icon on the top right (bottom screen).) File properties - lets you view info on current file/folder. Screenshots - Press (L + R) -> (/screenshots/Screenshot_YearMonthDay-Num.bmp) Fast scroll - Use analog stick File's time-stamp Browsing CTRNAND MP3, vorbis (ogg), flac and wav playback support. (All thanks to deltabeard/MaK11-12) Dir list Sorting (alphabetical - ascending, alphabetical - descending, size - largest to smallest, and size - smallest to largest) Online updater (nightly/releases) Credits:
    deltabeard/MaK11-12 for sound support. mtheall for ftpd. Steveice10 for allowing me to use his screen.c C3D code as a template to build and make modifications on. preetisketch for the banner. FrozenFire for the boot logo.
  10. 3DSident

    ctr_vercheck was originally created by wolfvak - It was initially intended to be a small application for the Nintendo 3DS to check your current FIRM and OS version only.
    I decided to fork this project, and added additional device info similar to PSPident, hence the name 3DSident.
    Current kernel, FIRM and system version detection. Display initial system version. Model detection with code name and hardware info (Retail/Devboard/Debugger/Capture unit) Displays screen type (TN/IPS). Displays region. Displays language. Displays MAC address. Displays serial. Displays SDMC and NAND CID Displays NNID username, principal ID, persistent ID, transferable base ID, country and timezone. Displays device ID. Displays soap ID. Battery charging status. AC Adapter connection status. Battery percentage (actual battery percentage using mcu::HWC). Displays battery voltage (estimated) and unknown format. Displays MCU firmware. SD detection. Displays SD free and total storage capacity. Displays CTR free and total storage capacity. Displays TWL free and total storage capacity. (GUI exclusive) Displays TWL photo free and total storage capacity. (GUI exclusive) Displays number of titles installed on SD and NAND. Displays number of tickets installed. (GUI exclusive) Displays volume slider state and percentage. Displays 3D slider state and percentage. Displays Wifi signal strength. Displays IP address. Displays current brightness. Display auto-brightness status. (GUI exclusive) Display power saving mode. (GUI exclusive) Display sound output mode. (GUI exclusive) Displays if the console is a debug unit. (GUI exclusive) Displays headphone/audio jack status. (GUI exclusive) Card slot status and inserted card type (CTR/NAND). Displays parental control pin, email address and secret answer. (GUI exclusive) Displays home menu ID. Displays Wifi slot info (SSID, password and MAC address). Displays original/NAND local friend code seed. by joel16.
  11. 3DStris

    A Tetris clone for the Nintendo 3DS.

  12. Acekard 2 Official Firmware

    Official firmware for the Acekard.
    How to use ak2
    Please copy akmenu4.nds and folder __ak2 to the root of your TF card. And copy the rom or homebrews to any folders of your TF card. Then insert your TF card to your ak2 and insert your ak2 to DS. Turn on your DS and enjoy!
  13. AceKard All-In-One (AKAIO)

    AKBBS has been usurped thanks to amazing efforts of Normmatt in merging firmwares!
    AK-AIO is custom system software for *BOTH* the AceKard RPG and AK2/AK2i.
    Base features
    For those unfamiliar with all the additions the AKBBS (now AIO) software has in comparison to the stock firmware, here's a sampling of the bigger changes:
    * Cheat Improvements - R4/XML Cheat File processing
    * "Future Adaptable" Multi-loader support
    * Multiple Save Slots per title - with copying between slots
    * Slot-2 Integration - EZ3in1 (w/GBA Patching) and older FlashAdvance Pro carts
    * Shortcut tweaks
    * Multi-page Start Menu
    * Filetype-based external icon support
    * Per-Rom settings for soft-reset/download play/cheats
    * Copying/Cutting/Deleting SAV files along with NDS files
    * Several improvements to 2byte language support
    * SAV backup/restore from within GUI (.SAV<->.BAK)
    * Wifi updating of Loaders
    Version History
    AK-AIO 1.9.0
    + More of a "Game Fix/Compatibility" release
    + Pokemons, Pokemons, Pokemons compatibility fixed
    + Updated to compile with latest DevKitArm
    + Cheats updated to CMP Cheat code Database version 6/29/2012
    AK-AIO 1.8.9z
    + All this time for just a "z" in file version? Yes.
    + Finally fixed per-file/extension custom icons... broken since 1.8.0
    + Update loader to Mighty Morphin Power Loader release (Jan 2012)
    + Not much else; poor DS seems to be lonely with its 2D-ness :(
    AK-AIO 1.8.9
    + Internal name listing mode will show the filename if there's a lack of info (e.g. - DS Program File)
    + Arm7 fix for slow windows in 1.8.8
    + Many, many, many game fixes
    + New default skin (EvoI)
    + Optimizations in icon display
    + Code cleanup to reduce memory usage

    AK-AIO 1.8.8a
    + Fixed display problems with some bmp files.
    AK-AIO 1.8.8
    + Updated to devkitARM r34 and libnds 1.5.2
    + Added two small icon view modes: Filename and Internal Name
    + Touchscreen scrolling has been inverted by default
      - Mimics touchscreen phone/tablet scrolling
      - Can be toggled in Advanced Settings screen
    + FAS1 Modifications to allow modifying specific SRAM Banks and dumping the entire 256KB SRAM
      - Options in the FAS1 Menu
    + Added support for 24bit and 32bit bitmaps for skins
      - Note these get down sampled to 16bit so no increase in available colors.
    AK-AIO 1.8.7
    + Added Wifi Cloud Save button to Akmenu.
    + Added Russian translation (Thanks mc_B3oWoL).
    + Added Danish translation (Thanks oz8hp).
    + Updated Korean translation (Thanks cherries4u).
    + Updated Spanish translation (Thanks felixsr).
    + Updated Dutch translation (Thanks Jodyza).
    AK-AIO 1.8.6a
    + Fixed real cart being detected as clone after softreset.
    AK-AIO 1.8.6
    + Fixed left spin box sometimes having text on it.
    + Fixed spin box width calculation.
    + Cheat Window now uses 60% less memory for scrolling cheats/notes. Finally!
    AK-AIO 1.8.5
    + Fixed usrcheat parsing bug where enabled codes in folder caused a crash during parsing.
    + Fixed PassMe booting for Slot 2 (L+A on Slot 2 icon).
    + Fixed bricking on old AK2s.
    AK-AIO 1.8.2
    + New Anti-Anti-Piracy work around (enabled by default).
      - Works on all SD and doesn't break download play.
    + Fixed various ak2 only bugs. (global settings being reset after softreset, etc)
    AK-AIO 1.8.1
    + Updated French translation (Thanks corenting).
    + Updated German translation (Thanks SignZ).
    + Updated Korean translation (Thanks cherries4u).
    + Fix GBA Auto saving.
    + Fix some corruption issues.
    + Optimize .cc parsing.
    AK-AIO 1.8.0
    + New Filesystem library (should be more reliable and less buggy than libfat).
    + Adjusted key repeat delay from 3 seconds to 1 second.
    + zLib updates since lord knows how long it's been since that was first added
      - Credit to GPF for sources (http://gpf.dcemu.co.uk/)
    + Added ability to delete non-empty folders.
    + Changed the way the list is sorted so its case insensitive.
    + Fix custom icons.
    + Updated French translation (Thanks corenting).
    + Updated German translation (Thanks WiZaRd).
    + USRCHEAT.DAT is now maintained by yusuo and hosted at akaio.net
      - TempDB in Wifi Plugin replaced by AKAIO (yusuo)
      - WhatsNew works for it as well
      - We have complete control of your cheats. Be afraid.
    + Added Anti-Anti-Piracy work around.
      - This seems to break single card download play atleast for now so its disabled by default.
      - On AKRPG it creates a filename.ap file for each game you launch with the option enabled.
      - On AK2 it creates an ap.bin file in the __aio folder.
    + Fixed usrcheat.dat parsing when the game is the last in the file.
    AK-AIO 1.7.1
    + Updated English language file.
    + Added option to disable Icon Animations.
    + AKRPG SD now works the same way as AK2/AK2i.
      - Direct SD Saving.
      - Save size set to 512KB unless a bigger size is needed.
    + Added some shortcuts:
      - L+UP = Cheats enabled for selected game.
      - L+DOWN = Cheats disabled for selected game.
      - L+LEFT = Soft-Reset enabled for selected game.
      - L+RIGHT = Soft-Reset disabled for selected game.
    + Added Cheat Scrolling speed option
    + Fixed Wifi Settings Window not saving what you've chosen
    + Wifi easter egg?
    AK-AIO 1.7
    + Updated Brazilian Portuguese translation (Thanks Cereal Killer).
    + Updated Polish translation (Thanks Tatsuhikki).
    + Updated Czech translation (Thanks penthaler).
    + Added Norwegian translation (Thanks Glisern).
    + Updated Italian translation (Thanks Miottolo).
    + Updated Korean translation (Thanks cherries4u).
    + Added Thai translation (Thanks kikukiku).
    + Add option to disable homebrew softreset globally.
    + Add homebrew softreset support for libnds 1.4.3 (IRQ hooking only)
    + Updated savelist.bin
    + Added Yellow Wood Goblin's updated GBA ROM patching routines.
    + Fix GBA rom as shortcut detected as NDS rom bug.
    AK-AIO 1.6 RC2
    + Show error screen on boot if your using a clone.
    + Added Korean language (Thanks cherries4u).
    + Added Czech language (Thanks penthaler).
    + Fixed hiddenFileNames ini bug.
    + Now shows an error if a clone is detected.
    + Updated savelist.bin
    AK-AIO 1.6 RC1
    + Fixed Internal Name language setting.
    + Fixed Time Stamps on save files.
    + Fixed Setting Skin and Language at the same time not saving.
    + Homebrew Softreset (AK2/AK2i Only).
    + AK+ loader removed (Unsupported since it was first added in 1.0).
    + Fixed some cheat window bugs.
    + Fixed custom icon bug.
    + Updated homebrew argv support.
    + Updated savelist.bin
    AK-AIO 1.5.1
    + Fix Date/Time retrieved from files.
    + Fix Cheat Window Freeze/White screen problem. (Thanks Baka_Kyuubi84 for the test case)
    + Added Swedish language file. (Thanks the_engineeer)
    + Added Brazilian Portuguese language file. (Thanks Cereal Killer)
    + Updated savelist.bin
      + Zelda now defaults to the required 1MB (If your using a 512kb save you will need to start again because the save file is corrupt, Alternatively you can manually set the save size backto 4Mbit and continue but it will cause problems later into the game).
    + Fix disk icon appearing over other windows.
    + Settings window shows long filenames for skins and languages now.
    AK-AIO 1.5
    + Fixed issue with the hiddenFileNames globalsettings option not accepting non lowercase filenames.
    + Optimizations to the AK2 dldi should be a little quicker now.
    + Update Dutch translation (Thanks MarioWaza).
    + Update Spanish translation (Thanks Pendor).
    + AK2/AK2i clones are now officially unsupported.
    + Gba icon has been removed from main selection screen on DSi.
    + Removed outdated plugin system.
    + Per rom GBA frame support (256x192x15bpp)
      - Place BMP with internal game id of gba rom in __aio/frames.
    + Added support for save sizes up to 256Mbit (32Megabyte).
    + .sav is now default save extension.
    + Reverse Alphabetical List sorting (set sortListAlpha=0 in globalsettings.ini).
    + Auto-Anti-Piracy Patcher updated.
    + ARGV support for homebrew.
    + New DSi detection (Shouldn't show slot2 icon after softreset on ak2i now).
    + Disable start menu by adding "LockStartMenu = 1" to your globalsettings.ini
    + Fixed Trainer Toolkit support.
    Please refer to LoaderChangelog.txt for compatibility fixes.

    AK-AIO 1.4.1
    NOTE: It's recommended you delete your optionlist.bin file in the __aio folder when updating to this release as the file structure has changed.
    + Soft reset Improvements.
    + Fixed corrupt Language files (Italian, German and Japanese).
    + Added missing font needed for chinese.
    + Added setting for Hide Extensions to the settings window.
    + Fix optionlist.bin corruption.
    + Spin boxes wrap around.
    + Game Fixes (DMA-Save Mode):
      - Princess Maker 4
      - Club House Games
      - Mario and Luigi RPG 3
      - Rune Factory A Fantasy Harvest Moon
      - Animal Crossing (Currently cannot be run in this mode, force usage of DMA mode).
      - Hidamari Sketch Dokodemo Sugoroku x 365
    + Game Fixes:
      - Grand Theft Auto Chinatown Wars (U) Thanks gelu.
      - Mario and Luigi RPG 3 (J) (new patch, thanks gelu).
      - Layton 3 (J) (new patch, thanks gelu).
      - Animal Crossing.
    + Updated French language (jp33).
    + Fix backlight always enabled on DS Phat.
    + Fix the Per-File icon problem if you have similar games (e.g. - Golden Sun.gba and Golden Sun 2.gba)
      - In blissland, GOLDEN~1 is the same as GOLDEN~5
    + Wifi Updater has lots of fixes relating to GBATemp's new, crappy, server and its timeouts
      - We appreciate the hosting, but seriously... everything needed to be rewritten to adapt to the crap speeds
    NOTE: DMA-Save mode is now default so DMA mode (red loading text) is now enabled by holding X during loading.
    AK-AIO 1.4
    + Settings window uses tabs now, merging Settings, Advanced Settings, and Patches options (Thanks Gelu)
      - Use L/R to cycle through tabs
    + Misc cleanup of the gui.
    + 3in1 options now have FAS1 settings merged (detects 3in1/FA at selection, displays options accordingly)
    + Language files have some addition "title" additions/changes
    + Leapyear code fixed because the DS sucks at reporting variables nicely.
    + Updated German language (moviecut).
    + Reset more of arm7 before runing a game (Thanks Gelu).
    + 3in1+ Fix for Opera (Untested, Thanks cory1492).
    + Game fixes:
      - 3369 Mario and Luigi RPG 3 (J) fixed.
    AK-AIO 1.3.5 (Unreleased)
    + Game fixes:
      - 0645/0777 Star Trek Tactical Assault
      - General save fixes. (Thanks Gelu for noticing a silly bug).
    + New Patching Mode hold X while launching a rom.
      - Fixes video and sound glitches which occur in old patching modes.
      - NOTE: This is still experiental so it isn't default.
    + Folders now show their size in the Info window.
    + Soft Reset fixes.
    AK-AIO 1.3.1 (Unreleased)
    + Game fixes:
      - 1752/2314 My Spanish Coach fixed.
      - 2243/2412 Pokemon Mystery Dungeon Explorers of Darkness fixed.
      - 2385 Daigasso Band Brothers DX fixed.
      - 2906/2971 Star Wars The Clone Wars Jedi Alliance fixed.
    + Unnecessary Guru Meditation screens on the AKRPG is fixed.
    + Soft Reset fixes.
    + Copying files should work better.
    + Game icons that rely on the nds firmware's background will display properly (Thanks Gelu).
    + Misc cleanup.
    AK-AIO 1.3
    + AK2i support (options that could potentially harm AK2i are disabled)
    + Loaders are now external and can be updated separately to the GUI.
      - Updated Wirelessly! (choose Loader Update in Wifi Update option of Start Menu)
      - Small changelog, download, update all possible
      - Loaders only updated for card being used (e.g. - AK2 users only download ak2loader)
      - Resume supported
      - Many loaders are beta, know this and shut up
      - Manual download page @ http://akaio.gbatemp.net/loaders/
    + Wifi Cheat Update has resume support!
      - Prompts after confirming you wish to "Try Again"
    + Files are now sorted alphabetically (Forced at the moment, sorry).
    + Added Some of Gelu's patches:
      - Faster Directory Listing.
      - New List mode - Internal nds names.
      - Lots of Soft Reset Fixes for the AKRPG.
      - new DMA mode and BBDX save fix for the AKRPG.
      - font system (fully supports unicode now :D).
      - New FIFO IPC System (Behind the scenes stuff).
      - Massive amount of soft reset fixes mainly for the AKRPG.
      - Game fixes (Brain Age 2 (K), Chrono Trigger (U/J),...).
      - Added a few game related fixes (Think Kids, Tropix, Bleach 2).
      NOTE: because of new font system, language files now need to be utf8. Some have been converted such as English and Japanese but others will need to be saved as utf8 to work properly.
    + Japanese games now show Japanese characters in rom info window when language isnt set to Japanese
    + Added a few game related fixes (Yoshi's Island, Star Trek, NSMB).
    + Files are now sorted alphabetically (Forced at the moment, sorry).
    + Pokemon Diamond/Pearl/Platinum can now read saves for R/S/E/FR/LG from ewin and 3in1 (AK2 Only for now).
    + Cheat engine fixes. (AK2 and AKRPG only for now).
    + Optimizations all round (Shouldn't have any lag in GUI anymore, also shouldn't experience any lag while saving).
    + Italian language added, language updates for English
    + New 3in1 options window.
    + Show GBA internal name in Internal view mode.
    + 3in1 internal GBA rom header stuff and work on Save/Load prompts in 3in1 options window.
      - Enable/Disable saving 3in1 SRAM on startup (Enabled by default)
      - Enable/Disable prompting before saving/loading SAV<->SRAM (recommended!)
      - Enable/Disable the Universal Sleep Hack for GBA games
      - Blank NOR button added for quick erase
      - Dump SRAM button will manually dump the SRAM to a timestamped .sav file in the root
      - 3in1+ support (untested, but routines and discovery are in, Opera and Rumble sources not available yet)
      - Thanks to all donators!
    + Fixed some issues with the cheat window.
      - Folders that only allow one cheat selected now function properly
      - Separate icon for skinners for single-select folders (see included skins)
    + Animal Crossing cheats on AK2. (Use the v1.1 rom as v1.0 will not work anymore).
    + Unicode font loads on a per-ROM basis
      - Default font is "kochi-mincho-subst.pcf" in /__aio/fonts directory, old unicode font removed (was 2x the size)
      - Skinners may add their own custom font to their ui's directory
      - New line in uisettings.ini "customUnicodeFont = xxxxxx.pcf" will load that font instead of default
    + Ability to hide extensions by manually adding "hideExtension = 1" to globalsettings.ini
    + DMA mode on AK2 (Hold A while loading a game to use non-DMA mode: Red text = DMA / Blue text = non-DMA).
    + New Super Mario Brothers Minigames on AK2: If they don't work, set Download Play to "Disabled" and boot in non-DMA mode (hold down A while loading)
    + Misc bug fixes (Too many to list).
    AK-AIO 1.2
    + New AKRPG/AK2 Detection Routine which has proven to be much better
    + Cheat Update functions run from plugin, giving full memory access to it and allowing updates without full AKAIO updates
      - Can choose to download USRCHEAT.DAT or CHEATS.XML and whether or not to display "Whats New" before launching
      - Should be much more stable, perhaps a teeny bit faster
      - Third option in "which cheat file to download" box displays the setting window at plugin launch, can be used for future expansion
    + Uses gelu's latest fixes for BBDX on the RPG (only works from MicroSD) - excellent work, gelu!
      - Also has some other fixes gelu's put in for 3in1 NOR erasing, etc.
      - gelu = the AKRPG master.
    + Preliminary AK+ Support. Very preliminary. As in, no help offered but know it's still being worked on (See: AK+ SUPPORT)
    + New Experimental Cheat engine for AK2 and AKRPG, please report any bugs
    + EZIV compatiblity fixed without need for special line in globalsettings.ini
    + Scrolling Non-unicode Cheats/Notes, toggle in Advanced Options (default: on)
      - Can also call cheat window in ROM Properties with SELECT (if button is visible)
    + Simple Internal Text Reader
      - System Settings -> TXT Viewer
      - Parses text, add bookmarks with X, scroll between bookmarks with L/R Buttons
      - Not as fast as native TXT plugin due to pre-processing of text files, perhaps if we had the TXT Plugin source things could be done, but that would make sense.
    + Per ROM rumble settings, ROM Options window
    + Listview mode remembered
    + 3in1 Support should be fixed, with thanks to cory1492 for testing
    + GBA Frame issue with Slot-2 booting from main list fixed
    + Asian languages should be better supported, since we're compiling the menu with DevKitARM 21
    + Variable Height Scrollbars and clickable arrows in cheat window/internal TXT viewer. 3 new BMPs for skinning: scrollbar_t.bmp/scrollbar_m.bmp/scrollbar_b.bmp
    + Super awesome hidden poweroff button in help window, add your own "poweroff.bmp" to "__aio" for fun

    AK-AIO 1.1
    + USRCHEAT.DAT wifi updating support from within shell
      - Connects to Narin's GBATemp site, displays WhatsNew.txt, downloads, unzips, replaces in one step
      - UpdateDB option in Start Menu -> More -> UpdateDB
      - zlib thanks to GPF (http://gpf.dcemu.co.uk/)
      - Download speed limited by DS routine IPStack
    + (AK2) Alternate loader support, place loader(s) in "__aio/ak2loader/"
      - ROM options window, select the AK2 loader to use to launch ROM
      - Compatible with AceKard official loaders
    + (RPG) uses gelu's latest 4.09e13 softreset routines
      - Updated 3in1 routines to all of gelu's latest
    + Fixed Dragon Quest 5 (AK2/AKRPG)
      - Can now get off the ship and save file wont be rolled back
    + Can change save file extension (.nds.sav or .sav)
      - Extension conversion: .SAV file Info Window, press "Save Ext." button
      - Will convert all Save Slot SAV files as well
    + Scans for cheats on ROM Info Window (.DAT only), if exist "Cheat" button displays
    + Per file icon support (32x32x15bpp)
      - place BMP with same name in same dir as file (eg: nesDS.bmp for nesDS.nds)
    + (Source) Variable spinbox width/General cheatlist cleanups/Scrolling Messageboxes
    + (Source) Minor changes to the cheat window
    + Fixed save size problems
      - Shouldn't have any more problems with save sizes
    + Misc Skinning fixes
      - Fixed problem with Adv.Evo skin
      - Form titles moved up 1 pixel
    + SAV<->BAK routines now use native AK functions
    AK-AIO 1.0
    + Runs on both AK2 and AKRPG
    + Uses gelu's latest AKRPG rom loader
    + Uses latest AK2 4.07a16 rom loader
    + Contains everything from AKBBS1.99
    + Future support for larger than 4mbit save types (only supports 64mbit at the moment)
    + Applied Bliss' AR Engine fixes to the AKRPG
    + Hopefully fixed most of the soft reset issues with the AKRPG
    Special Notes
    Seeing as this release has experimental support for saves ranging all then way up to 128mbit, please err on the side of caution and backup your saves before using this firmware.
    The "__RPG" and "__AK2" directory is now simply called "__AIO"
    Existing users should make sure to rename their system directory, and update globalsettings.ini to reflect the new hidden directory.
    Known Bugs
    There are no known bugs
    * Fix any bugs that crop up
    Cheats included are from Rayder's awesome compilation at GBATemp, now maintained by Narin, and are current as of the date of this release.
    For the most up-to-date files, check GBATemp's release site (http://cheats.gbatemp.net/), either via PC or by using the "UpdateDB" option in the start menu.
  14. b9sTool

    WARNING: Never, under any circumstance, use this homebrew in conjunction with a youtube/video guide of any kind! General Info
    This app only writes to FIRM0, not FIRM1, so it should be safe given your FIRM1 is not corrupt or a9lh'd. Never use this on anything but 3DS FIRM 11.8.X-YZ. NEVER use this if arm9loaderhax or sighax is installed (on any firmware)! The result will be a brick! Compiling:
    Just supply the current decrypted FIRMs for both new/old 3ds and put them in the firm_new and firm_old directories respectively. Then place the newest boot9strap.firm payload in the payload directory. Then compile with make FIRM_INFO="11.8 only" or whatever is actually the firmware range of the current native firm. The user does not have to supply any extra files like in previous versions. Needs the latest libfat version. Important b9sTool 5.X.X differences to 4.X.X
    This has been removed. This feature was made in the interest of safety, but the realization that the update trick can reliably restore corrupted firms made it redundant.
    It was also a pain in the ass.
    This is dumped to your boot9strap folder when b9s is installed. It isn't used now but may be useful in the future. Don't delete it.
    The hex number in the filename is the first 4 bytes of the file's SHA1.
      Cycling firm types:
    When you install boot9strap multiple times, the standard behavior is that it will cycle between b9s and stock firm.
    Don't count on this though, it's just a property of xoring operations and really isn't intended.
    It is recommended you only install boot9strap once.
      Firmware info:
    4.0.1 - 5.0.0 is for firmware 11.8 ONLY (always check the firmware in the app menu to be sure as this can change as new firmwares are released!) 4.0.0 is for firmwares 11.4 to 11.7 ONLY Be careful using b9sTool between firmware updates - only use b9sTool on the firmware it's intended for. Credits
    zoogie, plailect
  15. Bannerbomb3

    This is a POC for a new System Settings userland exploit. 
    It uses ROP execution to dump DS Internet from System Settings using a custom crafted dsiware export.
    This is useful primarily as an enhancement for "Fredminer" variant of seedminer to obtain free cfw on 3ds.
    Among other things, it brings free cfw to more regions*, and removes the possibility of Nintendo pulling certain games like Steel Diver from the eshop to thwart homebrew efforts.
    ~~~ Hbmenu? ~~~
    I've been able to get otherapp.bin booting by using 3ds_ropkit and a loader ROP chain. However, shortly after the bottom screen turns yellow, the 3ds just reboots to home menu.
    It's really alright though. Fredminer gets you a more stable 3dsx homebrew environment anyway, so this isn't really a high priority issue right now (still would be cool to see hbmenu booting I admit).
    ~~~ Exploit ~~~
    Basically put, this overflows the banner title strings in DSiWare exports (TADs) when you view them in System Settings, and smashes the stack leading to ROP control for the attacker.
    You do need the movable.sed to encrypt a payload TAD, but that's easy enough to do nowadays. Movable.sed bruteforcing now only takes about a minute and free online services can do it for you. Over 350,000 people have done it so it can't be that hard :p
    ~~~ Q&A ~~~
    Q: What's with the 3 in Bannerbomb3?
    A: It's a tribute to the Wii scene, they did 1 & 2. I love old homebrew scenes.
    Q: Why TADmuffin?
    A: Muffin sounded funny so I went with that. Just needed to be different from TADpole.
    Q: Will this work on the DSi since it has DSiWare exports too?
    A: The flaw is definitely there as well, but I've been unsuccessful exploiting it on hardware (I can get code exe on no$gba though). Moot because of Memory Pit anyhow ;)
    Q: Is this your first 3ds userland exploit?
    A: Yes. Feels good man.
    ~~~ Thanks ~~~
    - Yellows8 for 3ds ropkit
    - All the people on #3dsdev, reading my backlog (Ctrl-F "pivot") provided a wealth of good info on the art of stack pivoting.
    - Nintendo Homebrew Discord for maintaining online tools/guides and helping all the seed/frog/fredminer users. I hope this sploit makes your jobs a little easier.
    - Jhynjhiruu for testing
    by zoogie.
  16. beeShop

    GUI for 3DS Network Installing.

    How to use:
    NOTE: Make sure your 3DS and the computer you're using beeShop on are on the same network if you're using the first or second install method. If they aren't, you won't be able to send the files/URLs over to your 3DS.
    Download & extract the latest beeShop release (preferrably into a separate folder). Get ahold of a database file (.CSV) in format composed of Name,URL (either made by yourself or from other sources) and put it somewhere easily accessible. On your 3DS, open FBI > Remote Install > "Receive URL's over the Network" and note down the IP of your 3DS (don't close FBI after doing this). Launch beeShop, and click on the Settings button to open the Settings menu. You can configure lots of stuff in there, but right now, you need to press on the Select button on the top right hand corner. This will open a file selection dialog. Select a database (.CSV) file whose values should be in this format: Name,URL. Then, write the IP Address of your 3DS in the text box below IP:, select your preferred install method, and finally click on Save. beeShop should ask you to restart. Allow it. If your selected install method is Download & Install on 3DS:
    Make sure your 3DS is in FBI > Remote Install > Receive URLs over the Network. Select an entry of your choice from the list and click on Install. If everything went right, beeShop should send the download link for the selected entry to FBI, which will ask you to install. Press A to do so. NOTE: beeShop will stay on Status: Installing while your 3DS is downloading in FBI.
    If your selected install method is Download on PC, install on 3DS:
    Make sure your 3DS is in FBI > Remote Install > Receive URLs over the Network. Select an entry of your choice from the list and click on Download. The selected entry will now be downloaded and a message box will show (entry) was successfully downloaded. once it's done. Now, click on the Install button and choose the file (.CIA) that was downloaded (it will be located in the same directory where beeShop.exe is located). This will send the file to FBI, which will ask you whether you want to install or not on your 3DS. Press A to install.
    If your selected install method is custom-install: WARNING: custom-install is intended for advanced users only. Damage and or corruption may occur in some cases. Make sure you have a backup of your SD card just in case. You'll get shown this exact same warning when beeShop starts with custom-install as the selected install method.
    Open the settings menu and click on the Configure custom-install button. This will open yet another window where you can specify the different files/paths needed for custom-install. Here's what you need: The SD card content encryption key from your 3DS (movable.sed) The ARM9 Bootrom of your 3DS (boot9.bin) How to dump various 3DS files A seed database for games that require seeds to function (seeddb.bin) (required, beeShop won't launch custom-install without this) Specify a valid drive letter in the first text box (D:/ for example). Select your movable.sed file in the second text box. Select your boot9.bin file in the third text box. Select the seeddb.bin in the fourth text box.
    Click on save.
    Get CIAs (app files). These must be sourced by yourself or by using the second install method. Make sure you have your SD card inserted into your computer. (and that you have the correct drive letter specified in the custom-install settings). On the main window, click on Install, which will open a file selection dialog. Select a .CIA file. If you have checked Show custom-install command line window, that window will open so you can see what's happening. Once it finished installing, you have to use custom-install-finalize on your 3DS to install a ticket for the installed title. Credits:
    manuGMG & TimmSkiller DexterX12 Tools used:
    Steveice10 - (servefiles.py and sendurls.py) ihaveamac - (custom-install) Translators:
    TimmSkiller (German Translation) CiN CiN (Italian Translation) raccoon (French Translation) Eidwood (Catalan Translation) GrabsZel (Portuguese Translation) Testers:
    Mineplanet84 MyPasswordIsWeak Mike Kaiju Kelonio Note:
    beeShop does not encourage piracy and is only a way of gathering homebrew applications to a modded Nintendo 3DS System.
  17. BigBlueMenu - BigBlueBox

    Well heres a menu to manage all your CIA files
    You can just use the .3DS file to run and install or install the .cia to your console so its always there mucher newer than the old DevMenu version everyones using
    Enjoy as Always
  18. Boot9strap

    Boot9/Boot11 code execution.
    Install via SafeB9SInstaller.
    Launches "boot.firm" off of the SD card or CTRNAND. Hold Start + Select + X on boot to dump the bootroms/your OTP.
    Normmatt: Theorizing the NDMA overwite exploit.
    TuxSH: Help implementing bootrom payloads.
    Luma3DS: Codebase used in the stage 2 FIRM loader.
    This software is licensed under the terms of the GPLv3.
    You can find a copy of the license in the LICENSE file.
  19. BootNTR

    Allows you to use cheats ingame.
    Install with FBI.
  20. BootNTRSelector

    A mod of BootNTR which will allows you to choose the version of NTR you want to load (and it is also much faster than regular BootNTR).
    Install the .cia file through FBI and run it.
    Copy the .3dsx file into sdmc:/3ds/BootNTRSelector/ and run it through the New Homebrew Menu.
    How to use
    Launch BootNTRSelector through your method of choice and follow the on-screen instructions, no extra steps or files are required.
    BootNTRSelector will now default to whichever NTR version you selected last.
    Notes for Old3DS users
    You need to use one of the Mode3 releases in order to use NTR with extended memory games (such as Monster Hunter, Pokémon Sun/Moon, Smash Bros, etc.). Mode3 has no effect on New3DS.
    Launching BootNTRSelector before the home menu is completely loaded may result in a crash / error. So before launching it, wait a couple of seconds for the home menu to be fully loaded.

    by Nanquitas.
  21. CFW Suite

    A collection of tools which can be used to modify some of the text from a DS or DS Lite firmware, to create a custom firmware (CFW).
    Code from Chism, Loopy, Lick, and others has been used.
    Steps to modify the "Touch the Touch Screen to continue." text
    Dump original firmware
    (Optional but recommended) install a version of FlashMe, this adds a failsafe to your firmware so you can recover if a future flash fails. Dump your DS firmware using DSBF Dumper. Modifying the firmware
    Compile guiTool by running make, Extract gui data from your firmware with guiTool firmware.bin -e gui.bin, Make any changes you want to the gui.bin file (note: text is Unicode), the "Touch the Touch Screen to continue." text starts at 0x2c20 in the file. Make a copy of your firmware (here it is called cfw.bin), Inject gui data into your custom firmware with guiTool cfw.bin -i gui.bin, (Optional but recommended) run DeSmuME, go to Config->Emulation Settings and configure it to boot from your custom firmware; this is just to test that it works, Flashing to hardware (fwManager - recommended method)
    Compile fwManager by running make, or download a prebuilt binary, copy it to your flashcard, Make a new directory called firmwares on your flashcard, Place your modified firmware (cfw.bin) here, Run fwManager and select your custom firmware; when the installer is running, short the SL1 terminal as if you were installing FlashMe. Flashing to hardware (FlashMeInjector - old method for homebrew loaders that don't support libfat)
    Compile FlashMeInjector by running make, Inject your firmware into the FlashMe installer with FlashMeInjector flashme.nds -lite cfw.bin if you are using a DS Lite, or FlashMeInjector flashme.nds -phat cfw.bin if you are using an original DS, Run your modified FlashMe installer on your DS, FlashMe firmwares have an additional checksum, which will be incorrect, FlashMe will tell you the correct one and won't flash anything, Correct the FlashMe checksum with the one your DS told you, and inject the new firmware back into flashme.nds, Run flashme.nds again, from here the installation process will be the same as if you were installing FlashMe normally (SL1 must be shorted), If you follow the optional steps, then the risk of a brick will be relatively low; however, I take no responsibility if a brick does happen as a result of using these tools.
    Assuming you kept a backup of your original firmware, you can flash it with fwManager. Alternatively you may use noflashme.
    No content owned by Nintendo is contained in this repo!
    No firmwares are here, you must dump your own. The firmwares contained in the FlashMe installer have been removed, you must inject your own if you are using FlashMeInjector.
    by CTurt.
  22. Checkpoint (Nintendo 3DS)

    A fast and simple homebrew save manager for 3DS written in C++.
    Why use Checkpoint?
    Checkpoint is created following ideas of simplicity and efficiency. The UI has been designed to condense as many options as possible, while keeping it simple to work with.
    Moreover, Checkpoint is extremely lightweight - while being packaged with a nice graphic user interface - and is built using the most recent libraries available.
    Checkpoint for 3DS natively supports 3DS and DS cartridges, digital standard titles and demo titles. It also automatically checks and filters homebrew titles which may not have a save archive to backup or restore, which is done without an external title list and filters. For this reason, Checkpoint doesn't need constant user maintenance to retain full functionality.
    Checkpoint for Switch natively supports NAND saves for the titles you have played. Title information are loaded automatically.

    You can use Checkpoint for 3DS with both cfw and Rosalina-based Homebrew Launchers. *hax-based Homebrew Launchers are not supported by Checkpoint.
    Checkpoint for Switch runs on homebrew launcher. Make sure you're running up-to-date payloads.
    The first launch of the 3DS version will take considerably longer than usual (usually 1-2 minutes depending on how many titles you have installed), due to the working directories being created - Checkpoint will be significatively faster upon launch from then on.
    You can scroll between the title list with the DPAD/LR and target a title with A when the selector is on it. Now, you can use the DPAD or the touchscreen to select a target backup to restore/overwrite.
    Working path
    Checkpoint relies on the following folders to store the files it generates. Note that all the working directories are automatically generated on first launch (or when Checkpoint finds a new title that doesn't have a working directory yet).
    sdmc:/3ds/Checkpoint: root path sdmc:/3ds/Checkpoint/config.json: custom configuration file sdmc:/3ds/Checkpoint/saves/<unique id> <game title>: root path for all the save backups for a generic game sdmc:/3ds/Checkpoint/extdata/<unique id> <game title>: root path for all the extdata backups for a generic game Configuration file
    You can add and toggle features to Checkpoint for 3DS by editing the config.json configuration file.Sample configuration file:
    {   "filter": [     "0x000400000011C400",     "0x000400000014F100"   ],   "favorites": [     "0x000400000011C400"   ],   "additional_save_folders": {     "0x00040000001B5000": {       "folders": [         "/3ds/mySaves/1B50",         "/moreSaves"       ]     },     "0x00040000001B5100": {       "folders": [         "/3ds/PKSM/backups"       ]     }   },   "additional_extdata_folders": {   },   "nand_saves": true,   "version": 2 }  
  23. Custom 3DS Title Install

    Experimental script to automate the process of a manual title install for Nintendo 3DS. Originally created late June 2019.
    Dump boot9.bin and movable.sed from a 3DS system. Install pycryptodomex: Windows: py -3 -m pip install --user --upgrade pycryptodomex macOS/Linux: python3 -m pip install --user --upgrade pycryptodomex Run custom-install.py with boot9.bin, movable.sed, path to the SD root, and CIA files to install (see Usage section). Use custom-install-finalize on the 3DS system to finish the install. Setup
    Linux users must build Save3ds and place save3ds_fuse in bin/linux.
    movable.sed is required and can be provided with -m or --movable.
    boot9 is needed:
    -b or --boot9 argument (if set) BOOT9_PATH environment variable (if set) %APPDATA%\3ds\boot9.bin (Windows-specific) ~/Library/Application Support/3ds/boot9.bin (macOS-specific) ~/.3ds/boot9.bin ~/3ds/boot9.bin A SeedDB is needed for newer games (2015+) that use seeds.
    SeedDB is checked in order of:
    --seeddb argument (if set) SEEDDB_PATH environment variable (if set) %APPDATA%\3ds\seeddb.bin (Windows-specific) ~/Library/Application Support/3ds/seeddb.bin (macOS-specific) ~/.3ds/seeddb.bin ~/3ds/seeddb.bin Usage
    Use -h to view arguments.
    py -3 custom-install.py -b boot9.bin -m movable.sed --sd E:\ file.cia file2.cia python3 custom-install.py -b boot9.bin -m movable.sed --sd /Volumes/GM9SD file.cia file2.cia python3 custom-install.py -b boot9.bin -m movable.sed --sd /media/GM9SD file.cia file2.cia License/Credits
    pyctr/ is from ninfs d994c78.
    save3ds by wwylele is used to interact with the Title Database (details in bin/README).
    Thanks to @BpyH64 for researching how to generate the cmacs.
    by ihaveamac.
  24. Dead Simple EULA Set

    DSES is a simple tool to set the EULAs for the 3DS to accepted.
    In order to play 3DS games online/make use of streetpass, the 3DS makes the user accept an EULA. If this is for in-region titles, this is can be handled by the 3DS itself. If you wish to make use of out-of-region titles however, you will need to use homebrew to set the EULA to accepted.
    A number of EULA setting tools exist already (notably, SciresM/EULASetter, which is the base for this tool).
    However, all of these tools I've encountered so far sometimes offer a lot of other features and more importantly, put hex values in front of the user.
    This tool does none of that. It does one thing. Set your EULA to accepted if it isn't and to unaccepted if it is. No complications, nothing. Just press A and it changes the EULA.
    Note that when unaccepting the EULA, you will need to reaccept it the next time you use a 3DS game in your own region.
    Download the CIA from the releases page and open it with FBI. Press A to change your EULA. Press SELECT to remove the program after running it.
    If for whatever reason you need to reset the EULA to its initial values, rerun the application again.
    There is also a 3DSX option available for those who prefer 3DSX homebrew. Put it on your SD card and run it with the Homebrew Launcher or with 3dslink. Press SELECT to remove the program after running it.
  25. Decrypt9

    Multipurpose content dumper and decryptor for the Nintendo 3DS
    Decrypt9 WIP (work-in-progress) by d0k3
    This is a work in progress fork of Archshifts original Decrypt9, including bleeding edge new features. Note that the names of the executable files for this are Decrypt9WIP.* instead of Decrypt9.*.
    Decrypt9, Decrypt9WIP, Decrypt9UI - which one to use?
    There are at the present time, three main versions of Decrypt9 available:
    Decrypt9 by Archshift: This is the original version of Decrypt9 by Archshift. New features are pulled into this once they are thoroughly tested. This is as stable as it gets, but may also miss some of the newer features. Decrypt9 WIP by d0k3: This is the work in progress fork of Archshifts original Decrypt9. It contains the newest features and is always up to date. Releases in here can be considered tested beta versions. Decrypt9 UI by Shadowtrance: This is a themed version of Decrypt9 WIP created by Shadowtrance. It contains a nice graphical user interface (instead of text only as the other two versions), but may not be up to date at all times
    What can I do with this?
    See this incomplete list, more detailed descriptions are found further below.
    Create XORpads for decryption of NCCH ('.3DS') files Create XORpads for decryption of files in the '/Nintendo 3DS' folder Create XORpads for decryption of the TWLN and CTRNAND partitions Decrypt Titlekeys, either from a file or directly from SysNAND / EmuNAND Backup & restore your SysNAND and EmuNAND Dump & Inject any partition from your SysNAND and EmuNAND Dump & Inject a number of files (ticket.db, ..) from your SysNAND and EmuNAND Inject any app into the Health & Safety app Create and update the SeedDB file Directly decrypt (cryptofix) NCCH ('.3DS') and CIA files Directly decrypt files from the '/Nintendo 3DS/' folder Dump retail game cartridges ... and a lot more How to run this / entry points
    Decrypt9 can be built to run from a number of entry points, descriptions are below. Note that you need to be on or below 3DS firmware version v9.2 for any of these to work.
    A9LH & Brahma: Copy Decrypt9.bin to somewhere on your SD card and run it via either Brahma or arm9loaderhax. Brahma derivatives / loaders (such as BrahmaLoader, BootCTR and CTR Boot Manager) and A9LH chainloaders (such as Luma3DS and BootCTR9) will work with this as well. Build this with make a9lh. Homebrew Launcher: Copy Decrypt9.3dsx & Decrypt9.smdh into /3DS/Decrypt9 on your SD card. Run this via Smealums Homebrew Launcher, Mashers Grid Launcher or any other compatible software. Build this with make brahma. CakeHax Browser: Copy Decrypt9.dat to the root of your SD card. For MSET also copy Decrypt9.nds to your SD card. You can then run it via http://dukesrg.github.io/?Decrypt9.dat from your 3DS browser. Build this via make cakehax. CakeHax MSET: Copy Decrypt9.dat to the root of your SD card and Decrypt9.nds to anywhere on the SD card. You can then run it either via MSET and Decrypt9.nds. Build this via make cakerop. Gateway Browser Exploit: Copy Launcher.dat to your SD card root and run this via http://go.gateway-3ds.com/ from your 3DS browser. Build this with make gateway. Please note: this entrypoint is deprecated. While it may still work at the present time with little to no problems, bugs will no more be fixed and it may be completely removed at a later time. Use CakeHax instead. If you are a developer and you are building this, you may also just run make release to build all files at once. If you are a user, all files are already included in the release archive. When building this, you may also select to compile with one of four available fonts by appending FONT=ORIG/6X10/ACORN/GB to the make command line parameters. Working folders
    Basically every input file for Decrypt9 can be placed into the SD card root and output files can be written there, too. Working folders are mostly optional. However, using them is recommended and even required for some of the Decrypt9 features to work. These two folders (on the root of your SD card) are used:
    /files9/D9Game/: NCCH (.3DS), CIA, BOSS, SD card files (from the '/Nintendo 3DS/' folder) go here and are decrypted in place by the respective features. The cart dumper uses this directory as output directory. /files9/: Everything that doesn't go into /files9/D9Game/ goes here, and this is also the standard output folder. If /files9/D9Game/ does not exist, NCCH, CIA, BOSS and SD card files are also processed in this folder. Decryption of game files (NCCH, CIA, BOSS, SD) needs at least one of these two folders to exist. Input files are first searched in /files9/ and (if not found) then in the SD card root.
    Support files
    Depending on the environment, Decrypt9 is ran from, you may need support files to have full functionality. Support files are placed into either the root folder, or the work folder (/files9/). Here's a list of support files used in Decrypt9, when you need them and what they are used for:
    slot0x05keyY.bin: This file was previously needed for access to CTRNAND features (which is basically everything) on N3DS. At the moment it is not needed on any entrypoint. slot0x25keyX.bin: This file is needed to decrypt 7x crypto NCCHs and CIAs on O3DS < 7.0. slot0x18keyX.bin: This file is needed to decrypt Secure 3 crypto NCCHs and CIAs on O3DS without A9LH. slot0x1BkeyX.bin: This file is needed to decrypt Secure 4 crypto NCCHs and CIAs in every environment. slot0x24keyY.bin: This file is needed to properly dump & inject GBA VC savegames. aeskeydb.bin: This is an alternative to the four slot0x??key?.bin files mentioned above. It can contain multiple keys. It can be created from your existing slot0x??key?.binfiles in Decrypt9 via the 'Build Key Database' feature. seeddb.bin: Decrypt9 can create and update this file from the seeds installed in your system. This file is needed to decrypt seed crypto NCCHs and CIAs. Note that your seeddb.bin must also contain the seed for the specific game you need to decrypt. otp.bin: This file is console-unique and is required - on entrypoints other than A9LH - for decryption of the 'secret' sector 0x96 on N3DS (and O3DS with a9lh installed). Refer to this guide for instructions on how to get your own otp.bin file. movable.sed: This is dumpable by Decrypt9. It is needed to decrypt SD files from another 3DS, or from another installation on your own 3DS. It is not needed when decrypting your own SysNAND / EmuNAND SD files. secret_sector.bin: A copy of the decrypted, untouched (non-a9lh) sector0x96.bin. This is required for decryption of the encrypted ARM9 section of N3DS FIRMs. It is not required for anything else. As an alternative to this you can also provide slot0x11key95.bin and slot0x11key96.bin. d9logo.bin: Contains a logo (or, in fact, anything) to be displayed on the bottom screen. A d9logo.bin file is included in the release archive. If you want to create one yourself, install ImageMagick and run convert [your image] -rotate 90 bgr:d9logo.bin, where [your image] is any image of 320x240px resolution. Decrypt9 controls
    The most important controls are displayed on screen, here is a list of all:
    DOWN/UP - Navigate menus, scroll output, select between options. A - Enter submenu or confirm action. B - Depending on location, leave submenu or cancel. L/R - Switch between submenus (first level submenu only). X - Make a screenshot. Works in menu and on console output, after a feature finishes. X + LEFT/RIGHT - Batch screenshot all submenus / entries (only on menu) SELECT - Unmount SD card (only on menu). HOME - Reboot the console. POWER - Poweroff the console. START (+ LEFT) - Reboot (START only) / Poweroff (with LEFT) the console. There are some features (NAND backup and restore, f.e.), that require the user to choose a file or a directory. In these cases, use the arrow keys (that includes LFET/RIGHT) to select and A / B to confirm and cancel. Also, most file write operations (NAND writes excluded) can be cancelled by holding B.
    Decrypt9 features description
    Features in Decrypt9 are categorized into 7 main categories, see the descriptions of each below.
    XORpad Generator Options
    This category includes all features that generate XORpads. XORpads are not useful on their own, but they can be used (with additional tools) to decrypt things on your PC. Most, if not all, of the functionality provided by these features can now be achieved in Decrypt9 in a more comfortable way by newer dump/decrypt features, but these are still useful for following older tutorials and to work with other tools.
    NCCH Padgen: This generates XORpads for NCCH/NCSD files ('.3DS' f.e.) from ncchinfo.bin files. Generate the ncchinfo.bin via the included Python script ncchinfo_gen.py (or ncchinfo_tgen.py for theme packs) and place it into the /files9/ work folder. Use Archshift's XORer to apply XORpads to .3DS files. NCCH Padgen is also used in conjunction with Riku's 3DS Simple CIA Converter. Important Note: Depending on you 3DS console type / FW version and the encryption in your NCCH/NCSD files you may need additional files (see 'Support files' above) and / or seeddb.bin. SD Padgen (SDinfo.bin): This generates XORpads for files installed into the '/Nintendo 3DS/' folder of your SD card. Use the included Python script sdinfo_gen.py and place the the resulting sdinfo.bin into your /files9/ work folder. If the SD files to generate XORpads for are from a different NAND (different console, f.e.), you also need the respective movable.sed file (dumpable via Dercrypt9) to generate valid XORpads. By now, this feature should only make sense when decrypting stuff from another 3DS - use one of the two features below or the SD Decryptor instead. Use padXORer by xerpi to apply XORpads. SD Padgen (SysNAND dir): This is basically an improved version of the above feature. For typical users, there are two folders in '/Nintendo 3DS/' on the SD card, one belonging to the SysNAND, the other to EmuNAND. This feature will generate XORpads for encrypted content inside the folder belonging to the SysNAND. It won't touch your SysNAND, thus it is not a dangerous feature. A folder selection prompt will allow you to specify exactly the XORpads you want to be generated (use the arrow keys to select). Generating all of them at once is not recommended, because this can lead to several GBs of data and very long processing time. SD Padgen (EmuNAND dir): This is the same as the above feature, but utilizing the EmuNAND folder below '/Nintendo 3DS/' on the SD card. The EmuNAND folder is typically a lot larger than the SysNAND folder, so be careful when selecting the content for which to generate XORpads for. Any Padgen (anypad.bin): This feature is a more versatile alternative to various other padgen features. It uses the anypad.bin file as base. For information on the format of this file, refer to xorpad.h. A few pointers to get you started: If setNormalKey, setKeyX, setKeyY are non zero, the respective keys in the struct are used, if zero, the keys are unused. ctr array is the initialization vector, or, if either AP_USE_NAND_CTR or AP_USE_SD_CTR the offset of the initialization vector. mode is the AES mode, refer to either aes.h or to 3DBrew. CTRNAND Padgen: This generates a XORpad for the CTRNAND partition inside your 3DS console flash memory. Use this with a NAND (SysNAND/EmuNAND) dump from your console and 3DSFAT16Tool to decrypt and re-encrypt the CTRNAND partition on PC. This is useful for any modification you might want to do to the main file system of your 3DS. CTRNAND Padgen (slot0x4): This is an N3DS only feature. It is the same as the above option, but forces to use slot0x04 when generating the XORpad. Slot0x04 XORpads are required for decryption and encryption of the CTRNAND partition from downgraded N3DS NAND (SysNAND / EmuNAND) dumps. TWLNAND Padgen: This generates a XORpad for the TWLNAND partition inside your 3DS console flash memory. Use this with a NAND (SysNAND/EmuNAND) dump from your console and 3DSFAT16Tool to decrypt and re-encrypt the TWLNAND partition on PC. This can be used, f.e. to set up the SudokuHax exploit. FIRM0FIRM1 Padgen: This generates the combined XORpad for the FIRM0 and FIRM1 partitions inside your 3DS console flash memory. Use this with a NAND (SysNAND/EmuNAND) dump from your console and 3DSFAT16Tool to decrypt and re-encrypt the FIRM0 / FIRM1 partition on PC. This is useful f.e. for manual installation of the arm9loaderhax exploit. Titlekey Options
    This category includes all titlekey related features. Decrypted titlekeys (decTitleKeys.bin) are used to download software from CDN via the included Python script cdn_download.py and PlaiCDN. Encrypted titlekeys are used, for the same purpose, by FunKeyCIA. You may also view the (encrypted or decrypted) titlekeys via print_ticket_keys.py.
    Titlekey Decrypt (file): First, generate the encTitleKeys.bin via the included Python script dump_ticket_keys.py and place it into the /files9/ work folder. This feature will decrypt the file and generate the decTitleKeys.bin, containing the decrypted titlekeys. Titlekey Encrypt (file): This feature takes a decTitleKeys.bin file and encrypts it to encTitleKeys.bin. This is useful to convert between the two formats, to make sure you have the right format for the tools you use. Titlekey Decrypt (SysNAND): This will find and decrypt all the titlekeys contained on your SysNAND, without the need for additional tools. The decTitleKeys.bin file will be generated on your SD card. Titlekey Decrypt (EmuNAND): This will find and decrypt all the titlekeys contained on your EmuNAND, without the need for additional tools. The decTitleKeys_emu.bin file will be generated on your SD card. Titlekey Dump (SysNAND): This will find all the titlekeys contained on your SysNAND and dump them, without the additional step of decryption, to encTitleKeys.bin. Titlekey Dump (EmuNAND): This will find all the titlekeys contained on your EmuNAND and dump them, without the additional step of decryption, to encTitleKeys_emu.bin. Ticket Dump (SysNAND): Use this to dump all tickets found inside your SysNAND ticket.db file. Naming scheme for tickets is (commonkey index)-(console id)-(title id).tik. Commonkey index is typically 0 for eShop titles and 1 for system titles, a console id of zero for eShop titles typically means a forged (= non genuine) ticket. Dumped tickets are installable via FBI. Ticket Dump (EmuNAND): Same as above, but uses the ticket.db file from your EmuNAND. SysNAND / EmuNAND Options
    This is actually two categories in the main menu, but the functionality provided the same (for SysNAND / EmuNAND respectively). These categories include all features that dump, inject, modify or extract information from/to the SysNAND/EmuNAND. For functions that output files to the SD card, the user can choose a filename from a predefined list. For functions that use files from the SD card for input, the user can choose among all candidates existing on the SD card. For an extra layer of safety, critical(!) features - meaning all features that actually introduce change to the NAND - are protected by a warning message and an unlock sequence that the user has to enter. Caution is adviced with these protected features. They should only be used by the informed user.
    (Sys/Emu)NAND Backup & Restore...: This contains multiple options to backup or restore your SysNAND or EmuNAND. The submenu contains the following entries: NAND Backup: Dumps the NAND.bin file from your SysNAND or the ÈmuNAND.bin file from your EmuNAND. This is a full backup of your 3DS System NAND and can be used to restore your 3DS SysNAND / EmuNAND to a previous state or for modifications. NAND Backup (minsize): Same as the above option, but only dumps the actually used size of the NAND (the remainder is only unused data). Use this instead of the above to save some space on your SD card. NAND Restore(!): This fully restores your SysNAND or EmuNAND from the provided NAND.bin file (needs to be in the /files9/ work folder or in the SD card root). Although backups will be checked before restoring, be careful not to restore a corrupted NAND.bin file. Also note that you won't have access to this feature if your SysNAND is too messed up or on a too high FW version to even start Decrypt9 (should be self explanatory). NAND Restore (forced)(!): Same as the above option, but skips most safety checks. This is not recommended to be used without being properly informed. Keep in mind that, if the above option stops you from restoring a NAND backup, it is normally with good reason and means a prevented brick. NAND Restore (keep a9lh)(!): Only available on SysNAND, this is the same as the standard (unforced) restore option, but keeps all your arm9loaderhax files intact. Only use if you actually have arm9loaderhax installed. Validate NAND Dump: Use this to check and verify NAND dumps on your SD card. If this check passes on a NAND dump, you will also be able to restore it via the standard restore option. CTRNAND Transfer...: This menu contains various options to enable transfer of CTRNAND partitions between consoles. Auto CTRNAND Transfer: Automatically transfer a transferable CTRNAND image to this consoles NAND. Without A9LH installed, this will overwrite the FIRM0, FIRM1, CTRNAND. With A9LH installed, this will only overwrite CTRNAND. O3DS images can be transferred into N3DS consoles, but the NCSD header of the NAND may be overwritten. Dump transferable CTRNAND: Dump a CTRNAND image for later use in the feature above. Transferables images can be shared between consoles. Autofix CTRNAND: Use this to automatically fixes the CMACs for movable.sed, *.db and system saves inside the CTRNAND. It will also fix the <id0> inside the data folder. This is useful f.e. when a CTRNAND from another console was previously injected the regular way. Partition Dump...: This allows you to dump & decrypt any of the partitions inside your NANDs (TWLN / TWLP / AGBSAVE / FIRM0 / FIRM1 / CTRNAND / Sector0x96). Partitions with a file system (TWLN / TWLP / CTRNAND) can easily be mounted, viewed and edited on Windows via OSFMount. These partitions are included in your NAND and can be dumped by this feature: TWLN: TWL-NAND FAT16 File System - this is the same as on a Nintendo DSi console. Installed DSiWare titles reside in this partition. This partition can be used, f.e. to set up SudokuHax. TWLP: TWL-NAND PHOTO FAT12 File System - this is a Nintendo DSi specific partition for storing photos. AGBSAVE: AGB_FIRM GBA savegame - this contains a temporary copy of the current GBA games savegame. FIRM0: Firmware partition - this is here for development purposes only and should not be changed by users. FIRM1: Firmware partition backup - usually an exact copy of FIRM0. CTRNAND: CTR-NAND FAT16 File System - this contains basically you complete 3DS setup. Titles installed to the NAND reside here, and you can extract basically any file of interest from this partition. Sector0x96: Console-unique encrypted New3DS key-storage - this contains N3DS keys, access to it is required for A9LH installation. NAND header: NCSD header - the header of your NAND, this is is console-unique and contains the offsets/sizes of all partitions. It also contains the encrypted TWL MBR partition table. Partition Inject...(!): This allows you to reencrypt & inject any of the partitions on your NAND from the respective files (TWLN.bin / TWLP.bin / AGBSAVE.bin / FIRM0.bin / FIRM1.bin / CTRNAND.bin / Sector0x96.bin) (see above). Only use this if you know exactly what you're doing and be careful. While there are some safety clamps in place, they won't protect you from a major messup caused by yourself. System File Dump...: This allows you to directly dump & decrypt various files of interest from your SysNAND and EmuNAND. These files are included in this feature: ticket.db: Contains titlekeys for installed titles - use this with Cearps FunkyCIA to download installed (legit, purchased) titles directly to your PCs ard drive. title.db: A database of installed titles - apart from informative purposes this doesn't serve a direct purpose for most users at the moment. import.db: A database of titles to be installed - this can be used to get rid of the FW update nag at a later time. Read more on it in this GBAtemp thread. certs.db: A database of certificates - any practical use for this is unknown at the moment. SecureInfo_A: This contains your region and an ASCII serial number - this can be used to temporarily change your 3DS region. The dump / inject options in Decrypt9 simplify the tutorial found here. LocalFriendCodeSeed_B: This contains your FriendCodeSeed - in theory this can be used to import your friend list to another 3DS. movable.sed: This contains the keyY for decryption of data on the SD card - Decrypt9 itself uses this in the SD Decryptor / Encryptor and in SD padgen. System File Inject...(!): This allows you to directly encrypt & inject various files of interest into the SysNAND and EmuNAND. For more information check out the list above. System Save Dump...: This allows you to directly dump & decrypt various system saves from your SysNAND and EmuNAND. These files are included in this feature: seedsave.bin: Contains the seeds for decryption of 9.6x seed encrypted titles - only the seeds for installed (legit, purchased) titles are included in this. Use SEEDconv (recommended) or the included Python script seeddb_gen.py to extract the seeds from this into the Decrypt9 readable seeddb.bin. nagsave.bin: Contains some data relating to system updates - it is possible to block automatic system updates (ie. the 'update nag') with this file. Research is still in progress. Read this and the posts after it for more information. nnidsave.bin: Contains your NNID data - this can be used to reset / remove the NNID from your system, without removing any other data. See here for instructions. friendsave.bin: Contains your actual friendlist - this can be used to backup and restore your friendlist in conjunction with LocalFriendCodeSeed_B. Also see here. configsave.bin: The config savegame - this contains various things that are set via the config menu. It also contains a flag telling the system that initial setup was already executed. System Save Inject...(!): This allows you to directly encrypt & inject various system saves into the SysNAND and EmuNAND. For more information check out the list above. Miscellaneous..: This section contains various features that don't fit into any of the other categories. Health&Safety Dump: This allows you to to dump the decrypted Health and Safety system app to your SD card. The dumped H&S app can be used to create injectable files for any homebrew software. Health&Safety Inject(!): This is used to inject any app into your Health & Safety system app (as long as it is smaller than the original H&S app). Multiple safety clamps are in place, and this is a pretty safe feature. Users are still adviced to be cautious using this and only use eiter the original hs.app or inject apps created with the Universal Inject Generator. This feature will detect all injectable apps on the SD card and let the user choose which one to inject. GBA VC Save Dump: Only available on SysNAND, use this to dump the GBA VC Savegame from your NAND. Other than the headered AGBSAVE.bin format, this allows usage in emulators. slot0x24keyY.bin is required for this to work. For info on how to use this and the below feature, see here or here. GBA VC Save Inject: Only available on SysNAND, use this to inject back a GBA VC Savegame (f.e. after manual editing) to your NAND. Same as above, slot0x24keyY.bin is required for this to work. Update SeedDB: Use this to create or update the seeddb.bin file on your SD card with the seeds currently installed in your Sys/EmuNAND. Only new seeds will get added to seeddb.bin, seeds already in the database stay untouched. Dump Config (for Citra): Use this to dump the config file, which is required by the Citra emulator for certain games. Also see here. NCCH FIRMs Dump: Use this to dump NATIVE_FIRM, SAFE_MODE_FIRM, TWL_FIRM and AGB_FIRM from your NAND. For N3DS FIRMs, the ARM9 section will be decrypted as well. This feature is at the moment only useful for research. FIRM ARM9 Decryptor: Use this to decrypt the ARM9 section of N3DS FIRMs. This feature is at the moment only useful for research. Content Decryptor Options
    This category includes all features that allow the decryption (and encryption) of external and internal content files. Content files are directly processed - the encrypted versions are overwritten with the decrypted ones and vice versa, so keep backups. The standard work folder for content files is /files9/D9Game/, but if that does not exist, content files are processed inside the /files9/ work folder.
    NCCH/NCSD File Options: Files with .3DS and .APP extension are typically NCCH / NCSD files. NCCH/NCSD typically contain game or appdata. NCCH/NCSD Decryptor: Use this to fully decrypt all NCCH / NCSD files in the folder. A full decryption of a .3DS file is otherwise also known as cryptofixing. Important Note: Depending on you 3DS console type / FW version and the encryption in your NCCH/NCSD files you may need additional files key files (see 'Support files' above) and / or seeddb.bin. NCCH/NCSD Encryptor: Use this to (re-)encrypt all NCCH / NCSD files in the folder using standard encryption (f.e. after decrypting them). Standard encryption can be processed on any 3DS, starting from the lowest firmware versions. On some hardware, .3DS files might need to be encrypted for compatibility. CIA File Options: CIA files are 'Content Installable Files', this entry contains all related features. CIA Decryptor (shallow): Use this to decrypt, for all CIA files in the folder, the titlekey layer of CIA decryption. The internal NCCH encryption is left untouched. CIA Decryptor (deep): Use this to fully decrypt all CIA files in the folder. This also processes the internal NCCH encryption. Deep decryption of a CIA file is otherwise known as cryptofixing. This also may need additional key files and / or seeddb.bin, see 'Support files' above. CIA Decryptor (CXI only): This is the same as CIA Decryptor (deep), but it does not process the 'deep' NCCH encryption for anything but the first CXI content. On some hardware, fully deep decrypted CIA files might not be installable, but CIA files processed with this feature will work. CIA Encryptor (NCCH): Use this to encrypt the NCCH containers inside of the CIA files in the folder. NCCH encryption is required, for example, for system CIA files to be installable. BOSS File Options: BOSS files are typically received via Spotpass, this entry contains all related features. BOSS Decryptor: Use this to decrypt BOSS files. This feature will decrypt all encrypted BOSS files (with a valid BOSS header) found in the folder. BOSS Encryptor: Use this to encrypt BOSS files. This feature will encrypt all unencrypted BOSS files (with a valid BOSS header) found in the folder. SD File Options: SD files are titles, extdata and databases found inside the /Nintendo 3DS/// folder. This entry contains all related features. SD Decryptor/Encryptor: Use this to decrypt or encrypt 'SD files'. For this feature to work, you need to manually copy the file(s) you want to process. Copy them with their full folder structure (that's everything after /Nintendo 3DS/<id0>/<id1>/) to the work / game folder. This feature should by now only be useful to encrypt content, decryption is much easier handled by the two features below. SD Decryptor (SysNAND dir): An improved version of the feature above. This allows you to select content from /Nintendo 3DS/ (more specifically from the subfolder belonging to SysNAND) to be directly copied to your work / game folder and then decrypted from there. SD Decryptor (EmuNAND dir): This has the same functionality as the feature above, but handles the content of the /Nintendo 3DS/ subfolder belonging to the EmuNAND instead. SD CXI Dumper (SysNAND dir): This feature is similar to the SD Decryptor, but only handles the CXI (CTR eXecutable Image), uses title_id.cxi as file name and fully decrypts the NCCH. This is useful to create images for use in Citra from installed content. This handles content from the /Nintendo 3DS/ subfolder belonging to SysNAND. SD CXI Dumper (EmuNAND dir): This has the same functionality as the feature above, but handles the content of the /Nintendo 3DS/ subfolder belonging to the EmuNAND instead. CIA Builder Options: This subsection contains various features that allow you to build CIAs from files installed to / stored on your SD card. Build CIA from NCCH/NCSD: This was previously called 'NCCH/NCSD to CIA Converter'. It allows you to convert any NCCH/NCSD file (that means .3DS files, too) to an installable (on a signature patched system) CIA file. The CIA file will be written to filename.ext.cia. CIA Builder (SysNAND/orig.): This was previously called 'Content to CIA (SysNAND dir)'. This feature allows you to directly convert content installed to the SD card to a CIA file. It handles content from the /Nintendo 3DS/ subfolder belonging to SysNAND. This variant of the feature tries to build CIAs as genuine as possible, while still wiping identifying information from the file. If you need similar functionality for titles installed to NAND, use ctrnand-title-cia-gen by ihaveamac. CIA Builder (EmuNAND/orig.): This was previously called 'Content to CIA (EmuNAND dir)__' and has the same functionality as the feature above, but handles the content of the /Nintendo 3DS/ subfolder belonging to the EmuNAND instead. CIA Builder (SysNAND/decr.): This feature has the same functionality as the features above. In addition, it fully decrypts the CIA files it generates for better compatibility. Take note that the additional decryption and recalculation of checksums mean longer processing times. This handles content from the /Nintendo 3DS/ subfolder belonging to SysNAND. CIA Builder (EmuNAND/decr.): This has the same functionality as the feature above, but handles the content of the /Nintendo 3DS/ subfolder belonging to the EmuNAND instead. Gamecart Dumper Options
    This category includes all features handling dumping of content from external cartridges. Cartridge dumps are also known as .3ds files.
    Dump Cart (full): This feature dumps the full, unaltered data from the inserted cartridge. For 4GB cartridges, the last sector is silently discarded, because the FAT32 file system can't handle files equal or above 4GB. This feature also handles NTR/TWL cartridges (aka. NDS and DSi crtridges). Dump Cart (trim): Same as the above feature, but discards the unused padding for smaller output and faster processing. Using this is recommended unless the padding is required for digital preservation purposes. Dump & Decrypt Cart (full): Same as 'Dump Cart (full)', but also decrypts the cartridge data on-the-fly. Decrypted cartridge data is required for emulators and recommended for CIA conversion. The recommended CIA conversion tool is 3dsconv. NTR/TWL cartridges are not encrypted and thus won't be decrypted. Dump & Decrypt Cart (trim): Same as above, but discards the unused padding for smaller output and faster processing. This is recommended over the above feature. Dump Cart to CIA: Use this to directly dump an inserted cartridge to a fully decrypted CIA file, which can be installed to a patched system using CIA installer software like FBI. For most users, this type of dump will be the most convenient. NTR/TWL cartridges can't be dumped to a CIA file. Dump Private Header: Dumps the cartridge unique private header from the inserted cartridge. Flash Savegame to Cart: Flash a savegame file to a retail game cartridge. This currently only works for NTR/TWL carts. The savegame to flash must have a filename of ndscart*.sav. NDS Flashcart Options
    This category includes special features for certain NDS type flashcarts (currently only the AK2i).
    Auto NTRCARDHAX to AK2i: This performs an automatic NTRCARDHAX injection to the AK2i flashcart.
    Dump AK2i: Use this to dump the AK2i flashcart bootrom to the game directory.
    Inject AK2i: Use this to inject the AK2i flashcart bootrom from the game directory.
    Inject NTRCARDHAX to AK2i: Patch and inject the NTRCARDHAX payload to the AK2i flashcart. AK2i 1.41 version is required. If your AK2i is not on this version, upgrade or downgrade to it.
    Restore AK2i bootrom: Restore the AK2i flashcart original bootrom.
    Maintenance Options
    This category includes special features which allow you to test and manage Decrypt9 internal functionality.
    System Info: Displays various information about your 3DS and SD card on screen. Used for informational purposes and to test if information is available. Create Selftest Reference: Run this first on a known working entrypoint to generate the selftest reference data. This will create a file called d9_selftest.ref inside your SD card root or work folder. Run Selftest: Run the actual selftest (must have created the reference data before). This will create or update a file called d9_selftest.lst on your SD card root or work folder. Note: on O3DS failed ncch_sec3_key, ncch_sec4_key and nand_ctrn_key tests are normal and expected. On O3DS <= FW 7.0, ncch_7x_key may fail. On N3DS and O3DS ncch_sec4_key may fail. With all key files (see 'Support files') available, no test should fail. This is used, for example, to assure that everything works as intended on a new entrypoint. Build Key Database: This is used to build the aeskeydb.bin file from all available slot0x??key?.bin files. It will also process files that are not used by Decrypt9. With the aeskeydb.binavailable, Decrypt9 can load keys from it and doesn't need the slot0x??key?.bin files anymore. De/Encrypt Key Database: By default, the aeskeydb.bin created in Decrypt9 is encrypted, and the keys in it are not readable via a Hex Editor. Use this to either decrypt an encrypted database, or to encrypt a decrypted one. Note that Decrypt9 can load keys from both. License
    You may use this under the terms of the GNU General Public License GPL v2 or under the terms of any later revisions of the GPL. Refer to the provided LICENSE.txt file for further information.
    Credits by Archshift
    Roxas75 for the method of ARM9 code injection Cha(N), Kane49, and all other FatFS contributors for FatFS Normmatt for sdmmc.c as well as project infrastructure (Makefile, linker setup, etc) Relys, sbJFn5r for the decryptor Credits by d0k3
    Everyone mentioned by Archshift above Archshift for starting this project and being a great project maintainer b1l1s, Normmatt for their 'behind-the-scenes' work and for making arm9loaderhax support possible Gelex for various code improvements and useful advice throughout D9 development ihaveamac for first developing the simple CIA generation method and for being of great help in porting it patois, delebile, SteveIce10 for Brahma and it's updates mid-kid for CakeHax and for hosting freenode #Cakey Shadowtrance, Syphurith, AuroraWright for being of great help developing various features dark_samus3 and Plailect for making CTRNAND transfers a possibility osilloscorpion and idgrepthat for enabling NTR cart dumps profi200 for helpful hints that first made developing some features possible Al3x_10m for helping me with countless hours of testing and useful advice Shadowhand for being awesome and hosting my nightlies SciresM and Reisyukaku for helping me allow devkit compatibility liomajor, Datalogger, zoogie, atkfromabove, mixups, key1340, k8099, Supster131, stbinan, Wolfvak, imanoob, Stary2001, kasai07 and countless others from freenode #Cakey and the GBAtemp forums for testing, feedback and helpful hints Everyone I forgot about - if you think you deserve to be mentioned, just contact me
Conéctate para seguir esto  

  • Crear nuevo...