|
|
| Line 1: |
Line 1: |
| ==Technical Details== | | ==Remove Shiny- Locks in Pokémon games== |
| In order to exploit the SAFE_MODE firmware of our system, we need to inject an exploited WiFi profile.
| | This guide will show you how to remove shiny locks and edit shiny chance from the generation 6 and 7 Pokémon games on the 3DS using LayeredFS and pk3DS |
| We can do this using an existing exploit, BannerBomb3.
| |
|
| |
|
| To accomplish this, we use your system’s encryption key (movable.sed) to build a DSiWare backup that exploits the system in order to inject the exploited WiFi profile into your connections list.
| | ==Compatibility Notes== |
| | |
| Once the WiFi profile has been injected, we will use SAFE_MODE, which is a recovery feature present on all 3DS consoles, to activate the exploited WiFi profile.
| |
| | |
| For a more technical explanation, see the following links for information on the BannerBomb3 and unSAFE_MODE exploits: [https://github.com/zoogie/Bannerbomb3 BannerBomb3], [https://github.com/zoogie/unSAFE_MODE/ unSAFE_MODE].
| |
|
| |
|
| ==Compatibility Notes==
| | {{info|This guide requires you have [[Custom firmware|CFW]] with [[3DS:Luma3DS|Luma3DS]] 8.0+ (preferably latest).}} |
| These instructions work on USA, Europe, Japan, and Korea region consoles as indicated by the letters U, E, J, or K after the system version.
| | {{info|This guide requires a computer running Windows.}} |
|
| |
|
| {{Warning
| | ==What You Need== |
| | text = If your (Right/Left Shoulder), (D-Pad Up), or (A) buttons do not work, you will need to follow [[3DS:Alternate Exploits/Installing boot9strap (Fredtool)|an alternate branch of Seedminer]]. For assistance with this matter, join [https://discord.gg/MWxPgEp Nintendo Homebrew on Discord] and ask, in English, for help.
| |
| }}
| |
|
| |
|
| ==What You Need==
| | *The latest release of [https://projectpokemon.org/home/forums/topic/34377-pk3ds-pok%C3%A9mon-3ds-rom-editor-and-randomizer/ pk3DS] |
| | *The latest release of [https://github.com/d0k3/GodMode9/releases GodMode9] |
|
| |
|
| *The latest release of [https://github.com/d0k3/SafeB9SInstaller/releases/download/v0.0.7/SafeB9SInstaller-20170605-122940.zip SafeB9SInstaller] (direct download)
| | ==Section I - Dumping exefs and romfs from your game== |
| *The latest release of [https://github.com/SciresM/boot9strap/releases/download/1.4/boot9strap-1.4.zip boot9strap] (direct download)
| |
| *The latest release of [https://github.com/LumaTeam/Luma3DS/releases/latest Luma3DS] (the Luma3DS <code>.zip</code> file)
| |
| *[https://github.com/zoogie/unSAFE_MODE/releases/download/v1.3/usm.bin usm.bin] (direct download)
| |
|
| |
|
| ==Instructions==
| | #Press and hold {{B|Start}}, while still holding {{B|Start}}, power on your console to launch GodMode9 |
| | #Navigate to <code>[C:] GAMECART</code> |
| | #Press {{B|A}} on <code>[TitleID].trim.3ds</code> |
| | #Select NCSD image options... |
| | #Select Mount image to drive |
| | #Press {{B|A}} to enter drive |
| | #Press {{B|A}} on <code>content0.game</code> |
| | #Hover over the folder <code>exefs</code> and press {{B|R}} + {{B|A}} |
| | #Select <code>Copy to 0:/gm9/out</code> |
| | #When done hover over the folder <code>romfs</code> and press {{B|R}} + {{B|A}} |
| | #Select <code>Copy to 0:/gm9/out</code> |
| | #When thats done press {{B|Start}} |
| | #Your dumped <code>exefs</code> and <code>romfs</code> can be found in <code>/gm9/out/</code> |
|
| |
|
| ===Section I - Prep Work===
| | ==Section II - Removing shiny lock and edit shiny chance== |
| In this section, you will copy the files needed to trigger the unSAFE_MODE exploit onto your console’s SD card.
| |
|
| |
|
| #Your SD card should be inserted in your computer
| | <tabber> |
| #Copy <code>usm.bin</code> to the root of your SD card
| | |-|Generation 7= |
| #Copy <code>boot.firm</code> and <code>boot.3dsx</code> from the Luma3DS <code>.zip</code> to the root of your SD card
| | <span> |
| #*The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
| |
| #Create a folder named <code>boot9strap</code> on the root of your SD card
| |
| #Copy <code>boot9strap.firm</code> and <code>boot9strap.firm.sha</code> from the boot9strap <code>.zip</code> to the <code>/boot9strap/</code> folder on your SD card
| |
| #Copy <code>SafeB9SInstaller.bin</code> from the SafeB9SInstaller <code>.zip</code> to the root of your SD card
| |
|
| |
|
| ===Section II - BannerBomb3===
| | {{warning|unselecting everything in <code>Randomizer Options</code> except <code>Remove Shiny Locks</code>doesnt work}} |
| In this section, you will trigger the BannerBomb3 exploit using the DSiWare Management menu, which can be used to overwrite your Wi-Fi slots with hacked data. Your Wi-Fi connection settings will be temporarily overwritten while the exploit is active.
| |
|
| |
|
| #Reinsert your SD card into your console
| |
| #Power on your console
| |
| #Launch System Settings on your console
| |
| #Navigate to <code>Data Management</code> -> <code>DSiWare</code> -> <code>SD Card</code> (image(not really))
| |
| #*Your console should show the BB3 multihax menu
| |
| #*If the BB3 multihax menu doesn’t open, [[3dsguide:troubleshooting#bannerbomb3|follow this troubleshooting guide]]
| |
| #*If the BB3 multihax menu says “cfw installed already”, you already have custom firmware and should continue from [[3dsguide:checking-for-cfw|here]]
| |
| #Use the D-Pad to navigate and press the (A) button to select “Install unSAFE_MODE”
| |
| #*Your console will automatically power off
| |
| #Power on your console
| |
| #Launch System Settings on your console
| |
| #Navigate to <code>Internet Settings</code> -> <code>Connection Settings</code>
| |
| #Ensure that all three connections are named “Haaaaaaaxxxxxxxxx…”
| |
| #*Do NOT change these settings!
| |
| #*If all three connections are NOT all named “Haaaaaaaxxxxxxxxx…”, STOP! Something went wrong in this section and MUST be fixed before you can continue
| |
| #Power off your console | | #Power off your console |
| | #insert your SD Card into your Computer |
| | #create a folder on your Computer named after the game you want to patch <code>[gamefolder]</code> |
| | #Move the <code>exefs</code> and <code>romfs</code> folders from your SD Card in the folder you just created <code>[gamefolder]</code> |
| | #go into the <code>exefs</code> folder |
| | #rename the <code>.code</code> file to <code>.code.bin</code> |
| | #extract the pk3DS <code>.zip</code> on your Computer and double click on <code>pk3DS.WinForms.exe</code> |
| | #click on <code>file</code>, <code>open</code> |
| | #now select the folder where the <code>exefs</code> and <code>romfs</code> folders are located |
| | #in pk3DS click on <code>ExeFS</code>, than on <code>Shiny Rate</code> |
| | #here click on <code>EVERYTHING SHINY</code> and than on <code>SAVE</code>, this is to check, if everything is running correct |
| | #Now click on <code>RomFS</code>, than on <code>Static Encounters</code> |
| | #in Section <code>Gifts</code> and <code>Encounters</code> remove the tick on Shiny Locks on every Pokemon |
| | #Click on <code>SAVE</code> and close pk3DS |
| | #go into your <code>exefs</code> folder and copy <code>.code.bin</code> |
| | #Paste the <code>.code.bin</code> folder in the Root of the game folder you created on step 3 |
| | #Rename the <code>.code.bin</code> file to <code>code.bin</code> |
| | #Copy the file called 9 in <code>[gamefolder]\romfs\a\1\5</code> to the root of the <code>[gamefolder]</code> |
| | </span> |
| | </tabber> |
|
| |
|
| ===Section III - unSAFE_MODE===
| | ==Section III - Preparing the SD Card== |
| In this section, you will enter Safe Mode (a feature available on all 3DS family consoles) and navigate to a menu where unSAFE_MODE will be triggered, which will launch you into the boot9strap (custom firmware) installer.
| |
|
| |
|
| #With your console still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), and while holding these buttons together, power on your console | | <tabber> |
| #*Keep holding the buttons until the console boots into Safe Mode (a “system update” menu) | | |-|Generation 7= |
| #Press “OK” to accept the update | | <span> |
| #*There is no update. This is part of the exploit
| | #On Your SD Card go to <code>/luma/titles/</code> and create a folder with the corresponding <code>TitleID</code> of the game you patched |
| #Press “I accept” to accept the terms and conditions | | #* Create a <code>titles</code> folder if you don't already have one |
| #The update will eventually fail, with the error code <code>003-1099</code>. This is intended behaviour | | #Copy the <code>code.bin</code> in the <code>TitleID</code> folder |
| #When asked “Would you like to configure Internet settings?”, select “Yes” | | #in the <code>TitleID</code> folder create a folder called <code>romfs</code> |
| #On the following menu, navigate to <code>Connection 1</code> -> <code>Change Settings</code> -> <code>Next Page (right arrow)</code> -> <code>Proxy Settings</code> -> <code>Detailed Setup</code> (image(not really)) | | #in the <code>romfs</code> folder create a folder called <code>a</code> |
| #If the exploit was successful, your console will have booted into SafeB9SInstaller
| | #in the <code>a</code> folder create 4 folders called <code>0</code>, <code>1</code>, <code>2</code> and <code>3</code> |
| #*If your console instead freezes on a white screen, hold the POWER button until it turns off, then retry this section | | #in each of the 4 folders need to be 10 folders called <code>0</code>, <code>1</code>, <code>2</code>, <code>3</code>, <code>4</code>, <code>5</code>, <code>6</code>, <code>7</code>, <code>8</code> and <code>9</code> |
| #*If your console instead freezes on a red screen, you are missing <code>usm.bin</code> from the root of your SD card
| | #copy the file called <code>9</code> of the root of the <code>[gamefolder]</code> and paste it in <code>[TitleID]\romfs\a\1\5</code> |
| | </span> |
| | </tabber> |
|
| |
|
| ===Section IV - Installing boot9strap===
| | ==Section IV - Patching the Game== |
| In this section, you will install custom firmware onto your console.
| |
|
| |
|
| #When prompted, input the key combo given on the top screen to install boot9strap | | # Eject your SD Card from your Computer and reinsert it into your console |
| #*If a step on the lower screen has red-colored text, and you are not prompted to input a key combo, [[3dsguide:troubleshooting#issues-with-safeb9sinstaller|follow this troubleshooting guide]] | | # Press and hold {{B|Select}}, while still holding {{B|Select}}, power on your console to open the Luma configuration menu |
| #Once it is complete, press (A) to reboot your console
| | # Select <code>Enable game patching</code> then press {{B|Start}} to save and exit |
| #Your console should have booted into the Luma3DS configuration menu
| |
| #*Luma3DS configuration menu are settings for the Luma3DS custom firmware. Many of these settings may be useful for customization or debugging | |
| #*For the purpose of this guide, '''leave these options on the default settings''' (do not check or uncheck anything)
| |
| #*If your console shuts down when you try to power it on, ensure that you have copied <code>boot.firm</code> from the Luma3DS <code>.zip</code> to the root of your SD card
| |
| #Press (Start) to save and reboot
| |
|
| |
|
| At this point, your console will boot to Luma3DS by default.
| | ==Section V - General Stuff== |
|
| |
|
| *Luma3DS does not look any different from the normal HOME Menu. If your console has booted into the HOME Menu, it is running custom firmware.
| | ===Deinstaling gamepatches=== |
| *On the next page, you will install useful homebrew applications to complete your setup.
| | #start <code>System Setting</code> on the 3DS |
| | #Click on <code>Data Management</code>, <code>Nintendo 3DS</code>, <code>Add-on content</code> |
| | #Click on the game you want to patch and than click <code>Delete</code> |
|
| |
|
| ===Section V - Restoring WiFi Configuration Profiles=== | | ===Editing shiny Chance=== |
| In this section, you will trigger the BannerBomb3 exploit a second time so that you can restore the Wi-Fi connection slots that were overwritten in Section II.
| |
| | |
| #Launch System Settings on your console
| |
| #Navigate to <code>Data Management</code> -> <code>DSiWare</code> -> <code>SD Card</code> (image (not really))
| |
| #Use the D-Pad to navigate and press the (A) button to select “Uninstall unSAFE_MODE”
| |
| #*Your console will automatically reboot
| |
| #Power off your console
| |
| #Insert your SD card into your computer
| |
| #Navigate to <code>Nintendo 3DS</code> -> <code><ID0></code> -> <code><ID1></code> -> <code>Nintendo DSiWare</code> on your SD card
| |
| #Delete <code>F00D43D5.bin</code> from your Nintendo DSiWare folder and from your computer. This file will not be needed anymore
| |
|
| |
|
| <span style="font-size:200%;">Continue to [[3dsguide:finalizing-setup|Finalizing Setup]]</span> | | <tabber> |
| | |-|Generation 7= |
| | <span> |
| | #open pk3DS |
| | #ignore the next step, if the correct gamefolder is auto selected from pk3DS |
| | #*if the correct folder isnt selected follow step 8 and 9 from <code>Section II</code> |
| | #in pk3DS click on <code>ExeFS</code>, than on <code>Shiny Rate</code> |
| | #here you can now setup your wanted shiny chances with <code>Reroll Helper</code> |
| | #hit <code>SAVE</code> after you selected the wanted shiny chance |
| | #close pk3DS and go to <code>[gamefolder]/exefs</code> and copy <code>.code.bin</code> to the root of the <code>[gamefolder]</code> |
| | #*if the old code.bin file is here, delete the file first |
| | #rename <code>.code.bin</code> to <code>code.bin</code> |
| | #move <code>code.bin</code> to <code>/luma/titles/[TitleID]</code> on your SD Card and replace the old <code>code.bin</code> with the new <code>code.bin</code> |
| | </span> |
| | </tabber> |
