Part 5 (arm9loaderhax) - GamerTunerit/Guide GitHub Wiki

You cannot use another console's OTP or you will brick GUARANTEED.

The final step of this guide is to install arm9loaderhax and setup Luma3DS to run just milliseconds into the boot. This is accomplished by using SafeA9LHInstaller by AuroraWright.

This will install AuroraWright's Fork of arm9loaderhax.

This guide uses "Updated SysNAND" mode, in which we copy our RedNAND to SysNAND (to keep games and such) and install arm9loaderhax to have permanent SysNAND hax with no RedNAND required at all.

We will also setup the ability to launch payloads from arm9loaderhax, giving us the ability to unbrick our SysNAND from situations that would normally brick us by restoring from backup.

Overview of steps

In this section, we will go through the process that all the other steps have led up to: actually installing arm9loaderhax.

This is nearly the best possible kind of device exploit because it is permanantly installable into the NAND firm partitions, and runs before most of the OS loads, allowing it to not only work on all versions once installed, but also protect itself and recover from most situations that would brick a non-a9lhax 3DS such as a nonfunctional home menu or bad title install.

The file arm9loaderhax.bin is what is launched by arm9loaderhax itself after it finishes loading off of NAND, and can be any valid arm9 payload. This file can be replaced at any time, although Luma3DS allows for the launch of other arm9 payloads by holding buttons on boot.

In this case, we use Luma3DS by AuroraWright to boot a patched SysNAND directly, allowing us to completely bypass the need for any kind of RedNAND, vastly simplifying the usage of a hacked 3DS in addition to saving SD card space.

Once arm9loaderhax is installed and Luma3DS is setup with the correct options, we then backup our SD card and format it using EmuNAND9 to remove the now obsolete RedNAND and reclaim the SD card space it previously used.

During this process, we also setup programs such as FBI (installs CIA formatted games and applications), Luma3DS Updater (updates our CFW installation easily), Uncart (converts physical cartridge games to digital CIA files), Hourglass9 (allows us to restore NANDs and such before boot to recover from bricks and do many other miscellaneous functions), and EmuNAND9 (manages RedNAND installations in addition to several miscellaneous features).

Screeninit arm9loaderhax payloads turn on the screen before handing control over to arm9loaderhax.bin (making sure it works with all arm9loaderhax.bin files), while noscreeninit arm9loaderhax payloads do not (allowing arm9loaderhax.bin to control things like brightness during boot). You can choose to use either (the guide used to only have screeninit payloads).

Do NOT use the original payload_input.zip or data_input.zip with SafeA9LHInstaller v2 or you will BRICK!

What you need

Instructions

Section I - Preparatory work
  1. Copy emergency_SecureInfo_A, emergency_movable.sed, emergency_title.db, emergency_ticket.db, NCSD_header_[o/n]3ds.bin, and firm0firm1.xorpad from the root of your SD card to a safe location on your computer and back them up to multiple locations (such as online file storage); they do not replace NAND backups, but in the event of lost backups could save you from total data loss (after further research and development is completed)
  2. Delete emergency_SecureInfo_A, emergency_movable.sed, emergency_title.db, emergency_ticket.db, NCSD_header_[o/n]3ds.bin, and firm0firm1.xorpad from the root of your SD card
  3. Delete the EmuNAND9 folder from the root of your SD card if you have one
  4. Copy the a9lh folder from data_input_v2.zip to the root of your SD Card
  5. Copy payload_stage1.bin and payload_stage2.bin from the arm9loaderhax zip to a9lh folder on your SD card
  6. Copy arm11.bin and arm9.bin from the SafeA9LHInstaller zip to the root of your SD card
  7. Copy hblauncher_loader.cia from the hblauncher_loader zip to the root of your SD card
  8. Copy lumaupdate.cia from the Luma3DS Updater zip to the root of your SD card
  9. Copy arm9loaderhax.bin and the luma folder from the Luma3DS zip to the root of your SD card
  10. Copy Hourglass9.bin from the Hourglass9 zip to the /luma/payloads/ folder on your SD card
  11. In the /luma/payloads folder, rename Hourglass9.bin to start_Hg9.bin
  12. Copy and merge the 3DS folder from the EmuNAND9 zip to the root of your SD card
  13. Copy EmuNAND9.bin from the EmuNAND9 zip to the /luma/payloads/ folder on your SD card
  14. In the /luma/payloads folder, rename EmuNAND9.bin to y_EmuN9.bin
  15. Copy arm9loaderhax.bin from the Uncart zip to the /luma/payloads/ folder on your SD card
  16. In the /luma/payloads folder, rename arm9loaderhax.bin to x_Uncart.bin
  17. Copy aeskeydb.bin to the root of your SD card
  18. Copy firmware.bin from the Luma3DS NTR Firmware zip to the /luma/ folder on your SD card
  19. Copy emuNAND_original.bin and emuNAND_original.bin.sha from Section I of Part 4 to the root of your SD card
Section II - Installing arm9loaderhax
  1. Reinsert your SD card into your 2.1.0 3DS
  2. Go to http://dukesrg.github.io/2xrsa.html?arm11.bin on your 3DS
  3. Select Full Install
  4. The installer will now install arm9loaderhax on your device (this is very fast)
  5. Following this, booting to a black screen is normal (Luma3DS cannot boot a 2.1.0 NAND).
  6. Copy your console specific OTP.bin from the /a9lh/ folder on your SD card to a safe location on your computer and back it up to multiple locations (such as online file storage)
Section III - Configuring Luma3DS
  1. Hold select on boot to enter the Luma3DS menu.
  1. Use the A button and the D-Pad to turn on the following:
  • "Autoboot SysNAND"
  • "SysNAND is updated"
  • "Force A9LH detection"
  • "Show current NAND in System Settings"
  • "Show GBA boot screen in patched AGB_FIRM"
  1. If you are using a New 3DS, you should also enable the following:
  • Toggle "New 3DS CPU" to "Clock+L2(x)" for improved game performance
  1. Press Start to save and reboot
  2. Following this, booting to a black screen is normal (Luma3DS cannot boot a 2.1.0 NAND).
Section IV - Copying RedNAND data to SysNAND
  1. Open Hourglass9 from arm9loaderhax by holding Start on boot
  2. Go to "SysNAND Backup/Restore..."
  3. Select "SysNAND Restore"
  4. Confirm and restore from emuNAND_original.bin
  5. Your device should now be able to boot properly once more.
Section V - Removing RedNAND from your SD
  1. Press Select on the main menu to eject your SD card
  2. Delete emuNAND_original.bin and emuNAND_original.bin.sha from the root of your SD card
  3. Backup every file on your SD card to a folder on your computer, all files will be deleted in the next step
    (if you followed Part 3 of this guide, you can delete the SD card backup from that - this will replace it)
  4. Reinsert your SD card into your 3DS.
  5. Hold Y on boot to launch EmuNAND9
  6. Go to "SD Format Options", then "Format SD..."
  7. Select the "Format SD (No EmuNAND)" option
  8. Ignore the starter.bin prompt and continue
  9. Press Select on the main menu to eject your SD card
  10. Put your SD card in your computer, then copy all your files back into it
Section VI - Finalizing setup
  1. Reinsert your SD card into your 3DS
  2. From EmuNAND Manager Options, make a backup of SysNAND to sysNAND.bin
  3. Press Select on the main menu to eject your SD card, then put it in your computer
  4. Rename sysNAND.bin to sysNAND-A9LHAX.bin, sysNAND.bin.sha sysNAND-A9LHAX.bin.sha, and copy both to a safe location on your computer; this is a SysNAND backup containing arm9loaderhax (Your backup should match one of the sizes on this page; if it does not, you should delete it and make a new one!)
  5. Delete sysNAND-A9LHAX.bin and sysNAND-A9LHAX.bin.sha from your SD card
  6. Reinsert your SD card into your 3DS then press Start to reboot
  7. Update your CFW SysNAND to the latest version using system settings (if it is not already)
  8. Open Health and Safety (which is now FBI)
  9. Select "SD"
  10. Navigate to hblauncher_loader.cia and press A to install
  11. Navigate to lumaupdate.cia and press A to install
  12. Exit with the home button
  13. Launch the Homebrew Launcher from the home menu icon at least once to ensure the payload is functional
  14. Reboot!

If everything has gone according to plan, arm9loaderhax will be installed to your device, your RedNAND will have been copied to your SysNAND, you will no longer need RedNAND, you will have a CIA installer, and you'll be able to launch the Homebrew Launcher from an icon on your home menu. Your device will now automatically launch into CFW SysNAND.

You can now use Luma3DS Updater to update your Luma3DS to the latest version just by opening it and pressing A. (This is not the same thing as a System Update; it just downloads and extracts the newest Luma3DS files)

You will no longer be able to boot without the SD card in, that is normal.
You will now boot a Custom Firmware based SysNAND by default.
You can now hold Select on boot to launch the Luma3DS configuration menu.
You can now hold Start on boot to launch Hourglass9, a full featured NAND tool.
You can now hold Y on boot to launch EmuNAND9, a full featured RedNAND and SD management tool.
You can now hold X on boot to launch Uncart, a tool for converting a physical game cart to an installable file.

You can update your arm9loaderhax installation in the future by following the instructions on the Updating arm9loaderhax page.

You can remove any extra files from the root of the SD card that are not in the image.

SD Card