遊戲速報 Komica複製文集散地

ありがとう任天堂

http://bbs.tgbus.com/thread-5573875-1-1.html

[教程] 【破除鎖區】正版4.0~9.4系統適用｜官方系統破除鎖區，跨區運行正版卡帶（僅限舊3DS） [複製鏈接]

linyuqiang1

任天堂學院

UID: 9230377
積分: 112279
帖子: 10671
精華: 0
浮雲: 12375
猥幣: 451445
汽油: 127

電梯直達

樓主

發表於2015-1-17 14:53:11 | 只看該作者 | 倒序瀏覽

本帖最後由linyuqiang1 於2015-1-18 16:11 編輯

來源：https://github.com/smealum/regionthree/

製作者：smealum

注意事項

本方法適用於4.0~9.4系統的舊版3DS 3DSLL，以及2DS，

New3DS暫時不可用，未來可能會增加支持

如果瀏覽器崩潰，清除掉cookies和歷史記錄，重啟再使用

神遊、港台版不可用

使用電源鍵退出遊戲，按Home鍵會假死

破解鎖區步驟

下載Launcher.dat放在SD卡根目錄
　　（下載地址　https://github.com/smealum/regionthree/raw/master/Launcher.dat ）
插入要運行的卡帶

進入downloadplay ダウンロードプレイ應用

按HOME鍵保留後台進瀏覽器

瀏覽器訪問go.gateway-3ds.com

其他區域的遊戲會自動啟動

　（破解鎖區過程會黑屏，乃屬正常）

本方法會屏蔽啟動版本檢測，所以理論上不需要更新系統也可以運行高版本遊戲

原文

region free loader for 3DS/3DSXL/2DS on firmware versions 9.0-9.4

loads games from other regions and runs them in YOUR language if possible !

video can be found here : https://www.youtube.com/watch?v=ZQwAEqSmU7w

How to use

Download Launcher.dat from the repo (or compile it yourself) https://github.com/smealum/regionthree/raw/master/Launcher.dat

Copy Launcher.dat to the root of your SD card

Insert the game you want to run into your 3DS and power it up

Open the "Download Play" application

Hit the home menu button, but do not exit the Download Play application (keep it running in the background)

Open the Web Browser applet

Go to Gateway's exploit page (not linking directly to it here because not a fan of their whole piracy thing they've got going)

Wait a few seconds; screen should turn black and after a bit your game should boot up !

FAQ

Does this work on the latest firmware version ? Yes, 9.4 is supported.

Does this let me run homebrew and/or roms ? No, it just lets you run legit physical games from other regions.

Do I need to connect to the internet every time I want to use this ? Yes.

Do I need a flashcart/game/hardware for this ? No.

Will this work on my New 3DS ? No, at the moment this only works on 3DS, 3DS XL and 2DS models.

Will it ever work on the New 3DS ? Maybe. I don't plan on working on it, like, ever, but the code is out there now so...

Will this break or brick my 3DS ? No. There's virtually 0 chance of that happening, all this runs is run of the mill usermode code, nothing dangerous. Nothing unusual is written to your NAND, nothing permanent is done. With that in mind, use at your own risk, I won't take responsibility if something weird does happen.

Do you take donations ? No, I do not.

How does it work ? See below.

Technical stuff

Basically we use GW's entrypoint to get ROP (not code execution, either userland or kernel) under spider (that's what the browser applet is called).
From there, we use the GPU DMA vuln to take over the download play application (this is done by overwriting the GSP interrupt handler funcptr table).
The download play application has access to the ns:s service (spider does not), and we use that service to launch our out-of-region game.
For more detail on the webkit/ spider exploit, visit http://yifan.lu/2015/01/10/rever ... first-stage-part-1/
For more detail on the GPU DMA exploit, visit http://smealum.net/?p =517
To build the ROP, use Kingcom's armips assembler https://github.com/Kingcom/armips

Credits

All ROP and code written on this repo written by smea

ns:s region free booting trick found by yellows8

Neatly packaged spider exploit by Gateway

Bond697, sm, yifanlu for working on the GW payload so I wouldn't have to.

Myria for helping with testing.

分享到：1

已有8人評分	浮雲	收起理由
蘭休斯特	+ 1	沼躍魚已經看穿了一切
unpop	+ 1	效果拔群
nintendo_z	+ 1	沼躍魚已經看穿了一切
yqx888	+ 5	看看我們家小天使
LuLuLucy	+ 5	看看我們家小天使
521018852	+ 15	看看我們家小天使
695837974	+ 10	沼躍魚已經看穿了一切
那時的海鳴	+ 5	看看我們家小天使