Changes

The ARM9 bootrom does the following at reset:  reset vector branches to another instruction, then branches to bootrom+0x8000. Hence, there's no way to know for certain when exactly the ARM9 exception-vector data stored in memory gets initialized.

The ARM9 bootrom does the following at reset:  reset vector branches to another instruction, then branches to bootrom+0x8000. Hence, there's no way to know for certain when exactly the ARM9 exception-vector data stored in memory gets initialized.

This requires *very* *precise* timing for triggering the hardware fault: it's unknown if anyone actually exploited this successfully at the time of writing(the one who attempted+discovered it *originally* as listed in this wiki section hasn't).

This requires *very* *precise* timing for triggering the hardware fault.

 

It has been exploited by derrek (others?) to dump the ARM9 bootrom as of Summer 2015.

| None: all available 3DS models at the time of writing have the exact same ARM9/ARM11 bootrom for the unprotected areas.

| None: all available 3DS models at the time of writing have the exact same ARM9/ARM11 bootrom for the unprotected areas.

| New3DS

| New3DS