Changes

| enhanced-arm9loaderhax

| enhanced-arm9loaderhax

| See the 32c3 3ds talk.

| See the 32c3 3ds talk.

Since this is a combination of a trick with the arm9-bootrom + arm9loaderhax, and since you have to manually write FIRM to the firm0/firm1 NAND partitions, this can't be completely fixed. Any system with existing ARM9 code execution and an OTP/OTP hash dump can exploit this. Additionally, by using the FIRM partition known-plaintext bug and bruteforcing the second entry in the keystore, this can currently be exploited on all New3DS systems without any other prerequisite hacks.

Since this is a combination of a trick with the arm9-bootrom + arm9loaderhax, and since you have to manually write FIRM to the firm0/firm1 NAND partitions, this can't be completely fixed (System Update firm partition writes can be blocked by patching System calls at boot time). Any system with existing ARM9 code execution and an OTP/OTP hash dump can exploit this. Additionally, by using the FIRM partition known-plaintext bug and bruteforcing the second entry in the keystore, this can currently be exploited on all New3DS systems without any other prerequisite hacks.

| arm9loaderhax which automatically occurs at hard-boot.

| arm9loaderhax which automatically occurs at hard-boot.

| See arm9loaderhax / description.

| See arm9loaderhax / description.