In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
+
In order to install custom firmware on our console, we need to get Homebrew Launcher access.
To accomplish this, we can use the Download Play functionality of the game Mario Kart 7, using a 3DS with custom firmware already installed along with a custom game plugin.
-
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject the exploited WiFi profile into your connections list.
+
This custom plugin will send a hacked payload to an unhacked console, which then exploits the system in order to inject menuhax67, which will allow us to get Homebrew Launcher access.
-
Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
+
Once we have Homebrew Launcher access, we can run nimdsphax to install boot9strap.
-
For a more technical explanation, see the following links for information on the kartdlphax and unSAFE_MODE exploits: kartdlphax, unSAFE_MODE.
+
See here for information about kartdlphax, here for information about menuhax67, and here for information about nimdsphax.
The latest release of Luma3DS (the Luma3DS .zip file)
-
The latest release of unSAFE_MODE (the RELEASE .zip file)
-
Section I - Hardware Button Check (target 3DS)
-
-
In this section, you will see whether your shoulder buttons are working on your console. This will determine which method you will follow on the next page.
-
-
-
Power on your console
-
Once you see the HOME Menu, press the (Left Shoulder) and (Right Shoulder) buttons at the same time
-
-
The camera applet should appear
-
-
-
Power off your console
-
-
-
If the camera does not open, you cannot follow this method. If this is the case, join Nintendo Homebrew on Discord and ask, in English, for help.
-
-
Section II - Prep Work (source 3DS)
+
Section I - Prep Work (source 3DS)
In this section, you will set up your source 3DS (the 3DS with custom firmware) for delivery of the exploit data to the target 3DS.
In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your target 3DS (the 3DS that you are trying to modify)’s SD card.
+
In this section, you will set up the files that the target 3DS will need to install custom firmware.
Insert the SD card of your target 3DS in your computer
Copy boot.firm and boot.3dsx from the Luma3DS .zip to the root of the target 3DS’s SD card
Create a folder named boot9strap on the root of your SD card
-
Copy boot9strap.firm and boot9strap.firm.sha from the RELEASE .zip to the /boot9strap/ folder on your SD card
+
Copy boot9strap.firm and boot9strap.firm.sha from the boot9strap .zip to the /boot9strap/ folder on your SD card
Copy SafeB9SInstaller.bin from the SafeB9SInstaller .zip to the root of your SD card
-
Copy usm.bin from the RELEASE .zip to the root of your SD card
-
Create a folder called 3ds on the root of your SD card
-
Copy slotTool.3dsx from the slotTool folder inside the RELEASE .zip to the /3ds/ folder on your SD card
+
Create a folder named 3ds on the root of your SD card if it does not already exist
+
+
This folder stores homebrew applications and data; it is different from the Nintendo 3DS folder that the console automatically generates
+
+
+
Copy the nimdsphax folder from the nimdsphax.zip to the /3ds/ folder on your SD card
+
Copy menuhax67_installer.3dsx from the menuhax .zip to the /3ds/ folder on your SD card
+
Copy Launcher.dat from the folder for your model and region inside the menuhax .zip to the root of your SD card
Eject the SD card and put it in the target 3DS
-
Section IV - kartdlphax
+
-
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
+
+
+
Section III - kartdlphax
+
+
In this section, you will use Download Play to transfer the exploit data from the source 3DS to the target 3DS, which can be used to install menuhax67, a Homebrew Launcher entrypoint. Your HOME Menu settings will be temporarily inaccessible on the target 3DS while this exploit is active.
Power on the source 3DS
@@ -650,45 +644,32 @@ window.cookieconsent.initialise({
If the exploit was not successful, power off the source 3DS and target 3DS and start again from the beginning of Section III - kartdlphax
-
Press (X) to inject unSAFE_MODE
-
If the injection was successful, the screen will turn green and the target 3DS will automatically power off
-
-
If the screen turns red, power off the target 3DS and start again from the beginning of Section III - kartdlphax. If this doesn’t work, ask for help at Nintendo Homebrew on Discord)
-
-
-
You will not need to use your source 3DS to complete any further steps on this guide. Any further steps should only be completed on the target 3DS.
-
-
Section V - unSAFE_MODE
-
-
In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
+
Section IV - Installing menuhax67
-
With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
+
Press (Y) + (D-Pad Down) to install menuhax67
-
Keep holding the buttons until the console boots into Safe Mode (a “system update” menu)
+
The console will automatically power off
-
Press “OK” to accept the update
+
Power on your console
+
Tap on the small HOME Menu settings icon in the top left of the bottom screen ()
-
There is no update. This is part of the exploit
+
If the console freezes for a while and then crashes, make sure you have Launcher.dat on the root of your SD card
-
Press “I accept” to accept the terms and conditions
-
The update will eventually fail, with the error code 003-1099. This is intended behaviour
-
When asked “Would you like to configure Internet settings?”, select “Yes”
-
On the following menu, navigate to Connection 1 -> Change Settings -> Next Page (right arrow) -> Proxy Settings -> Detailed Setup (image)
-
If the exploit was successful, your console will have booted into SafeB9SInstaller
+
If the exploit was successful, your console will have booted into the Homebrew Launcher
+
Launch nimdsphax from the list of homebrew
+
If the exploit was successful, you will have booted into SafeB9SInstaller
-
If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section
-
If your console instead freezes on a red screen, you are missing usm.bin from the root of your SD card
If your console freezes on a red screen, hold the POWER button until it turns off, then try running menuhax again by powering on your console and tapping on the HOME Menu settings icon
-
Section VI - Installing boot9strap
+
Section V - Installing boot9strap
In this section, you will install custom firmware onto your console.
On the next page, you will install useful homebrew applications to complete your setup.
-
Section VII - Restoring WiFi Configuration Profiles
+
Section VI - Removing menuhax67
-
In this section, you will enter the Homebrew Launcher (using custom firmware) so that you can restore the Wi-Fi connection slots that were overwritten in Section I.
+
In this section, you will use the Homebrew Launcher to remove menuhax67, which will let you access the HOME Menu Settings option normally.
In this section, you will see whether your shoulder buttons are working on your console. This will determine which method you will follow on the next page.
+
In this section, you will see whether your shoulder buttons are working on your console. This will determine whether your console is compatible with this method.