Part 3 (arm9loaderhax) - PlailectIT/Guide GitHub Wiki

You cannot use another console's OTP or you will brick GUARANTEED.

The final Step of this guide is to install arm9loaderhax and setup Luma3DS to run just milliseconds into the boot. This is accomplished by using SafeA9LHInstaller by AuroraWright.

This will install AuroraWright's Fork of arm9loaderhax.

We will also setup the ability to launch payloads from arm9loaderhax, giving us the ability to unbrick our SysNAND from situations that would normally brick us by restoring from backup.

Overview of steps

In this section, we will go through the process that all the other steps have led up to: actually installing arm9loaderhax.

This is nearly the best possible kind of device exploit because it is permanently installable into the NAND firm partitions, and runs before most of the OS loads, allowing it to not only work on all versions once installed, but also protect itself and recover from most situations that would brick a non-a9lhax 3DS such as a nonfunctional home menu or bad title install.

The file arm9loaderhax.bin is what is launched by arm9loaderhax itself after it finishes loading off of NAND, and can be any valid arm9 payload. This file can be replaced at any time, although Luma3DS allows for the launch of other arm9 payloads by holding buttons on boot.

In this case, we use Luma3DS by AuroraWright to boot a patched SysNAND directly, allowing us to completely bypass the need for any kind of RedNAND, vastly simplifying the usage of a hacked 3DS in addition to saving SD card space.

Once arm9loaderhax is installed and Luma3DS is setup with the correct options, we then restore our previous backup.

During this process, we also setup programs such as the following:

• FBI (installs CIA formatted games and applications)
• Luma3DS Updater (updates our CFW installation easily)
• Hourglass9 (multipurpose tool which can do NAND and cartridge functions)

What you need

• data_input_v2.zip (mirror) (mirror)
• aeskeydb.bin (mirror) (mirror)
• The latest release of arm9loaderhax (noscreeninit)
• The latest release of Luma3DS (regular version, not "dev")
• The latest release of SafeA9LHInstaller
• The latest version of Universal Inject Generator
• The latest release of hblauncher_loader
• The latest release of Hourglass9
• The latest release of Luma3DS Updater
• The latest release of DspDump
• The latest release of FBI
• The Homebrew Starter Kit

Instructions

Section I - Prep work

1. Copy the /files9/ folder on your SD card to a safe location on your computer and back them up to multiple locations (such as online file storage); the files inside could save you from total data loss if your break your system
2. Create a folder named cias on the root of your SD card if it does not already exist
3. Delete the 3ds folder from the root of your SD card if it exists
4. Copy the contents of the starter folder in starter.zip to the root of your SD card
5. Ensure NANDmin.bin and NANDmin.bin.sha are in the /files9/ folder on your SD card
6. Copy the a9lh folder from data_input_v2.zip to the root of your SD Card
7. Copy payload_stage1.bin and payload_stage2.bin from the arm9loaderhax zip to a9lh folder on your SD card
8. Copy arm11.bin and arm9.bin from the SafeA9LHInstaller zip to the root of your SD card
9. Copy hblauncher_loader.cia from the hblauncher_loader zip to the /cias/ folder on your SD card
10. Copy lumaupdater.cia from the Luma3DS Updater zip to the /cias/ folder on your SD card
11. Copy FBI.cia from the FBI zip to the /cias/ folder on your SD card
12. Copy arm9loaderhax.bin from the Luma3DS zip to the root of your SD card
13. Create a folder named luma on the root of your SD card
14. Create a folder named payloads in the luma folder on your SD card
15. Copy Hourglass9.bin from the Hourglass9 zip to the /luma/payloads/ folder on your SD card and rename Hourglass9.bin to start_Hourglass9.bin
16. Copy aeskeydb.bin to the /files9/ folder on your SD card
17. Copy DspDump.3dsx to the /3ds/ folder on your SD card

Section II - Installing arm9loaderhax

12. Reinsert your SD card into your 2.1.0 3DS
13. Go to http://dukesrg.github.io/2xrsa.html?arm11.bin on your 3DS
    • If you get an error, follow this troubleshooting guide
    • If you get a glitched screen, follow this troubleshooting guide
14. Press (Select) to Full Install
15. The installer will now install arm9loaderhax on your device (this is very fast)
16. For now, booting to a black screen or a message about firmware.bin is normal (Luma3DS cannot boot a 2.1.0 NAND), just continue with the instructions
17. Shut down your console, hold the power button until it turns off if necessary
18. Copy your console specific OTP.bin from the /a9lh/ folder on your SD card to a safe location on your computer and back it up to multiple locations (such as online file storage), then reinsert your SD card your 2.1.0 3DS

Section III - Configuring Luma3DS

1. Hold select on boot to enter the Luma3DS menu

• Make sure to start holding the button before pressing power
• If you get a black screen, follow this troubleshooting guide
• If you boot to SafeA9LHInstaller, follow this troubleshooting guide

1. Use the (A) button and the D-Pad to turn on the following:

• "Autoboot SysNAND"
• "Show current NAND in System Settings"
• "Show GBA boot screen in patched AGB_FIRM"

2. If you are using a New 3DS, you should also enable the following:

• Toggle "New 3DS CPU" to "Clock+L2(x)" for improved game performance

2. Press Start to save and reboot

• If it freezes, hold the power button until it shuts down, then continue with the instructions

18. For now, booting to a black screen or a message about firmware.bin is normal (Luma3DS cannot boot a 2.1.0 NAND), just continue with the instructions

Section IV - Restoring the System

If, before following this guide, you already had an EmuNAND or RedNAND setup and would like to move the contents of your previous EmuNAND or RedNAND to your new SysNAND CFW, now is the time to follow Move RedNAND.

1. Open Hourglass9 from arm9loaderhax by holding Start on boot
2. Go to "SysNAND Backup/Restore..."
3. Select "SysNAND Restore"
4. Confirm and restore from NANDmin.bin
5. Go to the main menu, then press (Select) to eject your SD card, then put it in your computer
6. Navigate to /Nintendo 3DS/(32 Character ID)/(32 Character ID)/extdata/00000000/ on your SD card
   • EUR Region: Delete 00000098
   • JPN Region: Delete 00000082
   • USA Region: Delete 0000008f
7. If are on a 3.X or 4.X NAND, copy the following firmware file to /luma/
   • New 3DS: firmware.bin (mirror)
   • Old 3DS: firmware.bin (mirror)
8. Reinsert your SD card into your 3DS
9. Your device should now be able to boot properly once more.

• If you get a black screen, follow this troubleshooting guide
• If you do not have any usable NAND backups, follow 9.2.0 ctrtransfer starting on Step 4

Section V - Injecting FBI

If you restored an EmuNAND or RedNAND that already contains FBI as part of the last section, you can skip this section.

1. Open Hourglass9 from arm9loaderhax by holding (Start) on boot
2. Go to "SysNAND Backup/Restore", then select the "Health&Safety Dump" option to dump Health & Safety to hs.app (you can use Up and Down / Left and Right to change the name)
3. Press (Select) to eject your SD card, then put it in your computer
4. Extract Universal Inject Generator, then copy both hs.app from your SD card and FBI.cia from the FBI zip to the input folder
5. Double click go.bat (or execute go.sh with Terminal on Linux, or double click Mac_inject_launcher.app on Mac)
6. Copy FBI_inject_with_banner.app to the /files9/ folder on your SD card and reinsert your SD card into your 3DS
7. Press (B), then go to "SysNAND Backup/Restore", then select the "Health&Safety Inject" option
8. Press down once to select FBI_inject_with_banner.app, then press (A) and confirm to inject
9. Go to the main menu, then press (Start) to reboot

Section VI - Finalizing setup

6. Update your CFW SysNAND to the latest version using system settings (if it is not already)
   • If you copied a firmware.bin to /luma/ earlier, delete it after updating or you won't be able to boot
7. Open Health and Safety (which is now FBI)
8. Select "SD"
9. Select "cias"
10. Navigate to FBI.cia and press (A) to install
11. Navigate to hblauncher_loader.cia and press (A) to install
12. Navigate to lumaupdater.cia and press (A) to install
13. Exit with the home button
14. Launch the Homebrew Launcher from the home menu
15. Select "DSP Dump"
16. Press (Start) when prompted to exit
17. Reboot while holding Start to launch Hourglass9
18. Go to "SysNAND Backup/Restore", then select "Health&Safety Inject"
19. Select hs.app (the original one that doesn't contain FBI), then press (A) and confirm to inject
20. Press (Start) on the main menu to reboot!

You can now use Luma3DS Updater to update your Luma3DS to the latest version just by opening it and pressing (A). (This is not the same thing as a System Update; it just downloads and extracts the newest Luma3DS files)

You will no longer be able to boot without the SD card in, that is normal.
You will now boot a Custom Firmware based SysNAND by default.
You can now hold (Select) on boot to launch the Luma3DS configuration menu.
You can now hold (Start) on boot to launch Hourglass9, an arm9loaderhax safe multipurpose NAND and cartridge tool.

You can update your arm9loaderhax installation in the future by following the instructions on the Updating arm9loaderhax page.

To use NTR CFW, get ntr.bin from the appropriate zip on this page and copy it to the root of your SD card, then install BootNTR.cia from this page.

Keep your NANDmin.bin file, it can be restored by Hourglass9 to save you from a brick in the future.

You can remove your NAND backups from /files9/ as long as you still have them backed up to a safe location.

You can remove any extra files from the root of the SD card that are not in the image.