Changes

| Old versions of Kernel9 never set bit1 of [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]]. This leaves the [[OTP Registers|0x10012000]]-region unprotected (this region should be locked early during boot!). Since it's never locked, you can dump it once you get ARM9 code execution. See [[OTP Registers|here]] regarding the data stored there.

| Old versions of Kernel9 never set bit1 of [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]]. This leaves the [[OTP Registers|0x10012000]]-region unprotected (this region should be locked early during boot!). Since it's never locked, you can dump it once you get ARM9 code execution. See [[OTP Registers|here]] regarding the data stored there.

From [[3.0.0-5|3.0.0-X]] this was fixed by setting the bit in Kernel9 after poking some registers in that region. On New3DS arm9loader sets this bit instead of Kernel9.

From [[3.0.0-5|3.0.0-X]] this was fixed by setting the bit in Kernel9 after poking some registers in that region. On New3DS arm9loader sets this bit instead of Kernel9. This is exploitable on N3DS however if you downgrade to 1.0 and reencrypt the NAND with keyslot 0x4 instead of 0x5.

| Dumping of the [[OTP Registers|OTP]] area

| Dumping of the [[OTP Registers|OTP]] area

| [[3.0.0-5|3.0.0-X]]

| [[3.0.0-5|3.0.0-X]]

| [[User:Plutooo|plutoo]], Normmatt independently

| [[User:Plutooo|plutoo]], Normmatt independently

|}

|}

== ARM11 software ==

== ARM11 software ==