10.0.0-27

The Old3DS+New3DS 10.0.0-27 system update was released on September 8, 2015. This Old3DS update was released for the following regions: USA, EUR, JPN, CHN, KOR, and TWN. This New3DS update was released for the following regions: USA, EUR, JPN, CHN, and KOR.

Security flaws fixed: yes, see the ARM11-kernel section here.

Change-log

Official USA change-log:

• Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience

System Titles

<fill this in (manually) later>

NATIVE_FIRM

Minus configmem init, exactly 4 functions were updated in the ARM11-kernel(at least one was for fixing a security issue). See here for details on that.

Only the following FIRM ARM11 modules were updated with the codebin:

• FS module was updated.
• Loader module was updated, the only change was that the version value passed to FS:InitializeWithSdkVersion was changed from 0x0b0201c8 to 0x0b0400c8.

Process9

One of the changes was that main() was updated. Three functions(two initialization functions + launch_firm()) which were previously called directly are now called via a wrapper function with a funcptr parameter. As a result, the main() prologue/epilog changed. This is for temporarily relocating the stack elsewhere(same relocated-stack-addr for all func-calls), just for calling the funcptr(all registers except for r0..r3 are saved/restored before/after calling the funcptr).

Some FS-related code seems to have been changed.

There's also some new UTF-16 strings in the .(ro)data, but there's no(?) known code which actually uses these.

New3DS-only

No actual code/data was changed in the arm9loader.

During loading, kernel9 copies the entire Process9 NCCH to a relocated base-addr, which is: endaddr - ncchsize. On Old3DS, endaddr is 0x080fffe0. On New3DS, endaddr was 0x080fffe0 prior to v10.0-FIRM, now it's 0x0817ffe0.

The Process9 .bss(which contains the proc9 heaps too) is larger now: previously the .bss ended at address 0x080ff080, now it ends at 0x08117040.

Therefore, *all* of the extended New3DS-only arm9mem gets overwritten during FIRM boot with v10.0.

There were no New3DS-only Process9 code changes.

See Also

System update report(s):

• [1]
• [2]