With Luma3DS' configuration menu, you can create a PIN lock using ABXY and the four D-Pad directions which must be entered before the system will boot. However, note that due to its limitations, it is impractical for all purposes except as a childproofing measure.
PIN Setup
Hold SELECT while powering on your device to enter the Luma3DS Configuration Menu, then press A on the PIN lock to choose a number of digits to use for your PIN: 4, 6, or 8. Once you have chosen a number, press START to exit the Luma3DS Configuration screen. At this point, you will be prompted to enter the PIN using ABXY and the DPad - once you have entered the number of digits you chose, the PIN will be set, so be careful not to push a button incorrectly. Once set, you will be prompted for the PIN before you can access the Luma3DS Chainloader, Luma3DS Configuration, or boot into the system.
If you have a splash active, the splash will always display after the PIN is entered correctly.
PIN Screen Customization
 |
These two types of customization are incompatible. If both are present, the PIN Splash will always override the PIN Message. |
PIN Message
If you place a text file with the name pinmessage.txt in SD://luma that is at most 800 characters long, the message inside that file will be displayed on the bottom screen of the PIN screen, with new lines also adding the ♪ character at the end of the previous line.
PIN Splash
By placing a splash image file named splashpin.bin in SD://luma that has the same dimensions as a splashbottom.bin (320x240), that image will be displayed on the bottom screen of the PIN screen.
Limitations
PIN Bypass
A PIN set via Luma3DS is easy to get rid of via multiple methods - all of them understandable, as either you could potentially lock yourself out of your own system otherwise or the weakness is outside of Luma's control - but regardless, it weakens its practical value even when Luma is installed as bootloader (FIRM0/1). The potential weaknesses allowing for this are as follows:
- The PIN itself is stored as an encrypted file,
SD://luma/pin.bin, but if deleted, Luma3DS acts as if it never existed and allows you to boot normally.- Notably, this does not zero out the setting in the configuration menu; if you boot into it again but don't manually zero out the setting, it will prompt you for a new PIN afterward.
- If you use a different
boot.firmto boot the 3DS, the new payload ignores the presence ofpin.binand automatically disables the PIN when booting you into its configuration menu, also allowing you to set your own as a result.- This applies in three ways, as follows:
- Changing out the payload on the SD, or using a payload from elsewhere on the SD.
- On a system that normally boots from the CTRNAND, inserting a usable SD with
boot.firmon its root. - Booting a flashcart via ntrboot that is configured to boot a
boot.firm; this method supersedes a PIN from Luma installed on SD, CTRNAND, and FIRM0/1.
- If using fastboot3DS instead of boot9strap, the fastboot3ds chainloader being earlier in the boot process than Luma means that you can boot into GodMode9 and delete
pin.bin, as above, before the PIN menu can appear.
Pin Bruteforce
The Luma3DS PIN screen allows you unlimited tries with no delay to guess the PIN, meaning that even if none of the PIN Bypass methods are available to you, you can still force your way into the system. This is mostly impractical - the maximum number of PINs are 4096 for 4 digits, 262,144 for 6 digits, and 16,777,216 for 8 digits - but the possibility still remains, and against a 4-digit PIN it's even relatively feasible.