3dbrew - User contributions [en]

CGFX

2018-07-31T05:42:58Z

M-1: /* Tools */

CGFX is a container format used to store graphics resources. It can contain 3D models, textures and animation data.

== CGFX ==

CGFX header :
{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Magic "CGFX"
|-
| 0x4
| 0x2
| Byte order mark: FFFE (little endian) or FEFF (big endian)
|-
| 0x6
| 0x2
| CGFX header size
|-
| 0x8
| 0x4
| Revision
|-
| 0xC
| 0x4
| File size (bytes)
|-
| 0x10
| 0x4
| Number of entries
|}

A typical CGFX file contains two main entries, beginning directly after the CGFX header: DATA and IMAG.

== DATA ==

DATA contains a list of DICT references.

DATA header (for N = 0..15) :
{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Magic "DATA"
|-
| 0x4
| 0x4
| DATA Size (in bytes)
|-
| 0x8 +(N*8)
| 0x4
| Number of entries in DICT N
|-
| 0xC +(N*8)
| 0x4
| Offset (self-relative) to DICT N
|}

The DATA header contains the entry counts and offsets for each DICT entry. The number of entries can vary (probably based on the version?), but are always in the following order. Any unused entries are zeroed.

Typical entries:
{| class="wikitable"
|-
! N
! Type
|-
| 0
| Models
|-
| 1
| Textures
|-
| 2
| LUTS (Material/Color/Shader look-up tables?)
|-
| 3
| Materials
|-
| 4
| Shaders
|-
| 5
| Cameras
|-
| 6
| Lights
|-
| 7
| Fog
|-
| 8
| Environments
|-
| 9
| Skeleton animations
|-
| 10
| Texture animations
|-
| 11
| Visibility animations
|-
| 12
| Camera animations
|-
| 13
| Light animations
|-
| 14
| Emitters
|-
| 15
| Unknown
|}

== DICT ==

DICTs are generic structures used to store values (and associate them to a key ?). A DICT header is 0x1C bytes long.

DICT header :
{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Magic "DICT"
|-
| 0x4
| 0x4
| DICT size (in bytes)
|-
| 0x8
| 0x4
| Number of entries
|-
| 0xC
| 0x4
| ?
|-
| 0x10
| 0x2
| Unknown. Seems to be shifted left by 4 bits in the source.
|-
| 0x10
| 0x2
| ?
|-
| 0x12
| 0xA
| ?
|}

DICT entry:
{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| ?
|-
| 0x4
| 0x2
| ?
|-
| 0x6
| 0x2
| ?
|-
| 0x8
| 0x4
| Offset (self-relative) to symbol
|-
| 0xC
| 0x4
| Offset (self-relative) to object
|}

== CMDL ==

CMDL is used to describe a 3D model.

CMDL Header :
{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Flags (bit 7: hasSkeletonSobj)
|-
| 0x4
| 0x4
| Magic "CMDL"
|-
| 0x8
| 0x4
| ?
|-
| 0xC
| 0x4
| Offset (self-relative) to model name
|-
| 0x10
| 0x18
| ?
|-
| 0x28
| 0x4
| Number of entries in Animation Types DICT
|-
| 0x2C
| 0x4
| Offset (self-relative) to Animation Types DICT
|-
| 0x30
| 0xC
| Global scale vector (3 floats : x, y, z)
|-
| 0x3C
| 0x18
| ?
|-
| 0x54
| 0x30
| Matrix 1
|-
| 0x84
| 0x30
| Matrix 2
|-
| 0xB4
| 0x4
| Number of Vertex Info SOBJ entries
|-
| 0xB8
| 0x4
| Offset (self-relative) to Vertex Info SOBJ list
|-
| 0xBC
| 0x4
| Number of MTOB DICT entries
|-
| 0xC0
| 0x4
| Offset (self-relative) to MTOB DICT
|-
| 0xC4
| 0x4
| Number of Vertex Info SOBJ entries
|-
| 0xC8
| 0x4
| Offset (self-relative) to Vertex Info SOBJ list
|-
| 0xCC
| 0x4
| Number of Unknown DICT entries
|-
| 0xD0
| 0x4
| Offset (self-relative) to Unknown DICT
|-
| 0xD4
| 0xC
| ?
|-
| 0xE0
| 0x4
| Skeleton Info SOBJ offset (self-relative) [only present if flag bit 7 is set]
|-
| 0xB8+[0xB8]
| 0x4*N
| Vertex Info SOBJ self-relative offset list
|}

A CMDL section refers to outside data; it can not be considered separately from the rest of the CGFX file.
The second DICT in the CMDL section contains offsets to MTOB objects.

== SOBJ ==

SOBJ structures can be used to describe 3D objects that are part of the model. If such is the case then they will follow this structure :

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Flags (bit 4: model; bit 1: skeleton)
|-
| 0x4
| 0x4
| Magic "SOBJ"
|-
| 0x8
| 0x4
| ?
|-
| 0xC
| 0x4
| Unknown symbol offset (self-relative)
|-
| 0x10
| 0xC
| ?
|-
| 0x1C
| 0x4
| Offset (self-relative) to Unknown1 (appears to hold array of floats) ?
|-
| 0x20
| 0xC
| Mesh position offset (X/Y/Z floats)
|-
| 0x2C
| 0x4
| Face groups count
|-
| 0x30
| 0x4
| Offset (self-relative) to face groups offset array
|-
| 0x34
| 0x4
| ?
|-
| 0x38
| 0x4
| Vertex groups count
|-
| 0x3C
| 0x4
| Offset (self-relative) to vertex groups offset array
|-
| 0x40
| 0x4
| Unknown offset (self-relative) ?
|}

Face groups:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Bone groups count
|-
| 0x4
| 0x4
| Offset (self-relative) to UInt32 bone group IDs array
|-
| 0x8
| 0x4
| ?
|-
| 0xC
| 0x4
| Unknown2 count
|-
| 0x10
| 0x4
| Offset (self-relative) to Unknown2 offset array
|}

Unknown2:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Face group descriptor count
|-
| 0x4
| 0x4
| Offset (self-relative) to face array descriptors offset array
|-
| 0x8
| 0x4
| Unknown3 count
|-
| 0xC
| 0x4
| Offset (self-relative) to UInt32 Unknown3 array
|-
| 0x10
| 0x8
| ?
|}

Face array descriptor:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Flags (bit 1: vertex index format: 0=byte, 1=short)
|-
| 0x4
| 0x4
| ?
|-
| 0x8
| 0x4
| Vertex index array size (in bytes)
|-
| 0xC
| 0x4
| Offset (self-relative) to vertex index array
|}

Vertex groups come in a number of different formats. Typically the first vertex group entry is of format 0x40000002 and contains the actual vertex array.

Vertex group format 0x40000002:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Flags (0x40000002)
|-
| 0x4
| 0x4
| ?
|-
| 0x8
| 0x4
| ?
|-
| 0xC
| 0x4
| ?
|-
| 0x10
| 0x4
| ?
|-
| 0x14
| 0x4
| Vertex array size (in bytes)
|-
| 0x18
| 0x4
| Offset (self-relative) to vertex array
|-
| 0x1C
| 0x4
| ?
|-
| 0x20
| 0x4
| ?
|-
| 0x24
| 0x4
| Vertex stride/size in bytes (see below)
|-
| 0x28
| 0x4
| Unknown3 count
|-
| 0x2C
| 0x4
| Offset (self-relative) to component declaration offset array
|}

Each mesh's primary vertex group contains an array of vertex component declaration objects, defining the order and parameters for each of a vertex's components.

Vertex component declaration:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Flags (0x40000001)
|-
| 0x4
| 0x4
| Vertex component type (see below)
|-
| 0x8
| 0x4
| ?
|-
| 0xC
| 0x4
| ?
|-
| 0x10
| 0x4
| ?
|-
| 0x14
| 0x4
| ?
|-
| 0x18
| 0x4
| ?
|-
| 0x1C
| 0x4
| ?
|-
| 0x20
| 0x4
| ?
|-
| 0x24
| 0x1
| Component data type (see below)
|-
| 0x25
| 0x1
| ?
|-
| 0x26
| 0x1
| ?
|-
| 0x27
| 0x1
| ?
|-
| 0x28
| 0x4
| Number of values in this component (e.g. XYZ->3, UV->2)
|-
| 0x2C
| 0x4
| Multiplier for this component's values (float)
|-
| 0x30
| 0x4
| Position of this component within vertex stride
|}

Vertex formats with bone data support multiple bone assignment. In this case, the sum of all bone weights is 0x64.

Vertex component types:

{| class="wikitable"
|-
! Value
! Type
|-
| 0x00
| Position
|-
| 0x01
| Normal
|-
| 0x02
| ? (unobserved)
|-
| 0x03
| Color
|-
| 0x04
| UV0
|-
| 0x05
| UV1
|-
| 0x06
| ? (unobserved, possibly UV2)
|-
| 0x07
| Weight
|-
| 0x08
| Index
|}

Vertex component data types:

{| class="wikitable"
|-
! Value
! Type
|-
| 0x00
| sbyte
|-
| 0x01
| byte
|-
| 0x02
| short
|-
| 0x03
| ? (unobserved, possibly ushort)
|-
| 0x04
| ? (unobserved, possibly int)
|-
| 0x05
| ? (unobserved, possibly uint)
|-
| 0x06
| float
|}

Vertex components are stored as one of the above data types, and the vertex component declaration contains a multiplier that adapts the values to the float version which the game will use.
For example, color RGBA values are stored as bytes, and the multiplier converts them from 0-255 to 0-1.0, and position components using short values are normalized via the multiplier to take advantage of the entire short value range.

== TXOB ==

TXOBs are contained within MTOBs. They can describe textures; if such is the case, then their structure is as follows :

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Flags
|-
| 0x4
| 0x4
| Magic "TXOB"
|-
| 0x8
| 0x8
| ?
|-
| 0xC
| 0x4
| Offset (self-relative) to symbol
|-
| 0x18
| 0x4
| Texture height
|-
| 0x1C
| 0x4
| Texture width
|-
| 0x28
| 0x4
| Mipmap levels
|-
| 0x34
| 0x4
| Texture format ID (see table below)
|-
| 0x3C
| 0x4
| Texture height (?)
|-
| 0x40
| 0x4
| Texture width (?)
|-
| 0x44
| 0x4
| Texture data size
|-
| 0x48
| 0x4
| Texture data offset (self-relative)
|}

{| class="wikitable"
|-
! Texture format ID
! Description
|-
|0x0
|RGBA8
|-
|0x1
|RGB8
|-
|0x2
|RGBA5551
|-
|0x3
|RGB565
|-
|0x4
|RGBA4
|-
|0x5
|LA8
|-
|0x6
|HILO8
|-
|0x7
|L8
|-
|0x8
|A8
|-
|0x9
|LA4
|-
|0xA
|L4
|-
|0xB
|A4 ?
|-
|0xC
|ETC1 (see notes below)
|-
|0xD
|ETC1A4 ?
|}

Every texture format has its texture data divided into 8x8 tiles. See [[SMDH#Icon_graphics|SMDH]] for more information.
ETC1 is a compressed texture format which compresses blocks of 4x4 pixels into u64s. These u64 are traditionally stored in big endian; however, nintendo's implementation stores them in little endian. ETC1 textures are stored in 8x8 tiles; decompressed 4x4 therefore have to be organized accordingly. See [https://gist.github.com/smealum/8897237] for implementation example.

== LUTS ==

Appears to contain color lookup tables possibly for use with shaders.

LUTS Header:
{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Magic "LUTS"
|-
| 0x4
| 0x2
| Seems to adhere to powers of 2 (width/height/flags?)
|-
| 0x6
| 0x2
| Seems to adhere to powers of 2 (width/height/flags?)
|-
| 0x8
| 0x4
| ?
|-
| 0xC
| 0x8
| all zeroes ?
|-
| 0x14
| 0x4
| ?
|-
| 0x18
| 0x4
| Offset to DICT (self-relative) ?
|}
All observed instances have an otherwise unreferenced DICT section immediately afterward (the last LUTS value being a 0x4, which may describe the relative position of that DICT), which appears to describe material specularity.

== Skeleton data ==

Skeleton data is stored in an array. Each entry is 0xE0 bytes in length and organized this way :

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x0
| 0x4
| Offset (self relative) to name symbol
|-
| 0x4
| 0x4
| ?
|-
| 0x8
| 0x4
| Joint ID
|-
| 0xC
| 0x4
| Parent joint ID
|-
| 0x10
| 0x4
| Signed offset (self-relative) to parent joint
|-
| 0x2C
| 0xC
| Angle vector (floats, x, y, z)
|-
| 0x38
| 0xC
| Position vector (floats, x, y, z)
|-
| 0x44
| 0x30
| Transformation matrix (4x3)
|-
| 0x74
| 0x30
| Identity matrix ? (4x3)
|}

Each entry stores the joint transformation data twice; once as angle/position vectors and once as a transformation matrix. Each entry also stores a second matrix which appears to always be identity. (?)

== CANM ==

CANMs are used to store skeletal animation data.

== Tools ==
* Every File Explorer
* Ohana3DS and its forks
* SPICA

== Links ==
* Another CGFX Format Description (Archived Page): [https://web.archive.org/web/20150511211029/http://florian.nouwt.com/wiki/index.php/CGFX_(File_Format) http://florian.nouwt.com/wiki/index.php/CGFX_(File_Format)]

[[Category:File formats]]

Homebrew Exploits

2017-06-11T13:25:51Z

M-1:

==Payload==
{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Description
! Supported firmwares
|-
| style="background: DarkOrange" | Only new3ds(XL)
| [https://smealum.github.io/3ds/ *hax payload]
| Booted by all of the below non-sysmodule exploits.
| From '''9.0.0-7''' up to and including '''11.3.0-36''', '''11.4.0-37''' only new3ds(XL).
|}

For the rest of this page, "Supported firmwares" refers to the exploit ''itself'', not whether *hax payload supports it.

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system. ''Please'' see the above Payload section regarding what "Supported firmwares" indicates ''exactly''.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: lightgreen" | Yes
| [[ninjhax|Ninjhax 2.x]]
| From '''9.0.0-7''' up to and including '''11.3.0-36''', '''11.4.0-37''' only new3ds(XL).
| A cartridge or eShop version (JPN-only, not available anymore for purchase) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [http://plutooo.github.io/freakyhax/ freakyhax]
| From '''9.0.0-7''' up to and including '''11.3.0-36''', '''11.4.0-37''' only new3ds(XL).
| A cartridge or eShop version (USA/EUR/JAP, not available anymore for purchase) of "Freakyform Deluxe".
| plutoo
| [http://plutooo.github.io/freakyhax/ Install]
|-
| style="background: salmon" | No
| [http://plutooo.github.io/smilehax/ smilehax]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (JPN all versions up to 3.32 excluded, USA 3.31 only)
| plutoo
| [http://plutooo.github.io/smilehax/ Install]
|-
| style="background: salmon" | No
| [http://mrnbayoh.github.io/basicsploit/ BASICSploit]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (USA all versions)
| MrNbaYoh
| [http://mrnbayoh.github.io/basicsploit/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''11.4.0-37'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo (prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| From '''9.0.0-2''' to '''11.0.0-33'''
Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| A USA, EUR, JPN, or KOR system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|-
| style="background: salmon" | No
| [https://github.com/svanheulen/genhax genhax]
| (New 3DS only) From '''9.9.0-X''' up to and including '''11.2.0-X'''.
| A gamecard or eShop-install of Monster Hunter X (JPN only), and the DLC encryption key (see installer instructions). '''Note: the secondary exploit still works, see bellow'''
| svanheulen
| [https://github.com/svanheulen/genhax_installer Install]
|-
| style="background: salmon" | No
| [https://github.com/nedwill/soundhax soundhax]
| From '''9.0.0-13''' up to and including '''11.3.0-36'''.
| A USA, EUR, JPN or KOR system.
| nedwill
| [http://soundhax.com Install]
|-
| style="background: darkorange" | Yes
| [https://github.com/MrNbaYoh/doodlebomb doodlebomb]
| From '''9.0.0-X'''(?) up to and including '''11.4.0-X'''.
| An eShop-install of Swapdoodle (version 1.1.1 or lower). As of 2017-4-26, version 1.1.2 was released, blocking outdated app version from sending or receiving messages.
| MrNbaYoh
| [https://mrnbayoh.github.io/doodlebomb/ Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own. ''Please'' see the above Payload section regarding what "Supported firmwares" indicates ''exactly''.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: lightgreen" | Yes
| [http://vegaroxas.github.io/ steelhax]
| From '''9.0.0-X''' up to and including '''11.3.0-X''', for '''X''' up to and including 36.
| A copy of Steel Diver: Sub Wars
| Vegaroxas
| [https://github.com/VegaRoXas/vegaroxas.github.io/raw/master/files/steelhax-installer.zip Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''11.3.0-X''', for '''X''' up to and including 36.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Before compression was introduced in the 2016-7-18 release, the size of the *hax payload meant the exploit can't coexist with regular saves on a physical version of the game.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| JPN/USA/EUR: From '''9.0.0-X''' up to and including '''11.2.0-X'''.
KOR: From '''9.6.0-X''' up to and including '''11.2.0-X'''.
| JPN/USA/EUR: Having created [[Home_Menu#Home_Menu_Theme_SD_ExtData|theme extdata]] through opening the official theme selector at least once.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to and including '''11.3.0-X''', '''11.4.0-X''' only new3ds(XL).
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: salmon" | No
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1). v1.1 patches out the overflow vulnerability used by (v*)hax.
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''11.2.0-X''', for '''X''' up to and including 35.
| An eShop-install of Citizens of Earth (either v1 or v2), featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|-
| style="background: salmon" | No
| [http://mrnbayoh.github.io/basehaxx/ basehaxx]
| From '''9.0.0-X''' up to and including '''11.1.0-X''', for '''X''' up to and including 34.
| A gamecard or eShop-install of Pokémon Omega Ruby / Alpha Sapphire.
| MrNbaYoh
| [http://mrnbayoh.github.io/basehaxx/ install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/stickerhax stickerhax]
| From '''9.0.0-X''' up to and including '''11.4.0-X'''.
| A gamecard or eShop-install of Paper Mario: Sticker Star.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/stickerhax Here]
|-
| style="background: lightgreen" | Yes
| [https://github.com/svanheulen/genhax genhax]
| (New 3DS only) From '''9.9.0-X'''(JPN) or '''10.3.0-X'''(EUR/USA) up to and including '''11.3.0-X'''.
| A gamecard or eShop-install of Monster Hunter Generations or Monster Hunter X (without the game updates installed), and an internet connection during installation.
| svanheulen
| [https://github.com/svanheulen/genhax_installer Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/MrNbaYoh/painthax painthax]
| From '''9.0.0-X''' up to and including '''11.3.0-X'''.
| An eShop-install of PixelPaint.
| MrNbaYoh
| [https://github.com/MrNbaYoh/painthax/releases/latest install]
|-
| style="background: salmon" | No
| [https://github.com/yellows8/ctpkpwn ctpkpwn_tfh]
| From '''9.9.0-X''' up to and including '''11.3.0-X'''.
| A gamecard or eShop-install of "The Legend of Zelda: Tri Force Heroes", and an Internet connection during installation. Unless you have "CFW", ctr-httpwn >=v1.2 with the included bosshaxx on a compatible system-version is also required. If installing via ctr-httpwn, you can't do so on >=v11.4. Note that the exploit itself was not fixed.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/ctpkpwn/releases Install]
|-
| style="background: salmon" | No
| [https://github.com/MrNbaYoh/doodlebomb doodlebomb]
| From '''9.0.0-X'''(?) up to and including '''11.4.0-X'''.
| An eShop-install of Swapdoodle.
| MrNbaYoh
| [https://mrnbayoh.github.io/doodlebomb/ Install]
|}

==Exploits without Homebrew Launcher (Not recommended)==

<u>'''Warning:'''</u> The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''5.0.0-2''' to '''11.0.0-33''' (Pre-v5.0 is supported for some versions if you manually modify the source)

(New3DS) From '''9.0.0-20''' to '''11.0.0-33'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|-
| style="background: salmon" | No
| Ninjhax (with specialized payloads)
| Up to '''9.2.0-20'''?
|
| smea + independent developers
| N/A
|}

==Previous Exploits==
<u>'''Warning:'''</u> These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced (see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| style="background: salmon" | No, still usable pre-v11.4.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''11.3.0-X'''. This includes bosshaxx.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].