Hacks Guide Wiki - User contributions [en]

3DS:History of 3DS Hacking

2026-03-05T09:24:50Z

Octeble: Fixed minor inaccuracies around a9lh installation, browserhax, and gateway firmware versions

<references />
==2011==

===March===
The official release of the Nintendo 3DS in the west, and the creation of the wiki [[3dbrew:Main_Page|3dbrew]].

===June===
The first 3DS roms are dumped.

===September===
Crown3DS gives a teaser implying the creation of a flashcart, but instead released a website written in broken English promising the community that they are progressing.

===December===
The first release of tools that convert video to the type of stereographic 3D video compatible with the Nintendo 3DS Camera.

==2012==

===Unknown Month===
It is believed that Neimod's hardware RAM dumps and internal research led to the first userland and a9 exploits.<ref>https://gbatemp.net/threads/3ds-hacking-scene-history.443396/</ref>

===March===
The first (?) homebrew app is written in .cxi format, that being "Hello World" by Xcution (author of CiTRUS, a tool that allows BaNneR and ICoN files to be made using the .xbsf format)

==2013==

===August===
The flashcart [[Gateway-3DS]] is first released, and serves as the sole option for homebrew in the 3DS' early years. At this time, there was basic arm9 homebrew possible via an [https://www.3dbrew.org/wiki/System_Settings MSET] exploit combined with [https://github.com/naehrwert/p3ds/tree/df8f52a8c22b7f4758e1a47b2ca712d12be60bc6 p3ds] (python tools for the 3DS).

===December===
Users in the community figure out how to reverse engineer [[Gateway-3DS]]' payload to create their own NAND emulation (or redirection). This leads to the users Smealum and Yellows8 creating a private payload called RedNAND.

==2014==

===January===
brickgate/brickway - A scandal where Gateway released a FIRM that intentionally bricks consoles using Gateway3DS flashcart clones (such as R4 and Orange3DS). On top of this, its code was written badly enough that it triggered on many legitimate Gateway3DS cartridges, bricking completely 'innocent' users in the crossfire.

===March===
The first commit of Citra, the first major 3DS emulator, is released.

===August===
The secondary userland exploit {{GitHub|yellows8/oot3dhax|oot3dhax}} is first released by yellows8.

===November===
[https://www.gamebrew.org/wiki/Palantine_CFW_3DS Palantine] (a CFW made by Yellows8 and other) is leaked, bringing a closed-source custom firmware to the public. However, it had limitations such as the emuNAND not being update-able, having a low boot rate, and being difficult to install, among others. The thing it did best, running CIAs, would be taken and added to Gateway3DS shortly after.

The flashcart [[Sky3DS]] is first released. It could play pirated roms on entirely stock consoles, but couldn't run homebrew and had a very high ban risk due to the way it worked. This ban risk was unfixable until full custom firmware was released, and by that point it became obsolete anyway.

The primary userland exploit {{GitHub|smealum/ninjhax|ninjhax}} is first released by smealum.

==2015==

===January===
Gateway cracks firmware version 9.2 and updates their flashcarts to ULTRA. The user yifanlu makes a blog post about reverse engineering the memchunkhax/firmlaunchhax combo used by Gateway; roxas75, patois, and team SALT all implement their own versions of it shortly after.

===February===
The custom firmware {{GitHub|roxas75/rxTools|rxTools}} is first released by roxas75, notable for being purely focused on utilitarian homebrew and trying to avoid piracy entirely to avoid all potential legal issues.

===May===
The custom firmware PastaCFW is first released. It is named after a leak of sigpatches on pastebin, which was combined with patois' Brahma (an open source memchunkhax/firmlaunchhax) to make the first open source custom firmware. its only major caveat was that it had no emuNAND support.

A fork of rxTools with PastaCFW's sigpatches is released by ahp_person (appletinivi), causing roxas75 to openly dispute him in an attempt to stop piracy from becoming a legal issue for the wider homebrew community.

===June===
Once popular demand turns against him, roxas75 eventually gives in, releasing the rxTools source and officially adding sigpatches. He then, understandably, quits the homebrew scene immediately afterward and does not ever return.

===July===
The primary userland exploit Ninjhax2x is first released.

===August===
The exploits Tubehax and Ironhax are first released.
*Tubehax is a primary userland exploit that took advantage of the 3DS YouTube app, but was unfortunately patched only a couple months later on all versions.
*Ironhax is the first secondary (userland) exploit, meaning it requires extra leverage to work (usually from a primary exploit such as Tubehax).

ReiNand, the first fully-featured custom firmware to support the New 3DS, is released.

===September===
The exploits Menuhax and Browserhax are first released.
*Menuhax is a secondary userland exploit targeting the Home Menu. After the one use of a primary exploit needed to install it, it gives fully untethered coldboot userland access by exploiting the Home Menu automatically as it loads.
*Browserhax is a term for a series of primary userland exploits using the internet browsers for the n3DS and o3DS, which would become mainstays of the scene.

===December===
An upgrade to Sky3DS, Sky3DS+, is released. Among others, its new features included bypassing cart-based AP in recent games and having a second button for more ease of selecting games.

The CCC hosts [https://gbatemp.net/threads/32c3-console-hacking-3ds-talk-dec-27-smea-derrek-plutoo.405640/ 32c3] in Hamburg, Germany. During 32c3, [https://smealum.github.io/3ds/32c3/ smealum gives a talk] where snshax, [[arm9loaderhax]], memchunkhax2, and ntrcardhax are revealed, & menuhax and ironhax receive updates to continue functioning.
*snshax and ntrcardhax would ultimately be of little interest, thanks to snshax being n3DS-only and ntrcardhax requiring an extremely specific type of modified flashcart that effectively didn't exist.
*memchunkhax2 is a privilege escalation k11 exploit that, although not immediately useful, would quickly become the foundation of downgrading as part of other exploit chains.
*Arm9loaderhax is an untethered coldboot custom firmware loader that is installed directly to the FIRM partitions. Although it was somewhat unsafe and risky to install through its entire lifetime, it was still a massive step forward for the homebrew community by allowing homebrew tools even larger amounts of control over the system.

==2016==

===January===
An exploit chain using memchunkhax2 is introduced, the first implementation of downgrading from 10.x firmwares to 9.2 for certain other exploits.

Downgrading would soon after be patched by version 10.4.

===February===
[[arm9loaderhax]] is fully released, and becomes a mainstay of the scene.

The primary userland exploit ctr-httpwn is first released by yellows8.

A complex dispute between the original author of ReiNand (Reisyukaku) and the rest of its developer team hits its first overt boiling point, causing them to cut ties as much as possible and officially fork the project into AuReiNand.

===March===
The privilege escalation k11 exploit memchunkhax2.1 is first released by Aliaspider, which allowed 9.2 downgrades to resume until version 10.7 patched it a second time.

===April===
AuReiNand is renamed to Luma3DS, and work begins towards rewriting every line of code. Once this is done, they detach it from ReiNand's fork network on GitHub, which marks the point where it is converted into an entirely original project.

The tool {{GitHub|dazjo/salt_sploit_installer|salt_sploit_installer}} is first released, being unique because it sets the stage for three secondary userland exploits very shortly afterward.
Just a few days later, two of those three - {{GitHub|shinyquagsire23/v_hax|(v*)hax}} and {{GitHub|shinyquagsire23/supermysterychunkhax|supermysterychunkhax}} - are both first released by shinyquagsire23.

===May===
The third secondary userland exploit to use salt_sploit_installer, {{GitHub|dazjo/humblehax|humblehax}}, is first released by dazjo. This one is especially notable because it required purchasing a limited-time game from Humble Bundle, a quirk not seen in any exploit before or since.

===June===
The secondary userland exploit {{GitHub|MrNbaYoh/basehaxx|basehaxx}} is first released by MrNbaYoh.

===July===
A user reveals a DSiWare-based firm downgrade method after several months' worth of teasers. The release of this allowed 9.2 downgrades to continue on versions 11.0 - 11.2, before being patched a third time.

===September===
Arm9loaderhax gains two new tools that make its installation even easier: CTRNand Transfer (shortening the install time of both new and old 3DS) and OTPless (an instant N3DS install method). CTRNand Transfer would be kept and see far more use later, but OTPless was later removed from use due to having a small but completely random chance to brick.

===December===
The CCC hosts [https://gbatemp.net/threads/33c3-console-hacking-2016-3ds-wiiu-talk-dec-27-30-smea-derrek-nedwill-naehrwert.450043/ 33c3] in Hamburg, Germany. During 33c3, [https://derrekr.github.io/3ds/33c3/ derrekr gives a talk] where soundhax, fasthax, and sighax are revealed.
*Soundhax is a primary userland exploit targeting Nintendo 3DS Sound that was made by nedwill. Because it was free (unlike ninjhax, which required Cubic Ninja, a paid game), almost all consoles at the time were vulnerable to this exploit.
*Fasthax is another privilege escalation k11 exploit, also made by nedwill.
*[https://zoogie.github.io/sh/ Sighax] is a complex exploit of a vulnerability in the bootrom revealed by derrekr; when used properly, it allows anyone to sign arbitrary firmware code without restrictions. derrekr also revealed vague details about how he dumped the 3DS ARM9/ARM11 bootroms, though gave no detail about the exact code.<ref>https://wololo.net/2016/12/28/33c3-3ds-bootrom-cracked-sign-firmwares/</ref>

Nintendo launches a bug bounty program for the 3DS on HackerOne, with bounties from $100 - $20,000 per exploit. This caused exploit developers to start moving away from public releases.
==2017==

===January===
The privilege escalation k9 exploit chain safehax is first released by the user appleTinivi, after an anonymous user posted the method on 3dbrew. Through the use of this exploit chain (usable on all versions up to 11.2), the process for installing a9lh was significantly streamlined: specifically, it shortens the list of needed steps to directly downgrading to 2.1, using exploits on 2.1 to get a copy of otp.bin, installing a9lh using the otp, and restoring the original NAND.

===February===
safehax and fasthax are patched by the release of version 11.3, also temporarily patching firm downgrading via DSiWare and hardmodding again in the process.

===April===
A previously-unknown privilege escalation k11 exploit, udsploit is first released by Smealum just as it's patched by the release of version 11.4. However, it remains useful for those who stayed on version 11.3.

Safehax is updated to work on 11.3 by AppleTinivi due to an oversight in Nintendo's previous patch for safehax.

===May===
SciresM creates and gives an unofficial sequel to 33c3, 33.5c3. [https://sciresm.github.io/33-and-a-half-c3/ During this talk], [[boot9strap]] and the concepts that would later allow [[ntrboot]] are revealed.
*Boot9strap is effectively the successor to arm9loaderhax, being another coldboot firmware loader that works in a much cleaner way by implementing a FIRM sighax signature. Because of how it works, it carries near-zero brick risk and gains control early enough to keep access to the bootroms and decrypted OTP, allowing it to dump them in software.
*Ntrboot allows for any correctly signed firm to be booted from a DS cartridge when the correct keycombo is held down, which also skips the entire normal boot process. This allows it to serve both as an instant custom firmware installation method and an extremely potent unbricking tool.

Since legitimate firms can now be created with nothing more than NAND access, DSiWare and hardmod-based downgrades resume on the latest firmware by using the known plaintext attack.

===June===
The n2DSXL is released in Australia, and it is quickly discovered that it happens to have the same vulnerable bootroms as the old 3DS models did.

===August===
The first practical implementation of [[Ntrboot]] is released, starting only with support for ak2i and R4 flashcards but quickly growing to others.

===September===
The Gateway team reveals they have been working on a new flashcard called [[Stargate]], a 3-in-1 hybrid of an ntrboot card, DS flashcart, and [[Sky3DS]]. It was abandoned after a few months due to people seeking out cheaper options for ntrboot cards.

==2018==

===January===
A user reveals a method to brute-force the movable.sed using only the LocalFriendCodeSeed (which is obtainable in userland). This entrypoint, called [[3DS:Seedminer|Seedminer]], allowed users to inject hacked DSiWare and install [[boot9strap]] with only one 3DS.

===July===
Nintendo releases version 11.8.

===August===
Smealum reveals an arm9 exploit chain that he had been teasing at defcon, but it had already been patched in version 11.8 because he disclosed it to the HackerOne bug bounty program earlier on. As part of the reveal, he posted the incomplete repos on Github, but nobody to date has been able to make the exploit work.

===September===
The primary *miner exploit Frogminer is first released. This variant of the *miner exploit path utilizes an old version of the Japanese Flipnote Studio injected into DS Download Play instead of using Sudoku, meaning unlike its predecessor, it is a completely free *miner exploit.

===December===
Nintendo releases version 11.9, patching an unreleased browser exploit for both the O3DS and N3DS thanks to another HackerOne bounty submission by the userland exploit developer MrNbaYoh.

==2019==

===July===
The primary userland exploit BannerBomb3, which targeted System Settings and mostly used the *miner series to complete the exploit chain, is first released.

===December===
The CCC hosts [https://gbatemp.net/threads/36c3-hacker-conference-underway-27th-to-30th-of-december-2019.555023/ 36c3] in Leipzig, Germany. During 36c3, [https://mrnbayoh.github.io/36c3/ MrNbaYoh gives a talk] that demonstrates a new primary exploit chain: using StreetPass tags, someone could remotely takeover a 3DS in userland and install custom firmware, with zero user interaction required. This would set up further exploits developed by TuxSH and Lazypixie which would take over the ARM11 kernel, and later on Safehax 2.x to also take over ARM9. However, due to its potential for malicious use (i.e. remotely bricking consoles), this exploit chain was submitted to HackerOne sometime earlier and patched in version 11.12, two months before 36c3 started.

==2020==

===April===
The privilege escalation k9 exploit chain unSAFE_MODE, a revised version of safehax for version 11.13, is first released. Notably, this exploit chain would never be directly patched, but would be made unusuable when universal_otherapp is patched.

===July===
Nintendo's HackerOne bounty program [https://hackerone.com/nintendo/updates?type=team is closed on July 15th.]

===August===
The primary userland exploit new-browserhax, which is the simplest and most potent browserhax yet, is first released for both the n3DS and o3DS by zoogie. This begins a temporary 'golden age' where installing CFW is the easiest it ever has been, or will be (as of 2025-03-13).

===September===
Nintendo shuts down retail production of all 3DS models.

===October===
The secondary exploit menuhax67, the successor to Yellows8's menuhax, is first released by zoogie. This version of the exploit still requires initial userland access, but has even more privileges and is simpler to activate than the original. (And it's a great meme)

===November===
Nintendo releases version 11.14.0-46, patching a few last-minute submissions of exploits from the HackerOne bounty. This includes zoogie's new-browserhax, which ends the 'golden age' temporarily and changes the main userland entry point to back to Seedminer.

===December===
After the one month cooldown between each submission of bugs to HackerOne, MrNbaYoh and TuxSH disclose the entrypoint SSLoth and an exploit for it, safecerthax. Together, they create a full chain to boot9strap on o3DS models (and this chain still works on certain older versions, though it requires access to [[3DS:Safe Mode|Safe Mode]]).

TuxSH updates universal-otherapp to include a new exploit chain (based on smpwn, spipwn, khax and agbhax) that works on NATIVE_FIRM.

The primary userland exploit new-browserhax-xl is released by zoogie, resuming the 'golden age' of easy CFW installs.

==2021==

===January===
Nintendo ends Unity3DS and many debugging/dev hardware items in one fell swoop.

===April===
The privilege escalation userland exploit chain nimhax, an expansion of ctr-httpwn that simultaneously takes over the nim sysmodule, is first released by luigoalma.

The primary userland exploit old-browserhax-xl is first released by zoogie, complementing new-browserhax-xl so that all consoles have a browser exploit available again.

The semi-primary userland exploit [[3DS:Kartdlphax|kartdlphax]], an exploit for Mario Kart 7 that requires a second modded console, is first released by PabloMK7 (creator of CTGP-7).

===July===
Nintendo releases version 11.15, which patches both browserhax-xl exploits, ending the 'golden age' for good in the process. It also patches SSLoth (which leaves safecerthax unpatched but unusuable), and as such Seedminer becomes the main exploit again.

==2022==

===August===
Nintendo releases version 11.16, breaking TuxSH's universal-otherapp combo by patching smpwn.

Nintendo also lays the foundation for the eShop closure by updating MINT/ESHOP to handle shutting down eShop payments. Just two weeks later, they would update the NVER (most likely meaning Network Version) on this title due to a typo in the web data module.

===December===
The entrypoint ENLBufferPwn, an online RCE for Mario Kart 7, is disclosed by PabloMK7 after it was already patched in version 1.2 of the game. Although it had potential for custom firmware, PabloMK7 disclosed it because it could be used to remotely load universal-otherapp over the network; doing so would create a k9 exploit chain that also had potential for mass bricks, online cheats, remote installation of malware, or practically anything else (though with size constraints). By the time of disclosure, it was already being used in the wild to reset VR scores and interfere with races, making this claim of threat even more credible.

==2023==

===March===
The primary userland exploit super-skaterhax, another n3DS-only browser exploit, is first released.

Nintendo closes the eShop on the 27th, restricting all exploits that relied on free games and DSiWare to people who had bought them before its close. These exploits were removed from the guide's main paths shortly after.

===May===
Nintendo releases version 11.17, patching BannerBomb3 and leaving the o3DS with no free softmod method for the first time in a while.

===July===
The privilege escalation "k11" exploit chain nimdsphax, an expansion of nimhax that also takes over the dsp sysmodule, is first released by TuxSH and luigoalma. It is notable in that it does not directly exploit k11, but instead disables GPU_PROT and then uses the GPU to directly overwrite k11 code.

The secondary exploit Kartminer7, a secondary *miner exploit also requiring a copy of Mario Kart 7 (can be either physical or digital), is first released by zoogie.

===October===
The primary k9 exploit MSET9, which targets System Settings and has no extra requirements, is first released by zoogie. This restores free softmod access for the o3DS, but also works consistently on the n3DS as well and is generally an extremely stable exploit.

===December===
Zoogie(?) calls it quits and is looking forward to future challenges whilst appreciating the time "he had helping people unlock their 3DSs!" -zoogie
<references />

(Credit to zoogie for writing "A Pretty Brief History of the 3ds Hacking/Homebrew Scene", the GBAtemp page that this page was heavily adapted from.)

3DS:Alternate Exploits/Installing boot9strap (safecerthax)

2026-03-05T08:52:30Z

Octeble: Clarified the process coming from Black Screen Unbrick in Section III

==Technical Details==
For technical details on the exploit that you will be using on this page, see [https://github.com/MrNbaYoh/safecerthax here].

==Compatibility Notes==
safecerthax is compatible with all Old 3DS and Old 2DS consoles in all regions on system versions 1.0.0 through 11.14.0.

==What You Need==

*The latest release of [https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip SafeB9SInstaller] (direct download)
*The latest release of [https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip boot9strap] (direct download)
*The latest release of [https://github.com/LumaTeam/Luma3DS/releases/latest Luma3DS] (the Luma3DS <code>.zip</code> file)

==Instructions==

====Section I - Hardware Button Check====

If you came here from [[3DS:BSU|Black Screen Unbrick]], you may skip this section.

#Power on your console
#Once you see the HOME Menu, press the (Left Shoulder) and (Right Shoulder) buttons at the same time
#*The camera applet should appear
#*If the console crashes, just continue to the next section
#Power off your console

If the camera did NOT appear, you cannot follow this method as your shoulder buttons are broken

====Section II - Prep Work====

#Insert your SD card into your computer
#Copy everything from the Luma3DS <code>.zip</code> to the root of your SD card
#*The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
#Create a folder named <code>boot9strap</code> on the root of your SD card
#Copy <code>boot9strap.firm</code> and <code>boot9strap.firm.sha</code> from the boot9strap <code>.zip</code> to the <code>/boot9strap/</code> folder on your SD card
#Copy <code>SafeB9SInstaller.bin</code> from the SafeB9SInstaller <code>.zip</code> to the root of your SD card
#Reinsert your SD card into your console
#Power on your console

====Section III - safecerthax proxy====

If you came from [[3DS:BSU|Black Screen Unbrick]], turn off wireless either using the switch on the 3DS if you have it or at the router. Then, boot into recovery mode by powering on your console while holding {{Key press|L|R|Up|A}}. Attempt to update, click on the "Set Internet Settings" button after closing out the error that appears when the update fails, turn your wireless back on, and continue from Step 3.

#Launch the System Settings application
#Navigate to <code>Internet Settings</code> -> <code>Connection Settings</code>
#Click on your network connection slot and navigate to <code>Change Settings</code> -> <code>Next Page (right arrow)</code> -> <code>Proxy Settings</code>
#Set “Proxy Settings” to “Yes”, then click <code>Detailed Setup</code>
#Set the Proxy Server to <code>ssloth.nintendohomebrew.com</code>, and the Port to <code>8080</code>
#Click OK, then click Save
#When prompted, click “Test” to perform the connection test
#*The test should succeed
#Click “OK” to continue
#Power off your console

====Section IV - safecerthax====

#With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console
#*Keep holding the buttons until the console boots into Safe Mode (a “system update” menu)
#Press “OK” to accept the update
#*There is no update. This is part of the exploit
#Press “I accept” to accept the terms and conditions
#The update will eventually fail, with the error code <code>003-1099</code>. This is intended behaviour
#Press “OK” to close the error message
#If the exploit was successful, you will have booted into SafeB9SInstaller
#*If the console freezes or crashes, force power off the console, then retry this section

====Section V - Installing boot9strap====

#When prompted, input the key combo given on the top screen to install boot9strap
#*If a step on the lower screen has red-colored text, and you are not prompted to input a key combo, [[3dsguide:troubleshooting#issues-with-safeb9sinstaller|follow this troubleshooting guide]]
#Once it is complete, press (A) to reboot your console
#Your console should have booted into the Luma3DS configuration menu
#*Luma3DS configuration menu are settings for the Luma3DS custom firmware. Many of these settings may be useful for customization or debugging
#*For the purpose of this guide, '''leave these options on the default settings''' (do not check or uncheck anything)
#*If your console shuts down when you try to power it on, ensure that you have copied <code>boot.firm</code> from the Luma3DS <code>.zip</code> to the root of your SD card
#Press (Start) to save and reboot

If you came from [[3DS:BSU|Black Screen Unbrick]] return to the page now, and follow the CFW Troubleshooting

At this point, your console will boot to Luma3DS by default.

*Luma3DS does not look any different from the normal HOME Menu. If your console has booted into the HOME Menu, it is running custom firmware.
*On the next page, you will install useful homebrew applications to complete your setup.

====Section VI - Restoring default proxy====

#Launch the System Settings application
#Navigate to <code>Internet Settings</code> -> <code>Connection Settings</code>
#Click on your network connection slot and navigate to <code>Change Settings</code> -> <code>Next Page (right arrow)</code> -> <code>Proxy Settings</code>
#Set “Proxy Settings” to “No”
#Click OK, then click Save
#When prompted, click “Test” to perform the connection test
#*The test should succeed
#Power off your console

-----

<span style="font-size:200%;">Continue to [[3dsguide:finalizing-setup|Finalizing Setup]]</span>

[[Category:Nintendo 3DS guides]]

3DS:FTP

2026-03-05T08:09:53Z

Octeble: Added additional reason not to use microSD management

'''FTP''' (File Transfer Protocol) is a way to transfer files wirelessly through a local network.

==What You Need==
'''On your computer''':
<ul>
<li>A working FTP client
{{FTP clients}}</li>
</ul>

'''On your 3DS''':
*The latest release of {{GitHub|mtheall/ftpd/releases|ftpd}} (any <code>.3dsx</code> or <code>.cia</code>)
**The normal (unlabelled) version has a GUI while the <code>classic</code> version is entirely text-based

==Installation==
If your 3DS can use the internet, choose the Universal-Updater method.

{{info|FTPD is installed as part of [[3dsguide:finalizing-setup|Finalizing Setup]] on 3DS Hacks Guide.}}

<tabber>
|-|Universal-Updater=
=== Section I - Prep Work ===
# Open Universal-Updater
# Tap the magnifying glass icon on the bottom screen, and search for '''ftpd'''
# Press A on the '''ftpd''' entry, and choose one of the four ftpd/ftpd-classic files
# Once it finishes downloading, exit Universal-Updater
# If using the 3DSX, open the Homebrew Launcher
# Open ftpd

|-|Manual=

=== Section I - Prep Work ===
# Turn the 3DS off
# Insert your SD card into your computer
# Download one of the four ftpd/ftpd-classic files and move it into the correct place on your SD card
#* If you chose one of the <code>.cia</code> files, its correct place is the <code>cias</code> folder - create this folder if it does not exist
#* If you chose one of the <code>.3dsx</code> files, its correct place is the <code>3ds</code> folder - create this folder if it does not exist
# Insert your SD card into your 3DS
# Turn the 3DS on
Did you choose a <code>.cia</code> or a <code>.3dsx</code> version of ftpd?
{{#tag:tabber|
.cia=
<ol start="6">
<li>Open FBI and navigate to <code>SD</code> -> <code>cias</code></li>
<li>Press {{B|A}} while <code>ftpd.cia</code> or <code>ftpd-classic.cia</code> is selected, then select <code>Install and delete CIA(s)</code></li>
<li>Allow FBI to install the CIA</li>
<li>Exit FBI, then exit the Homebrew Launcher</li>
<li>Ensure your 3DS is connected to the same Internet connection as your computer</li>
<li>Open ftpd</li>
</ol>

{{!}}-{{!}}

.3dsx=
<ol start="6">
<li>Open the Homebrew Launcher</li>
<li>Open ftpd</li>
</ol>
}}
</tabber>

==Usage==
#If you haven't already, install the FTP client for your operating system
#Open the FTP client and fill in the information as follows:
#*File protocol: FTP (''not'' SFTP)
#*Host name/IP address: The IP address displayed on the top screen of the 3DS (e.g. 192.168.0.67)
#**This is a local IP address, so you don't need to censor it if you need assistance
#*Port number: The number after the colon in the IP address displayed on the top screen of the 3DS (usually 5000)
#**If you don't see this option, instead type <code>(ip):(port)</code> into the host name/IP address box, e.g. <code>192.168.0.67:5000</code>
#*Username/password: If you see a checkbox for "Anonymous login", then enable it; otherwise, just leave it blank
#Click "Login" or "Connect"
#*If prompted to enter a username or password, press ENTER to leave it blank

<big>{{success|Your computer is now connected to your 3DS via FTP!}}</big>
[[Category:Nintendo 3DS guides]]

==FAQ==

===Why not microSD Management?===

While New 3DS models can do a similar method through microSD Management, said method has a number of downsides:
*microSD Management does not exist on Old 3DS models.
*microSD Management uses a protocol (SMBv1) that is only supported by Windows.
**Additionally, SMBv1 is heavily outdated, [https://techcommunity.microsoft.com/t5/storage-at-microsoft/stop-using-smb1/ba-p/425858 now a major security risk], and disabled by default on modern installations of Windows.
*microSD Management can cause random file corruption in use.
*microSD Management sometimes doesn't allow you to create or paste in folders on modern setups.

3DS:Black screen unbrick

2026-03-05T07:57:48Z

Octeble: Added a 'the'

{{shortcut|3DS:BSU}}
When a 3DS boots to a black screen instead of the HOME Menu, it is usually a bad sign. This page lists common troubleshooting steps to fix this issue.

The troubleshooting below should always be started at the first section. The troubleshooting will direct you to the next sections if necessary.

__TOC__

==CFW Check==
First, we will check if the console has CFW. This will help as it allows access to [[3DS:GodMode9|GodMode9]], a helpful tool for troubleshooting and fixing issues.

#Power on your console while holding the {{B|SELECT}} button
#*If your console boots to the [[3DS:Luma3DS/Configuration|Luma3DS configuration menu]], press {{B|START}} to save, then continue to the CFW troubleshooting section below
#*If your console doesn't boot to the Luma3DS configuration menu, do the same without the SD card inserted
#**If your console does boot to the Luma3DS configuration menu, your SD card wasn't inserted correctly, re-insert it and try again
#**If your console turns off right away, you have CFW and can continue to the CFW troubleshooting section below
#**If your console doesn't boot to the Luma3DS configuration menu but black-screens, your console is likely bricked without CFW, and you should continue to the stock troubleshooting section at the bottom of this page
#***To make sure of this, hold {{Key press|SELECT|START|X|POWER}} for seven seconds while the console is powered off, then power off again, hold {{B|HOME}}, and then press {{B|POWER}} - if the notification LED [[3DS:boot9strap#LED_Status_Codes|lit up a color]] or the [[3DS:fastboot3DS|fastboot3DS]] menu appears, then you have working CFW but something is interfering with Luma. Join the Nintendo Homebrew Discord for more advanced help

==CFW troubleshooting==

===Section I - Prep Work===

#Follow [[3dsguide:restoring-updating-cfw.html|Restoring / Updating CFW]], then "Updating GodMode9" and "Creating a NAND backup" section on [[3DS:GodMode9/Usage]]
#Take out any inserted game cartridge
#Continue to the next section

===Section II - RTCBug===

#Power on your console
#Wait ten seconds, then press {{Key press|L|Down|SELECT}} at the same time
#*If the [[3DS:Luma3DS/Rosalina|Rosalina menu]] opens, you're likely experiencing [[3DS:RTCBug]] - return by pressing B, wait 15 minutes, remove any inserted cartridge, and the HOME Menu should load on its own. If this doesn't work, continue to the next section
#*If Rosalina doesn't open, continue to the next section

===Section III - Luma3DS configuration reset===

#Insert the SD card into your computer
#Navigate to the folder <code>sd:/luma</code>
#Delete <code>config.ini</code>
#Reinsert the SD card into your console
#Power on your console
#*If your console doesn't boot to the Luma3DS config, follow [[SD Clean]], then return to section 2
#Do not enable anything, just press {{B|START}} to save the default configuration
#*If your console boots to the HOME Menu, you should look for and delete faulty patches in <code>/luma/sysmodules</code> and <code>/luma/titles</code> on the SD card before turning <code>Enable game patching</code> or <code>Loading external FIRMs and modules</code> back on
#*If your console doesn't boot to the HOME Menu, continue to the next section
#*If your console boots to an error, check [[3DS:EXCEPTION|the Luma exceptions page]] for how to fix your error, or ask for help in the Nintendo Homebrew Discord if your error isn't listed there

===Section IV - SD HOME Menu extdata===

#Power on your console without the SD card inserted
#*If it boots to the Luma3DS configuration screen, press {{B|START}} to save
#*If it doesn't boot to the HOME menu, continue to the next section
#*If it boots to the HOME Menu, do the following steps:
#*#Insert your SD card into your computer
#*#Navigate to <code>Nintendo 3DS</code> -> <code>ID0</code> -> <code>ID1</code> -> <code>extdata</code> -> <code>00000000</code>
#*#*<code>ID0</code> and <code>ID1</code> are 32-character long folders
#*#*If you have multiple ID0/ID1 folders, do the following for all of them
#*#Delete the corresponding folder for your region:
#*#*USA: <code>0000008f</code>
#*#*EUR: <code>00000098</code>
#*#*JPN: <code>00000082</code>
#*#*KOR: <code>000000A9</code>
#*#Reinsert your SD card into your console
#*#Power on your console
#*#*If it still doesn't boot to the HOME Menu, but does without the SD card, you're experiencing a very weird issue and should ask in the Nintendo Homebrew discord for more advanced help

===Section V - Safe Mode===

#Power on your console while holding {{Key press|L|R|Up|A}}
#*If your console boots to the Safe Mode menu, perform the update and see if it boots to the HOME Menu
#*If it doesn't boot to Safe Mode, or doesn't boot to the HOME Menu after a Safe Mode update, continue to the next section

===Section VI - ctrcheck===

#Follow the instructions on [[3DS:Ctrcheck|the ctrcheck page]]
#If the console doesn't boot to the HOME Menu after all applicable fixes have been tried, continue to the next section

===Section VII - New 3DS camera brick{{anchor|Section VIII - New 3DS camera brick}}===

{{info|If you are currently troubleshooting an old model console, ignore this and skip to the next section.
<br>If you are unsure whether your console is new or old, look at its shoulder buttons. A new model has four ({{Key press|ZL|L|R|ZR}}), and an old model has two ({{Key press|L|R}}).}}

#Insert your SD card into your computer
#Navigate to the <code>/luma/</code> folder
#Look for <code>errdisp.txt</code>
##If this file already exists, rename it to <code>_errdisp.txt</code>
##If this file doesn't exist, skip to the next section
#Reinsert your SD card into the console
#Power on the console
#Wait 30 seconds without pressing any buttons
#Power off the console
#Navigate to the <code>/luma/</code> folder
#Look for <code>errdisp.txt</code>
#*If this file exists, open it in a text editor, and check if the process name is <code>qtm</code>
#**If the process name is <code>qtm</code>, you need to disconnect your inner camera or replace it
#**If the process name is something else, your console has a very unusual issue and you should ask in the Nintendo Homebrew Discord for more advanced help
#*If this file doesn't exist, continue to the next section

===Section VIII - CTRTransfer{{anchor|Section VII - CTRTransfer}}===

#Follow the [[3dsguide:ctrtransfer.html|CTRTransfer guide on 3DS Hacks Guide]]
#*If the console doesn't boot to the HOME Menu at the end of Section III, continue to the next section of this guide

===Section IX - 3ds_hw_test===

#Follow the instructions on [[3DS:Hardware test|the hardware test page]]
#*If the number of errors from this is zero, continue to the next section

===Section X - Manual CTRTransfer===

#Follow [[3DS:CTRTransfer/Manual]]
#*When asked whether to restore optional data, press {{B|B}} to deny it

----
By this point, you have exhausted all conventional fixes. If your console has not booted to the HOME Menu by now, go to the Nintendo Homebrew Discord and mention that you've tried this page already.

==Stock troubleshooting==

===Section I - Safe Mode===

#Power on your console while holding {{Key press|L|R|Up|A}}
#*If your console boots to the Safe Mode menu and is an Old 3DS/XL/2DS model, try [[3DS:Safecerthax|Safecerthax]], if not, proceed to the next bullet point
#*If your console boots to the Safe Mode menu and the first bullet point didn't apply to you, perform the update and see if it boots to the HOME Menu
#*If it doesn't boot to Safe Mode, or doesn't boot to the HOME Menu after a Safe Mode update, continue to the next section

===Section II - Shutdown menu===

#Power on the console
#Wait 30 seconds without touching any buttons
#Press the POWER button
#*If the shutdown menu opens (a grey screen with text), you're experiencing <code>f000000b</code> corruption and must install boot9strap with a [[3DS:ntrboot|ntrboot]] compatible flashcart in order to fix the issue
#*If the screen stays black and the console only powers off if you hold the button for 15 seconds, this may be potentially fixable with [[3DS:ntrboot|ntrboot]] if it is not a hardware issue

[[Category:Unbricking]]
[[Category:Nintendo 3DS troubleshooting]]

3DS:Black screen unbrick

2026-03-05T07:56:39Z

Octeble: Added slight idiot proofing and additional link in ntrboot section + grammar fix

{{shortcut|3DS:BSU}}
When a 3DS boots to a black screen instead of the HOME Menu, it is usually a bad sign. This page lists common troubleshooting steps to fix this issue.

The troubleshooting below should always be started at the first section. The troubleshooting will direct you to the next sections if necessary.

__TOC__

== CFW Check ==
First, we will check if the console has CFW. This will help as it allows access to [[3DS:GodMode9|GodMode9]], a helpful tool for troubleshooting and fixing issues.

# Power on your console while holding the {{B|SELECT}} button
#* If your console boots to the [[3DS:Luma3DS/Configuration|Luma3DS configuration menu]], press {{B|START}} to save, then continue to the CFW troubleshooting section below
#* If your console doesn't boot to the Luma3DS configuration menu, do the same without the SD card inserted
#** If your console does boot to the Luma3DS configuration menu, your SD card wasn't inserted correctly, re-insert it and try again
#** If your console turns off right away, you have CFW and can continue to the CFW troubleshooting section below
#** If your console doesn't boot to the Luma3DS configuration menu but black-screens, your console is likely bricked without CFW, and you should continue to the stock troubleshooting section at the bottom of this page
#*** To make sure of this, hold {{Key press|SELECT|START|X|POWER}} for seven seconds while the console is powered off, then power off again, hold {{B|HOME}}, and then press {{B|POWER}} - if the notification LED [[3DS:boot9strap#LED_Status_Codes|lit up a color]] or the [[3DS:fastboot3DS|fastboot3DS]] menu appears, then you have working CFW but something is interfering with Luma. Join the Nintendo Homebrew Discord for more advanced help

== CFW troubleshooting ==

=== Section I - Prep Work ===

# Follow [[3dsguide:restoring-updating-cfw.html|Restoring / Updating CFW]], then "Updating GodMode9" and "Creating a NAND backup" section on [[3DS:GodMode9/Usage]]
# Take out any inserted game cartridge
# Continue to the next section

=== Section II - RTCBug ===

# Power on your console
# Wait ten seconds, then press {{Key press|L|Down|SELECT}} at the same time
#* If the [[3DS:Luma3DS/Rosalina|Rosalina menu]] opens, you're likely experiencing [[3DS:RTCBug]] - return by pressing B, wait 15 minutes, remove any inserted cartridge, and the HOME Menu should load on its own. If this doesn't work, continue to the next section
#* If Rosalina doesn't open, continue to the next section

=== Section III - Luma3DS configuration reset ===

# Insert the SD card into your computer
# Navigate to the folder <code>sd:/luma</code>
# Delete <code>config.ini</code>
# Reinsert the SD card into your console
# Power on your console
#* If your console doesn't boot to the Luma3DS config, follow [[SD Clean]], then return to section 2
# Do not enable anything, just press {{B|START}} to save the default configuration
#* If your console boots to the HOME Menu, you should look for and delete faulty patches in <code>/luma/sysmodules</code> and <code>/luma/titles</code> on the SD card before turning <code>Enable game patching</code> or <code>Loading external FIRMs and modules</code> back on
#* If your console doesn't boot to the HOME Menu, continue to the next section
#* If your console boots to an error, check [[3DS:EXCEPTION|the Luma exceptions page]] for how to fix your error, or ask for help in the Nintendo Homebrew Discord if your error isn't listed there

=== Section IV - SD HOME Menu extdata ===

#Power on your console without the SD card inserted
#* If it boots to the Luma3DS configuration screen, press {{B|START}} to save
#* If it doesn't boot to the HOME menu, continue to the next section
#* If it boots to the HOME Menu, do the following steps:
#*# Insert your SD card into your computer
#*# Navigate to <code>Nintendo 3DS</code> -> <code>ID0</code> -> <code>ID1</code> -> <code>extdata</code> -> <code>00000000</code>
#*#* <code>ID0</code> and <code>ID1</code> are 32-character long folders
#*#* If you have multiple ID0/ID1 folders, do the following for all of them
#*# Delete the corresponding folder for your region:
#*#* USA: <code>0000008f</code>
#*#* EUR: <code>00000098</code>
#*#* JPN: <code>00000082</code>
#*#* KOR: <code>000000A9</code>
#*# Reinsert your SD card into your console
#*# Power on your console
#*#* If it still doesn't boot to the HOME Menu, but does without the SD card, you're experiencing a very weird issue and should ask in the Nintendo Homebrew discord for more advanced help

=== Section V - Safe Mode ===

# Power on your console while holding {{Key press|L|R|Up|A}}
#* If your console boots to the Safe Mode menu, perform the update and see if it boots to the HOME Menu
#* If it doesn't boot to Safe Mode, or doesn't boot to the HOME Menu after a Safe Mode update, continue to the next section

=== Section VI - ctrcheck ===

# Follow the instructions on [[3DS:Ctrcheck|the ctrcheck page]]
# If the console doesn't boot to the HOME Menu after all applicable fixes have been tried, continue to the next section

=== Section VII - New 3DS camera brick{{anchor|Section VIII - New 3DS camera brick}} ===

{{info|If you are currently troubleshooting an old model console, ignore this and skip to the next section.
<br>If you are unsure whether your console is new or old, look at its shoulder buttons. A new model has four ({{Key press|ZL|L|R|ZR}}), and an old model has two ({{Key press|L|R}}).}}

# Insert your SD card into your computer
# Navigate to the <code>/luma/</code> folder
# Look for <code>errdisp.txt</code>
## If this file already exists, rename it to <code>_errdisp.txt</code>
## If this file doesn't exist, skip to the next section
# Reinsert your SD card into the console
# Power on the console
# Wait 30 seconds without pressing any buttons
# Power off the console
# Navigate to the <code>/luma/</code> folder
# Look for <code>errdisp.txt</code>
#* If this file exists, open it in a text editor, and check if the process name is <code>qtm</code>
#** If the process name is <code>qtm</code>, you need to disconnect your inner camera or replace it
#** If the process name is something else, your console has a very unusual issue and you should ask in the Nintendo Homebrew Discord for more advanced help
#* If this file doesn't exist, continue to the next section

=== Section VIII - CTRTransfer{{anchor|Section VII - CTRTransfer}} ===

# Follow the [[3dsguide:ctrtransfer.html|CTRTransfer guide on 3DS Hacks Guide]]
#* If the console doesn't boot to the HOME Menu at the end of Section III, continue to the next section of this guide

=== Section IX - 3ds_hw_test ===

# Follow the instructions on [[3DS:Hardware test|the hardware test page]]
#* If the number of errors from this is zero, continue to the next section

===Section X - Manual CTRTransfer===

# Follow [[3DS:CTRTransfer/Manual]]
#* When asked whether to restore optional data, press {{B|B}} to deny it

----
By this point, you have exhausted all conventional fixes. If your console has not booted to the HOME Menu by now, go to the Nintendo Homebrew Discord and mention that you've tried this page already.

==Stock troubleshooting==

===Section I - Safe Mode ===

# Power on your console while holding {{Key press|L|R|Up|A}}
#* If your console boots to the Safe Mode menu and is an Old 3DS/XL/2DS model, try [[3DS:Safecerthax|Safecerthax]], if not, proceed to next bullet point
#* If your console boots to the Safe Mode menu and the first bullet point didn't apply to you, perform the update and see if it boots to the HOME Menu
#* If it doesn't boot to Safe Mode, or doesn't boot to the HOME Menu after a Safe Mode update, continue to the next section

===Section II - Shutdown menu ===

# Power on the console
# Wait 30 seconds without touching any buttons
# Press the POWER button
#* If the shutdown menu opens (a grey screen with text), you're experiencing <code>f000000b</code> corruption and must install boot9strap with a [[3DS:ntrboot|ntrboot]] compatible flashcart in order to fix the issue
#* If the screen stays black and the console only powers off if you hold the button for 15 seconds, this may be potentially fixable with [[3DS:ntrboot|ntrboot]] if it is not a hardware issue

[[Category:Unbricking]]
[[Category:Nintendo 3DS troubleshooting]]