Godmode9: H&S Injector ARM9 crash

[TurdPooCharger]

Hey, congrats on GodMode9's 2nd anniversary. Let everyone know who was involved in its improvements, I'm loving the new features in the updated gm9 script engine.

Anyway, I'd like to report the misbehavior of injecting CIA titles into Health & Safety. I'm not sure if this problem only happens to me or is common to a lot of people whenever they inject H&S, so I'll iterate what the issue is:

When injecting into H&S and opening/running that injection title at least once, the 3DS system will (always?) experience an ARM9 crash when you turn off the 3DS like in the picture shown below.

During my in-depth study of the CIA container file and especially the ncch.bin (aka, NCCH0.bin) game header's structure, I found something that caught my attention in the extheader.bin (aka, ExHeader.bin) or the extended header.

Information obtained at these sources:

• https://www.3dbrew.org/wiki/NCCH
• https://3dbrew.org/wiki/NCCH/Extended_Header
• https://github.com/ihaveamac/3DS-rom-tools/wiki/Edit-title-ID-with-extracted-NCCH-header-and-ExHeader

Shout out goes to @ihaveamac for his documentation of hex editing those mentioned 3 bytes address of the Partition/Program ID as this lead to the discovery of a solution utilizing the full 8 bytes address.

You're probably sick of seeing some variation of this hex view for the ncch.bin, but here it is again for another refresher just in case.

Pay particular attention to the Partition/Program ID and Extended header SHA-256 hash. What makes Nintendo's factory installed titles as system apps is that they're installed on the SysNAND.

In the case of Health & Safety, this is installed at:

• 1:/title/00040010/20021300

This same Partition/Program ID or "00 13 02 20 10 00 04 00" hex address is also present in Health & Safety's extheader.bin in the aforementioned offset regions from @ihaveamac's method of editing the Title ID.

Here is a hex view of Health & Safety's extended header that shows this better:

In order to get a stable injection that does not trigger the ARM9 crash when powering off the 3DS, the injected CIA title's extheader.bin has to match Health & Safety's Partition/Program ID with the full 8 bytes address.

This then requires calculating the new SHA-256 of the modified extended header and then editing that hash info back into the hybridized H&S/injected app's NCCH0 header.

These were the missing puzzles in converting injected titles into "true" system apps.

Proof of this fix and working demonstration can be found in version 1.8 of the 'Inject and Restore Apps' gm9 script.

Edit 1: I had to correct that ncch hex pictures as I mistakenly referred the Partition ID as "Product ID". Too many P lettered words.

Also, this injection method doesn't stop ARM11 crashes, and those homebrew & game titles that didn't work before still don't work. I suspect something in the HeaderExeFS.bin (found in exefs.bin) has something to do with but alas those are separate bugs.

Edit 2: Opps, I referred to the SysNAND directory as 0:/ which is the SDCARD, where I really meant to say was 1:/ . Too many little mistakes.

Edit 3: I had to go back and edit that ncch picture again. Although not pertinent the discussion, the colorized sections for the icon.bin offset and size were missing in the ANSI character set on the right. In case anyone else needs to references this picture later, don't want to leave anything missing in that picture.

Edit 4: Wow, I really suck. In my hex view picture for the extended header, I wrote that 0x400 (in hex) is equal to 256 (in real numbers). Totally wrong. The correct value is 0x400 equals to 1024. Hex is not my strong suit. The corrected picture is now posted up. I probably fibbed some other numbers in this post.

Edit 5: Yup. Donked up again. There was a missing 0 in the ncch picture for the Program ID highlighted in green. The address was shown like this "00040010/2002130 .

[SirNapkin1334]

I will test to see if I get the arm9 crash. I don't ever recall getting it.

What happened to your C-stick? Did you break it off and are covering it?

[TurdPooCharger]

Thanks for chiming in. I don't know if the arm9 crash happens for all systems or whether it depends on region and old/new type. I've also had this crash happen on my other N3DS system. I believe @annson24 can attests this bug from his end too. Reading from past issues #85 and #90, d0k3 said the H&S injector was never intended as a full time title swap but as a means to an end of installing a CIA installer/FBI* to get Homebrew Launcher.

This was before Luma3DS was capable of boot.3dsx injection, rendering this injection method's original purpose as a vestige relic. However, I still believe this type of injection still has a place in today's homebrew as I know there are users out there who still would like put that "wasted" title to good use.

---

In a matter of speaking, yes. I (purposely) broke/ripped off the c-stick's rubber nub and covered it with the (subjectively) better PSP-1000 joystick cap. You once mentioned you have an O3DS. In case you have a N(2|3)DS(XL) or plan to get one someday, check out the PSP c-stick mod if you find the rubber nub ill suited for games like Super Smash and Monster Hunter.

How to Mod Your New 3DS C-Stick
https://www.youtube.com/watch?v=OYN9XWngRds

Edit 1 - * I originally quoted FBI but d0k3 never stated this or any specific CIA installer. It is the defacto popular CIA installer as of today. NASA is or was another big name CIA installer at one point? I forget at times that the early days of 3DS homebrew had many similar apps that competed and developed in arms race.

[d0k3]

I'll look into this later, @TurdPooCharger - thanks for the detailed report. @SirNapkin1334 - can you try and see if you can reproduce this issue?

[annson24]

I can confirm the issue. I've actually noticed the issue for a few months now actually, maybe even before rosalina was a thing. I thought this one was unfixable since it isn't being fixed at all so I didn't bother reporting it.

Here's a further report:

1. Opening H&S injected with FBI, and shutting down the device normally within the app = CRASH
2. Opening the app and shutting down/rebooting the device via rosalina = OK
3. Opening the app, closing it, then shutting down the device normally = CRASH
4. Opening app, closing it, then shutting down/rebooting the device via rosalina = CRASH
5. Opening app, closing, going into settings, and going back to home menu = CRASH

EDIT:
Can also confirm the fix works. Will be implementing this also to the megascript. Thanks a lot @TurdPooCharger

[d0k3]

Okay, should be fixed with the most recent commit. I also tried injecting an early version of freeshop, but that caused crashes that were not fixed by this. Did I already say that H&S injection is a pretty wonky one-trick solution and shouldn't be used to "not waste that space"? :)

Anyways, @TurdPooCharger / @annson24 - can you retry and see if it still happens?

[TurdPooCharger]

I will use FBI v2.5.0 as the test app for injection. BRB.

[TurdPooCharger]

GodMode9-v1.6.1-15-gab3af191-20180327013015
Injection Test Results:
(Testing procedures as denoted by @annson24)

• 3DShell v3.0.0 - :+1:
• FBI v2.5.0 - :+1:
• freeShop v4.1.2 - :+1:
• mGBA v0.7.0 (nightly 2018-03-18) - :+1:
• Anemone3DS v1.3.0 - :-1: **

Passing Grade:
75% (C - Fair)

** Actually, that last one was an cheap shot, trick question. Is this the same wonky bug where you previously mentioned in GM9 thread about not injecting anything either too large of a CIA or retail games? I don't think it is (directly) related to the ARM9 bug focused here nor a size file issue.

All Virtual Consoles, eShop digital games, and certain homebrews apps, even if they're smaller than the H&S .app, will not work. I'm also investigating this one and believe it has something to do with the HeaderExeFS.bin (or the first 512 bytes in exefs.bin). Posting this one here for documentation purposes but is not considered related to this issue. As for ever exactly pinpointing and solving this wonky one, no promises. :)

Actual Passing Grade:

120% (A+ - Excellent, bonus 20% for quick workaround) :1st_place_medal:

How old is the version of freeShop you injected? I used v4.1.2, and it works. I found out when injecting the older v4.1.1, freeShop will automatically update and download the latest CIA onto HOME Menu and not within injected H&S. Also, I think really old versions of freeShop stopped being compatible when retrieving info from _that Title Site_.

Also, here's another one I found while bug testing, which is no fault of the H&S injector. If you load up freeShop, press the HOME button during the wavy blue Homebrew splash screen, resume, and then quickly press the power button to turn off the 3DS, you either get a stuck splash or ARM11 crash.

This happens on the standalone CIA installed version, too. I'll probably won't report this one to freeShop's repo at their notabug.org as the average 3DS user does not typically operate (regular or injected) freeShop in this manner.

Last words before closing this issue, be expecting another issue to be presented some time later. Currently jotting down details for some features request in the GM9 script command.

Edit - Reopening the issue. Need one more tester (@annson24 , thanks) for double blind verification.

[d0k3]

Great, thank you for testing! I think it's expected that not everything (not even all homebrew) is injectable. After all, we're converting a SD title to a system title, and we don't even know yet what else could affect it.

The error you saw with Anemone 3DS means this:
[3DS] Module: FS (17) | Description: Title/object not found? (fs) (120) | Summary: Not found (4) | Level: Status (25)

Well... try to interpret that. I guess with some knowledge of the Anemone 3DS source, you could. Anways, waiting for what @annson24 will say.

[TurdPooCharger]

Anemone3DS *. mGBA passed with flying colors. @annson24 lives somewhere in the middle east and works on megascript at his work away from the wifey so she doesn't kills him (huehuehue). I think that's very sweet of her, so he's a very lucky man.

Here's a neat fact about @endrift's emulator when compared to the typical title setup. mGBA has no romfs.bin. Her entire emulator is the .code itself. The first time I GM9 image mounted her emulator, it baffled the crap out of me. The first train of thought was that there was something wrong in GodMode9. Only after subsequent hex comparison between her .cia , .app , etc. revealed that wasn't the case. Crazy beans I tell you, sir.

[TurdPooCharger]

PM'd @annson24 at GBAtemp.

Edit - Just got word he got the memo, but he should be ready to test when it's his day time. That anticipation to put this issue to rest. :)

[annson24]

Sorry for the delay, didn't noticed that this was reopened. Anyway, FBI to H&S test report:

All scenarios as the report I made last time are now working properly, no more arm9 crashes. 👍

[TurdPooCharger]

And now we can put this to rest. It's been great bug testing and patching with you guys. Thanks.