WikiTemp - User contributions [en]

User:STIMulat3

2016-03-20T23:37:03Z

STIMulat3: Redirected page to gbatemp:members/stimulat3.368154/

#REDIRECT [[gbatemp:members/stimulat3.368154/]]

User:Dotjasp

2016-03-20T23:31:22Z

STIMulat3: Redirected page to gbatemp:members/dotjasp.367904/

#REDIRECT [[gbatemp:members/dotjasp.367904/]]

User:Dark samus3

2016-03-20T23:21:15Z

STIMulat3: Redirected page to gbatemp:members/dark samus3.366370/

#REDIRECT [[gbatemp:members/dark_samus3.366370/]]

Arm9loaderhax

2016-03-20T22:53:39Z

STIMulat3: added author for updaters, warning

{{Infobox 3DS Homebrew
| title = arm9loaderhax
| image =
| type = Exploit
| author = [[User:delebile|delebile]], [[User:plutoo|plutoo]], [[User:yellows8|yellows8]]
| contributor = [[User:Normmatt|Normmatt]], [[User:b1l1s|b1l1s]], [[User:dark_samus3|dark_samus3]]
| version =
| license =
| download = https://github.com/delebile/arm9loaderhax/archive/master.zip
| website = https://github.com/Plailect/Guide/wiki
| source = https://github.com/delebile/arm9loaderhax
| discussion =
| dm =
| dmversion =
| 3dsx = yes
| 3ds = no
| bin = no
| dat = no
| cxi = no
| cia = no
| titleID =
}}

== Usage ==
=== Installation ===
If you need help to install this homebrew on your console, read [[3DS Homebrew#Launching_Homebrew|how to launch 3DS homebrew]].

* [https://github.com/Plailect/Guide/wiki/ Full installation guide]
* [https://github.com/AuroraWright/SafeA9LHInstaller Safe installer and updater] (.3dsx & .bin) by [[User:Aurora Wright|Aurora Wright]]
* [https://gbatemp.net/threads/arm9loader-technical-details-and-discussion.408537/page-116#post-6112713 Updater (WIP)] (.bin) by [[User:dark_samus3|dark_samus3]] **much higher risk of bricking**

==Forks==
* [https://github.com/hartmannaf/BootCtr9 Fork] by [[User:hartmannaf|hartmannaf]]
* [https://github.com/dark-samus/arm9loaderhax Fork] by [[User:dark_samus3|dark_samus3]]

== Credits ==
* [[User:Smealum|Smealum]] and contributors for libctru
* [[User:Normmatt|Normmatt]] for sdmmc.c and .h, and also for .ld files and the log from XDS by ichfly that provided us some of the information needed to get screen init
* [[User:Christophe Devine|Christophe Devine]] for the SHA codes
* [[User:archshift|archshift]] for i2c.c and .h
* [[User:megazig|megazig]] for crypto.c and .h
* [[User:patois|patois]] for original BRAHMA code
* [[User:Smealum|Smealum]], [[User:Derrek|Derrek]], [[User:plutoo|plutoo]] for publishing the exploit
* [[User:yellows8|yellows8]] and [[User:plutoo|plutoo]] as ideators of it
* 3dbrew community
* [[User:b1l1s|b1l1s]] for his screen init code, and work on inegrating it into stage 2
* [[User:dark_samus3|dark_samus3]] for work on integrating screen init into stage 2

Arm9loaderhax

2016-03-20T22:50:28Z

STIMulat3: created first bits of page; added links, credits, infobox, forks. TODO: add image

{{Infobox 3DS Homebrew
| title = arm9loaderhax
| image =
| type = Exploit
| author = [[User:delebile|delebile]], [[User:plutoo|plutoo]], [[User:yellows8|yellows8]]
| contributor = [[User:Normmatt|Normmatt]], [[User:b1l1s|b1l1s]], [[User:dark_samus3|dark_samus3]]
| version =
| license =
| download = https://github.com/delebile/arm9loaderhax/archive/master.zip
| website = https://github.com/Plailect/Guide/wiki
| source = https://github.com/delebile/arm9loaderhax
| discussion =
| dm =
| dmversion =
| 3dsx = yes
| 3ds = no
| bin = no
| dat = no
| cxi = no
| cia = no
| titleID =
}}

== Usage ==
=== Installation ===
If you need help to install this homebrew on your console, read [[3DS Homebrew#Launching_Homebrew|how to launch 3DS homebrew]].

* [https://github.com/Plailect/Guide/wiki/ Full installation guide]
* [https://github.com/AuroraWright/SafeA9LHInstaller Safe installer and updater] (.3dsx & .bin)
* [https://gbatemp.net/threads/arm9loader-technical-details-and-discussion.408537/page-116#post-6112713 Unsafe updater (WIP)] much higher chance of brick

==Forks==
* [https://github.com/hartmannaf/BootCtr9 Fork] by [[User:hartmannaf|hartmannaf]]
* [https://github.com/dark-samus/arm9loaderhax Fork] by [[User:dark_samus3|dark_samus3]]

== Credits ==
* [[User:Smealum|Smealum]] and contributors for libctru
* [[User:Normmatt|Normmatt]] for sdmmc.c and .h, and also for .ld files and the log from XDS by ichfly that provided us some of the information needed to get screen init
* [[User:Christophe Devine|Christophe Devine]] for the SHA codes
* [[User:archshift|archshift]] for i2c.c and .h
* [[User:megazig|megazig]] for crypto.c and .h
* [[User:patois|patois]] for original BRAHMA code
* [[User:Smealum|Smealum]], [[User:Derrek|Derrek]], [[User:plutoo|plutoo]] for publishing the exploit
* [[User:yellows8|yellows8]] and [[User:plutoo|plutoo]] as ideators of it
* 3dbrew community
* [[User:b1l1s|b1l1s]] for his screen init code, and work on inegrating it into stage 2
* [[User:dark_samus3|dark_samus3]] for work on integrating screen init into stage 2

Tubehax

2016-03-20T22:02:48Z

STIMulat3: added image, links, explained why exploit no longer works, credit

{{Infobox 3DS Homebrew
| title = tubehax
| image = 3dshb_tubehax.png
| imagesize = 120px
| type = Exploit
| author = [[User:Smealum|Smealum]]
| contributor =
| version =
| license =
| download = https://smealum.github.io/3ds/#prepare
| website = https://smealum.github.io/3ds/
| source = https://github.com/smealum/tubehax
| discussion =
| dm =
| dmversion =
| 3dsx =
| 3ds =
| bin =
| dat =
| cxi =
| cia =
| titleID =
}}

== Usage ==
Tubehax is no longer usable, as Nintendo has blocked older versions of the YouTube app from connecting to the internet.

=== Installation ===
If you need help to install this homebrew on your console, read [[3DS Homebrew#Launching_Homebrew|how to launch 3DS homebrew]].

==Credits==
* [[User:Smealum|Smealum]] - code

File:3dshb tubehax.png

2016-03-20T21:58:40Z

STIMulat3:

== Licensing ==
{{homebrew-icon}}

The Homebrew Launcher

2016-03-20T21:45:23Z

STIMulat3: changed website link to https

{{Infobox 3DS Homebrew
| title = The Homebrew Launcher
| image = 3dshb_TheHomebrewLauncher_logo.png
| imagesize = 260px
| type = loader
| author = [[User:Smealum|Smealum]], [[User:GEMISIS|GEMISIS]], [[User:fincs|fincs]], [[User:mtheall|mtheall]]
| graphicsby = [[User:Fluto|Fluto]], [[User:Arkhandar|Arkhandar]], [[User:dotjasp|dotjasp]]
| version = 1.1.0
| download = https://smealum.github.io/ninjhax2/boot.3dsx
| website = https://smealum.github.io/3ds/
| source = https://github.com/smealum/3ds_hb_menu
| 3dsx = yes
| 3ds = no
| cia = no
| bin = no
| dat = no
}}
The Homebrew Launcher (hbmenu for short) is the default menu for ninjhax, a 3DS homebrew-enabling exploit released on November 20th 2014. It is a fairly simple (and beautiful) menu that lists homebrew applications and lets you run them.

==Usage==
===Installation===
To use The Homebrew Launcher as your ninjhax main menu, simply rename the 3dsx executable to boot.3dsx and place it at the root of your SD card.

It is included in every iteration 3ds homebrew starter kit by default.

===Controls===
* Start: reboot your console into home menu.
* D-Pad, Circle Pad, Stylus: Navigate and select an application
* A or Stylus: Start application.
* B: Exit submenu/selector
* Y: Launch [[NetLoader]]

=== Supported format===
Only executable files in 3dsx format are supported.

Icons and banners are supported in smdh, bin, and icn format.

===Supported paths===
The Homebrew Launcher scans all the .3dsx files located in the sdmc:/3ds/ folders and its sub-folders.

It can list 3dsx executables located in the sdmc:/3ds/ directory, but ideally, you should have a folder for each application, containing an executable and an icon (SMDH) file.

The executable should be named either ''boot.3dsx'' or ''[folder name].3dsx''.

The icon file can be named either ''icon.bin'', ''icon.smdh'', ''icon.icn'', ''[folder name].smdh'', or ''[folder name].icn''. They are all the same smdh format, only the name is different, so use the filename you prefer.

Here is a list of all supported paths and filename for executable:
/3ds/<filename>.3dsx
/3ds/name of the homebrew/boot.3dsx
/3ds/name of the homebrew/<name of the folder>.3dsx

And a list of all supported paths and filename for the icons:
/3ds/name of the homebrew/icon.bin
/3ds/name of the homebrew/icon.icn
/3ds/name of the homebrew/icon.smdh
/3ds/name of the homebrew/<name of the folder>.icn
/3ds/name of the homebrew/<name of the folder>.smdh

== Compiling ==
In order to compile The Homebrew Launcher, you need to install zlib for 3DS:

1) Download [http://prdownloads.sourceforge.net/libpng/zlib-1.2.8.tar.gz?download zlib-1.2.8]. You ''don't'' need to extract it.

2) Copy the following text and save it as a file named "Makefile":
{| class="mw-collapsible mw-collapsed"
!
|-
|
<source lang="make">
ZLIB := zlib
ZLIB_VERSION := $(ZLIB)-1.2.8
ZLIB_SRC := $(ZLIB_VERSION).tar.gz

export PORTLIBS := $(DEVKITPRO)/portlibs/armv6k
export PATH := $(DEVKITARM)/bin:$(PATH)
export PKG_CONFIG_PATH := $(PORTLIBS)/lib/pkgconfig
export CFLAGS := -march=armv6k -mtune=mpcore -mfloat-abi=hard -O3 -mword-relocations
export CPPFLAGS := -I$(PORTLIBS)/include
export LDFLAGS := -L$(PORTLIBS)/lib

.PHONY: all install clean

all: $(ZLIB_SRC)
@[ -d $(ZLIB_VERSION) ] || tar -xaf $<
@cd $(ZLIB_VERSION) && \
CHOST=arm-none-eabi ./configure --static --prefix=$(PORTLIBS)
@$(MAKE) -C $(ZLIB_VERSION)

install:
@$(MAKE) -C $(ZLIB_VERSION) install

clean:
@$(RM) -r $(ZLIB_VERSION)
</source>
|}
3) Place both the makefile and the tar.gz in the same folder.

4) Open a command prompt/terminal and navigate to the folder with the Makefile

5) Run the commands <code>make</code> and <code>make install</code>

6) You can now compile the homebrew launcher.

==Forks==
* [https://gbatemp.net/threads/homebrew-launcher-with-sorting-and-folder-support.396793/ Fork with sorting and folder support] by [[User:suloku|suloku]]

* [https://gbatemp.net/threads/release-homebrew-launcher-with-grid-layout.397527/ Fork with grid layout] by [[User:mashers|mashers]]

==Credits==
* [[User:Smealum|Smealum]] - code
* [[User:GEMISIS|GEMISIS]] - code
* [[User:fincs|fincs]] - code
* [[User:mtheall|mtheall]] - code
* [[User:Fluto|Fluto]] - graphics
* [[User:Arkhandar|Arkhandar]] - graphics
* [[User:dotjasp|dotjasp]] - graphics (regionfree icon)

Browserhax

2016-03-20T21:43:36Z

STIMulat3: added credits

{{Infobox 3DS Homebrew
| title = browserhax
| image = 3dshb_browserhax_logo.png
| imagesize = 260px
| type = Exploit
| author = [[User:yellows8|yellows8]]
| contributor =
| version =
| license =
| download = https://smealum.github.io/ninjhax2/starter.zip
| website = https://yls8.mtheall.com/3dsbrowserhax.php
| source = https://github.com/yellows8/3ds_browserhax_common
| discussion =
| dm =
| dmversion =
| 3dsx =
| 3ds =
| bin =
| dat =
| cxi =
| cia =
| titleID =
}}

==Usage==
Browserhax no longer works as of system menu version 10.6.
===Installation===
If you need help to install this homebrew on your console, read [[3DS Homebrew#Launching_Homebrew|how to launch 3DS homebrew]].

==Credits==

* [[User:yellows8|yellows8]] - code
* [[User:megazig|megazig]] - help with APT

Browserhax

2016-03-20T21:41:14Z

STIMulat3: fixed infobox; removed empty sections; added no longer work with 10.6 up

File:3dshb browserhax logo.png

2016-03-20T21:16:52Z

STIMulat3: logo of the browserhax exploit

== Summary ==
logo of the browserhax exploit
== Licensing ==
{{homebrew-icon}}

Ninjhax

2016-03-20T21:06:27Z

STIMulat3: updated version numbers and changelog

'''Ninjhax''' (sometimes misspelled Ninjahax) is a user mode exploit found by [[User:smealum|smealum]] for the Nintendo 3DS game ''Cubic Ninja''. The exploit was initially released November 20, 2014<ref>https://twitter.com/smealum/status/535552052097585152</ref>, supporting 3DS system menu versions 4.0 - 9.2. One of the system flaws used by ninjhax was subsequently blocked by the 9.3 update<ref>https://twitter.com/smealum/status/542118829422149632</ref>. Several months later, on July 18, 2015, smealum released ninjhax version 2.0<ref>https://twitter.com/smealum/status/622293897117483009</ref>. This new version added support for system menu versions above 9.2, up to version 10.7. The old version 1 can still be used on lower system menu versions.

Ninjhax makes use of a flaw in the level editor of ''Cubic Ninja''. The level storage format contains sections of variable length that are loaded to fixed-length buffers without length checks<ref>[http://smealum.net/?p=517 ninjhax: the writeup - smealum.net]</ref>. This is used to create a [[wikipedia:Stack buffer overflow|stack buffer overflow]], which leads to [[wikipedia:Return-oriented programming|ROP]] capabilities. The exploited level can easily be loaded through the QR code sharing feature of the game.

== Changelog ==
=== v1.0 (November 20, 2014) ===
Initial release

=== v1.1 (December 25, 2014) ===
* Improved 3dsx loader
* new HB service commands

=== v1.1b (December 26, 2014) ===
* Stability improvements

=== v2.0 (July 18, 2015) ===
* Add support for system menu version 9.3 - 9.9
* Added support for out-of-region gamecards and custom themes

=== v2.1 (August 27, 2015) ===
* Added [[tubehax]] and [[ironhax]] compatibility.
* Stability improvements.

=== v2.5b (October 25, 2015) ===
* Add support for system menu version 10.0 - 10.5
* Added eShop firmware spoofing, rom hacking, in-game screenshots, CPU overclocking, sleep mode and power button support, sound support

=== v2.6g (February 24, 2016) ===
* Added support for system menu version 10.6 - 10.7
* Added ability to return to home menu without reboot
* Stability improvements

== Credits ==
* [[User:smealum|smealum]] — 3DS research, core exploit code for all versions, ctrulib improvements, hbmenu code, testing/debugging
* [[User:yellows8|yellows8]] — 3DS research, ctrulib improvements, auditing, help with pretty much everything
* [[User:plutoo|plutoo]] — 3DS research, ctrulib improvements, auditing, help with pretty much everything
* [[User:fincs|fincs]] — 3DSX format/code, ctrulib improvements, devkitARM integration, testing
* [[User:mtheall|mtheall]] — ctrulib improvements, hbmenu code, testing, .gitignore files
* [[User:GEMISIS|GEMISIS]] — hbmenu code, testing
* [[User:Fluto|Fluto]], [[User:Arkhandar|Arkhandar]] — hbmenu design
* [[User:Normmatt|Normmatt]], ichfly — general help, testing
* [[User:case|case]] — javascript master
* [[User:lobo|lobo]] — webpage template

== Links ==
* [http://smealum.net/ninjhax/ Version 1 website]
* [https://smealum.github.io/ninjhax2/ Version 2 website]
* [https://github.com/smealum/ninjhax Source Code (Git)]

== References ==
<references />

3DS Homebrew

2016-03-20T19:41:26Z

STIMulat3: /* What can I do? */ combined columns for downgrade

{{3DSNav}}

Welcome to the wonderful world of '''3DS Homebrew'''!

To run homebrew on your 3DS you need a method to run custom code. There are currently several public exploits available which allow running unsigned code on a 3DS system.

==What can I do?==
Depends on your installed Firmware version:

{| class="prettytable"
! Can I...
! System Menu 10.4 and up
! System Menu 9.3 to 10.3
! System Menu 9.2 and below
|-
| Run basic homebrew?
| colspan="2" {{yes}}, use a Ninjhax2, browserhax, or menuhax exploit to run the Homebrew Launcher
| {{yes}} (same exploits as ≥9.3, plus Homebrew Launcher loader CIA)
|-
| Run arm9loaderhax homebrew?
| colspan="2" {{no}}, unless arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer
| {{yes}}
|-
| Install Custom Themes?
| colspan="2" {{yes}}, use CHMM2
| {{yes}}, use CHMM2/ExtDataTool. Note that themes are for ≥9.x only.
|-
| Install/extract save files?
| colspan="2" {{yes}}, use svdt for 3DS games, TWLSaveTool for retail DS cartridges
| {{yes}}, use SaveDataFiler or JK's SaveManager for 3DS games, TWLSaveTool for retail DS cartridges
|-
| Run games from other regions (regionfree)?
| colspan="2" {{yes}}, use the region free launcher of The Homebrew Launcher
| {{yes}}, use a region free CFW
|-
| Go online with a game from another region?
| colspan="2" {{yes}}, as long as the game doesn't require an update
| {{yes}}
|-
| Run 3DS ROMs?
| colspan="2" {{yes}}, buy a Sky3DS and play ROMs from that.
| {{yes}}, various options.
|-
| Install out-of-region eShop content (like DLC)?
| colspan="2" {{no}}
| {{yes}}
|-
| Play modified ROMs (ROM hacks)?
| colspan="2" {{yes}}, use NTR CFW, HANS, or a flashcart
| {{yes}}, use NTR CFW, HANS, a flashcart, or install as a CIA
|-
| Run DS ROMs?
| colspan="2" {{yes}}, use a DS flashcart (Supercard DSTWO/R4i Gold)
| {{yes}}, use a DS flashcart (blocked carts can be unblocked with CFW and/or patched TWL_FIRM)
|-
| Use CFW/EmuNAND?
| colspan="2" {{no}} (exception: if arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or if SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer)
| {{yes}}
|-
| Install CIA files?
| {{no}}
| {{yes}} (Legit only)
| {{yes}}, use a CFW with signature checks disabled to install unsigned CIAs
|-
| Downgrade my System?
| colspan="2" {{yes}}, use SysUpdater CIA (on EmuNAND) or 3dsx (on SysNAND from Homebrew Launcher)
| {{yes}}
|}

==Exploits==
===The MSET exploit===
This exploit only works on 3DS System Software version 4.1.x to 4.5.x

This exploit is also used by Flashcart manufacturers to take over the 3DS's kernel.

To exploit this vulnerability, you need a working DS Mode flashcart for your 3DS and you must run an NDS Homebrew designed to alter the DS Profile settings strings. When launching the 3DS System Settings application's DS profile settings editor, it will cause the application that edits the DS profile to crash, and this crash pushes custom code into memory from within the edited profile and makes the security co-processor "accidentally" load that code, resulting in homebrew being launched.

===Spider exploit===
This exploit works up to version 9.2.0 and grants kernel level access. It was used by flashcart manufacturers after the MSET exploit was patched.

===arm9loaderhax===
* Released by [[User:delebile|delebile]]. Exploit discovered by [[User:WulfyStylez|WulfyStylez]], [[User:Dazzozo|Dazzozo]], [[User:shinyquagsire23|shinyquagsire23]], [[User:plutoo|plutoo]], [[User:Normmatt|Normmatt]], and [[User:yellows8|yellows8]].
* Requires an exploit on ≤9.2 in order to install; must be built from source, using the console-specific OTP hash
* Exploits a vulnerability in arm9loader to execute ARM9 code directly at boot (arm9loaderhax.bin)
* Works on New 3DS, Old 3DS, and 2DS in the EUR, JAP, or USA regions up to 9.2
* Can be used with an [https://github.com/Plailect/Guide/wiki updated SysNAND] (up to 10.7).
* [https://github.com/delebile/arm9loaderhax Source]
* [http://delebile.bplaced.net/topic.php?id=9 Documentation 1], [https://gbatemp.net/threads/arm9loader-technical-details-and-discussion.408537/ Documentation 2]
* [https://github.com/Plailect/Guide/wiki Guide]
* [https://www.youtube.com/watch?v=QKNLa8I8hPQ Video]

===ninjhax===
* Released by [[User:smealum|Smealum]]
* Uses an exploit in sharing user-created levels in the game ''Cubic Ninja'' to launch homebrew.
* Works up to 10.7
* [https://github.com/smealum/ninjhax/ Source]
* [https://www.youtube.com/watch?v=iKjuy3-z054 Video]

===ironhax===
* Released by [[User:smealum|Smealum]]
* Requires an exploit in order to install
* Uses a save game exploit for ''IronFall: Invasion'' in order to launch homebrew.
* Works up to 10.3
* [https://github.com/smealum/ironhax Source]

===tubehax===
* Released by [[User:smealum|Smealum]]
* Uses a DNS server to redirect the app's traffic to a exploitable webpage.
* Technically works up to 10.1, but older Youtube versions are blocked by Nintendo, effectively killing the exploit
* [https://github.com/smealum/tubehax Source]

===browserhax===
* Released by [[User:yellows8|yellows8]].
* A collection of webkit exploits for the use of launching 3DS homebrew.
* Works up to 10.4
* [https://github.com/yellows8/3ds_browserhax_common Source]

===oot3dhax===
* Released by [[User:yellows8|yellows8]].
* Requires an exploit in order to install
* Uses a save game exploit for ''The Legend of Zelda: Ocarina of Time 3D'' in order to launch homebrew.
* Works up to 10.4
* [https://github.com/yellows8/oot3dhax Source]

===smashhax===
* Released by [[User:yellows8|yellows8]]
* Only works on N3DS.
* Uses a exploit in local multiplayer for ''Smash Bros for 3DS'' by acting like a fake beacon for sessions.
* Works up to 10.3 (?). May be fixed in v1.1.3
* [https://github.com/yellows8/3ds_smashbroshax Source]

===menuhax (AKA themehax, HomeMenuHax)===
* Released by [[User:yellows8|yellows8]]
* Uses a exploit in themedata used by the home menu in order to launch homebrew.
* Works up to 10.3
* [https://github.com/yellows8/3ds_homemenuhax Source]

==Executable formats==
There are a few different types of executables made for the 3DS at this time.

===The .cxi format===
This file format is used officially by the console. The .cxi container type can only be launched on a 3DS Development Unit (A 3DS released to developers).

This is not a format used by the homebrew community. It's listed for historical reasons.

===The .bin format===
This type is the raw format for homebrew compiled into an ARM binary file. It's usually encapsulated into a Launcher.dat file to be launched using the MSET exploit, converted into a .3ds file to be launched using a front-end homebrew launcher, or launched as-is with an arm9loader exploit.

* Boot method: Encapsulated into a Launcher.dat, or using a .bin launcher homebrew
* Filename: Whatever you want, with a .bin extension
* Requirement: Python to encapsulate it into a Launcher.dat file, or a method to launch .bin homebrew on your console.
* Access level: The homebrew has full Kernel-mode access and has access to both the ARM9 and ARM11 cores, but the console's services in ARM11 are all disabled, due to the public method of taking over the ARM11 core from within the ARM9 core (credit to Kane49) (This means you have no access to the 3D slider, sound, etc. unless you code it back yourself).
* Restriction: When running from a broken-kernel state (Launcher.dat direct from MSET), random regions of the RAM are likely to have the NX (No-eXecute) security bit still active on them. This causes the program to sometimes not be able to start as the memory is set to not allow execution from the address range the program was unluckily loaded into. This also limits the size of the application, as when the application is larger, the chance of it landing in NX-enabled regions is significantly larger than if it is smaller, leaving the likeliness of it being able to start, up to luck. The size limit is around 19-22kb. In ARM11, code is loaded in a clean memory area, but before jumping to ARM11 it starts in ARM9 and is loaded in the same location, so the problem could happen too.

If you get homebrew in this format and do not have a way to launch a raw .bin file, you will need a python script to insert it into a Launcher.dat file.

* [https://github.com/naehrwert/p3ds 3DS Python Tool] by Naehrwert.
* [http://gbatemp.net/attachments/build-py-zip.5924/ Build.py for Linux] by Tomiga.
* [https://github.com/insaneKane/3DS_Homebrew_Stuff2/blob/master/build.py build.py] by Kane49. (Advice from [http://gbatemp.net/threads/homebrew-development.360646/#post-4887774 here]: make sure to change both instances of "-mcpu=mpcore -march=armv6k" in it to "-mcpu=arm946e-s -march=armv5te")

Or use a script to copy a ROP header and footer around the payload binary file, example: copy /b header+binary+footer Launcher.dat

You can find the pre-compiled ROP header (exp.bin) and footer (pad.bin) in Snailface's [[3DS Homebrew demo (Snailface)|3DS Homebrew demo]] package.

===The Launcher.dat format===
* Boot method: The homebrew is launched directly from the MSET exploit.
* Filename: The homebrew filename is usually "Launcher.dat" but can come using the "MsetForBoss.dat" variant using a alternate MSET exploit roploader, you can have upto 2 homebrew files at the same time on your console (one using the launcher.dat file name and one with the name MsetForBoss.dat), but it requires switch between DS profile roploaders to alternate which file will be loaded.
* Requirement: You need a DS flashcart to install the MSET vulnerability and run the Launcher.dat homebrew.
* Access level: Full Kernel-mode control (same as .bin homebrew).
* Restriction: file size (same as .bin homebrew)

There are 2 different formats of launcher.dat/MsetForBoss.dat, unencrypted(also referred to as homebrew or non gateway), and encrypted(also known as gateway encrypted) you will need to use a alternate DS profile exploit depending on whether you are trying to run a encrypted or unencrypted launcher.dat file, but most if not all MsetForBoss.dat files are unencrypted

===The .3ds / .3dsx format===
* Boot method: The homebrew is launched from a front end launcher.
* Filename: For Smealum's homebrew launcher use boot.3dsx, every homebrew has a different folder. For Gateway use any name .3ds and place in on a microSD.
* Requirement: For the gateway (.3ds) requires a [[Gateway 3DS]] flashcart running firmware 2.2 OMEGA or newer. For Smealum's homebrew launcher (.3dsx) requires a [[ninjhax]] exploit and an SD card with boot.3dsx (can be either your homebrew or the homebrew launcher) files on it you'll also need a wifi connection to the internet from your 3DS.
* Access level HBL with ≥9.2 SysNAND: The homebrew is usually only allowed User-mode access and has access to only 30% of the system core's first CPU thread, and 100% access to the second thread, although it can gain limited system access by using [[memchunkhax2]]. As a result, most homebrew cannot modify or access the system in any way using the current implementation of ARM11 homebrew, but the ARM11 services are available.
* Access level HBL with ≤9.2 SysNAND: Homebrew is allowed system access if using a CFW with signature checks disabled.
* Access level Gateway: Homebrew ran using the gateway will have as much access as any other game.

===The .cia format===
This file format is used officially by the console as a container for eShop downloaded contents.
It's meant to be extracted, installed and displayed on the console's system menu using its own icon.

The .cia container type can only be installed on a 3DS with installation privilege. To unlock the installation feature, you need a modified EmuNAND or Gateway 3DS v2.6 or newer.

==Launching Homebrew==
'''ATTENTION''': All homebrew using a Launcher.dat file have full Kernel access and therefore can modify the content of your console.
Nobody developed or released homebrew explicitly bricking your 3DS, but be careful when you decide to run unknown files. You are responsible for any problem you may encounter.

===The .cxi format===
There's currently no method to directly launch this format on a retail unit. It can, however, be launched by packaging it into a CIA.

===The .bin/elf format===
These formats are the raw executable.
* There's currently no .elf homebrew launcher to use with Ninjhax.
* These files are sometimes converted to another format (dat, cia, 3ds, 3dsx) by the developers when released to public. Then can then be launched using a different homebrew loading method.
* Some ARM9 (in Launcher.dat format) experimental homebrew can launch the .bin format, but require a 3DS with a System Software version 4.x.
* [[Arm9loaderhax]] is capable of launching homebrew in .bin format on System Software version 9.x to 10.x.

===Launcher.dat format===
This exploit works by using a ROP (Return-Oriented Programming) Chain to get access to Kernel-mode control and run a homebrew executable.

There are two ROP chain exploits you can use:
* [[Gateway 3DS]]'s ROP Chain. (Encrypted ROP Chain)
* Fierce Waffle's [http://www.fiercewaffle.com/softwareArticle.php?id=10 Open source] ROP chain. (Unencrypted ROP Chain)

The Launcher.dat file contains two sections: The end of the ROP chain initiated by the MSET exploit, and the homebrew binary.

Gateway 3DS, which was the first to publicly release this exploit, encrypted their ROP chain to prevent flashcart clones. If you install the Gateway ROP chain, you will have to encrypt your Launcher.dat homebrew using their encryption key.
If you install an open source ROP chain, you can run unencrypted homebrew, but you will not be able to run Gateway 3DS's Launcher.dat until you reinstall their own ROP chain.

There are [[List of 3DS homebrew applications#Utilities|tools]] to quickly encrypt or decrypt a Launcher.dat file to work with a corresponding ROP chain.

====The different ROP Chain installers====
* Gateway 3DS ROP chain installer. (No link will be shared here. The installer is provided with the Gateway-3DS flashcart firmware package.)
* [http://www.mediafire.com/download/6j9v70csj4g75it/ROPLoader.nds ROP Chain installer], by [[Fierce Waffle]]. It's a little unstable and can brick the DS Mode of the console. It requires a full 3DS format to fix it. You will lose all your data installed on 3DS if you format it.
* [http://gbatemp.net/threads/alternate-rop-installer.361185/ Alternate ROP Installer], by [[Drenn]], based on Fierce Waffle ROP Chain binary. It's restoring a full NVRAM dump of Drenn's DS Profile to your console. More stable than using the real installer, but it will fully replace your profile information, except your WiFi settings. You can use [[List of applications for 3DS|ROP Installer Modifier]] to edit the DS profile information (Favorite color and user name) to be written to the profile during the installation.
* [http://filetrip.net/3ds-downloads/homebrew/download-ropmultiloader-1-1-f32981.html ROP MultiLoader], by [[SnailFace]]. Lets you easily choose the ROP chain you want to install.

====Installing a ROP Chain====
The ROP chain installation requires a DS-mode Flashcart to run the installer .nds program.

# Choose a ROP chain installer from the list above.
# Extract the NDS file if needed and place it on your MicroSD Card, then insert it into your compatible NDS-mode Flashcart.
# Insert the NDS-mode flashcart into your 3DS console and launch the installer.

Note: If you launch the DS-mode again (DS Game or DS mode Flashcart) after installing the ROP Chain, the profile will be reset and the exploit deleted. You will need to install it again to launch 3DS homebrew.

====Launching the Homebrew====
# Encrypt or Decrypt the Launcher.dat file based on the ROP chain you installed. (Gateway ROP chain requires encryption)
# Place the Launcher.dat file on the root of your SD Card.
# Boot the 3DS and go to Settings > Other > Profile > DS Profile.
# The homebrew will launch.

===The .3ds format===
The .3ds format requires a gateway 3DS flashcart or a MT-card flashcart.

====Gateway 3DS Flashcart====
The Gateway 3DS flashcart homebrew launcher can be used only on a 3DS System version 4.0 to 9.2. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the Gateway 3DS firmware version 2.2 Omega or newer.

#(4.x only) Install the Gateway 3DS ROP Chain. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the Gateway Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#(4.x) Launch Gateway from the DS Profile. / (9.x) Open the web browser and visit http://go.gateway-3ds.com/ and launch Gateway mode.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

====MT-Card Flashcart====
The MT-Card homebrew launcher can be used only on a 3DS System version 4.0 to 4.5. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the MT-Card firmware version 2.0 or newer.

#Install the MT-Card exploit using the DS mode flashcart. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the MT-Card Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#Launch MT-Card from the DS Profile.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

===The .3dsx format===
The .3dsx format requires a front end to be launched first.

====The Homebrew Launcher====
[[The Homebrew Launcher]] lets the user run unsigned homebrew compiled in .3dsx format in User-mode on the ARM11 core.
It was originally developed by [[smealum]] and [https://twitter.com/gemisisDev gemisisDev], since its release more developers are helping and improving it. It exploits a vulnerability in 3DS a System Software versions 4.x to 9.2.x with eShop revision 7 to 20.

You will not need a Flashcart to use it, but will need the retail game Cubic Ninja.
Cubic Ninja launched from a flashcart is working too.

Installing The Homebrew Launcher
# Download and extract [http://smealum.net/ninjhax/dl/starter.zip The Homebrew Starter Kit] to the root of your 3DS SD Card. You should now have a file named boot.3dsx and a "3ds" folder on the root of your SD Card.
# Enable Wifi and launch Cubic Ninja game
# Choose the "Create" menu and select "QR Code" method, then "Scan QR code" option.
# Go to http://smealum.net/ninjhax/#qrcode and select your System version to generate the corresponding QR Code
# Scan your QR code and it will download "The Homebrew Launcher" loader automatically and install it into the Savegame slot of Cubic Ninja game. It will also launch automatically after the Installation.

Launching The Homebrew Launcher
# You don't need Wifi once it's already installed to your Cubic Ninja game.
# Run Cubic Ninja and go to QR Code menu. The Homebrew Launcher will load.

Place your homebrew in either one of these locations:
#/3ds/<homebrew_name>/boot.3dsx
#/3ds/<homebrew_name>/<same_as_folder_name>.3dsx
#/3ds/<filename>.3dsx

If you want an icon for your Homebrew to be displayed in The Homebrew Launcher, place it in either one of these locations:
#/3ds/<homebrew_name>/icon.bin
#/3ds/<homebrew_name>/<icon or folder_name>.smdh
#/3ds/<homebrew_name>/<icon or folder_name>.icn

===The .cia format===
The .cia format requires a patched firmware (CFW) or Gateway 3DS flashcart. The user needs a 3DS with a System Software version 4.0.x to 9.2.x.

====Dev Menu====
Currently, one of the ways to install cia files and manage installed titles is by using DevMenu program from the official Nintendo 3DS development kit (SDK). This program is illegal to share and will not be linked here or on the forum. However, homebrew alternatives exist such as Big Red Menu.
To use DevMenu and install files to your NAND or EmuNAND, you need enough privileges which is only possible on a modified EmuNAND (commonly called "custom Firmware") or using Gateway 3DS v2.6 or newer.

- When using a modified EmuNAND you need to permanently install DevMenu program on your console.

- When using Gateway 3DS you can use BigBlueMenu, which is the DevMenu program converted to .3ds format.

[[Category:Nintendo 3DS|Homebrew]]
[[Category:3DS Homebrew| ]]
[[Category:3DS ARM9 Homebrew| ]]
[[Category:3DS ARM11 Homebrew| ]]

3DS Homebrew

2016-03-20T19:38:50Z

STIMulat3: /* What can I do? */ added little bit of downgrade info

{{3DSNav}}

Welcome to the wonderful world of '''3DS Homebrew'''!

To run homebrew on your 3DS you need a method to run custom code. There are currently several public exploits available which allow running unsigned code on a 3DS system.

==What can I do?==
Depends on your installed Firmware version:

{| class="prettytable"
! Can I...
! System Menu 10.4 and up
! System Menu 9.3 to 10.3
! System Menu 9.2 and below
|-
| Run basic homebrew?
| colspan="2" {{yes}}, use a Ninjhax2, browserhax, or menuhax exploit to run the Homebrew Launcher
| {{yes}} (same exploits as ≥9.3, plus Homebrew Launcher loader CIA)
|-
| Run arm9loaderhax homebrew?
| colspan="2" {{no}}, unless arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer
| {{yes}}
|-
| Install Custom Themes?
| colspan="2" {{yes}}, use CHMM2
| {{yes}}, use CHMM2/ExtDataTool. Note that themes are for ≥9.x only.
|-
| Install/extract save files?
| colspan="2" {{yes}}, use svdt for 3DS games, TWLSaveTool for retail DS cartridges
| {{yes}}, use SaveDataFiler or JK's SaveManager for 3DS games, TWLSaveTool for retail DS cartridges
|-
| Run games from other regions (regionfree)?
| colspan="2" {{yes}}, use the region free launcher of The Homebrew Launcher
| {{yes}}, use a region free CFW
|-
| Go online with a game from another region?
| colspan="2" {{yes}}, as long as the game doesn't require an update
| {{yes}}
|-
| Run 3DS ROMs?
| colspan="2" {{yes}}, buy a Sky3DS and play ROMs from that.
| {{yes}}, various options.
|-
| Install out-of-region eShop content (like DLC)?
| colspan="2" {{no}}
| {{yes}}
|-
| Play modified ROMs (ROM hacks)?
| colspan="2" {{yes}}, use NTR CFW, HANS, or a flashcart
| {{yes}}, use NTR CFW, HANS, a flashcart, or install as a CIA
|-
| Run DS ROMs?
| colspan="2" {{yes}}, use a DS flashcart (Supercard DSTWO/R4i Gold)
| {{yes}}, use a DS flashcart (blocked carts can be unblocked with CFW and/or patched TWL_FIRM)
|-
| Use CFW/EmuNAND?
| colspan="2" {{no}} (exception: if arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or if SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer)
| {{yes}}
|-
| Install CIA files?
| {{no}}
| {{yes}} (Legit only)
| {{yes}}, use a CFW with signature checks disabled to install unsigned CIAs
|-
| Downgrade my System?
| {{yes}}, with SysUpdater CIA or 3dsx
| {{yes}}, with SysUpdater CIA or 3dsx
| {{yes}}
|}

==Exploits==
===The MSET exploit===
This exploit only works on 3DS System Software version 4.1.x to 4.5.x

This exploit is also used by Flashcart manufacturers to take over the 3DS's kernel.

To exploit this vulnerability, you need a working DS Mode flashcart for your 3DS and you must run an NDS Homebrew designed to alter the DS Profile settings strings. When launching the 3DS System Settings application's DS profile settings editor, it will cause the application that edits the DS profile to crash, and this crash pushes custom code into memory from within the edited profile and makes the security co-processor "accidentally" load that code, resulting in homebrew being launched.

===Spider exploit===
This exploit works up to version 9.2.0 and grants kernel level access. It was used by flashcart manufacturers after the MSET exploit was patched.

===arm9loaderhax===
* Released by [[User:delebile|delebile]]. Exploit discovered by [[User:WulfyStylez|WulfyStylez]], [[User:Dazzozo|Dazzozo]], [[User:shinyquagsire23|shinyquagsire23]], [[User:plutoo|plutoo]], [[User:Normmatt|Normmatt]], and [[User:yellows8|yellows8]].
* Requires an exploit on ≤9.2 in order to install; must be built from source, using the console-specific OTP hash
* Exploits a vulnerability in arm9loader to execute ARM9 code directly at boot (arm9loaderhax.bin)
* Works on New 3DS, Old 3DS, and 2DS in the EUR, JAP, or USA regions up to 9.2
* Can be used with an [https://github.com/Plailect/Guide/wiki updated SysNAND] (up to 10.7).
* [https://github.com/delebile/arm9loaderhax Source]
* [http://delebile.bplaced.net/topic.php?id=9 Documentation 1], [https://gbatemp.net/threads/arm9loader-technical-details-and-discussion.408537/ Documentation 2]
* [https://github.com/Plailect/Guide/wiki Guide]
* [https://www.youtube.com/watch?v=QKNLa8I8hPQ Video]

===ninjhax===
* Released by [[User:smealum|Smealum]]
* Uses an exploit in sharing user-created levels in the game ''Cubic Ninja'' to launch homebrew.
* Works up to 10.7
* [https://github.com/smealum/ninjhax/ Source]
* [https://www.youtube.com/watch?v=iKjuy3-z054 Video]

===ironhax===
* Released by [[User:smealum|Smealum]]
* Requires an exploit in order to install
* Uses a save game exploit for ''IronFall: Invasion'' in order to launch homebrew.
* Works up to 10.3
* [https://github.com/smealum/ironhax Source]

===tubehax===
* Released by [[User:smealum|Smealum]]
* Uses a DNS server to redirect the app's traffic to a exploitable webpage.
* Technically works up to 10.1, but older Youtube versions are blocked by Nintendo, effectively killing the exploit
* [https://github.com/smealum/tubehax Source]

===browserhax===
* Released by [[User:yellows8|yellows8]].
* A collection of webkit exploits for the use of launching 3DS homebrew.
* Works up to 10.4
* [https://github.com/yellows8/3ds_browserhax_common Source]

===oot3dhax===
* Released by [[User:yellows8|yellows8]].
* Requires an exploit in order to install
* Uses a save game exploit for ''The Legend of Zelda: Ocarina of Time 3D'' in order to launch homebrew.
* Works up to 10.4
* [https://github.com/yellows8/oot3dhax Source]

===smashhax===
* Released by [[User:yellows8|yellows8]]
* Only works on N3DS.
* Uses a exploit in local multiplayer for ''Smash Bros for 3DS'' by acting like a fake beacon for sessions.
* Works up to 10.3 (?). May be fixed in v1.1.3
* [https://github.com/yellows8/3ds_smashbroshax Source]

===menuhax (AKA themehax, HomeMenuHax)===
* Released by [[User:yellows8|yellows8]]
* Uses a exploit in themedata used by the home menu in order to launch homebrew.
* Works up to 10.3
* [https://github.com/yellows8/3ds_homemenuhax Source]

==Executable formats==
There are a few different types of executables made for the 3DS at this time.

===The .cxi format===
This file format is used officially by the console. The .cxi container type can only be launched on a 3DS Development Unit (A 3DS released to developers).

This is not a format used by the homebrew community. It's listed for historical reasons.

===The .bin format===
This type is the raw format for homebrew compiled into an ARM binary file. It's usually encapsulated into a Launcher.dat file to be launched using the MSET exploit, converted into a .3ds file to be launched using a front-end homebrew launcher, or launched as-is with an arm9loader exploit.

* Boot method: Encapsulated into a Launcher.dat, or using a .bin launcher homebrew
* Filename: Whatever you want, with a .bin extension
* Requirement: Python to encapsulate it into a Launcher.dat file, or a method to launch .bin homebrew on your console.
* Access level: The homebrew has full Kernel-mode access and has access to both the ARM9 and ARM11 cores, but the console's services in ARM11 are all disabled, due to the public method of taking over the ARM11 core from within the ARM9 core (credit to Kane49) (This means you have no access to the 3D slider, sound, etc. unless you code it back yourself).
* Restriction: When running from a broken-kernel state (Launcher.dat direct from MSET), random regions of the RAM are likely to have the NX (No-eXecute) security bit still active on them. This causes the program to sometimes not be able to start as the memory is set to not allow execution from the address range the program was unluckily loaded into. This also limits the size of the application, as when the application is larger, the chance of it landing in NX-enabled regions is significantly larger than if it is smaller, leaving the likeliness of it being able to start, up to luck. The size limit is around 19-22kb. In ARM11, code is loaded in a clean memory area, but before jumping to ARM11 it starts in ARM9 and is loaded in the same location, so the problem could happen too.

If you get homebrew in this format and do not have a way to launch a raw .bin file, you will need a python script to insert it into a Launcher.dat file.

* [https://github.com/naehrwert/p3ds 3DS Python Tool] by Naehrwert.
* [http://gbatemp.net/attachments/build-py-zip.5924/ Build.py for Linux] by Tomiga.
* [https://github.com/insaneKane/3DS_Homebrew_Stuff2/blob/master/build.py build.py] by Kane49. (Advice from [http://gbatemp.net/threads/homebrew-development.360646/#post-4887774 here]: make sure to change both instances of "-mcpu=mpcore -march=armv6k" in it to "-mcpu=arm946e-s -march=armv5te")

Or use a script to copy a ROP header and footer around the payload binary file, example: copy /b header+binary+footer Launcher.dat

You can find the pre-compiled ROP header (exp.bin) and footer (pad.bin) in Snailface's [[3DS Homebrew demo (Snailface)|3DS Homebrew demo]] package.

===The Launcher.dat format===
* Boot method: The homebrew is launched directly from the MSET exploit.
* Filename: The homebrew filename is usually "Launcher.dat" but can come using the "MsetForBoss.dat" variant using a alternate MSET exploit roploader, you can have upto 2 homebrew files at the same time on your console (one using the launcher.dat file name and one with the name MsetForBoss.dat), but it requires switch between DS profile roploaders to alternate which file will be loaded.
* Requirement: You need a DS flashcart to install the MSET vulnerability and run the Launcher.dat homebrew.
* Access level: Full Kernel-mode control (same as .bin homebrew).
* Restriction: file size (same as .bin homebrew)

There are 2 different formats of launcher.dat/MsetForBoss.dat, unencrypted(also referred to as homebrew or non gateway), and encrypted(also known as gateway encrypted) you will need to use a alternate DS profile exploit depending on whether you are trying to run a encrypted or unencrypted launcher.dat file, but most if not all MsetForBoss.dat files are unencrypted

===The .3ds / .3dsx format===
* Boot method: The homebrew is launched from a front end launcher.
* Filename: For Smealum's homebrew launcher use boot.3dsx, every homebrew has a different folder. For Gateway use any name .3ds and place in on a microSD.
* Requirement: For the gateway (.3ds) requires a [[Gateway 3DS]] flashcart running firmware 2.2 OMEGA or newer. For Smealum's homebrew launcher (.3dsx) requires a [[ninjhax]] exploit and an SD card with boot.3dsx (can be either your homebrew or the homebrew launcher) files on it you'll also need a wifi connection to the internet from your 3DS.
* Access level HBL with ≥9.2 SysNAND: The homebrew is usually only allowed User-mode access and has access to only 30% of the system core's first CPU thread, and 100% access to the second thread, although it can gain limited system access by using [[memchunkhax2]]. As a result, most homebrew cannot modify or access the system in any way using the current implementation of ARM11 homebrew, but the ARM11 services are available.
* Access level HBL with ≤9.2 SysNAND: Homebrew is allowed system access if using a CFW with signature checks disabled.
* Access level Gateway: Homebrew ran using the gateway will have as much access as any other game.

===The .cia format===
This file format is used officially by the console as a container for eShop downloaded contents.
It's meant to be extracted, installed and displayed on the console's system menu using its own icon.

The .cia container type can only be installed on a 3DS with installation privilege. To unlock the installation feature, you need a modified EmuNAND or Gateway 3DS v2.6 or newer.

==Launching Homebrew==
'''ATTENTION''': All homebrew using a Launcher.dat file have full Kernel access and therefore can modify the content of your console.
Nobody developed or released homebrew explicitly bricking your 3DS, but be careful when you decide to run unknown files. You are responsible for any problem you may encounter.

===The .cxi format===
There's currently no method to directly launch this format on a retail unit. It can, however, be launched by packaging it into a CIA.

===The .bin/elf format===
These formats are the raw executable.
* There's currently no .elf homebrew launcher to use with Ninjhax.
* These files are sometimes converted to another format (dat, cia, 3ds, 3dsx) by the developers when released to public. Then can then be launched using a different homebrew loading method.
* Some ARM9 (in Launcher.dat format) experimental homebrew can launch the .bin format, but require a 3DS with a System Software version 4.x.
* [[Arm9loaderhax]] is capable of launching homebrew in .bin format on System Software version 9.x to 10.x.

===Launcher.dat format===
This exploit works by using a ROP (Return-Oriented Programming) Chain to get access to Kernel-mode control and run a homebrew executable.

There are two ROP chain exploits you can use:
* [[Gateway 3DS]]'s ROP Chain. (Encrypted ROP Chain)
* Fierce Waffle's [http://www.fiercewaffle.com/softwareArticle.php?id=10 Open source] ROP chain. (Unencrypted ROP Chain)

The Launcher.dat file contains two sections: The end of the ROP chain initiated by the MSET exploit, and the homebrew binary.

Gateway 3DS, which was the first to publicly release this exploit, encrypted their ROP chain to prevent flashcart clones. If you install the Gateway ROP chain, you will have to encrypt your Launcher.dat homebrew using their encryption key.
If you install an open source ROP chain, you can run unencrypted homebrew, but you will not be able to run Gateway 3DS's Launcher.dat until you reinstall their own ROP chain.

There are [[List of 3DS homebrew applications#Utilities|tools]] to quickly encrypt or decrypt a Launcher.dat file to work with a corresponding ROP chain.

====The different ROP Chain installers====
* Gateway 3DS ROP chain installer. (No link will be shared here. The installer is provided with the Gateway-3DS flashcart firmware package.)
* [http://www.mediafire.com/download/6j9v70csj4g75it/ROPLoader.nds ROP Chain installer], by [[Fierce Waffle]]. It's a little unstable and can brick the DS Mode of the console. It requires a full 3DS format to fix it. You will lose all your data installed on 3DS if you format it.
* [http://gbatemp.net/threads/alternate-rop-installer.361185/ Alternate ROP Installer], by [[Drenn]], based on Fierce Waffle ROP Chain binary. It's restoring a full NVRAM dump of Drenn's DS Profile to your console. More stable than using the real installer, but it will fully replace your profile information, except your WiFi settings. You can use [[List of applications for 3DS|ROP Installer Modifier]] to edit the DS profile information (Favorite color and user name) to be written to the profile during the installation.
* [http://filetrip.net/3ds-downloads/homebrew/download-ropmultiloader-1-1-f32981.html ROP MultiLoader], by [[SnailFace]]. Lets you easily choose the ROP chain you want to install.

====Installing a ROP Chain====
The ROP chain installation requires a DS-mode Flashcart to run the installer .nds program.

# Choose a ROP chain installer from the list above.
# Extract the NDS file if needed and place it on your MicroSD Card, then insert it into your compatible NDS-mode Flashcart.
# Insert the NDS-mode flashcart into your 3DS console and launch the installer.

Note: If you launch the DS-mode again (DS Game or DS mode Flashcart) after installing the ROP Chain, the profile will be reset and the exploit deleted. You will need to install it again to launch 3DS homebrew.

====Launching the Homebrew====
# Encrypt or Decrypt the Launcher.dat file based on the ROP chain you installed. (Gateway ROP chain requires encryption)
# Place the Launcher.dat file on the root of your SD Card.
# Boot the 3DS and go to Settings > Other > Profile > DS Profile.
# The homebrew will launch.

===The .3ds format===
The .3ds format requires a gateway 3DS flashcart or a MT-card flashcart.

====Gateway 3DS Flashcart====
The Gateway 3DS flashcart homebrew launcher can be used only on a 3DS System version 4.0 to 9.2. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the Gateway 3DS firmware version 2.2 Omega or newer.

#(4.x only) Install the Gateway 3DS ROP Chain. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the Gateway Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#(4.x) Launch Gateway from the DS Profile. / (9.x) Open the web browser and visit http://go.gateway-3ds.com/ and launch Gateway mode.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

====MT-Card Flashcart====
The MT-Card homebrew launcher can be used only on a 3DS System version 4.0 to 4.5. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the MT-Card firmware version 2.0 or newer.

#Install the MT-Card exploit using the DS mode flashcart. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the MT-Card Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#Launch MT-Card from the DS Profile.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

===The .3dsx format===
The .3dsx format requires a front end to be launched first.

====The Homebrew Launcher====
[[The Homebrew Launcher]] lets the user run unsigned homebrew compiled in .3dsx format in User-mode on the ARM11 core.
It was originally developed by [[smealum]] and [https://twitter.com/gemisisDev gemisisDev], since its release more developers are helping and improving it. It exploits a vulnerability in 3DS a System Software versions 4.x to 9.2.x with eShop revision 7 to 20.

You will not need a Flashcart to use it, but will need the retail game Cubic Ninja.
Cubic Ninja launched from a flashcart is working too.

Installing The Homebrew Launcher
# Download and extract [http://smealum.net/ninjhax/dl/starter.zip The Homebrew Starter Kit] to the root of your 3DS SD Card. You should now have a file named boot.3dsx and a "3ds" folder on the root of your SD Card.
# Enable Wifi and launch Cubic Ninja game
# Choose the "Create" menu and select "QR Code" method, then "Scan QR code" option.
# Go to http://smealum.net/ninjhax/#qrcode and select your System version to generate the corresponding QR Code
# Scan your QR code and it will download "The Homebrew Launcher" loader automatically and install it into the Savegame slot of Cubic Ninja game. It will also launch automatically after the Installation.

Launching The Homebrew Launcher
# You don't need Wifi once it's already installed to your Cubic Ninja game.
# Run Cubic Ninja and go to QR Code menu. The Homebrew Launcher will load.

Place your homebrew in either one of these locations:
#/3ds/<homebrew_name>/boot.3dsx
#/3ds/<homebrew_name>/<same_as_folder_name>.3dsx
#/3ds/<filename>.3dsx

If you want an icon for your Homebrew to be displayed in The Homebrew Launcher, place it in either one of these locations:
#/3ds/<homebrew_name>/icon.bin
#/3ds/<homebrew_name>/<icon or folder_name>.smdh
#/3ds/<homebrew_name>/<icon or folder_name>.icn

===The .cia format===
The .cia format requires a patched firmware (CFW) or Gateway 3DS flashcart. The user needs a 3DS with a System Software version 4.0.x to 9.2.x.

====Dev Menu====
Currently, one of the ways to install cia files and manage installed titles is by using DevMenu program from the official Nintendo 3DS development kit (SDK). This program is illegal to share and will not be linked here or on the forum. However, homebrew alternatives exist such as Big Red Menu.
To use DevMenu and install files to your NAND or EmuNAND, you need enough privileges which is only possible on a modified EmuNAND (commonly called "custom Firmware") or using Gateway 3DS v2.6 or newer.

- When using a modified EmuNAND you need to permanently install DevMenu program on your console.

- When using Gateway 3DS you can use BigBlueMenu, which is the DevMenu program converted to .3ds format.

[[Category:Nintendo 3DS|Homebrew]]
[[Category:3DS Homebrew| ]]
[[Category:3DS ARM9 Homebrew| ]]
[[Category:3DS ARM11 Homebrew| ]]

3DS Homebrew

2016-03-20T19:36:09Z

STIMulat3: /* The .3ds / .3dsx format */ changed memchunkhax to memchunkhax2; linkified memchunkhax2

{{3DSNav}}

Welcome to the wonderful world of '''3DS Homebrew'''!

To run homebrew on your 3DS you need a method to run custom code. There are currently several public exploits available which allow running unsigned code on a 3DS system.

==What can I do?==
Depends on your installed Firmware version:

{| class="prettytable"
! Can I...
! System Menu 10.4 and up
! System Menu 9.3 to 10.3
! System Menu 9.2 and below
|-
| Run basic homebrew?
| colspan="2" {{yes}}, use a Ninjhax2, browserhax, or menuhax exploit to run the Homebrew Launcher
| {{yes}} (same exploits as ≥9.3, plus Homebrew Launcher loader CIA)
|-
| Run arm9loaderhax homebrew?
| colspan="2" {{no}}, unless arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer
| {{yes}}
|-
| Install Custom Themes?
| colspan="2" {{yes}}, use CHMM2
| {{yes}}, use CHMM2/ExtDataTool. Note that themes are for ≥9.x only.
|-
| Install/extract save files?
| colspan="2" {{yes}}, use svdt for 3DS games, TWLSaveTool for retail DS cartridges
| {{yes}}, use SaveDataFiler or JK's SaveManager for 3DS games, TWLSaveTool for retail DS cartridges
|-
| Run games from other regions (regionfree)?
| colspan="2" {{yes}}, use the region free launcher of The Homebrew Launcher
| {{yes}}, use a region free CFW
|-
| Go online with a game from another region?
| colspan="2" {{yes}}, as long as the game doesn't require an update
| {{yes}}
|-
| Run 3DS ROMs?
| colspan="2" {{yes}}, buy a Sky3DS and play ROMs from that.
| {{yes}}, various options.
|-
| Install out-of-region eShop content (like DLC)?
| colspan="2" {{no}}
| {{yes}}
|-
| Play modified ROMs (ROM hacks)?
| colspan="2" {{yes}}, use NTR CFW, HANS, or a flashcart
| {{yes}}, use NTR CFW, HANS, a flashcart, or install as a CIA
|-
| Run DS ROMs?
| colspan="2" {{yes}}, use a DS flashcart (Supercard DSTWO/R4i Gold)
| {{yes}}, use a DS flashcart (blocked carts can be unblocked with CFW and/or patched TWL_FIRM)
|-
| Use CFW/EmuNAND?
| colspan="2" {{no}} (exception: if arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or if SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer)
| {{yes}}
|-
| Install CIA files?
| {{no}}
| {{yes}} (Legit only)
| {{yes}}, use a CFW with signature checks disabled to install unsigned CIAs
|-
| Downgrade my System?
| {{yes}}
| {{yes}}
| {{yes}}
|}

==Exploits==
===The MSET exploit===
This exploit only works on 3DS System Software version 4.1.x to 4.5.x

This exploit is also used by Flashcart manufacturers to take over the 3DS's kernel.

To exploit this vulnerability, you need a working DS Mode flashcart for your 3DS and you must run an NDS Homebrew designed to alter the DS Profile settings strings. When launching the 3DS System Settings application's DS profile settings editor, it will cause the application that edits the DS profile to crash, and this crash pushes custom code into memory from within the edited profile and makes the security co-processor "accidentally" load that code, resulting in homebrew being launched.

===Spider exploit===
This exploit works up to version 9.2.0 and grants kernel level access. It was used by flashcart manufacturers after the MSET exploit was patched.

===arm9loaderhax===
* Released by [[User:delebile|delebile]]. Exploit discovered by [[User:WulfyStylez|WulfyStylez]], [[User:Dazzozo|Dazzozo]], [[User:shinyquagsire23|shinyquagsire23]], [[User:plutoo|plutoo]], [[User:Normmatt|Normmatt]], and [[User:yellows8|yellows8]].
* Requires an exploit on ≤9.2 in order to install; must be built from source, using the console-specific OTP hash
* Exploits a vulnerability in arm9loader to execute ARM9 code directly at boot (arm9loaderhax.bin)
* Works on New 3DS, Old 3DS, and 2DS in the EUR, JAP, or USA regions up to 9.2
* Can be used with an [https://github.com/Plailect/Guide/wiki updated SysNAND] (up to 10.7).
* [https://github.com/delebile/arm9loaderhax Source]
* [http://delebile.bplaced.net/topic.php?id=9 Documentation 1], [https://gbatemp.net/threads/arm9loader-technical-details-and-discussion.408537/ Documentation 2]
* [https://github.com/Plailect/Guide/wiki Guide]
* [https://www.youtube.com/watch?v=QKNLa8I8hPQ Video]

===ninjhax===
* Released by [[User:smealum|Smealum]]
* Uses an exploit in sharing user-created levels in the game ''Cubic Ninja'' to launch homebrew.
* Works up to 10.7
* [https://github.com/smealum/ninjhax/ Source]
* [https://www.youtube.com/watch?v=iKjuy3-z054 Video]

===ironhax===
* Released by [[User:smealum|Smealum]]
* Requires an exploit in order to install
* Uses a save game exploit for ''IronFall: Invasion'' in order to launch homebrew.
* Works up to 10.3
* [https://github.com/smealum/ironhax Source]

===tubehax===
* Released by [[User:smealum|Smealum]]
* Uses a DNS server to redirect the app's traffic to a exploitable webpage.
* Technically works up to 10.1, but older Youtube versions are blocked by Nintendo, effectively killing the exploit
* [https://github.com/smealum/tubehax Source]

===browserhax===
* Released by [[User:yellows8|yellows8]].
* A collection of webkit exploits for the use of launching 3DS homebrew.
* Works up to 10.4
* [https://github.com/yellows8/3ds_browserhax_common Source]

===oot3dhax===
* Released by [[User:yellows8|yellows8]].
* Requires an exploit in order to install
* Uses a save game exploit for ''The Legend of Zelda: Ocarina of Time 3D'' in order to launch homebrew.
* Works up to 10.4
* [https://github.com/yellows8/oot3dhax Source]

===smashhax===
* Released by [[User:yellows8|yellows8]]
* Only works on N3DS.
* Uses a exploit in local multiplayer for ''Smash Bros for 3DS'' by acting like a fake beacon for sessions.
* Works up to 10.3 (?). May be fixed in v1.1.3
* [https://github.com/yellows8/3ds_smashbroshax Source]

===menuhax (AKA themehax, HomeMenuHax)===
* Released by [[User:yellows8|yellows8]]
* Uses a exploit in themedata used by the home menu in order to launch homebrew.
* Works up to 10.3
* [https://github.com/yellows8/3ds_homemenuhax Source]

==Executable formats==
There are a few different types of executables made for the 3DS at this time.

===The .cxi format===
This file format is used officially by the console. The .cxi container type can only be launched on a 3DS Development Unit (A 3DS released to developers).

This is not a format used by the homebrew community. It's listed for historical reasons.

===The .bin format===
This type is the raw format for homebrew compiled into an ARM binary file. It's usually encapsulated into a Launcher.dat file to be launched using the MSET exploit, converted into a .3ds file to be launched using a front-end homebrew launcher, or launched as-is with an arm9loader exploit.

* Boot method: Encapsulated into a Launcher.dat, or using a .bin launcher homebrew
* Filename: Whatever you want, with a .bin extension
* Requirement: Python to encapsulate it into a Launcher.dat file, or a method to launch .bin homebrew on your console.
* Access level: The homebrew has full Kernel-mode access and has access to both the ARM9 and ARM11 cores, but the console's services in ARM11 are all disabled, due to the public method of taking over the ARM11 core from within the ARM9 core (credit to Kane49) (This means you have no access to the 3D slider, sound, etc. unless you code it back yourself).
* Restriction: When running from a broken-kernel state (Launcher.dat direct from MSET), random regions of the RAM are likely to have the NX (No-eXecute) security bit still active on them. This causes the program to sometimes not be able to start as the memory is set to not allow execution from the address range the program was unluckily loaded into. This also limits the size of the application, as when the application is larger, the chance of it landing in NX-enabled regions is significantly larger than if it is smaller, leaving the likeliness of it being able to start, up to luck. The size limit is around 19-22kb. In ARM11, code is loaded in a clean memory area, but before jumping to ARM11 it starts in ARM9 and is loaded in the same location, so the problem could happen too.

If you get homebrew in this format and do not have a way to launch a raw .bin file, you will need a python script to insert it into a Launcher.dat file.

* [https://github.com/naehrwert/p3ds 3DS Python Tool] by Naehrwert.
* [http://gbatemp.net/attachments/build-py-zip.5924/ Build.py for Linux] by Tomiga.
* [https://github.com/insaneKane/3DS_Homebrew_Stuff2/blob/master/build.py build.py] by Kane49. (Advice from [http://gbatemp.net/threads/homebrew-development.360646/#post-4887774 here]: make sure to change both instances of "-mcpu=mpcore -march=armv6k" in it to "-mcpu=arm946e-s -march=armv5te")

Or use a script to copy a ROP header and footer around the payload binary file, example: copy /b header+binary+footer Launcher.dat

You can find the pre-compiled ROP header (exp.bin) and footer (pad.bin) in Snailface's [[3DS Homebrew demo (Snailface)|3DS Homebrew demo]] package.

===The Launcher.dat format===
* Boot method: The homebrew is launched directly from the MSET exploit.
* Filename: The homebrew filename is usually "Launcher.dat" but can come using the "MsetForBoss.dat" variant using a alternate MSET exploit roploader, you can have upto 2 homebrew files at the same time on your console (one using the launcher.dat file name and one with the name MsetForBoss.dat), but it requires switch between DS profile roploaders to alternate which file will be loaded.
* Requirement: You need a DS flashcart to install the MSET vulnerability and run the Launcher.dat homebrew.
* Access level: Full Kernel-mode control (same as .bin homebrew).
* Restriction: file size (same as .bin homebrew)

There are 2 different formats of launcher.dat/MsetForBoss.dat, unencrypted(also referred to as homebrew or non gateway), and encrypted(also known as gateway encrypted) you will need to use a alternate DS profile exploit depending on whether you are trying to run a encrypted or unencrypted launcher.dat file, but most if not all MsetForBoss.dat files are unencrypted

===The .3ds / .3dsx format===
* Boot method: The homebrew is launched from a front end launcher.
* Filename: For Smealum's homebrew launcher use boot.3dsx, every homebrew has a different folder. For Gateway use any name .3ds and place in on a microSD.
* Requirement: For the gateway (.3ds) requires a [[Gateway 3DS]] flashcart running firmware 2.2 OMEGA or newer. For Smealum's homebrew launcher (.3dsx) requires a [[ninjhax]] exploit and an SD card with boot.3dsx (can be either your homebrew or the homebrew launcher) files on it you'll also need a wifi connection to the internet from your 3DS.
* Access level HBL with ≥9.2 SysNAND: The homebrew is usually only allowed User-mode access and has access to only 30% of the system core's first CPU thread, and 100% access to the second thread, although it can gain limited system access by using [[memchunkhax2]]. As a result, most homebrew cannot modify or access the system in any way using the current implementation of ARM11 homebrew, but the ARM11 services are available.
* Access level HBL with ≤9.2 SysNAND: Homebrew is allowed system access if using a CFW with signature checks disabled.
* Access level Gateway: Homebrew ran using the gateway will have as much access as any other game.

===The .cia format===
This file format is used officially by the console as a container for eShop downloaded contents.
It's meant to be extracted, installed and displayed on the console's system menu using its own icon.

The .cia container type can only be installed on a 3DS with installation privilege. To unlock the installation feature, you need a modified EmuNAND or Gateway 3DS v2.6 or newer.

==Launching Homebrew==
'''ATTENTION''': All homebrew using a Launcher.dat file have full Kernel access and therefore can modify the content of your console.
Nobody developed or released homebrew explicitly bricking your 3DS, but be careful when you decide to run unknown files. You are responsible for any problem you may encounter.

===The .cxi format===
There's currently no method to directly launch this format on a retail unit. It can, however, be launched by packaging it into a CIA.

===The .bin/elf format===
These formats are the raw executable.
* There's currently no .elf homebrew launcher to use with Ninjhax.
* These files are sometimes converted to another format (dat, cia, 3ds, 3dsx) by the developers when released to public. Then can then be launched using a different homebrew loading method.
* Some ARM9 (in Launcher.dat format) experimental homebrew can launch the .bin format, but require a 3DS with a System Software version 4.x.
* [[Arm9loaderhax]] is capable of launching homebrew in .bin format on System Software version 9.x to 10.x.

===Launcher.dat format===
This exploit works by using a ROP (Return-Oriented Programming) Chain to get access to Kernel-mode control and run a homebrew executable.

There are two ROP chain exploits you can use:
* [[Gateway 3DS]]'s ROP Chain. (Encrypted ROP Chain)
* Fierce Waffle's [http://www.fiercewaffle.com/softwareArticle.php?id=10 Open source] ROP chain. (Unencrypted ROP Chain)

The Launcher.dat file contains two sections: The end of the ROP chain initiated by the MSET exploit, and the homebrew binary.

Gateway 3DS, which was the first to publicly release this exploit, encrypted their ROP chain to prevent flashcart clones. If you install the Gateway ROP chain, you will have to encrypt your Launcher.dat homebrew using their encryption key.
If you install an open source ROP chain, you can run unencrypted homebrew, but you will not be able to run Gateway 3DS's Launcher.dat until you reinstall their own ROP chain.

There are [[List of 3DS homebrew applications#Utilities|tools]] to quickly encrypt or decrypt a Launcher.dat file to work with a corresponding ROP chain.

====The different ROP Chain installers====
* Gateway 3DS ROP chain installer. (No link will be shared here. The installer is provided with the Gateway-3DS flashcart firmware package.)
* [http://www.mediafire.com/download/6j9v70csj4g75it/ROPLoader.nds ROP Chain installer], by [[Fierce Waffle]]. It's a little unstable and can brick the DS Mode of the console. It requires a full 3DS format to fix it. You will lose all your data installed on 3DS if you format it.
* [http://gbatemp.net/threads/alternate-rop-installer.361185/ Alternate ROP Installer], by [[Drenn]], based on Fierce Waffle ROP Chain binary. It's restoring a full NVRAM dump of Drenn's DS Profile to your console. More stable than using the real installer, but it will fully replace your profile information, except your WiFi settings. You can use [[List of applications for 3DS|ROP Installer Modifier]] to edit the DS profile information (Favorite color and user name) to be written to the profile during the installation.
* [http://filetrip.net/3ds-downloads/homebrew/download-ropmultiloader-1-1-f32981.html ROP MultiLoader], by [[SnailFace]]. Lets you easily choose the ROP chain you want to install.

====Installing a ROP Chain====
The ROP chain installation requires a DS-mode Flashcart to run the installer .nds program.

# Choose a ROP chain installer from the list above.
# Extract the NDS file if needed and place it on your MicroSD Card, then insert it into your compatible NDS-mode Flashcart.
# Insert the NDS-mode flashcart into your 3DS console and launch the installer.

Note: If you launch the DS-mode again (DS Game or DS mode Flashcart) after installing the ROP Chain, the profile will be reset and the exploit deleted. You will need to install it again to launch 3DS homebrew.

====Launching the Homebrew====
# Encrypt or Decrypt the Launcher.dat file based on the ROP chain you installed. (Gateway ROP chain requires encryption)
# Place the Launcher.dat file on the root of your SD Card.
# Boot the 3DS and go to Settings > Other > Profile > DS Profile.
# The homebrew will launch.

===The .3ds format===
The .3ds format requires a gateway 3DS flashcart or a MT-card flashcart.

====Gateway 3DS Flashcart====
The Gateway 3DS flashcart homebrew launcher can be used only on a 3DS System version 4.0 to 9.2. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the Gateway 3DS firmware version 2.2 Omega or newer.

#(4.x only) Install the Gateway 3DS ROP Chain. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the Gateway Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#(4.x) Launch Gateway from the DS Profile. / (9.x) Open the web browser and visit http://go.gateway-3ds.com/ and launch Gateway mode.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

====MT-Card Flashcart====
The MT-Card homebrew launcher can be used only on a 3DS System version 4.0 to 4.5. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the MT-Card firmware version 2.0 or newer.

#Install the MT-Card exploit using the DS mode flashcart. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the MT-Card Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#Launch MT-Card from the DS Profile.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

===The .3dsx format===
The .3dsx format requires a front end to be launched first.

====The Homebrew Launcher====
[[The Homebrew Launcher]] lets the user run unsigned homebrew compiled in .3dsx format in User-mode on the ARM11 core.
It was originally developed by [[smealum]] and [https://twitter.com/gemisisDev gemisisDev], since its release more developers are helping and improving it. It exploits a vulnerability in 3DS a System Software versions 4.x to 9.2.x with eShop revision 7 to 20.

You will not need a Flashcart to use it, but will need the retail game Cubic Ninja.
Cubic Ninja launched from a flashcart is working too.

Installing The Homebrew Launcher
# Download and extract [http://smealum.net/ninjhax/dl/starter.zip The Homebrew Starter Kit] to the root of your 3DS SD Card. You should now have a file named boot.3dsx and a "3ds" folder on the root of your SD Card.
# Enable Wifi and launch Cubic Ninja game
# Choose the "Create" menu and select "QR Code" method, then "Scan QR code" option.
# Go to http://smealum.net/ninjhax/#qrcode and select your System version to generate the corresponding QR Code
# Scan your QR code and it will download "The Homebrew Launcher" loader automatically and install it into the Savegame slot of Cubic Ninja game. It will also launch automatically after the Installation.

Launching The Homebrew Launcher
# You don't need Wifi once it's already installed to your Cubic Ninja game.
# Run Cubic Ninja and go to QR Code menu. The Homebrew Launcher will load.

Place your homebrew in either one of these locations:
#/3ds/<homebrew_name>/boot.3dsx
#/3ds/<homebrew_name>/<same_as_folder_name>.3dsx
#/3ds/<filename>.3dsx

If you want an icon for your Homebrew to be displayed in The Homebrew Launcher, place it in either one of these locations:
#/3ds/<homebrew_name>/icon.bin
#/3ds/<homebrew_name>/<icon or folder_name>.smdh
#/3ds/<homebrew_name>/<icon or folder_name>.icn

===The .cia format===
The .cia format requires a patched firmware (CFW) or Gateway 3DS flashcart. The user needs a 3DS with a System Software version 4.0.x to 9.2.x.

====Dev Menu====
Currently, one of the ways to install cia files and manage installed titles is by using DevMenu program from the official Nintendo 3DS development kit (SDK). This program is illegal to share and will not be linked here or on the forum. However, homebrew alternatives exist such as Big Red Menu.
To use DevMenu and install files to your NAND or EmuNAND, you need enough privileges which is only possible on a modified EmuNAND (commonly called "custom Firmware") or using Gateway 3DS v2.6 or newer.

- When using a modified EmuNAND you need to permanently install DevMenu program on your console.

- When using Gateway 3DS you can use BigBlueMenu, which is the DevMenu program converted to .3ds format.

[[Category:Nintendo 3DS|Homebrew]]
[[Category:3DS Homebrew| ]]
[[Category:3DS ARM9 Homebrew| ]]
[[Category:3DS ARM11 Homebrew| ]]

3DS Homebrew

2016-03-20T19:32:08Z

STIMulat3: /* The .3ds / .3dsx format */ updated outdated info

{{3DSNav}}

Welcome to the wonderful world of '''3DS Homebrew'''!

To run homebrew on your 3DS you need a method to run custom code. There are currently several public exploits available which allow running unsigned code on a 3DS system.

==What can I do?==
Depends on your installed Firmware version:

{| class="prettytable"
! Can I...
! System Menu 10.4 and up
! System Menu 9.3 to 10.3
! System Menu 9.2 and below
|-
| Run basic homebrew?
| colspan="2" {{yes}}, use a Ninjhax2, browserhax, or menuhax exploit to run the Homebrew Launcher
| {{yes}} (same exploits as ≥9.3, plus Homebrew Launcher loader CIA)
|-
| Run arm9loaderhax homebrew?
| colspan="2" {{no}}, unless arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer
| {{yes}}
|-
| Install Custom Themes?
| colspan="2" {{yes}}, use CHMM2
| {{yes}}, use CHMM2/ExtDataTool. Note that themes are for ≥9.x only.
|-
| Install/extract save files?
| colspan="2" {{yes}}, use svdt for 3DS games, TWLSaveTool for retail DS cartridges
| {{yes}}, use SaveDataFiler or JK's SaveManager for 3DS games, TWLSaveTool for retail DS cartridges
|-
| Run games from other regions (regionfree)?
| colspan="2" {{yes}}, use the region free launcher of The Homebrew Launcher
| {{yes}}, use a region free CFW
|-
| Go online with a game from another region?
| colspan="2" {{yes}}, as long as the game doesn't require an update
| {{yes}}
|-
| Run 3DS ROMs?
| colspan="2" {{yes}}, buy a Sky3DS and play ROMs from that.
| {{yes}}, various options.
|-
| Install out-of-region eShop content (like DLC)?
| colspan="2" {{no}}
| {{yes}}
|-
| Play modified ROMs (ROM hacks)?
| colspan="2" {{yes}}, use NTR CFW, HANS, or a flashcart
| {{yes}}, use NTR CFW, HANS, a flashcart, or install as a CIA
|-
| Run DS ROMs?
| colspan="2" {{yes}}, use a DS flashcart (Supercard DSTWO/R4i Gold)
| {{yes}}, use a DS flashcart (blocked carts can be unblocked with CFW and/or patched TWL_FIRM)
|-
| Use CFW/EmuNAND?
| colspan="2" {{no}} (exception: if arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or if SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer)
| {{yes}}
|-
| Install CIA files?
| {{no}}
| {{yes}} (Legit only)
| {{yes}}, use a CFW with signature checks disabled to install unsigned CIAs
|-
| Downgrade my System?
| {{yes}}
| {{yes}}
| {{yes}}
|}

==Exploits==
===The MSET exploit===
This exploit only works on 3DS System Software version 4.1.x to 4.5.x

This exploit is also used by Flashcart manufacturers to take over the 3DS's kernel.

To exploit this vulnerability, you need a working DS Mode flashcart for your 3DS and you must run an NDS Homebrew designed to alter the DS Profile settings strings. When launching the 3DS System Settings application's DS profile settings editor, it will cause the application that edits the DS profile to crash, and this crash pushes custom code into memory from within the edited profile and makes the security co-processor "accidentally" load that code, resulting in homebrew being launched.

===Spider exploit===
This exploit works up to version 9.2.0 and grants kernel level access. It was used by flashcart manufacturers after the MSET exploit was patched.

===arm9loaderhax===
* Released by [[User:delebile|delebile]]. Exploit discovered by [[User:WulfyStylez|WulfyStylez]], [[User:Dazzozo|Dazzozo]], [[User:shinyquagsire23|shinyquagsire23]], [[User:plutoo|plutoo]], [[User:Normmatt|Normmatt]], and [[User:yellows8|yellows8]].
* Requires an exploit on ≤9.2 in order to install; must be built from source, using the console-specific OTP hash
* Exploits a vulnerability in arm9loader to execute ARM9 code directly at boot (arm9loaderhax.bin)
* Works on New 3DS, Old 3DS, and 2DS in the EUR, JAP, or USA regions up to 9.2
* Can be used with an [https://github.com/Plailect/Guide/wiki updated SysNAND] (up to 10.7).
* [https://github.com/delebile/arm9loaderhax Source]
* [http://delebile.bplaced.net/topic.php?id=9 Documentation 1], [https://gbatemp.net/threads/arm9loader-technical-details-and-discussion.408537/ Documentation 2]
* [https://github.com/Plailect/Guide/wiki Guide]
* [https://www.youtube.com/watch?v=QKNLa8I8hPQ Video]

===ninjhax===
* Released by [[User:smealum|Smealum]]
* Uses an exploit in sharing user-created levels in the game ''Cubic Ninja'' to launch homebrew.
* Works up to 10.7
* [https://github.com/smealum/ninjhax/ Source]
* [https://www.youtube.com/watch?v=iKjuy3-z054 Video]

===ironhax===
* Released by [[User:smealum|Smealum]]
* Requires an exploit in order to install
* Uses a save game exploit for ''IronFall: Invasion'' in order to launch homebrew.
* Works up to 10.3
* [https://github.com/smealum/ironhax Source]

===tubehax===
* Released by [[User:smealum|Smealum]]
* Uses a DNS server to redirect the app's traffic to a exploitable webpage.
* Technically works up to 10.1, but older Youtube versions are blocked by Nintendo, effectively killing the exploit
* [https://github.com/smealum/tubehax Source]

===browserhax===
* Released by [[User:yellows8|yellows8]].
* A collection of webkit exploits for the use of launching 3DS homebrew.
* Works up to 10.4
* [https://github.com/yellows8/3ds_browserhax_common Source]

===oot3dhax===
* Released by [[User:yellows8|yellows8]].
* Requires an exploit in order to install
* Uses a save game exploit for ''The Legend of Zelda: Ocarina of Time 3D'' in order to launch homebrew.
* Works up to 10.4
* [https://github.com/yellows8/oot3dhax Source]

===smashhax===
* Released by [[User:yellows8|yellows8]]
* Only works on N3DS.
* Uses a exploit in local multiplayer for ''Smash Bros for 3DS'' by acting like a fake beacon for sessions.
* Works up to 10.3 (?). May be fixed in v1.1.3
* [https://github.com/yellows8/3ds_smashbroshax Source]

===menuhax (AKA themehax, HomeMenuHax)===
* Released by [[User:yellows8|yellows8]]
* Uses a exploit in themedata used by the home menu in order to launch homebrew.
* Works up to 10.3
* [https://github.com/yellows8/3ds_homemenuhax Source]

==Executable formats==
There are a few different types of executables made for the 3DS at this time.

===The .cxi format===
This file format is used officially by the console. The .cxi container type can only be launched on a 3DS Development Unit (A 3DS released to developers).

This is not a format used by the homebrew community. It's listed for historical reasons.

===The .bin format===
This type is the raw format for homebrew compiled into an ARM binary file. It's usually encapsulated into a Launcher.dat file to be launched using the MSET exploit, converted into a .3ds file to be launched using a front-end homebrew launcher, or launched as-is with an arm9loader exploit.

* Boot method: Encapsulated into a Launcher.dat, or using a .bin launcher homebrew
* Filename: Whatever you want, with a .bin extension
* Requirement: Python to encapsulate it into a Launcher.dat file, or a method to launch .bin homebrew on your console.
* Access level: The homebrew has full Kernel-mode access and has access to both the ARM9 and ARM11 cores, but the console's services in ARM11 are all disabled, due to the public method of taking over the ARM11 core from within the ARM9 core (credit to Kane49) (This means you have no access to the 3D slider, sound, etc. unless you code it back yourself).
* Restriction: When running from a broken-kernel state (Launcher.dat direct from MSET), random regions of the RAM are likely to have the NX (No-eXecute) security bit still active on them. This causes the program to sometimes not be able to start as the memory is set to not allow execution from the address range the program was unluckily loaded into. This also limits the size of the application, as when the application is larger, the chance of it landing in NX-enabled regions is significantly larger than if it is smaller, leaving the likeliness of it being able to start, up to luck. The size limit is around 19-22kb. In ARM11, code is loaded in a clean memory area, but before jumping to ARM11 it starts in ARM9 and is loaded in the same location, so the problem could happen too.

If you get homebrew in this format and do not have a way to launch a raw .bin file, you will need a python script to insert it into a Launcher.dat file.

* [https://github.com/naehrwert/p3ds 3DS Python Tool] by Naehrwert.
* [http://gbatemp.net/attachments/build-py-zip.5924/ Build.py for Linux] by Tomiga.
* [https://github.com/insaneKane/3DS_Homebrew_Stuff2/blob/master/build.py build.py] by Kane49. (Advice from [http://gbatemp.net/threads/homebrew-development.360646/#post-4887774 here]: make sure to change both instances of "-mcpu=mpcore -march=armv6k" in it to "-mcpu=arm946e-s -march=armv5te")

Or use a script to copy a ROP header and footer around the payload binary file, example: copy /b header+binary+footer Launcher.dat

You can find the pre-compiled ROP header (exp.bin) and footer (pad.bin) in Snailface's [[3DS Homebrew demo (Snailface)|3DS Homebrew demo]] package.

===The Launcher.dat format===
* Boot method: The homebrew is launched directly from the MSET exploit.
* Filename: The homebrew filename is usually "Launcher.dat" but can come using the "MsetForBoss.dat" variant using a alternate MSET exploit roploader, you can have upto 2 homebrew files at the same time on your console (one using the launcher.dat file name and one with the name MsetForBoss.dat), but it requires switch between DS profile roploaders to alternate which file will be loaded.
* Requirement: You need a DS flashcart to install the MSET vulnerability and run the Launcher.dat homebrew.
* Access level: Full Kernel-mode control (same as .bin homebrew).
* Restriction: file size (same as .bin homebrew)

There are 2 different formats of launcher.dat/MsetForBoss.dat, unencrypted(also referred to as homebrew or non gateway), and encrypted(also known as gateway encrypted) you will need to use a alternate DS profile exploit depending on whether you are trying to run a encrypted or unencrypted launcher.dat file, but most if not all MsetForBoss.dat files are unencrypted

===The .3ds / .3dsx format===
* Boot method: The homebrew is launched from a front end launcher.
* Filename: For Smealum's homebrew launcher use boot.3dsx, every homebrew has a different folder. For Gateway use any name .3ds and place in on a microSD.
* Requirement: For the gateway (.3ds) requires a [[Gateway 3DS]] flashcart running firmware 2.2 OMEGA or newer. For Smealum's homebrew launcher (.3dsx) requires a [[ninjhax]] exploit and an SD card with boot.3dsx (can be either your homebrew or the homebrew launcher) files on it you'll also need a wifi connection to the internet from your 3DS.
* Access level HBL with ≥9.2 SysNAND: The homebrew is usually only allowed User-mode access and has access to only 30% of the system core's first CPU thread, and 100% access to the second thread, although it can gain limited system access by using memchunkhax. As a result, most homebrew cannot modify or access the system in any way using the current implementation of ARM11 homebrew, but the ARM11 services are available.
* Access level HBL with ≤9.2 SysNAND: Homebrew is allowed system access if using a CFW with signature checks disabled.
* Access level Gateway: Homebrew ran using the gateway will have as much access as any other game.

===The .cia format===
This file format is used officially by the console as a container for eShop downloaded contents.
It's meant to be extracted, installed and displayed on the console's system menu using its own icon.

The .cia container type can only be installed on a 3DS with installation privilege. To unlock the installation feature, you need a modified EmuNAND or Gateway 3DS v2.6 or newer.

==Launching Homebrew==
'''ATTENTION''': All homebrew using a Launcher.dat file have full Kernel access and therefore can modify the content of your console.
Nobody developed or released homebrew explicitly bricking your 3DS, but be careful when you decide to run unknown files. You are responsible for any problem you may encounter.

===The .cxi format===
There's currently no method to directly launch this format on a retail unit. It can, however, be launched by packaging it into a CIA.

===The .bin/elf format===
These formats are the raw executable.
* There's currently no .elf homebrew launcher to use with Ninjhax.
* These files are sometimes converted to another format (dat, cia, 3ds, 3dsx) by the developers when released to public. Then can then be launched using a different homebrew loading method.
* Some ARM9 (in Launcher.dat format) experimental homebrew can launch the .bin format, but require a 3DS with a System Software version 4.x.
* [[Arm9loaderhax]] is capable of launching homebrew in .bin format on System Software version 9.x to 10.x.

===Launcher.dat format===
This exploit works by using a ROP (Return-Oriented Programming) Chain to get access to Kernel-mode control and run a homebrew executable.

There are two ROP chain exploits you can use:
* [[Gateway 3DS]]'s ROP Chain. (Encrypted ROP Chain)
* Fierce Waffle's [http://www.fiercewaffle.com/softwareArticle.php?id=10 Open source] ROP chain. (Unencrypted ROP Chain)

The Launcher.dat file contains two sections: The end of the ROP chain initiated by the MSET exploit, and the homebrew binary.

Gateway 3DS, which was the first to publicly release this exploit, encrypted their ROP chain to prevent flashcart clones. If you install the Gateway ROP chain, you will have to encrypt your Launcher.dat homebrew using their encryption key.
If you install an open source ROP chain, you can run unencrypted homebrew, but you will not be able to run Gateway 3DS's Launcher.dat until you reinstall their own ROP chain.

There are [[List of 3DS homebrew applications#Utilities|tools]] to quickly encrypt or decrypt a Launcher.dat file to work with a corresponding ROP chain.

====The different ROP Chain installers====
* Gateway 3DS ROP chain installer. (No link will be shared here. The installer is provided with the Gateway-3DS flashcart firmware package.)
* [http://www.mediafire.com/download/6j9v70csj4g75it/ROPLoader.nds ROP Chain installer], by [[Fierce Waffle]]. It's a little unstable and can brick the DS Mode of the console. It requires a full 3DS format to fix it. You will lose all your data installed on 3DS if you format it.
* [http://gbatemp.net/threads/alternate-rop-installer.361185/ Alternate ROP Installer], by [[Drenn]], based on Fierce Waffle ROP Chain binary. It's restoring a full NVRAM dump of Drenn's DS Profile to your console. More stable than using the real installer, but it will fully replace your profile information, except your WiFi settings. You can use [[List of applications for 3DS|ROP Installer Modifier]] to edit the DS profile information (Favorite color and user name) to be written to the profile during the installation.
* [http://filetrip.net/3ds-downloads/homebrew/download-ropmultiloader-1-1-f32981.html ROP MultiLoader], by [[SnailFace]]. Lets you easily choose the ROP chain you want to install.

====Installing a ROP Chain====
The ROP chain installation requires a DS-mode Flashcart to run the installer .nds program.

# Choose a ROP chain installer from the list above.
# Extract the NDS file if needed and place it on your MicroSD Card, then insert it into your compatible NDS-mode Flashcart.
# Insert the NDS-mode flashcart into your 3DS console and launch the installer.

Note: If you launch the DS-mode again (DS Game or DS mode Flashcart) after installing the ROP Chain, the profile will be reset and the exploit deleted. You will need to install it again to launch 3DS homebrew.

====Launching the Homebrew====
# Encrypt or Decrypt the Launcher.dat file based on the ROP chain you installed. (Gateway ROP chain requires encryption)
# Place the Launcher.dat file on the root of your SD Card.
# Boot the 3DS and go to Settings > Other > Profile > DS Profile.
# The homebrew will launch.

===The .3ds format===
The .3ds format requires a gateway 3DS flashcart or a MT-card flashcart.

====Gateway 3DS Flashcart====
The Gateway 3DS flashcart homebrew launcher can be used only on a 3DS System version 4.0 to 9.2. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the Gateway 3DS firmware version 2.2 Omega or newer.

#(4.x only) Install the Gateway 3DS ROP Chain. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the Gateway Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#(4.x) Launch Gateway from the DS Profile. / (9.x) Open the web browser and visit http://go.gateway-3ds.com/ and launch Gateway mode.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

====MT-Card Flashcart====
The MT-Card homebrew launcher can be used only on a 3DS System version 4.0 to 4.5. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the MT-Card firmware version 2.0 or newer.

#Install the MT-Card exploit using the DS mode flashcart. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the MT-Card Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#Launch MT-Card from the DS Profile.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

===The .3dsx format===
The .3dsx format requires a front end to be launched first.

====The Homebrew Launcher====
[[The Homebrew Launcher]] lets the user run unsigned homebrew compiled in .3dsx format in User-mode on the ARM11 core.
It was originally developed by [[smealum]] and [https://twitter.com/gemisisDev gemisisDev], since its release more developers are helping and improving it. It exploits a vulnerability in 3DS a System Software versions 4.x to 9.2.x with eShop revision 7 to 20.

You will not need a Flashcart to use it, but will need the retail game Cubic Ninja.
Cubic Ninja launched from a flashcart is working too.

Installing The Homebrew Launcher
# Download and extract [http://smealum.net/ninjhax/dl/starter.zip The Homebrew Starter Kit] to the root of your 3DS SD Card. You should now have a file named boot.3dsx and a "3ds" folder on the root of your SD Card.
# Enable Wifi and launch Cubic Ninja game
# Choose the "Create" menu and select "QR Code" method, then "Scan QR code" option.
# Go to http://smealum.net/ninjhax/#qrcode and select your System version to generate the corresponding QR Code
# Scan your QR code and it will download "The Homebrew Launcher" loader automatically and install it into the Savegame slot of Cubic Ninja game. It will also launch automatically after the Installation.

Launching The Homebrew Launcher
# You don't need Wifi once it's already installed to your Cubic Ninja game.
# Run Cubic Ninja and go to QR Code menu. The Homebrew Launcher will load.

Place your homebrew in either one of these locations:
#/3ds/<homebrew_name>/boot.3dsx
#/3ds/<homebrew_name>/<same_as_folder_name>.3dsx
#/3ds/<filename>.3dsx

If you want an icon for your Homebrew to be displayed in The Homebrew Launcher, place it in either one of these locations:
#/3ds/<homebrew_name>/icon.bin
#/3ds/<homebrew_name>/<icon or folder_name>.smdh
#/3ds/<homebrew_name>/<icon or folder_name>.icn

===The .cia format===
The .cia format requires a patched firmware (CFW) or Gateway 3DS flashcart. The user needs a 3DS with a System Software version 4.0.x to 9.2.x.

====Dev Menu====
Currently, one of the ways to install cia files and manage installed titles is by using DevMenu program from the official Nintendo 3DS development kit (SDK). This program is illegal to share and will not be linked here or on the forum. However, homebrew alternatives exist such as Big Red Menu.
To use DevMenu and install files to your NAND or EmuNAND, you need enough privileges which is only possible on a modified EmuNAND (commonly called "custom Firmware") or using Gateway 3DS v2.6 or newer.

- When using a modified EmuNAND you need to permanently install DevMenu program on your console.

- When using Gateway 3DS you can use BigBlueMenu, which is the DevMenu program converted to .3ds format.

[[Category:Nintendo 3DS|Homebrew]]
[[Category:3DS Homebrew| ]]
[[Category:3DS ARM9 Homebrew| ]]
[[Category:3DS ARM11 Homebrew| ]]

3DS Homebrew

2016-03-20T19:01:05Z

STIMulat3: /* The .bin/elf format */ reordered; bulleted; changed info to reflect arm9loaderhax; changed arm9loaderhax description; linkified arm9loaderhax

{{3DSNav}}

Welcome to the wonderful world of '''3DS Homebrew'''!

To run homebrew on your 3DS you need a method to run custom code. There are currently several public exploits available which allow running unsigned code on a 3DS system.

==What can I do?==
Depends on your installed Firmware version:

{| class="prettytable"
! Can I...
! System Menu 10.4 and up
! System Menu 9.3 to 10.3
! System Menu 9.2 and below
|-
| Run basic homebrew?
| colspan="2" {{yes}}, use a Ninjhax2, browserhax, or menuhax exploit to run the Homebrew Launcher
| {{yes}} (same exploits as ≥9.3, plus Homebrew Launcher loader CIA)
|-
| Run arm9loaderhax homebrew?
| colspan="2" {{no}}, unless arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer
| {{yes}}
|-
| Install Custom Themes?
| colspan="2" {{yes}}, use CHMM2
| {{yes}}, use CHMM2/ExtDataTool. Note that themes are for ≥9.x only.
|-
| Install/extract save files?
| colspan="2" {{yes}}, use svdt for 3DS games, TWLSaveTool for retail DS cartridges
| {{yes}}, use SaveDataFiler or JK's SaveManager for 3DS games, TWLSaveTool for retail DS cartridges
|-
| Run games from other regions (regionfree)?
| colspan="2" {{yes}}, use the region free launcher of The Homebrew Launcher
| {{yes}}, use a region free CFW
|-
| Go online with a game from another region?
| colspan="2" {{yes}}, as long as the game doesn't require an update
| {{yes}}
|-
| Run 3DS ROMs?
| colspan="2" {{yes}}, buy a Sky3DS and play ROMs from that.
| {{yes}}, various options.
|-
| Install out-of-region eShop content (like DLC)?
| colspan="2" {{no}}
| {{yes}}
|-
| Play modified ROMs (ROM hacks)?
| colspan="2" {{yes}}, use NTR CFW, HANS, or a flashcart
| {{yes}}, use NTR CFW, HANS, a flashcart, or install as a CIA
|-
| Run DS ROMs?
| colspan="2" {{yes}}, use a DS flashcart (Supercard DSTWO/R4i Gold)
| {{yes}}, use a DS flashcart (blocked carts can be unblocked with CFW and/or patched TWL_FIRM)
|-
| Use CFW/EmuNAND?
| colspan="2" {{no}} (exception: if arm9loaderhax was installed before updating SysNAND through a CFW with FIRM0 and FIRM1 patches, or if SysNAND ≤9.2 was swapped with EmuNAND using the arm9loaderhax installer)
| {{yes}}
|-
| Install CIA files?
| {{no}}
| {{yes}} (Legit only)
| {{yes}}, use a CFW with signature checks disabled to install unsigned CIAs
|-
| Downgrade my System?
| {{yes}}
| {{yes}}
| {{yes}}
|}

==Exploits==
===The MSET exploit===
This exploit only works on 3DS System Software version 4.1.x to 4.5.x

This exploit is also used by Flashcart manufacturers to take over the 3DS's kernel.

To exploit this vulnerability, you need a working DS Mode flashcart for your 3DS and you must run an NDS Homebrew designed to alter the DS Profile settings strings. When launching the 3DS System Settings application's DS profile settings editor, it will cause the application that edits the DS profile to crash, and this crash pushes custom code into memory from within the edited profile and makes the security co-processor "accidentally" load that code, resulting in homebrew being launched.

===Spider exploit===
This exploit works up to version 9.2.0 and grants kernel level access. It was used by flashcart manufacturers after the MSET exploit was patched.

===arm9loaderhax===
* Released by [[User:delebile|delebile]]. Exploit discovered by [[User:WulfyStylez|WulfyStylez]], [[User:Dazzozo|Dazzozo]], [[User:shinyquagsire23|shinyquagsire23]], [[User:plutoo|plutoo]], [[User:Normmatt|Normmatt]], and [[User:yellows8|yellows8]].
* Requires an exploit on ≤9.2 in order to install; must be built from source, using the console-specific OTP hash
* Exploits a vulnerability in arm9loader to execute ARM9 code directly at boot (arm9loaderhax.bin)
* Works on New 3DS, Old 3DS, and 2DS in the EUR, JAP, or USA regions up to 9.2
* Can be used with an [https://github.com/Plailect/Guide/wiki updated SysNAND] (up to 10.7).
* [https://github.com/delebile/arm9loaderhax Source]
* [http://delebile.bplaced.net/topic.php?id=9 Documentation 1], [https://gbatemp.net/threads/arm9loader-technical-details-and-discussion.408537/ Documentation 2]
* [https://github.com/Plailect/Guide/wiki Guide]
* [https://www.youtube.com/watch?v=QKNLa8I8hPQ Video]

===ninjhax===
* Released by [[User:smealum|Smealum]]
* Uses an exploit in sharing user-created levels in the game ''Cubic Ninja'' to launch homebrew.
* Works up to 10.7
* [https://github.com/smealum/ninjhax/ Source]
* [https://www.youtube.com/watch?v=iKjuy3-z054 Video]

===ironhax===
* Released by [[User:smealum|Smealum]]
* Requires an exploit in order to install
* Uses a save game exploit for ''IronFall: Invasion'' in order to launch homebrew.
* Works up to 10.3
* [https://github.com/smealum/ironhax Source]

===tubehax===
* Released by [[User:smealum|Smealum]]
* Uses a DNS server to redirect the app's traffic to a exploitable webpage.
* Technically works up to 10.1, but older Youtube versions are blocked by Nintendo, effectively killing the exploit
* [https://github.com/smealum/tubehax Source]

===browserhax===
* Released by [[User:yellows8|yellows8]].
* A collection of webkit exploits for the use of launching 3DS homebrew.
* Works up to 10.4
* [https://github.com/yellows8/3ds_browserhax_common Source]

===oot3dhax===
* Released by [[User:yellows8|yellows8]].
* Requires an exploit in order to install
* Uses a save game exploit for ''The Legend of Zelda: Ocarina of Time 3D'' in order to launch homebrew.
* Works up to 10.4
* [https://github.com/yellows8/oot3dhax Source]

===smashhax===
* Released by [[User:yellows8|yellows8]]
* Only works on N3DS.
* Uses a exploit in local multiplayer for ''Smash Bros for 3DS'' by acting like a fake beacon for sessions.
* Works up to 10.3 (?). May be fixed in v1.1.3
* [https://github.com/yellows8/3ds_smashbroshax Source]

===menuhax (AKA themehax, HomeMenuHax)===
* Released by [[User:yellows8|yellows8]]
* Uses a exploit in themedata used by the home menu in order to launch homebrew.
* Works up to 10.3
* [https://github.com/yellows8/3ds_homemenuhax Source]

==Executable formats==
There are a few different types of executables made for the 3DS at this time.

===The .cxi format===
This file format is used officially by the console. The .cxi container type can only be launched on a 3DS Development Unit (A 3DS released to developers).

This is not a format used by the homebrew community. It's listed for historical reasons.

===The .bin format===
This type is the raw format for homebrew compiled into an ARM binary file. It's usually encapsulated into a Launcher.dat file to be launched using the MSET exploit, converted into a .3ds file to be launched using a front-end homebrew launcher, or launched as-is with an arm9loader exploit.

* Boot method: Encapsulated into a Launcher.dat, or using a .bin launcher homebrew
* Filename: Whatever you want, with a .bin extension
* Requirement: Python to encapsulate it into a Launcher.dat file, or a method to launch .bin homebrew on your console.
* Access level: The homebrew has full Kernel-mode access and has access to both the ARM9 and ARM11 cores, but the console's services in ARM11 are all disabled, due to the public method of taking over the ARM11 core from within the ARM9 core (credit to Kane49) (This means you have no access to the 3D slider, sound, etc. unless you code it back yourself).
* Restriction: When running from a broken-kernel state (Launcher.dat direct from MSET), random regions of the RAM are likely to have the NX (No-eXecute) security bit still active on them. This causes the program to sometimes not be able to start as the memory is set to not allow execution from the address range the program was unluckily loaded into. This also limits the size of the application, as when the application is larger, the chance of it landing in NX-enabled regions is significantly larger than if it is smaller, leaving the likeliness of it being able to start, up to luck. The size limit is around 19-22kb. In ARM11, code is loaded in a clean memory area, but before jumping to ARM11 it starts in ARM9 and is loaded in the same location, so the problem could happen too.

If you get homebrew in this format and do not have a way to launch a raw .bin file, you will need a python script to insert it into a Launcher.dat file.

* [https://github.com/naehrwert/p3ds 3DS Python Tool] by Naehrwert.
* [http://gbatemp.net/attachments/build-py-zip.5924/ Build.py for Linux] by Tomiga.
* [https://github.com/insaneKane/3DS_Homebrew_Stuff2/blob/master/build.py build.py] by Kane49. (Advice from [http://gbatemp.net/threads/homebrew-development.360646/#post-4887774 here]: make sure to change both instances of "-mcpu=mpcore -march=armv6k" in it to "-mcpu=arm946e-s -march=armv5te")

Or use a script to copy a ROP header and footer around the payload binary file, example: copy /b header+binary+footer Launcher.dat

You can find the pre-compiled ROP header (exp.bin) and footer (pad.bin) in Snailface's [[3DS Homebrew demo (Snailface)|3DS Homebrew demo]] package.

===The Launcher.dat format===
* Boot method: The homebrew is launched directly from the MSET exploit.
* Filename: The homebrew filename is usually "Launcher.dat" but can come using the "MsetForBoss.dat" variant using a alternate MSET exploit roploader, you can have upto 2 homebrew files at the same time on your console (one using the launcher.dat file name and one with the name MsetForBoss.dat), but it requires switch between DS profile roploaders to alternate which file will be loaded.
* Requirement: You need a DS flashcart to install the MSET vulnerability and run the Launcher.dat homebrew.
* Access level: Full Kernel-mode control (same as .bin homebrew).
* Restriction: file size (same as .bin homebrew)

There are 2 different formats of launcher.dat/MsetForBoss.dat, unencrypted(also referred to as homebrew or non gateway), and encrypted(also known as gateway encrypted) you will need to use a alternate DS profile exploit depending on whether you are trying to run a encrypted or unencrypted launcher.dat file, but most if not all MsetForBoss.dat files are unencrypted

===The .3ds / .3dsx format===
* Boot method: The homebrew is launched from a front end launcher.
* Filename: For Smealum's homebrew launcher use boot.3dsx, every homebrew has a different folder. For Gateway use any name .3ds and place in on a microSD.
* Requirement: For the gateway (.3ds) requires a [[Gateway 3DS]] flashcart running firmware 2.2 OMEGA or newer. For Smealum's homebrew launcher (.3dsx) requires Cubic Ninja and an SD card with boot.3dsx (can be either your homebrew or the homebrew launcher) files on it you'll also need a wifi connection to the internet from your 3DS.
* Access level: The homebrew ran using Smealum's homebrew launcher is only allowed User-mode access and has access to only 30% of the system core's first CPU thread, and 100% access to the second thread. As a result, the homebrew cannot modify or access the system in any way using the current implementation of ARM11 homebrew, but the ARM11 services are available. Homebrew ran using the gateway will have as much access as any other game.

===The .cia format===
This file format is used officially by the console as a container for eShop downloaded contents.
It's meant to be extracted, installed and displayed on the console's system menu using its own icon.

The .cia container type can only be installed on a 3DS with installation privilege. To unlock the installation feature, you need a modified EmuNAND or Gateway 3DS v2.6 or newer.

==Launching Homebrew==
'''ATTENTION''': All homebrew using a Launcher.dat file have full Kernel access and therefore can modify the content of your console.
Nobody developed or released homebrew explicitly bricking your 3DS, but be careful when you decide to run unknown files. You are responsible for any problem you may encounter.

===The .cxi format===
There's currently no method to directly launch this format on a retail unit. It can, however, be launched by packaging it into a CIA.

===The .bin/elf format===
These formats are the raw executable.
* There's currently no .elf homebrew launcher to use with Ninjhax.
* These files are sometimes converted to another format (dat, cia, 3ds, 3dsx) by the developers when released to public. Then can then be launched using a different homebrew loading method.
* Some ARM9 (in Launcher.dat format) experimental homebrew can launch the .bin format, but require a 3DS with a System Software version 4.x.
* [[Arm9loaderhax]] is capable of launching homebrew in .bin format on System Software version 9.x to 10.x.

===Launcher.dat format===
This exploit works by using a ROP (Return-Oriented Programming) Chain to get access to Kernel-mode control and run a homebrew executable.

There are two ROP chain exploits you can use:
* [[Gateway 3DS]]'s ROP Chain. (Encrypted ROP Chain)
* Fierce Waffle's [http://www.fiercewaffle.com/softwareArticle.php?id=10 Open source] ROP chain. (Unencrypted ROP Chain)

The Launcher.dat file contains two sections: The end of the ROP chain initiated by the MSET exploit, and the homebrew binary.

Gateway 3DS, which was the first to publicly release this exploit, encrypted their ROP chain to prevent flashcart clones. If you install the Gateway ROP chain, you will have to encrypt your Launcher.dat homebrew using their encryption key.
If you install an open source ROP chain, you can run unencrypted homebrew, but you will not be able to run Gateway 3DS's Launcher.dat until you reinstall their own ROP chain.

There are [[List of 3DS homebrew applications#Utilities|tools]] to quickly encrypt or decrypt a Launcher.dat file to work with a corresponding ROP chain.

====The different ROP Chain installers====
* Gateway 3DS ROP chain installer. (No link will be shared here. The installer is provided with the Gateway-3DS flashcart firmware package.)
* [http://www.mediafire.com/download/6j9v70csj4g75it/ROPLoader.nds ROP Chain installer], by [[Fierce Waffle]]. It's a little unstable and can brick the DS Mode of the console. It requires a full 3DS format to fix it. You will lose all your data installed on 3DS if you format it.
* [http://gbatemp.net/threads/alternate-rop-installer.361185/ Alternate ROP Installer], by [[Drenn]], based on Fierce Waffle ROP Chain binary. It's restoring a full NVRAM dump of Drenn's DS Profile to your console. More stable than using the real installer, but it will fully replace your profile information, except your WiFi settings. You can use [[List of applications for 3DS|ROP Installer Modifier]] to edit the DS profile information (Favorite color and user name) to be written to the profile during the installation.
* [http://filetrip.net/3ds-downloads/homebrew/download-ropmultiloader-1-1-f32981.html ROP MultiLoader], by [[SnailFace]]. Lets you easily choose the ROP chain you want to install.

====Installing a ROP Chain====
The ROP chain installation requires a DS-mode Flashcart to run the installer .nds program.

# Choose a ROP chain installer from the list above.
# Extract the NDS file if needed and place it on your MicroSD Card, then insert it into your compatible NDS-mode Flashcart.
# Insert the NDS-mode flashcart into your 3DS console and launch the installer.

Note: If you launch the DS-mode again (DS Game or DS mode Flashcart) after installing the ROP Chain, the profile will be reset and the exploit deleted. You will need to install it again to launch 3DS homebrew.

====Launching the Homebrew====
# Encrypt or Decrypt the Launcher.dat file based on the ROP chain you installed. (Gateway ROP chain requires encryption)
# Place the Launcher.dat file on the root of your SD Card.
# Boot the 3DS and go to Settings > Other > Profile > DS Profile.
# The homebrew will launch.

===The .3ds format===
The .3ds format requires a gateway 3DS flashcart or a MT-card flashcart.

====Gateway 3DS Flashcart====
The Gateway 3DS flashcart homebrew launcher can be used only on a 3DS System version 4.0 to 9.2. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the Gateway 3DS firmware version 2.2 Omega or newer.

#(4.x only) Install the Gateway 3DS ROP Chain. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the Gateway Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#(4.x) Launch Gateway from the DS Profile. / (9.x) Open the web browser and visit http://go.gateway-3ds.com/ and launch Gateway mode.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

====MT-Card Flashcart====
The MT-Card homebrew launcher can be used only on a 3DS System version 4.0 to 4.5. The flashcart is required as the 3DS homebrew are stored on the MicroSD inserted in the flashcart.
This Homebrew launching method requires the MT-Card firmware version 2.0 or newer.

#Install the MT-Card exploit using the DS mode flashcart. (See the [[#The different ROP Chain installers|ROP chain installation method]] above)
#Place the MT-Card Launcher.dat file on the root of your SD Card.
#Place your homebrew on the root of your MicroSD Card formated as FAT32 or ExFAT, using the filename you want and .3ds extension.
#Launch MT-Card from the DS Profile.
#Press Select button to list all homebrew on your MicroSD card and press A to mount it.
#Launch it like a game.

===The .3dsx format===
The .3dsx format requires a front end to be launched first.

====The Homebrew Launcher====
[[The Homebrew Launcher]] lets the user run unsigned homebrew compiled in .3dsx format in User-mode on the ARM11 core.
It was originally developed by [[smealum]] and [https://twitter.com/gemisisDev gemisisDev], since its release more developers are helping and improving it. It exploits a vulnerability in 3DS a System Software versions 4.x to 9.2.x with eShop revision 7 to 20.

You will not need a Flashcart to use it, but will need the retail game Cubic Ninja.
Cubic Ninja launched from a flashcart is working too.

Installing The Homebrew Launcher
# Download and extract [http://smealum.net/ninjhax/dl/starter.zip The Homebrew Starter Kit] to the root of your 3DS SD Card. You should now have a file named boot.3dsx and a "3ds" folder on the root of your SD Card.
# Enable Wifi and launch Cubic Ninja game
# Choose the "Create" menu and select "QR Code" method, then "Scan QR code" option.
# Go to http://smealum.net/ninjhax/#qrcode and select your System version to generate the corresponding QR Code
# Scan your QR code and it will download "The Homebrew Launcher" loader automatically and install it into the Savegame slot of Cubic Ninja game. It will also launch automatically after the Installation.

Launching The Homebrew Launcher
# You don't need Wifi once it's already installed to your Cubic Ninja game.
# Run Cubic Ninja and go to QR Code menu. The Homebrew Launcher will load.

Place your homebrew in either one of these locations:
#/3ds/<homebrew_name>/boot.3dsx
#/3ds/<homebrew_name>/<same_as_folder_name>.3dsx
#/3ds/<filename>.3dsx

If you want an icon for your Homebrew to be displayed in The Homebrew Launcher, place it in either one of these locations:
#/3ds/<homebrew_name>/icon.bin
#/3ds/<homebrew_name>/<icon or folder_name>.smdh
#/3ds/<homebrew_name>/<icon or folder_name>.icn

===The .cia format===
The .cia format requires a patched firmware (CFW) or Gateway 3DS flashcart. The user needs a 3DS with a System Software version 4.0.x to 9.2.x.

====Dev Menu====
Currently, one of the ways to install cia files and manage installed titles is by using DevMenu program from the official Nintendo 3DS development kit (SDK). This program is illegal to share and will not be linked here or on the forum. However, homebrew alternatives exist such as Big Red Menu.
To use DevMenu and install files to your NAND or EmuNAND, you need enough privileges which is only possible on a modified EmuNAND (commonly called "custom Firmware") or using Gateway 3DS v2.6 or newer.

- When using a modified EmuNAND you need to permanently install DevMenu program on your console.

- When using Gateway 3DS you can use BigBlueMenu, which is the DevMenu program converted to .3ds format.

[[Category:Nintendo 3DS|Homebrew]]
[[Category:3DS Homebrew| ]]
[[Category:3DS ARM9 Homebrew| ]]
[[Category:3DS ARM11 Homebrew| ]]

User:Delebile

2016-03-20T18:39:44Z

STIMulat3: Redirected page to gbatemp:members/delebile.370337/

#REDIRECT [[gbatemp:members/delebile.370337/]]

User:Cedeckovec

2016-03-20T18:38:19Z

STIMulat3: Redirected page to gbatemp:members/cedeckovec.336197/

#REDIRECT [[gbatemp:members/cedeckovec.336197/]]

User:Thekman

2016-03-20T18:37:26Z

STIMulat3: Redirected page to gbatemp:members/thekman.357284/

#REDIRECT [[gbatemp:members/thekman.357284/]]

User:Xantoz

2016-03-20T18:36:50Z

STIMulat3: Redirected page to gbatemp:members/xantoz.356983/

#REDIRECT [[gbatemp:members/xantoz.356983/]]

User:Lolzvid

2016-03-20T18:35:21Z

STIMulat3: Redirected page to gbatemp:members/lolzvid.358614/

#REDIRECT [[gbatemp:members/lolzvid.358614/]]

User:Substance12

2016-03-20T18:34:01Z

STIMulat3: Redirected page to gbatemp:members/substance12.369219/

#REDIRECT [[gbatemp:members/substance12.369219/]]

User:JackMacWindows

2016-03-20T18:33:25Z

STIMulat3: Redirected page to gbatemp:members/jackmacwindows.380527/

#REDIRECT [[gbatemp:members/jackmacwindows.380527/]]

User:MichiS97

2016-03-20T18:31:56Z

STIMulat3: Redirected page to gbatemp:members/michis97.280122/

#REDIRECT [[gbatemp:members/michis97.280122/]]

User:Pepepuhn

2016-03-20T18:31:10Z

STIMulat3: Redirected page to gbatemp:members/pepepuhn.335735/

#REDIRECT [[gbatemp:members/pepepuhn.335735/]]

User:BHSPitMonkey

2016-03-20T18:30:31Z

STIMulat3: Redirected page to gbatemp:members/bhspitmonkey.219559/

#REDIRECT [[gbatemp:members/bhspitmonkey.219559/]]

User:HexZyle

2016-03-20T18:29:32Z

STIMulat3: Redirected page to gbatemp:members/hexzyle.371826/

#REDIRECT [[gbatemp:members/hexzyle.371826/]]

User:Tjessx

2016-03-20T18:28:27Z

STIMulat3: Redirected page to gbatemp:members/tjessx.357306/

#REDIRECT [[gbatemp:members/tjessx.357306/]]

User:MyLegGuy

2016-03-20T18:27:48Z

STIMulat3: Redirected page to gbatemp:members/mylegguy.356872/

#REDIRECT [[gbatemp:members/mylegguy.356872/]]

User:Nanni

2016-03-20T18:27:14Z

STIMulat3: Redirected page to gbatemp:members/ nanni.371393/

#REDIRECT [[gbatemp:members/_nanni.371393/]]

User:Jsa

2016-03-20T18:26:26Z

STIMulat3: Redirected page to gbatemp:members/jsa.374053/

#REDIRECT [[gbatemp:members/jsa.374053/]]

User:A Random Guy

2016-03-20T18:25:56Z

STIMulat3: Redirected page to gbatemp:members/a random guy.366070/

#REDIRECT [[gbatemp:members/a_random_guy.366070/]]

User:Ahezard

2016-03-20T18:25:17Z

STIMulat3: Redirected page to gbatemp:members/ahezard.383573/

#REDIRECT [[gbatemp:members/ahezard.383573/]]

List of 3DS homebrew applications

2016-03-20T18:23:45Z

STIMulat3: /* Other applications */ made DDexter into link; lowercased Phalk

<noinclude>{{3DSNav}}__NOTOC__{{Newpagepreload|Template:P/3DS Homebrew}}

'''NH2''' = Works with Ninjhax 2 / Tubehax / Ironhax / OotHax / SmashbrosHax</noinclude><includeonly>
==Applications==
</includeonly>
{| class="secondarynav"
| [[#Homebrew Loaders|Homebrew Loaders]]
| [[#Title Launchers|Title Launchers]]
| [[#File Browsers|File Browsers]]
| [[#Math|Math]]
| [[#Media players|Media players]]
| [[#Shells|Shells]]
| [[#System Tools|System Tools]]
| [[#Utilities|Utilities]]
| [[#Other applications|Other applications]]
|}

===Homebrew Loaders===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[BootCtr]]
| {{y}}
| Boot manager, assign buttons to choose between homebrew to launch, delayed autoboot. For use with menuhax.
| [[User:m45t3r|m45t3r]]
| [https://gbatemp.net/threads/re-release-bootctr-a-simple-boot-manager-for-3ds.401630/ Thread]
| [https://github.com/m45t3r/BootCtr Git]
|-
| [[BootCtr9]]
| {{n}}
| ARM9 version of BootCtr. For use with arm9loaderhax.
| [[User:hartmannaf|hartmannaf]]
|
| [https://github.com/hartmannaf/BootCtr9 Git]
|-
| [[CtrBootManager]]
| {{y}}
| Boot manager, GUI to choose between homebrew, delay autoboot. For use with menuhax.
| [[User:cpasjuste|cpasjuste]]
| [https://gbatemp.net/threads/ctrbootmanager-3ds-boot-manager-loader-homemenuhax.398383/ Thread]
| [https://github.com/Cpasjuste/CtrBootManager Git]
|-
| [[CtrBootManager9]]
| {{n}}
| ARM9 version of CtrBootManager. For use with arm9loaderhax.
| [[User:cpasjuste|cpasjuste]]
| [https://gbatemp.net/threads/release-ctrbootmanager9.417159/ Thread]
| [https://github.com/Cpasjuste/CtrBootManager Git]
|-
| [[Homebrew Emergency Launcher]]
| {{y}}
| Emergency launcher to be used if no other launchers work
| [[User:mashers|mashers]]
| [https://gbatemp.net/threads/release-homebrew-emergency-launcher.399394/ Thread]
|
|-
| Homebrew Loader
| {{n}}
| ARM9 homebrew
| [[User:kalimero|kalimero]]
|
|
|-
| [[Spider3DSTools]]
| {{n}}
|
| [[User:Yifan Lu|Yifan Lu]]
| [https://gbatemp.net/threads/custom-launcher-spider3dstools-released.379427/ Thread]
|
|-
| [[The Homebrew Launcher]]
| {{y}}
| Official Ninjhax Homebrew Launcher.
* [https://gbatemp.net/threads/homebrew-launcher-with-sorting-and-folder-support.396793/ Mod with sorting and folder support] by [[User:suloku|suloku]]
* [https://gbatemp.net/threads/release-homebrew-launcher-with-grid-layout.397527/ Mod with grid layout] by [[User:mashers|mashers]]
| [[User:Smealum|Smealum]], [[User:GEMISIS|GEMISIS]]
|
| [https://github.com/smealum/3ds_hb_menu Git]
|}

===Title Launchers===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[HANS]]
| {{y}}
| Loads games with patches to allow for region free, ROM hacks and screenshots.
| [[User:Smealum|Smealum]]
|
| [https://github.com/smealum/HANS Git]
|-
| [[regionFOUR]]
| {{y}}
| Region free cartridge loader for 3DS/3DSXL/2DS/new3DS on firmware versions 9.0-10.1.
| [[User:Smealum|Smealum]]
| [https://gbatemp.net/threads/regionfour-released-by-smealum.388115/ Thread]
| [https://github.com/smealum/regionFOUR Git]
|-
| [[regionthree]]
| {{n}}
| Region free cartridge loader for 3DS/3DSXL/2DS on firmware versions 4.0-9.5.
| [[User:Smealum|Smealum]]
| [https://gbatemp.net/threads/release-regionthree-region-free-loader-for-3ds-2ds-xl-from-9-0-9-4-sky3ds-users-regionfree.378975/ Thread]
| [https://github.com/smealum/regionthree Git]
|-
| [[Y.A.R.U.]] (Yet Another Regionfree Utility)
| {{n}}
| Region free cartridge loader for Palantine CFW/Emunand
| [[User:Rinnegatamante|Rinnegatamante]]
| [http://gbatemp.net/threads/release-y-a-r-u-regionfree-and-gw-mode-launcher.379675/ Thread]
|
|}

===File Browsers===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DS File Explorer]]
|
| Mount SD card and list files
| [[User:Ernilos|Ernilos]]
| [https://gbatemp.net/threads/homebrew-development.360646/page-83#post-5045023 Post]
| [https://mega.co.nz/#!tR1XhZwL!FHVm6TPD_Y39CM5epoAWEb0kXc_TrxPUuqHxnooVO0k Mega]
|-
| [[CTRXplorer]]
| {{y}}
| An open source SD file manager.
| [[User:d0k3|d0k3]]
| [https://gbatemp.net/threads/release-ctrxplorer-open-source-sd-file-manager.390353/ Thread]
| [https://github.com/d0k3/CTRXplorer/ Git]
|-
| [[ORGANIZ3D]]
| {{y}}
| A simple file browser written in LUA.
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/release-organiz3d-filebrowser-for-3ds.377783/ Thread]
|
|-
| [[SDBrowser]]
| {{y}}
| Files lister for 3DS.
| [[User:Lectem|Lectem]]
|
| [https://github.com/Lectem/SDBrowser Git]
|}

===Math===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| 3DS Binary --> Decimal Converter
| {{y}}
| Converts an entered binary number to its decimal equivalent
| [[User:AlbertoSONIC|AlbertoSONIC]] et al.
| [https://gbatemp.net/threads/homebrew-rev-15-3ds-binary-decimal-converter.374356/ Thread]
| [https://github.com/AlbertoSONIC/3DS_Binary_Decimal_Converter Git]
|-
| Graphing Calculator
| {{y}}
| Graphical calculator.
| [[User:flarn2006|flarn2006]]
| [https://gbatemp.net/threads/release-graphing-calculator.399078/ Thread]
| [https://github.com/flarn2006/GraphCalc3DS/ Git]
|-
| Super Simple Calculator
| {{y}}
| Calculator for simple math operations
| [[User:CKlidify|CKlidify]]
| [https://gbatemp.net/threads/release-super-simple-calculator.399475/ Thread]
|
|-
| Simple Calc
| {{y}}
| Another calculator for simple math operations.
| [[User:GalladeGuy|GalladeGuy]]
| [http://gbatemp.net/threads/simple-calc.401144/ Thread]
|
|}

===Media players===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DSAmnesic]]
| {{y}}
| Video player (<abbr title="Proof of concept">POC</abbr>)
| [[User:Lectem|Lectem]]
| [https://gbatemp.net/threads/release-3damnesic-a-poc-video-player.396184/ Thread]
| [https://github.com/Lectem/3Damnesic Git]
|-
| [[3DSurfer]]
|
| Wav player, written with LPP.
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/release-3dsurfer-wav-audioplayer-for-3ds.377647/ Thread]
|
|-
| [[CTR Streaming Server]]
|
| A 3DS homebrew audio/video playback server.
| [[User:yellows8|yellows8]]
|
| [https://github.com/yellows8/ctr-streaming-server Git]
|
|-
| [[3ds-vgmstream]]
|
| A port of vgmstream for the 3ds with a simple text based player
| [[User:TricksterGuy|TricksterGuy]]
| [https://gbatemp.net/threads/wip-3ds-vgmstream-new-audio-player-port-of-vgmstream.413755/ Thread]
| [https://github.com/TricksterGuy/3ds-vgmstream Git]
|}

===Shells===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[Sunshell]]
| {{y}}
| Multifunction shell written in LUA. Contains a variety of useful tools including an SD file manager, extdata dump/restore tool, and media players.
| [[User:Rinnegatamante|Rinnegatamante]]
| [http://gbatemp.net/threads/release-sunshell-a-powerfull-shell-for-3ds.382483/ Thread]
| [https://github.com/Rinnegatamante/Sunshell Git]
|}

===System Tools===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DS Homemenu ExtdataTool]]
| {{y}}
| Nintendo 3DS homebrew application for accessing SD extdata used by Home Menu.
| [[User:Yellows8|yellows8]]
|
| [https://github.com/yellows8/3ds_homemenu_extdatatool Git]
|-
| [[3DS Ram Dumper]]
|
| Dump RAM to file
| [[User:Palantine|Palantine]]
|
| [https://bitbucket.org/palantine/3ds-ram-dumper Git]
|-
| BigBlueMenu
| {{n}}
| Improved version of DevMenu. No link provided here.
| [[User:BigBlueBox|BigBlueBox]]
|
| —
|-
| [[Big Red Menu]]
| {{n}}
| Used to manage installed cia files on NAND.
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/big-red-menu-legal-cia-installer-uninstaller.379061/ Thread]
| [https://github.com/Rinnegatamante/Big_Red_Menu Git]
|-
| [[braindump]]
| {{y}}
| Dump decrypted contents (both ExeFS and RomFS) of any 3DS game.
| [[User:neobrain|neobrain]]
| [https://gbatemp.net/threads/braindump-prerelease-dump-game-contents-on-any-system-version.400920/ Thread]
| [https://github.com/neobrain/braindump/ Git]
|-
| CoinSetter
| {{n}}
| Official SDK Tool. No link provided here. Set the amount of play coins.
| Nintendo
|
| —
|-
| [[Custom Home Menu Manager]] 2 (CHMM2)
| {{y}}
| Allows viewing and changing of custom Home menu themes.
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/chmm-custom-homemenu-manager.379349/ 1.0] [https://gbatemp.net/threads/release-chmm2-custom-home-menu-manager-2.397543/ 2.0]
| [https://github.com/Rinnegatamante/CHMM2 Git]
|-
| DevMenu
| {{n}}
| Official SDK tool. No link provided here. Used to manage installed cia files on NAND.
| Nintendo
|
| —
|-
| [[Decrypt9]]
| {{y}}
| Decryption and dumping tools (XORpad) 9.2 and below, backup/restore SysNAND/EmuNAND
| [[User:Archshift|Archshift]], [[User:d0k3|d0k3]], [[User:Shadowtrance|Shadowtrance]]
| [https://gbatemp.net/threads/download-decrypt9-wip-3dsx-launcher-dat.388831/ Thread]
| [https://github.com/archshift/Decrypt9 Git] [https://github.com/d0k3/Decrypt9 Git] [https://github.com/Shadowtrance/Decrypt9 Git]
|-
| [[Diagnos3]]
| {{y}}
| Check the functionailty of your 3DS.
| [[User:Technicmaster0|Tcm0]] (FUK-Team)
| [https://gbatemp.net/threads/release-diagnos3.389435/ Thread]
| [http://filetrip.net/dl?wZJdhF8wWt Source]
|-
| [[EmuNAND9]]
| {{y}}
| EmuNAND SD formatter & manager
| [[User:d0k3|d0k3]]
| [https://gbatemp.net/threads/release-emunand9tool-open-source-emunand-formatter-manager.405921/ Thread]
| [https://github.com/d0k3/EmuNAND9 Git]
|-
| [[eShop Music Changer]]
| {{y}}
| Change the Nintendo eShop background music
| [[User:Ptrk25|Ptrk25]]
| [https://gbatemp.net/threads/release-eshop-music-changer.404945/ Thread]
| [https://github.com/Ptrk25/eshopMusicChanger Git]
|-
| [[Extdata dump]]
| {{y}}
| Dump, edit and restore Extra Data stored on SD Card.
| [[User:MrCheeze|MrCheeze]]
| [https://gbatemp.net/threads/3ds-extdata-dump-and-restore-tool-extra-data-editing.378492/ Thread]
| [https://github.com/MrCheeze/extdata_dump Git]
|-
| [[FBI]]
| {{y}}
| CIA Installer
| [[User:Steveice10|Steveice10]]
| [https://gbatemp.net/threads/release-fbi-open-source-cia-installer.386433/ Thread]
| [https://github.com/Steveice10/FBI Git]
|-
| [[FCRamDump]]
|
| Dump RAM to file
| [[User:Kane49|Kane49]]
|
|
|-
| [[GYTB]]
| {{y}}
| Add custom badged to your 3DS
| [[User:MrCheeze|MrCheeze]]
| [https://gbatemp.net/threads/release-gytb-custom-badges-made-really-really-simple.404355/ Thread]
| [https://github.com/MrCheeze/GYTB Git]
|-
| [[HexDump]]
|
| Display RAM dump on screen as hex value
| [[User:Ernilos|Ernilos]]
|
|
|-
| [[ironhax installer]]
| {{y}}
| Install the ironhax exploit. No longer works with the latest version of Ironfall.
| [[User:smealum|smealum]]
|
| [https://github.com/smealum/ironhax/tree/master/installer Git]
|-
| [[JK's SaveManager]]
| {{n}}
| User friendly save manger for quick and easy save swaping.
| [[User:JK_|JK_]]
| [https://gbatemp.net/threads/release-jks-savemanager-homebrew-cia-save-manager.413143/ Thread]
| [https://github.com/J-D-K/JKSM Git]
|-
| [[menuhax manager]]
| {{y}}
| Install or update menuhax.
| [[User:yellows8|yellows8]]
|
| [https://github.com/yellows8/3ds_homemenuhax/tree/master/menuhax_manager Git]
|-
| [[NASA]]
| {{y}}
| Universal CIA manager for firmware 4.1 - 10.7
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/release-nasa-universal-cia-manager-for-fw-4-1-10-6.409806/ Thread]
| [http://rinnegatamante.it/site/3ds_hbs.html Website]
|-
| [[NVRAM Flash Manager]]
| {{n}}
| Wifi NVRAM/SPI Flash dumper/restorer
| [[User:Rinnegatamante|Rinnegatamante]]
| [http://gbatemp.net/threads/release-nvram-flash-manager.383838/ Thread]
| [http://rinnegatamante.it/site/3ds_hbs.html Website]
|-
| [[Playcoin]]
| {{y}}
| Allows modifying the 3DS Play Coin counter, for Ninjhax/3dsx users.
| [[User:MrCheeze|MrCheeze]]
|
| [https://github.com/MrCheeze/playcoin Git]
|-
| [[RAM Dumping]]
|
| Dump RAM to file.
| [[User:fierce waffle|fierce waffle]]
| [https://gbatemp.net/threads/merry-christmas-have-some-ram-dumping.359697/ Thread]
|
|-
| [[SafeA9LHInstaller]]
| {{y}}
| Install arm9loaderhax.
| [[User:Aurora Wright|Aurora Wright]]
| [http://gbatemp.net/threads/safea9lhinstaller.419577/ Thread]
| [https://github.com/AuroraWright/SafeA9LHInstaller Git]
|-
| SaveDataFiler
| {{n}}
| Official SDK Tool. No link provided here. Edit save data.
| Nintendo
|
| —
|-
| [[save_manager]]
| {{y}}
| Manage save files.
| [[User:profi200|profi200]]
| [https://gbatemp.net/threads/save-data-manager-and-editor-for-firmware-up-to-9-9.396245/ Thread]
| [https://gist.github.com/profi200/d0d092c11d0eb0692748 Git]
|-
| [[SOON!]] (Super cOOl iNstaller!)
| {{n}}
| Very good-looking and easy to use CIA installer with cover art
| [[User:Chelsea_Fantasy|Chelsea_Fantasy]], [[User:Howling Wolf|Howling Wolf]]
| [https://gbatemp.net/threads/soon-super-cool-installer-a-new-cool-legal-open-source-cia-installer.387268/ Thread]
| [http://www.soon.esy.es/ Website]
|-
| [[SOON!2]]
| {{n}}
| New version of the very good-looking and easy to use CIA installer with cover art
| [[User:Chelsea_Fantasy|Chelsea_Fantasy]], [[User:Howling Wolf|Howling Wolf]]
| [https://gbatemp.net/threads/release-soon-2-super-cool-installer-2-a-new-super-cool-cia-installer.416076/ Thread]
| [http://www.soon.esy.es/ Website]
|-
| [[svdt]]
| {{y}}
| Manage save files.
| [[User:meladroit|meladroit]]
| [https://gbatemp.net/threads/svdt-save-data-explorer-manager.396562/ Thread]
| [https://github.com/meladroit/svdt/ Git]
|-
| [[UpdateSupresser]]
| {{y}}
| Removes update nag
| [[User:Giantblargg|Giantblargg]]
| [https://gbatemp.net/threads/release-updatesuppressor.404416/ Thread]
| [https://github.com/GiantBlargg/UpdateSuppressor Git]
|}

===Utilities===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DSController]]
| {{y}}
| Use your 3DS console as Windows controller (sends data to keyboard, joypad and mouse).
| [[User:CTurt|CTurt]]
| [https://gbatemp.net/threads/3ds-controller.375443/ Thread]
| [https://github.com/CTurt/3DSController Git]
|-
| [[3DS Homebrew Browser]]
| {{n}}
| Browse and install homebrew directly from your 3DS.
| [[User:cromo|cromo]] and [[User:Zeta0134|Zeta0134]]
|
| [https://github.com/zeta0134/3ds-homebrew-browser Git]
|-
| [[3DS Motion]]
| {{y}}
| 3DS Paint with added Stop-Motion animation support
| [[User:norips|norips]]
| [https://gbatemp.net/threads/beta-release-3ds_motion.403358/ Thread]
| [https://github.com/norips/3DS_Motion/releases Git]
|-
| [[3DS Multi Decryptor]]
| {{n}}
| Decrypts and creates XORPads for game's ROM files and SD card files. (Previously named 3DS CTR Decryptor)
| Team VOiD ([[User:sbJFn5r|sbJFn5r]], [[User:relys|relys]], [[User:xerpi|xerpi]])
|
| [https://github.com/Relys/3DS_Multi_Decryptor Git]
|-
| [[3DS Paint]]
|
| Drawing program
| [[User:AlbertoSONIC|AlbertoSONIC]]
| [https://gbatemp.net/threads/homebrew-3ds-paint.374473/ Thread]
| [https://github.com/AlbertoSONIC/3DS_Paint Git]
|-
| [[3DS Remote Desktop]]
|
| Stream Windows computer's screen to 3DS and send 3DS input to Windows.
| [[User:Retrozelda|Retrozelda]]
| [https://gbatemp.net/threads/3ds-remote-desktop.381646/ Thread]
| [https://bitbucket.org/RetroZelda/3ds-remote-desktop Git]
|-
| [[3DS Quick Shutdown]]
| {{y}}
| Shut down your 3DS
| [[User:daxtsu|daxtsu]]
| [https://gbatemp.net/threads/release-3ds-quick-shutdown.399981/ Thread]
| [https://github.com/thedax/3DS_Quick_Shutdown Git]
|-
| [[3DS Wifi Toggle]]
| {{y}}
| Turn Wifi on or off
| [[User:daxtsu|daxtsu]]
| [https://gbatemp.net/threads/release-wifi-toggle.400018/ Thread]
| [https://github.com/thedax/3DS_Wifi_Toggle Git]
|-
| [[3DText]]
|
| Simple text file viewer.
| [[User:DarkFlare69|DarkFlare69]]
| [https://gbatemp.net/threads/3dtext-text-viewer-for-3ds.377963/ Thread]
| [https://github.com/DarkFlare69/3DText Git]
|-
| [[Alarm Clock]]
| {{y}}
| A basic alarm clock
| [[User:730|730]]
| [https://gbatemp.net/threads/release-alarm-clock.397624/ Thread]
| Included
|-
| [[BMP Loader]]
|
| Load a specific converted BMP format.
| [[User:Ernilos|Ernilos]]
| [https://gbatemp.net/threads/homebrew-development.360646/page-38#post-4923633 Post]
|
|-
| [[BrewMan]]
| {{y}}
| Homebrew repository downloader, supports github and screenshots
| [[User:TheCruel|TheCruel]]
| [https://gbatemp.net/threads/wip-brewman-homebrew-installer-and-manager.415165/ Thread]
| [https://github.com/Repo3DS/BrewMan Git]
|-
| [[Checkmii]]
| {{y}}
| Checks what buttons are pressed
| [[User:Darkrevol|Darkrevol]]
| [https://gbatemp.net/threads/release-checkmii.395575/ Thread]
|
|-
| [[DownloadMii]]
| {{n}}
| Dicontinued. Browse and install homebrew directly from your 3DS.
| [[User:filfat|filfat]]
| [https://gbatemp.net/threads/released-downloadmii-a-homebrew-online-marketplace.374759/ Thread]
| [https://github.com/DownloadMii/DownloadMii Git]
|-
| [[edpJoy3DS]]
| {{y}}
| edpJoy client for 3DS
| [[User:edicpop|edicpop]]
| [https://gbatemp.net/threads/homebrew-edpjoy3ds.392968/ Thread]
|
|-
| [[fb43ds]]
| {{y}}
| Facebook's chat Client.
| Lino Maglione ([[User:jocopoco|jocopoco]])
| [https://gbatemp.net/threads/fb43ds-facebooks-client-for-nintendo-3ds.377030/ Thread]
| [https://github.com/linoma/fb43ds Git]
|-
| [[Font Viewer]]
| {{y}}
| View fonts from your SD card
| [[User:Jwiz33|Jwiz33]]
| [https://gbatemp.net/threads/release-font-viewer-tester.396145/ Thread]
|
|-
| [[For Anyone Who Walks A Lot]]
| {{y}}
| Awards play coins for steps beyond 1000
| [[User:iamevn|iamevn]]
| [https://gbatemp.net/threads/release-for-anyone-who-walks-a-lot.395152/ Thread]
| [https://github.com/iamevn/for-anyone-who-walks-a-lot Git]
|-
| [[ftbrony]]
| {{y}}
| FTP Server (My Little Pony themed)
| [[User:mtheall|mtheall]]
| [https://gbatemp.net/threads/ftp-server-ftbrony-by-mtheall.375254/ Thread]
| [https://github.com/mtheall/ftbrony Git]
|-
| [[FTP-3DS]]
| {{y}}
| Fork of ftbrony that is Nintendo themed
| [[User:iamevn|iamevn]]
| [https://gbatemp.net/threads/release-ftp-3ds.395195/ Thread]
| [https://github.com/iamevn/FTP-3DS/ Git]
|-
| [[FTP-GMX]]
| {{y}}
| Custom FTP Server for 3DS
| [[User:FloatingStar|FloatingStar]]
| [https://gbatemp.net/threads/release-ftp-gmx-customize-your-ftbrony.410506/ Thread]
| [https://github.com/FloatingStar/FTP-GMX Git]
|-
| [[ftpd]]
| {{y}}
| FTP server
| [[User:mtheall|mtheall]]
|
| [https://github.com/mtheall/ftpd Git]
|-
| [[ftpony]]
| {{y}}
| FTP server
| [[User:Smealum|Smealum]]
|
| [https://github.com/smealum/ftpony Git]
|-
| [[InstallMii]]
| {{y}}
| Graphical homebrew repository downloader
| [[User:simonepsp|simonepsp]]
| [https://gbatemp.net/threads/wip-installmii-graphical-repository-downloader.406097/ Thread]
|
|-
| [[MapleIRC]]
| {{y}}
| IRC Client
| [[User:titegtnodI|titegtnodI]]
| [https://gbatemp.net/threads/mapleirc-homebrew.376649/ Thread]
|
|-
| [[NinjaCam]]
| {{y}}
| Camera without shutter sound
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/release-ninjacam.405181/ Thread]
| [http://rinnegatamante.it/site/3ds_hbs.html Website]
|-
| [[PCHex]]
| {{y}}
| PKHex (Pokémon save editor) in homebrew form
| [[User:Stracker|Stracker]]
| [https://gbatemp.net/threads/pchex-homebrew-pkhex.397565/ Thread]
| [https://github.com/Strackeror/PCHex Git]
|-
| [[PCHex++]]
| {{y}}
| PCHex rewritten in C++ and with a GUI
| [[User:Slashcash|Slashcash]]
| [https://gbatemp.net/threads/wip-pchex-pchex-with-its-own-gui.405302/ Thread]
| [https://github.com/Slashcash/PCHex-plusplus Git]
|-
| [[PHBank]]
| {{y}}
| Pokémon Homebrew Bank
| [[User:Gocario|Gocario]]
| [https://gbatemp.net/threads/wip-phbank-pok%C3%A9mon-homebrew-bank.398718/ Thread]
| [https://github.com/gocario/PHBank Git]
|-
| [[Quick Reboot]]
| {{y}}
| Reboots the Nintendo 3DS console.
| [[User:AlbertoSONIC|AlbertoSONIC]]
| [https://gbatemp.net/threads/homebrew-quick-reboot-cfw-gateway-ninjhax.379101/ Thread]
| [https://github.com/AlbertoSONIC/3DS_Quick_Reboot Git]
|-
| [[screenshot-merge]]
| {{y}}
| Merges screenshots taken with ninjhax 2.5 or NTR CFW
| [[User:ihaveamac|ihaveamac]]
| [https://gbatemp.net/threads/screenshot-merge-merge-split-screenshots-right-on-the-3ds.405412/ Thread]
| [https://github.com/ihaveamac/screenshot-merge Git]
|-
| [[SmashBrosDummy]]
|
| A dummy application that simply exits as soon as it can. Used to exit increased memory mode from games like Super Smash Bros. and Monster Hunter.
| [[User:daxtsu|daxtsu]]
| [https://gbatemp.net/threads/release-smash-bros-monster-hunter-4-rebooter.379394/ Thread]
| [https://github.com/thedax/3ds-smash-dummy Git]
|-
| [[TWLSaveTool]]
| {{y}}
| Manage saves from NDS cartridges.
| [[User:TuxSH|TuxSH]]
| [https://gbatemp.net/threads/release-twlsavetool-v1-0.412887/ Thread]
| [https://github.com/TuxSH/TWLSaveTool Git]
|-
| [[uncart]]
| {{n}}
| Dump decrypted 3DS games cartridges
| [[User:neobrain|neobrain]]
|
| [https://github.com/citra-emu/uncart Git]
|-
|}

===Other applications===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DS Linux loader]]
| {{y}}
| Boots Linux
| [[User:xerpi|xerpi]]
| [https://gbatemp.net/threads/release-linux-for-the-3ds.407187/ Thread]
| [https://github.com/xerpi/3DS-Linux-Loader Git]
|-
| [[3DS Nyan Cat]]
| {{y}}
| 3DS Nyan Cat using LIBSF2D.
| [[User:markwinap|markwinap]]
| [https://gbatemp.net/threads/release-non-stop-nyan-cat-smile-please.387427/ Thread]
| [https://github.com/markwinap/3DS_Nyan_Cat Git]
|
|-
| [[Bird Whisperer]]
| {{y}}
| Notification center, built with Lua
| [[User:ElyosOfTheAbyss|ElyosOfTheAbyss]]
| [https://gbatemp.net/threads/release-bird-whisperer-a-notification-creater.404669/ Thread]
|
|-
| [[Crimson Scripter]]
| {{y}}
| Sound novel interpreter, made using lpp3ds.
| [[User:phalk|phalk]]
| [https://gbatemp.net/threads/wip-crimson-scripter.415152/ Thread]
|
|-
| [[ctrµLua]]
| {{y}}
| Lua interpreter for 3DS, part of [http://microlua.xooit.fr/index.php µLua]
| [[User:Firew0lf|Firew0lf]], [[User:Reuh|Reuh]], [[User:Negi|Negi]]
|
| [https://github.com/Firew0lf/ctruLua Git]
|-
| [[DDexter]]
| {{y}}
| Pokedex application for 3DS
| [[User:ddraco|ddraco]]
| [https://gbatemp.net/threads/release-ddexter-the-pokedex-without-the-poke-but-with-an-extra-d.399740/ Thread]
| [https://github.com/ddraco/DDexter Git]
|-
| [[Dice 3DS]]
| {{y}}
| Roll some dice
| [[User:keanutah|keanutah]]
| [https://gbatemp.net/threads/release-dice-3ds-roll-some-dice-pretty-straightforward.400086/ Thread]
|
|-
| [[DSi Homebrew Menu]] (CIA)
| {{n}}
| CIA that launches boot.nds DSi homebrew from the SD card
| [[User:ahezard|ahezard]]
| [https://gbatemp.net/threads/dsi-homebrew-menu-directly-on-your-home-menu.416791/ Thread]
| [https://github.com/ahezard/nds-hb-menu Git]
|-
| [[Fake Brick]]
| {{n}}
| Shows a fake brick screen
| [[User:flarn2006|flarn2006]]
| [https://gbatemp.net/threads/release-fake-brick.380080/ Thread]
|
|-
| [[FakeBrick9]]
| {{n}}
| Shows a fake brick screen
| [[User:A_Random_Guy|A_Random_Guy]]
| [https://gbatemp.net/threads/release-fakebrick9.418837/ Thread]
|
|-
| [[Homebrew Launcher Loader]] (CIA)
| {{n}}
| CIA that launches boot.3dsx from the SD card
| [[User:yellows8|yellows8]]
| [https://gbatemp.net/threads/release-yellows8s-homebrew-launcher-loader-for-cfw-users-cia-hbl-launcher.404151/ Thread]
| [https://github.com/yellows8/hblauncher_loader/ Git]
|-
| [[Koopa Cruiser]] (WIP)
| {{y}}
| Web Browser
| [[User:jsa|jsa]]
| [https://gbatemp.net/threads/wip-koopa-cruiser-a-basic-homebrew-web-browser.403811/ Thread]
| [https://github.com/thejsa/koopacruiser Git]
|-
| [[Lua Player Plus]]
| {{y}}
| Lua interpreter for 3DS, port from PSP Lua Player Plus.
| [[User:Rinnegatamante|Rinnegatamante]] & [[User:_Nanni|_Nanni]]
| [https://gbatemp.net/threads/w-i-p-lua-player-plus-first-lua-interpreter-for-3ds.374770/ Thread]
| [https://github.com/Rinnegatamante/lpp-3ds Git]
|
|-
| [[Manga Reader]]
| {{y}}
| Manga/Comics Reader for 3DS
| [[User:MyLegGuy|MyLegGuy]]
| [https://gbatemp.net/threads/release-manga-reader.399276/ Thread]
| [https://github.com/MyLegGuy/MangaReader Git]
|
|-
| Pictochat3D
| {{y}}
| Pictochat clone for 3DS
| [[User:Tjessx|Tjessx]]
| [https://gbatemp.net/threads/wip-pictochat3d-ninjhax.389600/ Thread]
|
|-
| [[VN3DS]]
| {{y}}
| Visual Novel Interpreter
| [[User:dfsa3fdvc1|dfsa3fdvc1]]
| [https://gbatemp.net/threads/w-i-p-vn3ds-visual-novel-interpreter-for-3ds-homebrew.396564/ Thread]
|
|}

User:Phalk

2016-03-20T18:20:56Z

STIMulat3: Redirected page to gbatemp:members/phalk.175113/

#REDIRECT [[gbatemp:members/phalk.175113/]]

User:ElyosOfTheAbyss

2016-03-20T18:19:49Z

STIMulat3: Redirected page to gbatemp:members/elyosoftheabyss.370417/

#REDIRECT [[gbatemp:members/elyosoftheabyss.370417/]]

User:TuxSH

2016-03-20T18:19:14Z

STIMulat3: Redirected page to gbatemp:members/tuxsh.373953/

#REDIRECT [[gbatemp:members/tuxsh.373953/]]

User:Ihaveamac

2016-03-20T18:18:37Z

STIMulat3: Redirected page to gbatemp:members/ihaveamac.364799/

#REDIRECT [[gbatemp:members/ihaveamac.364799/]]

User:Slashcash

2016-03-20T18:17:59Z

STIMulat3: Redirected page to gbatemp:members/slashcash.373675/

#REDIRECT [[gbatemp:members/slashcash.373675/]]

User:Simonepsp

2016-03-20T18:17:23Z

STIMulat3: Redirected page to gbatemp:members/simonepsp.376092/

#REDIRECT [[gbatemp:members/simonepsp.376092/]]

User:Jocopoco

2016-03-20T18:16:24Z

STIMulat3: Redirected page to gbatemp:members/jocopoco.344997/

#REDIRECT [[gbatemp:members/jocopoco.344997/]]

User:TheCruel

2016-03-20T18:15:42Z

STIMulat3: Redirected page to gbatemp:members/thecruel.341167/

#REDIRECT [[gbatemp:members/thecruel.341167/]]

User:Giantblargg

2016-03-20T18:13:54Z

STIMulat3: Redirected page to gbatemp:members/giantblargg.376196/

#REDIRECT [[gbatemp:members/giantblargg.376196/]]

User:Kalimero

2016-03-20T18:12:35Z

STIMulat3: Redirected page to gbatemp:members/kalimero.43527/

#REDIRECT [[gbatemp:members/kalimero.43527/]]

User:TricksterGuy

2016-03-20T18:11:14Z

STIMulat3: Redirected page to gbatemp:members/tricksterguy.380541/

#REDIRECT [[gbatemp:members/tricksterguy.380541/]]

User:Cpasjuste

2016-03-20T18:06:02Z

STIMulat3: Redirected page to gbatemp:members/cpasjuste.370907/

#REDIRECT [[gbatemp:members/cpasjuste.370907/]]

User:M45t3r

2016-03-20T18:04:52Z

STIMulat3: Redirected page to gbatemp:members/m45t3r.89800/

#REDIRECT [[gbatemp:members/m45t3r.89800/]]

User:M45t3r

2016-03-20T18:01:55Z

STIMulat3: Redirected page to Members/m45t3r.89800/

#REDIRECT [[members/m45t3r.89800/]]

List of 3DS homebrew applications

2016-03-20T17:45:45Z

STIMulat3: /* Other applications */ added Homebrew Launcher Loader CIA and DSi Homebrew Menu CIA

<noinclude>{{3DSNav}}__NOTOC__{{Newpagepreload|Template:P/3DS Homebrew}}

'''NH2''' = Works with Ninjhax 2 / Tubehax / Ironhax / OotHax / SmashbrosHax</noinclude><includeonly>
==Applications==
</includeonly>
{| class="secondarynav"
| [[#Homebrew Loaders|Homebrew Loaders]]
| [[#Title Launchers|Title Launchers]]
| [[#File Browsers|File Browsers]]
| [[#Math|Math]]
| [[#Media players|Media players]]
| [[#Shells|Shells]]
| [[#System Tools|System Tools]]
| [[#Utilities|Utilities]]
| [[#Other applications|Other applications]]
|}

===Homebrew Loaders===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[BootCtr]]
| {{y}}
| Boot manager, assign buttons to choose between homebrew to launch, delayed autoboot. For use with menuhax.
| [[User:m45t3r|m45t3r]]
| [https://gbatemp.net/threads/re-release-bootctr-a-simple-boot-manager-for-3ds.401630/ Thread]
| [https://github.com/m45t3r/BootCtr Git]
|-
| [[BootCtr9]]
| {{n}}
| ARM9 version of BootCtr. For use with arm9loaderhax.
| [[User:hartmannaf|hartmannaf]]
|
| [https://github.com/hartmannaf/BootCtr9 Git]
|-
| [[CtrBootManager]]
| {{y}}
| Boot manager, GUI to choose between homebrew, delay autoboot. For use with menuhax.
| [[User:cpasjuste|cpasjuste]]
| [https://gbatemp.net/threads/ctrbootmanager-3ds-boot-manager-loader-homemenuhax.398383/ Thread]
| [https://github.com/Cpasjuste/CtrBootManager Git]
|-
| [[CtrBootManager9]]
| {{n}}
| ARM9 version of CtrBootManager. For use with arm9loaderhax.
| [[User:cpasjuste|cpasjuste]]
| [https://gbatemp.net/threads/release-ctrbootmanager9.417159/ Thread]
| [https://github.com/Cpasjuste/CtrBootManager Git]
|-
| [[Homebrew Emergency Launcher]]
| {{y}}
| Emergency launcher to be used if no other launchers work
| [[User:mashers|mashers]]
| [https://gbatemp.net/threads/release-homebrew-emergency-launcher.399394/ Thread]
|
|-
| Homebrew Loader
| {{n}}
| ARM9 homebrew
| [[User:kalimero|kalimero]]
|
|
|-
| [[Spider3DSTools]]
| {{n}}
|
| [[User:Yifan Lu|Yifan Lu]]
| [https://gbatemp.net/threads/custom-launcher-spider3dstools-released.379427/ Thread]
|
|-
| [[The Homebrew Launcher]]
| {{y}}
| Official Ninjhax Homebrew Launcher.
* [https://gbatemp.net/threads/homebrew-launcher-with-sorting-and-folder-support.396793/ Mod with sorting and folder support] by [[User:suloku|suloku]]
* [https://gbatemp.net/threads/release-homebrew-launcher-with-grid-layout.397527/ Mod with grid layout] by [[User:mashers|mashers]]
| [[User:Smealum|Smealum]], [[User:GEMISIS|GEMISIS]]
|
| [https://github.com/smealum/3ds_hb_menu Git]
|}

===Title Launchers===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[HANS]]
| {{y}}
| Loads games with patches to allow for region free, ROM hacks and screenshots.
| [[User:Smealum|Smealum]]
|
| [https://github.com/smealum/HANS Git]
|-
| [[regionFOUR]]
| {{y}}
| Region free cartridge loader for 3DS/3DSXL/2DS/new3DS on firmware versions 9.0-10.1.
| [[User:Smealum|Smealum]]
| [https://gbatemp.net/threads/regionfour-released-by-smealum.388115/ Thread]
| [https://github.com/smealum/regionFOUR Git]
|-
| [[regionthree]]
| {{n}}
| Region free cartridge loader for 3DS/3DSXL/2DS on firmware versions 4.0-9.5.
| [[User:Smealum|Smealum]]
| [https://gbatemp.net/threads/release-regionthree-region-free-loader-for-3ds-2ds-xl-from-9-0-9-4-sky3ds-users-regionfree.378975/ Thread]
| [https://github.com/smealum/regionthree Git]
|-
| [[Y.A.R.U.]] (Yet Another Regionfree Utility)
| {{n}}
| Region free cartridge loader for Palantine CFW/Emunand
| [[User:Rinnegatamante|Rinnegatamante]]
| [http://gbatemp.net/threads/release-y-a-r-u-regionfree-and-gw-mode-launcher.379675/ Thread]
|
|}

===File Browsers===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DS File Explorer]]
|
| Mount SD card and list files
| [[User:Ernilos|Ernilos]]
| [https://gbatemp.net/threads/homebrew-development.360646/page-83#post-5045023 Post]
| [https://mega.co.nz/#!tR1XhZwL!FHVm6TPD_Y39CM5epoAWEb0kXc_TrxPUuqHxnooVO0k Mega]
|-
| [[CTRXplorer]]
| {{y}}
| An open source SD file manager.
| [[User:d0k3|d0k3]]
| [https://gbatemp.net/threads/release-ctrxplorer-open-source-sd-file-manager.390353/ Thread]
| [https://github.com/d0k3/CTRXplorer/ Git]
|-
| [[ORGANIZ3D]]
| {{y}}
| A simple file browser written in LUA.
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/release-organiz3d-filebrowser-for-3ds.377783/ Thread]
|
|-
| [[SDBrowser]]
| {{y}}
| Files lister for 3DS.
| [[User:Lectem|Lectem]]
|
| [https://github.com/Lectem/SDBrowser Git]
|}

===Math===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| 3DS Binary --> Decimal Converter
| {{y}}
| Converts an entered binary number to its decimal equivalent
| [[User:AlbertoSONIC|AlbertoSONIC]] et al.
| [https://gbatemp.net/threads/homebrew-rev-15-3ds-binary-decimal-converter.374356/ Thread]
| [https://github.com/AlbertoSONIC/3DS_Binary_Decimal_Converter Git]
|-
| Graphing Calculator
| {{y}}
| Graphical calculator.
| [[User:flarn2006|flarn2006]]
| [https://gbatemp.net/threads/release-graphing-calculator.399078/ Thread]
| [https://github.com/flarn2006/GraphCalc3DS/ Git]
|-
| Super Simple Calculator
| {{y}}
| Calculator for simple math operations
| [[User:CKlidify|CKlidify]]
| [https://gbatemp.net/threads/release-super-simple-calculator.399475/ Thread]
|
|-
| Simple Calc
| {{y}}
| Another calculator for simple math operations.
| [[User:GalladeGuy|GalladeGuy]]
| [http://gbatemp.net/threads/simple-calc.401144/ Thread]
|
|}

===Media players===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DSAmnesic]]
| {{y}}
| Video player (<abbr title="Proof of concept">POC</abbr>)
| [[User:Lectem|Lectem]]
| [https://gbatemp.net/threads/release-3damnesic-a-poc-video-player.396184/ Thread]
| [https://github.com/Lectem/3Damnesic Git]
|-
| [[3DSurfer]]
|
| Wav player, written with LPP.
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/release-3dsurfer-wav-audioplayer-for-3ds.377647/ Thread]
|
|-
| [[CTR Streaming Server]]
|
| A 3DS homebrew audio/video playback server.
| [[User:yellows8|yellows8]]
|
| [https://github.com/yellows8/ctr-streaming-server Git]
|
|-
| [[3ds-vgmstream]]
|
| A port of vgmstream for the 3ds with a simple text based player
| [[User:TricksterGuy|TricksterGuy]]
| [https://gbatemp.net/threads/wip-3ds-vgmstream-new-audio-player-port-of-vgmstream.413755/ Thread]
| [https://github.com/TricksterGuy/3ds-vgmstream Git]
|}

===Shells===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[Sunshell]]
| {{y}}
| Multifunction shell written in LUA. Contains a variety of useful tools including an SD file manager, extdata dump/restore tool, and media players.
| [[User:Rinnegatamante|Rinnegatamante]]
| [http://gbatemp.net/threads/release-sunshell-a-powerfull-shell-for-3ds.382483/ Thread]
| [https://github.com/Rinnegatamante/Sunshell Git]
|}

===System Tools===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DS Homemenu ExtdataTool]]
| {{y}}
| Nintendo 3DS homebrew application for accessing SD extdata used by Home Menu.
| [[User:Yellows8|yellows8]]
|
| [https://github.com/yellows8/3ds_homemenu_extdatatool Git]
|-
| [[3DS Ram Dumper]]
|
| Dump RAM to file
| [[User:Palantine|Palantine]]
|
| [https://bitbucket.org/palantine/3ds-ram-dumper Git]
|-
| BigBlueMenu
| {{n}}
| Improved version of DevMenu. No link provided here.
| [[User:BigBlueBox|BigBlueBox]]
|
| —
|-
| [[Big Red Menu]]
| {{n}}
| Used to manage installed cia files on NAND.
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/big-red-menu-legal-cia-installer-uninstaller.379061/ Thread]
| [https://github.com/Rinnegatamante/Big_Red_Menu Git]
|-
| [[braindump]]
| {{y}}
| Dump decrypted contents (both ExeFS and RomFS) of any 3DS game.
| [[User:neobrain|neobrain]]
| [https://gbatemp.net/threads/braindump-prerelease-dump-game-contents-on-any-system-version.400920/ Thread]
| [https://github.com/neobrain/braindump/ Git]
|-
| CoinSetter
| {{n}}
| Official SDK Tool. No link provided here. Set the amount of play coins.
| Nintendo
|
| —
|-
| [[Custom Home Menu Manager]] 2 (CHMM2)
| {{y}}
| Allows viewing and changing of custom Home menu themes.
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/chmm-custom-homemenu-manager.379349/ 1.0] [https://gbatemp.net/threads/release-chmm2-custom-home-menu-manager-2.397543/ 2.0]
| [https://github.com/Rinnegatamante/CHMM2 Git]
|-
| DevMenu
| {{n}}
| Official SDK tool. No link provided here. Used to manage installed cia files on NAND.
| Nintendo
|
| —
|-
| [[Decrypt9]]
| {{y}}
| Decryption and dumping tools (XORpad) 9.2 and below, backup/restore SysNAND/EmuNAND
| [[User:Archshift|Archshift]], [[User:d0k3|d0k3]], [[User:Shadowtrance|Shadowtrance]]
| [https://gbatemp.net/threads/download-decrypt9-wip-3dsx-launcher-dat.388831/ Thread]
| [https://github.com/archshift/Decrypt9 Git] [https://github.com/d0k3/Decrypt9 Git] [https://github.com/Shadowtrance/Decrypt9 Git]
|-
| [[Diagnos3]]
| {{y}}
| Check the functionailty of your 3DS.
| [[User:Technicmaster0|Tcm0]] (FUK-Team)
| [https://gbatemp.net/threads/release-diagnos3.389435/ Thread]
| [http://filetrip.net/dl?wZJdhF8wWt Source]
|-
| [[EmuNAND9]]
| {{y}}
| EmuNAND SD formatter & manager
| [[User:d0k3|d0k3]]
| [https://gbatemp.net/threads/release-emunand9tool-open-source-emunand-formatter-manager.405921/ Thread]
| [https://github.com/d0k3/EmuNAND9 Git]
|-
| [[eShop Music Changer]]
| {{y}}
| Change the Nintendo eShop background music
| [[User:Ptrk25|Ptrk25]]
| [https://gbatemp.net/threads/release-eshop-music-changer.404945/ Thread]
| [https://github.com/Ptrk25/eshopMusicChanger Git]
|-
| [[Extdata dump]]
| {{y}}
| Dump, edit and restore Extra Data stored on SD Card.
| [[User:MrCheeze|MrCheeze]]
| [https://gbatemp.net/threads/3ds-extdata-dump-and-restore-tool-extra-data-editing.378492/ Thread]
| [https://github.com/MrCheeze/extdata_dump Git]
|-
| [[FBI]]
| {{y}}
| CIA Installer
| [[User:Steveice10|Steveice10]]
| [https://gbatemp.net/threads/release-fbi-open-source-cia-installer.386433/ Thread]
| [https://github.com/Steveice10/FBI Git]
|-
| [[FCRamDump]]
|
| Dump RAM to file
| [[User:Kane49|Kane49]]
|
|
|-
| [[GYTB]]
| {{y}}
| Add custom badged to your 3DS
| [[User:MrCheeze|MrCheeze]]
| [https://gbatemp.net/threads/release-gytb-custom-badges-made-really-really-simple.404355/ Thread]
| [https://github.com/MrCheeze/GYTB Git]
|-
| [[HexDump]]
|
| Display RAM dump on screen as hex value
| [[User:Ernilos|Ernilos]]
|
|
|-
| [[ironhax installer]]
| {{y}}
| Install the ironhax exploit. No longer works with the latest version of Ironfall.
| [[User:smealum|smealum]]
|
| [https://github.com/smealum/ironhax/tree/master/installer Git]
|-
| [[JK's SaveManager]]
| {{n}}
| User friendly save manger for quick and easy save swaping.
| [[User:JK_|JK_]]
| [https://gbatemp.net/threads/release-jks-savemanager-homebrew-cia-save-manager.413143/ Thread]
| [https://github.com/J-D-K/JKSM Git]
|-
| [[menuhax manager]]
| {{y}}
| Install or update menuhax.
| [[User:yellows8|yellows8]]
|
| [https://github.com/yellows8/3ds_homemenuhax/tree/master/menuhax_manager Git]
|-
| [[NASA]]
| {{y}}
| Universal CIA manager for firmware 4.1 - 10.7
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/release-nasa-universal-cia-manager-for-fw-4-1-10-6.409806/ Thread]
| [http://rinnegatamante.it/site/3ds_hbs.html Website]
|-
| [[NVRAM Flash Manager]]
| {{n}}
| Wifi NVRAM/SPI Flash dumper/restorer
| [[User:Rinnegatamante|Rinnegatamante]]
| [http://gbatemp.net/threads/release-nvram-flash-manager.383838/ Thread]
| [http://rinnegatamante.it/site/3ds_hbs.html Website]
|-
| [[Playcoin]]
| {{y}}
| Allows modifying the 3DS Play Coin counter, for Ninjhax/3dsx users.
| [[User:MrCheeze|MrCheeze]]
|
| [https://github.com/MrCheeze/playcoin Git]
|-
| [[RAM Dumping]]
|
| Dump RAM to file.
| [[User:fierce waffle|fierce waffle]]
| [https://gbatemp.net/threads/merry-christmas-have-some-ram-dumping.359697/ Thread]
|
|-
| [[SafeA9LHInstaller]]
| {{y}}
| Install arm9loaderhax.
| [[User:Aurora Wright|Aurora Wright]]
| [http://gbatemp.net/threads/safea9lhinstaller.419577/ Thread]
| [https://github.com/AuroraWright/SafeA9LHInstaller Git]
|-
| SaveDataFiler
| {{n}}
| Official SDK Tool. No link provided here. Edit save data.
| Nintendo
|
| —
|-
| [[save_manager]]
| {{y}}
| Manage save files.
| [[User:profi200|profi200]]
| [https://gbatemp.net/threads/save-data-manager-and-editor-for-firmware-up-to-9-9.396245/ Thread]
| [https://gist.github.com/profi200/d0d092c11d0eb0692748 Git]
|-
| [[SOON!]] (Super cOOl iNstaller!)
| {{n}}
| Very good-looking and easy to use CIA installer with cover art
| [[User:Chelsea_Fantasy|Chelsea_Fantasy]], [[User:Howling Wolf|Howling Wolf]]
| [https://gbatemp.net/threads/soon-super-cool-installer-a-new-cool-legal-open-source-cia-installer.387268/ Thread]
| [http://www.soon.esy.es/ Website]
|-
| [[SOON!2]]
| {{n}}
| New version of the very good-looking and easy to use CIA installer with cover art
| [[User:Chelsea_Fantasy|Chelsea_Fantasy]], [[User:Howling Wolf|Howling Wolf]]
| [https://gbatemp.net/threads/release-soon-2-super-cool-installer-2-a-new-super-cool-cia-installer.416076/ Thread]
| [http://www.soon.esy.es/ Website]
|-
| [[svdt]]
| {{y}}
| Manage save files.
| [[User:meladroit|meladroit]]
| [https://gbatemp.net/threads/svdt-save-data-explorer-manager.396562/ Thread]
| [https://github.com/meladroit/svdt/ Git]
|-
| [[UpdateSupresser]]
| {{y}}
| Removes update nag
| [[User:Giantblargg|Giantblargg]]
| [https://gbatemp.net/threads/release-updatesuppressor.404416/ Thread]
| [https://github.com/GiantBlargg/UpdateSuppressor Git]
|}

===Utilities===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DSController]]
| {{y}}
| Use your 3DS console as Windows controller (sends data to keyboard, joypad and mouse).
| [[User:CTurt|CTurt]]
| [https://gbatemp.net/threads/3ds-controller.375443/ Thread]
| [https://github.com/CTurt/3DSController Git]
|-
| [[3DS Homebrew Browser]]
| {{n}}
| Browse and install homebrew directly from your 3DS.
| [[User:cromo|cromo]] and [[User:Zeta0134|Zeta0134]]
|
| [https://github.com/zeta0134/3ds-homebrew-browser Git]
|-
| [[3DS Motion]]
| {{y}}
| 3DS Paint with added Stop-Motion animation support
| [[User:norips|norips]]
| [https://gbatemp.net/threads/beta-release-3ds_motion.403358/ Thread]
| [https://github.com/norips/3DS_Motion/releases Git]
|-
| [[3DS Multi Decryptor]]
| {{n}}
| Decrypts and creates XORPads for game's ROM files and SD card files. (Previously named 3DS CTR Decryptor)
| Team VOiD ([[User:sbJFn5r|sbJFn5r]], [[User:relys|relys]], [[User:xerpi|xerpi]])
|
| [https://github.com/Relys/3DS_Multi_Decryptor Git]
|-
| [[3DS Paint]]
|
| Drawing program
| [[User:AlbertoSONIC|AlbertoSONIC]]
| [https://gbatemp.net/threads/homebrew-3ds-paint.374473/ Thread]
| [https://github.com/AlbertoSONIC/3DS_Paint Git]
|-
| [[3DS Remote Desktop]]
|
| Stream Windows computer's screen to 3DS and send 3DS input to Windows.
| [[User:Retrozelda|Retrozelda]]
| [https://gbatemp.net/threads/3ds-remote-desktop.381646/ Thread]
| [https://bitbucket.org/RetroZelda/3ds-remote-desktop Git]
|-
| [[3DS Quick Shutdown]]
| {{y}}
| Shut down your 3DS
| [[User:daxtsu|daxtsu]]
| [https://gbatemp.net/threads/release-3ds-quick-shutdown.399981/ Thread]
| [https://github.com/thedax/3DS_Quick_Shutdown Git]
|-
| [[3DS Wifi Toggle]]
| {{y}}
| Turn Wifi on or off
| [[User:daxtsu|daxtsu]]
| [https://gbatemp.net/threads/release-wifi-toggle.400018/ Thread]
| [https://github.com/thedax/3DS_Wifi_Toggle Git]
|-
| [[3DText]]
|
| Simple text file viewer.
| [[User:DarkFlare69|DarkFlare69]]
| [https://gbatemp.net/threads/3dtext-text-viewer-for-3ds.377963/ Thread]
| [https://github.com/DarkFlare69/3DText Git]
|-
| [[Alarm Clock]]
| {{y}}
| A basic alarm clock
| [[User:730|730]]
| [https://gbatemp.net/threads/release-alarm-clock.397624/ Thread]
| Included
|-
| [[BMP Loader]]
|
| Load a specific converted BMP format.
| [[User:Ernilos|Ernilos]]
| [https://gbatemp.net/threads/homebrew-development.360646/page-38#post-4923633 Post]
|
|-
| [[BrewMan]]
| {{y}}
| Homebrew repository downloader, supports github and screenshots
| [[User:TheCruel|TheCruel]]
| [https://gbatemp.net/threads/wip-brewman-homebrew-installer-and-manager.415165/ Thread]
| [https://github.com/Repo3DS/BrewMan Git]
|-
| [[Checkmii]]
| {{y}}
| Checks what buttons are pressed
| [[User:Darkrevol|Darkrevol]]
| [https://gbatemp.net/threads/release-checkmii.395575/ Thread]
|
|-
| [[DownloadMii]]
| {{n}}
| Dicontinued. Browse and install homebrew directly from your 3DS.
| [[User:filfat|filfat]]
| [https://gbatemp.net/threads/released-downloadmii-a-homebrew-online-marketplace.374759/ Thread]
| [https://github.com/DownloadMii/DownloadMii Git]
|-
| [[edpJoy3DS]]
| {{y}}
| edpJoy client for 3DS
| [[User:edicpop|edicpop]]
| [https://gbatemp.net/threads/homebrew-edpjoy3ds.392968/ Thread]
|
|-
| [[fb43ds]]
| {{y}}
| Facebook's chat Client.
| Lino Maglione ([[User:jocopoco|jocopoco]])
| [https://gbatemp.net/threads/fb43ds-facebooks-client-for-nintendo-3ds.377030/ Thread]
| [https://github.com/linoma/fb43ds Git]
|-
| [[Font Viewer]]
| {{y}}
| View fonts from your SD card
| [[User:Jwiz33|Jwiz33]]
| [https://gbatemp.net/threads/release-font-viewer-tester.396145/ Thread]
|
|-
| [[For Anyone Who Walks A Lot]]
| {{y}}
| Awards play coins for steps beyond 1000
| [[User:iamevn|iamevn]]
| [https://gbatemp.net/threads/release-for-anyone-who-walks-a-lot.395152/ Thread]
| [https://github.com/iamevn/for-anyone-who-walks-a-lot Git]
|-
| [[ftbrony]]
| {{y}}
| FTP Server (My Little Pony themed)
| [[User:mtheall|mtheall]]
| [https://gbatemp.net/threads/ftp-server-ftbrony-by-mtheall.375254/ Thread]
| [https://github.com/mtheall/ftbrony Git]
|-
| [[FTP-3DS]]
| {{y}}
| Fork of ftbrony that is Nintendo themed
| [[User:iamevn|iamevn]]
| [https://gbatemp.net/threads/release-ftp-3ds.395195/ Thread]
| [https://github.com/iamevn/FTP-3DS/ Git]
|-
| [[FTP-GMX]]
| {{y}}
| Custom FTP Server for 3DS
| [[User:FloatingStar|FloatingStar]]
| [https://gbatemp.net/threads/release-ftp-gmx-customize-your-ftbrony.410506/ Thread]
| [https://github.com/FloatingStar/FTP-GMX Git]
|-
| [[ftpd]]
| {{y}}
| FTP server
| [[User:mtheall|mtheall]]
|
| [https://github.com/mtheall/ftpd Git]
|-
| [[ftpony]]
| {{y}}
| FTP server
| [[User:Smealum|Smealum]]
|
| [https://github.com/smealum/ftpony Git]
|-
| [[InstallMii]]
| {{y}}
| Graphical homebrew repository downloader
| [[User:simonepsp|simonepsp]]
| [https://gbatemp.net/threads/wip-installmii-graphical-repository-downloader.406097/ Thread]
|
|-
| [[MapleIRC]]
| {{y}}
| IRC Client
| [[User:titegtnodI|titegtnodI]]
| [https://gbatemp.net/threads/mapleirc-homebrew.376649/ Thread]
|
|-
| [[NinjaCam]]
| {{y}}
| Camera without shutter sound
| [[User:Rinnegatamante|Rinnegatamante]]
| [https://gbatemp.net/threads/release-ninjacam.405181/ Thread]
| [http://rinnegatamante.it/site/3ds_hbs.html Website]
|-
| [[PCHex]]
| {{y}}
| PKHex (Pokémon save editor) in homebrew form
| [[User:Stracker|Stracker]]
| [https://gbatemp.net/threads/pchex-homebrew-pkhex.397565/ Thread]
| [https://github.com/Strackeror/PCHex Git]
|-
| [[PCHex++]]
| {{y}}
| PCHex rewritten in C++ and with a GUI
| [[User:Slashcash|Slashcash]]
| [https://gbatemp.net/threads/wip-pchex-pchex-with-its-own-gui.405302/ Thread]
| [https://github.com/Slashcash/PCHex-plusplus Git]
|-
| [[PHBank]]
| {{y}}
| Pokémon Homebrew Bank
| [[User:Gocario|Gocario]]
| [https://gbatemp.net/threads/wip-phbank-pok%C3%A9mon-homebrew-bank.398718/ Thread]
| [https://github.com/gocario/PHBank Git]
|-
| [[Quick Reboot]]
| {{y}}
| Reboots the Nintendo 3DS console.
| [[User:AlbertoSONIC|AlbertoSONIC]]
| [https://gbatemp.net/threads/homebrew-quick-reboot-cfw-gateway-ninjhax.379101/ Thread]
| [https://github.com/AlbertoSONIC/3DS_Quick_Reboot Git]
|-
| [[screenshot-merge]]
| {{y}}
| Merges screenshots taken with ninjhax 2.5 or NTR CFW
| [[User:ihaveamac|ihaveamac]]
| [https://gbatemp.net/threads/screenshot-merge-merge-split-screenshots-right-on-the-3ds.405412/ Thread]
| [https://github.com/ihaveamac/screenshot-merge Git]
|-
| [[SmashBrosDummy]]
|
| A dummy application that simply exits as soon as it can. Used to exit increased memory mode from games like Super Smash Bros. and Monster Hunter.
| [[User:daxtsu|daxtsu]]
| [https://gbatemp.net/threads/release-smash-bros-monster-hunter-4-rebooter.379394/ Thread]
| [https://github.com/thedax/3ds-smash-dummy Git]
|-
| [[TWLSaveTool]]
| {{y}}
| Manage saves from NDS cartridges.
| [[User:TuxSH|TuxSH]]
| [https://gbatemp.net/threads/release-twlsavetool-v1-0.412887/ Thread]
| [https://github.com/TuxSH/TWLSaveTool Git]
|-
| [[uncart]]
| {{n}}
| Dump decrypted 3DS games cartridges
| [[User:neobrain|neobrain]]
|
| [https://github.com/citra-emu/uncart Git]
|-
|}

===Other applications===
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Title
! style="width:1%" | NH2
! class="unsortable" | Description
! style="width:20%" | Author
! class="unsortable" style="width:8%" | Thread
! class="unsortable" style="width:8%" | Source
|-
| [[3DS Linux loader]]
| {{y}}
| Boots Linux
| [[User:xerpi|xerpi]]
| [https://gbatemp.net/threads/release-linux-for-the-3ds.407187/ Thread]
| [https://github.com/xerpi/3DS-Linux-Loader Git]
|-
| [[3DS Nyan Cat]]
| {{y}}
| 3DS Nyan Cat using LIBSF2D.
| [[User:markwinap|markwinap]]
| [https://gbatemp.net/threads/release-non-stop-nyan-cat-smile-please.387427/ Thread]
| [https://github.com/markwinap/3DS_Nyan_Cat Git]
|
|-
| [[Bird Whisperer]]
| {{y}}
| Notification center, built with Lua
| [[User:ElyosOfTheAbyss|ElyosOfTheAbyss]]
| [https://gbatemp.net/threads/release-bird-whisperer-a-notification-creater.404669/ Thread]
|
|-
| [[Crimson Scripter]]
| {{y}}
| Sound novel interpreter, made using lpp3ds.
| [[User:Phalk|Phalk]]
| [https://gbatemp.net/threads/wip-crimson-scripter.415152/ Thread]
|
|-
| [[ctrµLua]]
| {{y}}
| Lua interpreter for 3DS, part of [http://microlua.xooit.fr/index.php µLua]
| [[User:Firew0lf|Firew0lf]], [[User:Reuh|Reuh]], [[User:Negi|Negi]]
|
| [https://github.com/Firew0lf/ctruLua Git]
|-
| DDexter
| {{y}}
| Pokedex application for 3DS
| [[User:ddraco|ddraco]]
| [https://gbatemp.net/threads/release-ddexter-the-pokedex-without-the-poke-but-with-an-extra-d.399740/ Thread]
| [https://github.com/ddraco/DDexter Git]
|-
| [[Dice 3DS]]
| {{y}}
| Roll some dice
| [[User:keanutah|keanutah]]
| [https://gbatemp.net/threads/release-dice-3ds-roll-some-dice-pretty-straightforward.400086/ Thread]
|
|-
| [[DSi Homebrew Menu]] (CIA)
| {{n}}
| CIA that launches boot.nds DSi homebrew from the SD card
| [[User:ahezard|ahezard]]
| [https://gbatemp.net/threads/dsi-homebrew-menu-directly-on-your-home-menu.416791/ Thread]
| [https://github.com/ahezard/nds-hb-menu Git]
|-
| [[Fake Brick]]
| {{n}}
| Shows a fake brick screen
| [[User:flarn2006|flarn2006]]
| [https://gbatemp.net/threads/release-fake-brick.380080/ Thread]
|
|-
| [[FakeBrick9]]
| {{n}}
| Shows a fake brick screen
| [[User:A_Random_Guy|A_Random_Guy]]
| [https://gbatemp.net/threads/release-fakebrick9.418837/ Thread]
|
|-
| [[Homebrew Launcher Loader]] (CIA)
| {{n}}
| CIA that launches boot.3dsx from the SD card
| [[User:yellows8|yellows8]]
| [https://gbatemp.net/threads/release-yellows8s-homebrew-launcher-loader-for-cfw-users-cia-hbl-launcher.404151/ Thread]
| [https://github.com/yellows8/hblauncher_loader/ Git]
|-
| [[Koopa Cruiser]] (WIP)
| {{y}}
| Web Browser
| [[User:jsa|jsa]]
| [https://gbatemp.net/threads/wip-koopa-cruiser-a-basic-homebrew-web-browser.403811/ Thread]
| [https://github.com/thejsa/koopacruiser Git]
|-
| [[Lua Player Plus]]
| {{y}}
| Lua interpreter for 3DS, port from PSP Lua Player Plus.
| [[User:Rinnegatamante|Rinnegatamante]] & [[User:_Nanni|_Nanni]]
| [https://gbatemp.net/threads/w-i-p-lua-player-plus-first-lua-interpreter-for-3ds.374770/ Thread]
| [https://github.com/Rinnegatamante/lpp-3ds Git]
|
|-
| [[Manga Reader]]
| {{y}}
| Manga/Comics Reader for 3DS
| [[User:MyLegGuy|MyLegGuy]]
| [https://gbatemp.net/threads/release-manga-reader.399276/ Thread]
| [https://github.com/MyLegGuy/MangaReader Git]
|
|-
| Pictochat3D
| {{y}}
| Pictochat clone for 3DS
| [[User:Tjessx|Tjessx]]
| [https://gbatemp.net/threads/wip-pictochat3d-ninjhax.389600/ Thread]
|
|-
| [[VN3DS]]
| {{y}}
| Visual Novel Interpreter
| [[User:dfsa3fdvc1|dfsa3fdvc1]]
| [https://gbatemp.net/threads/w-i-p-vn3ds-visual-novel-interpreter-for-3ds-homebrew.396564/ Thread]
|
|}