It's here!

​

Info

@Normmatt has created a way to run B9S .firm files from bootrom via a DSi Flashcard and a magnet! This works on every 3DS on any firmware version.

For installation without a PC, user @TheCyberQuake has created a pack which will automatically install B9S and copy over essential starter homebrew from the flashcard's SD to the 3DS's. This will mainly be used for PC-less B9S installations. If you have a PC with you, use 3ds.guide. Read more here: https://gbatemp.net/threads/481141/

How does this work?

This works because of a flaw in the bootrom. Before the bootrom boots the NAND, it checks to see if Start+Select+X is held down, and if the shell is closed. If these requirements are met, it will boot an NDS cartridge from the bootrom. This give that cartridge bootrom access. You might be wondering how you'd hold down buttons while the shell is closed, and why you need a magnet. If you put a magnet in a specific spot on the 3DS, it will go into sleep mode. Using this, you can boot the NDS cartridge with the buttons held down while in sleep mode! Using a reflashable flashcard, you can boot B9SInstaller using the flashcard, and easily install it on your 3DS.

The 2DS doesn't need a magnet since a switch puts it to sleep instead of a magnet.

What does this mean?

1. Any 3DS model on any firmware can be hacked with minimal effort
2. You can unbrick any 3DS model from any type of brick.
   - Remember, you don't need a NAND backup for this. Just do a CTRTransfer.
   - This does not apply to MCU bricks.
3. Even consoles with fried NAND, or even the NAND chip physically removed, can use this

This is incredibly impressive stuff, and will most likely be released soon! edit: now!

FAQ

Q: Can Nintendo patch this?
A: Nope! Not without a new hardware revision.

Q: My flashcard is blocked by my firmware! Can I still use this?
A: Yes! The flashcard blacklist is not enabled on the bootrom.

Q: Why can't this work with my flashcard?
A: The installation requires you to flash NTRBoot to the flashcard's nand. Most DS flashcards, such as the original R4, have a ROM, which is not flashable.

Q: Can I install NTRBoot on my flashcard without another 3DS system?
A: If you can run NDS roms on your 3DS with it, then yes. If it's blocked on your 3DS version, then you'll need another 3DS system to use it.

Q: Will my 3DS flashcard work?
A: No, only the NDSi flashcards listed above.

Q: Will any other flash cards work?
A: Only the ones listed in the OP. However keep in mind that flashcards such as the DSTT, Supercard DS2 and R4 SDHC Dualcore are planned to be supported in the future.

Q: I tried to do this with my cartridge and it didn't work?
A: It doesn't work with regular DS cards.

Q: Can I unbrick from a ____ brick?
A: Considering the card has access to the bootrom, yes! This can unbrick any brick (except MCU), unless you've taken a knife to the motherboard.

Q: Can I install B9S on the latest firmware with this?
A: Again, since the card has access to the bootrom, you can do this easily! Just plug in your flashcard, boot up using the magnet and button combination, and install.

Q: Does this work on the New Nintendo 2DS XL?
A: Yes!

Release
Guide
Free NTRBoot Flashing
Free B9S Installations

Here is SciresM's post about this

Please see SciresM's presentation on bootromhax.​

 

[Deleted User]

It would be cool if we could do that. You could than CFW anything using a flashcard and CubicNinja or FreakyForms

What do you mean we could CFW anything using a flashcard and CubicNinja. This executes before the bootROM lockout and in place of NAND loading, so technically, this can be done without anything besides a modified flashcard.

 

[Snooli]

If we could flash the card from a homebrew 3ds without Arm9 access, we could use any userland exploit to flash the flashcard.
Unfortunately, we need A9 to flash.

 

[Deleted User]

If we could flash the card from a homebrew 3ds without Arm9 access, we could use any userland exploit to flash the flashcard.
Unfortunately, we need A9 to flash.

Oh that's what he meant. I thought he was talking about needing a flashcard after it had been flashed to boot into a NAND and then install CFW. my bad

 

[MagicKnight]

If we could flash the card from a homebrew 3ds without Arm9 access, we could use any userland exploit to flash the flashcard.
Unfortunately, we need A9 to flash.

Cards llike DSTWO can be "blindly" flashed simply putting a special file on the MicroSD and turning it on (you just need to plug it in), I think other brands can do the same so you don't need to execute anything on your 3DS console.

 

[Deleted User]

Cards llike DSTWO can be "blindly" flashed simply putting a special file on the MicroSD and turning it on (you just need to plug it in), I think other brands can do the same so you don't need to execute anything on your 3DS console.

I'm not sure that's the kind of flashing we're doing. That may just modify what loads when you launch the card, but we are also modifying the header

 

[Snooli]

Cards llike DSTWO can be "blindly" flashed simply putting a special file on the MicroSD and turning it on (you just need to plug it in), I think other brands can do the same so you don't need to execute anything on your 3DS console.

I'm not sure that's the kind of flashing we're doing. That may just modify what loads when you launch the card, but we are also modifying the header

[15:20] (Snooli) Even self-flashing cards can't self-flash?
[15:20] (+Normmatt) no

 

[MagicKnight]

I'm not sure that's the kind of flashing we're doing. That may just modify what loads when you launch the card, but we are also modifying the header

As far as i know on a DSTWO everything, including headers and everything, is controlled by the internal microprocessor and by flashing a custom firmware you can control them all. Maybe on Ace or R4 cards its different... I never had those cards.

 

[Deleted User]

[15:20] (Snooli) Even self-flashing cards can't self-flash?
[15:20] (+Normmatt) no

so am I right or wrong? not sure why you quoted my post

 

[Snooli]

so am I right or wrong? not sure why you quoted my post

You are correct

 

[NichyXD]

Hype for this hax.

 

[VashTS]

Normmatt got it working on a 2DS XL!
It can't be fixed.

cant tell if thats fake since 2ds hasn't launched but that is pretty legit if this is the case.

 

[Snooli]

cant tell if thats fake since 2ds hasn't launched but that is pretty legit if this is the case.

Most likely a dev unit. Don't forget that the PoC video was shot using dev Acekard2i, he propably has a lot of dev stuff.

 

[tivu100]

Yeah, I think the PSP and the 3DS are probably the two best consoles to hack now XD

Wii

 

[BARNWEY]

Wii

True, I used to be in the Wii scene (I was a lurker XD). It wasn't very developed back when I was in it though... Has it improved?

 

[Ziefer846]

My only concern is this: if I flash something on my AK2i to unbrick a 3DS or install B9S, can I recover my original AK2i firmware? I don't want to make my AK2i useless either.

 

[Ryccardo]

My only concern is this: if I flash something on my AK2i to unbrick a 3DS or install B9S, can I recover my original AK2i firmware? I don't want to make my AK2i useless either.

You should be able to as long as you make a backup first
(the new flasher by d0k3 will most likely have this - Decrypt9's definitely has)

 

[HolyHobo]

Anyone know if this brand of card will work for this method when it is released!? I have the 2014 edition! https://www.r43ds.org/products/R4-3DS-Dual-Core.html I guess my real question is this card reflashable

 

[Picahacker_]

I just tested if putting a magnet on the B button worked, and it did! this video is at least mostly real!

 

[Ziefer846]

You should be able to as long as you make a backup first
(the new flasher by d0k3 will most likely have this - Decrypt9's definitely has)

By backup, do you mean a backup of the flashcart software? How is that possible?

 

[Ryccardo]

By backup, do you mean a backup of the flashcart software? How is that possible?

Of the actual firmware

I guess (not having read the appropriate part of the Decrypt9 source) the card allows for backing it up through the regular slot1 interface