| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then bruteforce the remaining keyscrambler output. From the normal-key outputs, you could deduce the TWL keyscrambler function.
+
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the TWL key-generator function.
+
This applies to the keyX/keyY too.
−
This attack does not work for the 3DS keyscrambler because keyslots 0-3 are only for TWL keys.
+
This attack does not work for the 3DS key-generator because keyslots 0-3 are only for TWL keys.