This is a new homebrew menu loading userland exploit for the new3ds browser, Skater.
What's needed
A new3ds (or new2ds) on firmwares:
11.9.0-42 -> 11.13.0-45 for USA or JAPAN
11.10.0-43 -> 11.13.0-45 for EUROPE
Note: The last number on the firmware version matters. If you updated from a cartridge to your current firmware, you will need to update to latest firmware as your browser would have been erased by the cart update.
Directions
- In the release folder, find your region (USA, EUROPE, JAPAN) and take the two files inside that folder and put them on the root of your sd card. Do not copy the entire folder over.
- Place the homebrew launcher boot.3dsx from here also on the root of your sd card.
- With wifi on and working, scan this QR after pressing L+R should buttons together and tapping the QR button on the bottom screen. The link to the sploit page is https://zoogie.github.io/web/nbhax if you want to type it in manually and/or bookmark it.
- The exploit should then load homebrew menu. Make sure to add homebrews to the sdmc:/3ds folder first in order to have something to run. See other guides online about what you can do with homebrew.
Exploit details
This is the same Use-After-Free bug exploited in the WiiU version, with some changes. The input.type="image" -> "radio" is changed to input.type="image" -> "hidden" in this one to achieve compatibility, for instance.
Troubleshooting
-
Problem: The 3ds freezes on a yellow screen.
- Solution: Try again. Boot rate is about 75-80%. This has always been an issue with *hax homebrew and not specific to this implementation.
-
Problem: The 3ds freezes on some other color screen or "An error has occured" prompt shows up.
- Solution: Make sure you have all the correct files. Check your region is correct.
- At minimum, make sure to have the below 3 files in the sd root as shown.
sdmc:/arm11code.bin
sdmc:/browserhax_hblauncher_ropbin_payload.bin
sdmc:/boot.3dsx
-
Problem: I still can't get the exploit to work and the two solutions above didn't help.
- Solution: Go to your browser's settings and select Delete Cookies first then Reset Save Data. After being exited automatically, relaunch the browser and go to bookmarks. Create a bookmark with https://zoogie.github.io/web/nbhax as the address (or just edit an existing bookmark). Exit the browser, then launch it again, and then finally launch that nbhax bookmark you just made.
FAQ
Q: Will you support old3ds, old2ds?
A: I tried for a bit getting this to work but had no success. Can't even get the bug to crash old3ds. I'm certainly not saying old3ds support is impossible, so go ahead and try yourself! 🙂 It's open source. Let me know if you can at least get a crash and I might be able to do something with it.
Q: Can I install unSAFE_MODE with this to get cfw?
A: Absolutely, be my guest : ) You can boot slotTool.3dsx and install the hacked wifi slots, then run the unSAFE_MODE exploit. No explicit directions will be given for that here, but guides should pop up soon with directions.
Q: Where did this browser exploit come from originally?
A: CVE-2013-2857 https://bugs.chromium.org/p/chromium/issues/detail?id=240124 . It was ported to the WiiU a couple of years ago and I think it's still the main userland entrypoint for that homebrew scene.
Q: The 3ds_browserhax_common code you used works in php server code, why does your hax just use a github io page?
A: I used a local webserver to emit the unescape output of y8's hb loading code, then converted it to a u32int array for my implementation. I used this script for the conversion. I just really wanted to avoid having to set up a server or asking someone else for that favor.
Q: Will this exploit be fixed in a firmware update?
A: Don't know, but it's definitely possible. N has never fixed one of my exploits but they've always been proactive about fixing browser exploits. I give it 50/50 odds.
Thanks
- Big thanks to @ChampionLeake for the bug tip!
- The devs who developed JsTypeHax for the WiiU. This sploit is loosely modeled after it.
- MrNbaYoh for the nice bit of advice to only use similar size objects to overwrite a freed object.
- Yellows8 for the hbmenu loader code.
by zoogie.