How a Terrible Game Cracked the 3DS's Security - Early Days of 3DS Hacking 

> be a company that encourages piracy > get butthurt when someone pirates your product

When I was young, my dad bought me a copy of cubic Ninja from the clearance section before it took off... I still have it

Imagine having a bestselling game because of its homebrew potential.

Imagine being the dev team of Cubic Ninja, wondering why your game that flopped hard is now suddenly a best seller and also wishing that this had happened before the company went under.

The irony of a company called "Gateway" performing gatekeeping on their code should not be understated

r4 card: used by hackers and also 6 year old me playing cooking mama

Ironically, piracy is becoming more and more the only way we can ensure the preservation of older software.

They did NOT want people finding out how it works. *now lets talk about how it works*

I wonder how the Cubic Ninja devs felt when their game skyrocket in sales

I remember buying cubic ninja, and I was like this game sucks, and never playing it again, and now I see this...

I feel like once a game company stops selling games and the game system, its morally okay to pirate the games. They wont make money anyways, so its a win for the customer, but not a loss for the company.

The way gateway has like the most classically evil looking logo I’ve ever seen is absolutely hilarious

"Man, that is the best video i've seen in absolute AGES, i wonder what else this guy made..." "Oh."

i love how that the Gateway programmer literally called the function "Brick()"

I actually have a hacked 2ds, and i remember specifically having to go through some wierd hoops IN the 3ds, and therefore ds. I remember going through the japanese version of flipnote studio, but I had no idea what to do because I don't speak Japanese. I was insanely scared, but luckily I ended up using Google translate to find all the Japanese characters I needed. So I needed GOOGLE TRANSLATE to hack my 2ds. Weirdest thing I've probably ever done.

The 3DS being hacked years before the DSi is an understatement.

So what you're telling me is... The 3DS was susceptible to a simple buffer overflow attack... TWICE.

Gateway is the most savage company I've heard of. Their accidental self-sabotage sounds like a plot twist in a dramatic play

I was working at a video game store when this happened, and that day we had a bunch of people come in to buy Cubic Ninja. I remember being so confused because no one had cared about the game up until that point. The next day we were told to immediately take it off the shelf and it got recalled back to the head office haha.

for some reason whenever i hear about a code destroying a system it makes my heart skip a beat as if it were a horror movie i dont even know/care that much about electronics but it just happens

"If their amazing code didn't trigger on actual Gateway cards too" Called it. Their idea was idiotic.

Relying on pirates, known for not wanting to pay for things, as your main source of income is an...interesting business model, to say the least.

Fun facts : - MSET stands for MemorySet, it’s a function in c/c++ where you can set specific values to a location in memory. For example filling an array with a unique number. In that case, we memory set the ds profile to garbage characters to make the 3ds vulnerable.

I'm eternally gratetful to everyone that helped crack the 3ds, you can do a lot of cool stuff with it nowadays and I use it almost as much as I use my switch plus having ddlc, fnaf, lsd dream emulator, and pepsiman all on a 3ds with an undertale theme is amazing lol

Where did this dude come from? He obviously has experience in creating videos, yet this is the first video on this channel.

I genuinely love that they were basically like “Fine, you like them more? Let’s see how you feel when you can’t have either.” And just killed your DS

It's not piracy anymore. The goal changed to preservation

Moral dilemma? These are corporations. Do we actually care?

Awww, the good old days, my first smartphone,no data plan, connecting to that unsecured network behind school, just to open the gateway page, waiting for a new exploit on 6.0...

"They did not want anyone finding out how it worked!" -- "So let's talk a little bit about how it worked." OK, cool!

I love how thorough and simplified your explanations are. I've been trying to dabble in cracking/patching/REing for some time now, and you do a great job at taking otherwise advanced concepts and making them understandable for young teens.

This was a great summary of the whole saga, although I feel Roxas was painted in an overly positive light (closed source in the homebrew/hacking community is a major dick move) and Smealum was given far too much credit for works he likely never accomplished. He only ever repeated what other hackers would say, and always had convenient excuses why he couldn't follow up on his Q Drops---I mean, his vaguetweets on how "something" is "coming soon" and it "may require something" that you "may or may not" be able to "buy or otherwise find".

"they did NOT want anyone finding out how it worked." "........so lets talk a little about how it worked"

Just binge watched your whole channel

this is genuinely one of my favorite videos on youtube. ive watched it like 6 times since ~2020

>"Don't follow RU-vid guides" >mfw managed to jailbreak my 3ds by following a RU-vid guide

I had one friend on 3DS who was always playing Cubic Ninja, now I get it

"... bricks your 3ds..." "...give a bad name to competitors product..." Bruh... All I heard about flash carts during this time was that trying to use them on the 3ds bricked your device, Gateway unintentionally taught dopes like me to just *not buy any flashcards for 3ds entirely because they would brick the device*

I grew up with a dsi with one of those cards full of games on it. My family grew up poor so it was the best way my dad could give me the most out of my ds. Years and years later, it still works and i still replay pokemon games on it :]

coming back to watch this video after nintendo released their latest patch.... right after making it impossible to buy any first party 3ds games by closing the eshop. im sure that soon enough hackers will have found a solution for this one too. very interesting video!!

I love how ironic it was when Gateway tried to stop the pirates of their pirate product.

I have so many memories of 3ds homebrew. My favorite persists to this day: my custome home menu theme app bugged out and stopped properly updating music when I changed themes. It'd change the visuals and sfx, but not music. So, for the past 4 ish years, my 3ds has had a No Game No Life theme, with the opening from Watamote blaring instead. This persisted through system transfer, and my 3ds currently has no other homebrew on it, but god does it make me laugh every time

I remember browsing GBAtemp the day Ninjhax released, as soon as I saw it, I immediately ran to the local used game store, and bought a copy for maybe $5. Hilariously, they had 2 copies in stock, and literally the person in front of me was buying the other copy, I heard him talking with the person behind the counter, and it was immediately clear that he too had happened across the information online that day. Just really funny that we were both there at the same time, picking up the last 2 copies the store had, probably right before they would start to receive regular inquiries if they had a copy in stock.

I've literally watched this video like 10 times since I found it 2 years ago. Great vid

“They did not want anyone finding out how it worked” *Lets talk about how it worked*

"Hey, uh, John? There are a bunch of clones stealing our money." "..." "...John??" "CLONES GO BOOM BOOM"

This is like the best video on here. I’ve watched it so many times and it’s just entertaining to watch.

18:00 The guys that reversed Roxas' rxTool missed a great naming opportunity, should've called theirs soraTool.

How the heck do you have videos of this quality with less than 30 subs?! Man you earned mine!

man, I'm kinda disapointed because i thought your channel was filled with videos about hacking history... oh well hope you'll get there soon

it's crazy how much your content has improved in very subtle ways, the formula hasn't changed much but the audio has improved drastically since this video has a lot of plosives and audible crackles.

just finished watching all of your videos after being introduced to them via the fnaf and baldi stuff. amazing work man! a lot of this goes over my head but it’s super intriguing as a pc gamer who has been modding my games for years (albeit in a much more surface level way). can’t wait to see more from you!

"This exploit took advantage of webkit" Why do i hear this sentence about a different exploit every other week

I remember the first 3DS hack I saw was Minecraft 3 years before it was offically annouced for the 3DS and Wii U

I come back to this video all the time. we miss you Tech Rules

7:20 Hey you pirates, stop pirating our pirating tool! lol

Great video. Would be cool to listen about hacking history of others consoles. Like PSP for example.

You have a great style of commentary, casual and friendly without coming across as trying too hard x

I keep coming back to this video cause its so good, this kickstarted your channel

The "DS mode" is actually almost exactly how it works. The 3DS actually has a TWL_FIRM in the system, which is a DSi mode.

Got here from the 3DS hacks subreddit. Not done watching yet, just wanted to say, some of this sounds eerily similar to a certain situation. Piracy being the main motive for a certain device, the intentional bricking of consoles using said device... *cough* SX OS *cough*

Am I drunk? I was recommended this video but it's the only video on the channel? That being said, I understand why I was recommended it and I think this is a very high quality video and it's interesting too. I just wonder how someone could be pushed by "The Algorithm" on their only video?

"Needless to say, they did NOT want anyone figuring out how it worked... So lets talk a little about how it worked." this quote was the highlight of my day lmao

Who would've thought a group devoted to stealing for profit would have done unsavory things to people's devices?

“Needless to say, they did NOT want people finding out how it worked.” “So, let’s talk a little about how it works.”

imagine being the team behind cubic ninja and seeing this

Idk how many times I've watched this video, it's so interesting!! This, the anti piracy, and bleem videos are my favorite. Tech history is so cool, especially how you tell and present it. Tech rules!!

Here’s a reminder we haven’t forgotten about you: this is my favorite RU-vid documentary! I like your editing style, in particular.

Nintendo: *Releases a console* Hackers: *I'm four parallel universes ahead of you*

This is a good video. thanks RU-vid algorithm

Seeing this video makes me really appreciate all the work the homebrew community has done on making the 3ds so smooth to hack. We now can hack a 3ds easily without a game at all! Also I like how you immediately explained how the gateway carts worked after saying that gateway didn't want people to know how their carts worked!

>makes one video >gets 1.5 million views and 100k subs this is beyond science

Glad your being put into peoples' recommended, the quality and visuals are pretty great. :P

Ok I'm sure people have told you this before but this video is SOOOOOO GOOD! I've watched this so many times since a couple months after you posted it and I'm entertained everytime! Good luck:)

I think I've genuinely rewatched this video like 20 times. It's so good.

Hey, everyone! Thank you so much for the overwhelming support on this video! It was a long time in the making, and I'm really happy it seems to be so well-received. Everyone's been asking for MONTHS about the music at the start of the video. It's called "Root" by Silent Partner. Sorry for not mentioning before. For some reason, I didn't realize so many people would want to know! Also, a slight correction: I've been told that I got the colors of the Sky3DS buttons wrong, and it was the blue one that had the arbitrary limit. My bad! Anyway, thanks again! I hope I can continue to make interesting content that all of you enjoy!

One of the biggest ironies of the whole cracking 3DS firmware and Nintendo desperately trying to patch it with every iteration of their own firmware... Homebrew Launcher did not, in of itself, allow piracy. It enabled it, sure, but it also came with a bunch of cool features like customization options. Actually being able to change your 'wallpaper' background of your 3DS system, and alter the background music of the homescreen to anything. Nintendo, for whatever reason and even to this day, does not support minimal customization of your device. You can't put an image file on your SD card and use that as your background. You either choose their default colors or nothing at all. You can't even buy 'themes' as you can with your PS4 for example. They are VERY stubborn, and even that might be an understatement. That is but one example. Instead of adopting the more 'freeing,' user friendly and relatively harmless features/benefits of custom firmware... They chose to crack down on custom firmwares/exploits to install custom firmware without providing an alternative or an incentive NOT to jailbreak your 3DS. So can they really be surprised that hackers were relentless? And if you look at the PC as a platform... Nobody cares that you 'save edit' or use cheats in a single player game. And that has birthed amazing modding communities for all sorts of games, developers even embrace it and offer out opensource 'mod kits' to modders so that they can DESIGN content for their games that other players can use as they see fit. Just look at Skyrim or any Bethesda game for that matter. We've all probably played Skyrim with mods. You could make the argument that such games and the experience are improved by mods. Even Valve has Steam workshop and practically encourages players TO download mods for applicable games. Imagine Breath of the Wild with community created mods. A mod that removes the durability system so that players who dislike that can experience the game the way they want, if they so chose. Whole new areas, towns, weapons, armor, quests. Replacing Link's character model with Zelda. Right now that's impossible because not only does Nintendo not support it, but with every Switch game, your save file is saved to the device and linked to your account on it. You know what allows you to save on your SD card, inject different save files and harmlessly 'cheat' or 'soft mod' games? Custom firmware. Yet another incentive for hackers to use custom firmware and continue to find exploits, while Nintendo continues to be stubborn for no reason. It's an incentive that wouldn't EXIST if Nintendo offered support for things like that. I can understand wanting to crackdown on piracy. What I can't understand is why, as a platform creator, you would not want to make piracy the ONLY reason for hackers to exploit and install a custom firmware. You don't have to like people modding, save editing, using their own backgrounds/homescreen music etc. You DO, however, have to wise up and understand that the more concessions you make (the less incentives you give hackers to hack your own platform), then the less incentives those hacking communities will have to do it in the first place. More features, less hackers. Less hackers, more secure platform. More secure platform, less piracy. It's quite that simple.

Sailing the high seas is something I will never be ashamed of.

I always see these hacking history things and they're so cool and interesting but I can't help but always feel like it's just SO MUCH WORK 🤣 but it's always cool to see how passionate groups of people are to succeed with a particular such as hacking a 3ds

Much love to all the smart people out there doing tech science so I can put flowers wherever I want in Animal Crossing :)

the second i saw cubic ninja i was glad my parents bought it for me. they only got it because they saw it was really popular and bought it. even if it was badly received, i had so much fun with it. nostalgia kicking in harder than a brick.

I literally watch this over and over this is a pure master piece of a video

this led me down the rabbit hole to modding my 3ds

8:08 >when the pirate company has to use anti-piracy That's a damn irony!

I owned this game before the discovery. And genuinely enjoyed it.

9:00 I got an ad for Sackboy (a LittleBigPlanet spinoff). Nintendoes what SONY does.

4:48 “they did not want anyone finding out how their cards worked. So lasts talk about how their cards worked.” Clearly there was a flaw in the plan.

Regarding that last part about RU-vid guides, yeah, that's very true. Here in Latin America there was a problem with a RU-vid dude changing files to include his own name in the credits, his mistakes bricked tons of consoles across multiple countries. It was beneficial for modders like me who had a sudden load of work for unbricking said consoles, but it was an awful experience for a lot of users that followed him. You might want to check it out later, just search for Yakara Bricks.

You're semi correct on the not being able to mess with 3DS part with DS stuff part. There's also TWL mode (aka DSi mode). This mode is the enhanced version of DS mode. In that mode you can mess with 3DS stuff! Because of how TWL mode works and that it requires NAND access for DSiWare, that means that you can access ALL of NAND from it. TWL_FIRM (the software responsible for setting up legacy mode, aka DS/DSi mode) isn't able to actually restrict physical NAND read/writes to just the TWLN/TWLP partitions. (the partitions used by DSiWare/DSi Photos). As a result you can write to any part of the NAND. Normally this wouldn't be useful (aside from doing NAND backups I guess) since NAND is encrypted...BUT... There are known flaws in the FIRM partition encryption scheme that can be exploited by having a plain text version of a FIRM partition. As a result you could alter FIRM partitions from TWL mode (FIRM partitions are used during early boot process on 3DS and are responsible for booting up the full 3DS mode firmware). The only requirement is finding an exploitable DSiWare app to run homebrew code from. Which isn't that hard really. Apparently there's quite a few that's been found to be exploitable recently. :P But pure DS mode doesn't have nand access so in that respect you are still correct. Oh and TWL enhanced game carts wouldn't have nand access either despite being in DSi mode. Due to how DSi security was setup, Nintendo didn't allow most/any game carts to have NAND access. Though it was possible with the correct settings in the game header, no game had the settings required to enable it and since DSI Enhanced game header's were RSA protected, you can't just modify them to enable it. As far as I'm aware, only certain DEV flashcarts intended for dev consoles could have it enabled. (stuff like system updaters for updating firmware on dev consoles since they didn't use the normal system update feature that retail consoles used). Dev flashcarts can't be used on retail due to having different blowfish keys and such. Besides the dev software you'd write to such a flashcart had "dev signed" RSA headers. Retail consoles don't use the dev keys for RSA signing so they'd reject any dev signed software you tried to throw at it. So instead you'd want to try and exploit DSiWare. But anyways yeah pure DS mode can't touch any 3DS stuff though so I guess your technically correct...the best kind of correct.... :P Also you should cover the DSI at some point. It's recently been hacked and the story on that is interesting since in terms of CFW/full system access, that console had the longest run on being secure in that respect. The first full system access exploit "RocketLauncher" was found only a couple years ago. (and by yours truly...me... :D ). It was never publicly released due to lack of devs to work on install tools for end users to safely install it. But doesn't change the fact that it exists and could have been used to gain control over the system and access all features and allow CFW. I did post videos on it succesfully taking over a DSi. The irony in that exploit is it exploited a flaw in the very system they setup to try and block DS flashcarts. So you could use a modified flashcart with a custom rom to cause an overflow via a modified DS Cart White list file which Nintendo messed up and didn't setup RSA checks for in a specific firmware version. That's the short version. Look up my videos on it for the full explanation on how it works. Info about it on gbatemp too I guess if you want to research that further. Fortunately though a new exploit was found by NoCash called Unlaunch that involved a flaw in Stage2 where Stage2 didn't properly check the filesize of Launcher's TMD file before attempting to load the TMD file into ram (another classic overflow exploit) and he did release that one. RocketLauncher by virtue of being made obsolete by that new exploit hasn't been worked on since then. There's also a recent find by Shutterbug2000 who found some bugs in the SSL certificate security stuff in DSi's network protocol code used by most DSi software and as a result found a big flaw in Nintendo Zone that will allow installing Unlaunch/CFW onto ALL DSi's! It does require a second device to run a rom that hosts a beacon that will enable the Nintendo Zone icon on the target DSi, but once you get the DSi's Nintendo Zone connected to the redirected server (thanks to the above mentioned SSL flaws found), you can fool it into thinking it's connected to a trusted Nintendo server. It turns out Nintendo Zone has literally no checks on the SRLs (the software/roms sent over via wifi) so you can send it a homebrew SRL and as long as the header is in the correct format, it will happily load the thing anyways. :P Shutterbug hasn't release it yet, but he already shown that he used it successfully to install Unlaunch so it's only a matter of time. :D

I think it's funny how many hackers are against piracy when that's what 90% of people use it for. I doubt anyone ever hacked their console just to play homebrew and Doom ports

imagine having the hottest 3ds game of all time simply because hackers used it

I love the big old W that stands out in Gateway's logo. 'Cause they're as money hungry as Wario.

*talks about DS backward compability* Me: *hears Pheonix Wright: Ace Attorney music from the DS* Ahh... the days of the DS... like the scent of fresh lemon, you see.

Remember it's always morally correct to pirate Nintendo games.

I love this video! So neat to know how one of my most nostalgic handhelds was cracked back in it’s rise!

*"Needless to say, they didn't want anyone finding out about how it worked, so let's talk about how it worked"* Perfect.

I've used Cubic Ninja many times, happy to say I've still never attempted to play the actual game itself! Based on what I've seen and heard though, that's probably for the best.

Would love to see a video on the Switch, too. Homebrew on old Nintendo Switches is pretty much guaranteed to work no matter what firmware update gets released due to it being a hardware exploit rather than software.

Its almost been 2 years since this gem of a channel started and he hasnt changed much and still just as fun to watch

I remember when my grandma and brother got a 3ds each back in the summer of 2011. They also got one game each. My brother got OoT 3d while my Grandma got Cubic Ninja. Well, now I got something to bring up during christmas this year.