Installing B9S via USM+HBL

edgecase-hblusm.md

Installing boot9strap (HBL+USM)

Pre-requisites: Working shoulder buttons; USA/EUR/JPN region; eShop access; movable.sed

What You Need

• The game "Pokemon Picross" (free on Nintendo eShop)
• movable.sed
• The latest release archive for Luma3DS
• The v1.2 release archive for unSAFE_MODE

Section I - Prep Work

1. Insert your SD card into your computer
   • If you do not see the .bin extension, do not add it to the end of the filename
2. Create a folder named 3ds on the root of your SD card if it does not already exist
   • This folder is not the same as the Nintendo 3DS folder that you probably already have
3. Copy boot.firm and boot.3dsx from the Luma3DS .zip to the root of your SD card
4. Copy usm.bin from the unSAFE_MODE .zip to the root of your SD card
5. Copy the otherapp payload for your region/version from the unSAFE_MODE .zip's otherapps_with_CfgS folder and rename it to otherapp.bin
6. Copy the slotTool folder from the unSAFE_MODE .zip to the 3ds folder on your SD card
7. Put your SD card back into your console

Section II - PicHaxx

1. Open the PicHaxx Injector website on your computer
2. Select your movable.sed file
3. Select "Build and Download"
4. Wait for the process to complete
5. Navigate to Nintendo 3DS -> <ID0> -> <ID1> -> title -> 00040000 -> 0017c100 -> data on your SD card
   • The <ID0> will be the same one that you specified when bruteforcing your movable.sed
   • The <ID1> is a 32 character long folder inside of the <ID0>
6. Copy the newly downloaded 00000001.sav file to the data folder on your SD card
   • Overwrite the old save file when prompted
7. Reinsert your SD card into your device
8. Power on your device
9. Launch "Pokemon Picross"
10. If the exploit was successful, your device will have loaded the Homebrew Launcher

Section III - slotTool

1. Launch slotTool from the list of homebrew
   • If you get stuck on a red screen, delete slotTool.xml from the /3ds/slotTool/ directory, then retry this section
2. Select the "INSTALL exploit to wifi slots 1,2,3 & shutdown" option
   • You will see some on-screen text and then your system will shut down

Section IV - unSAFE_MODE

1. With your system still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), then press (Power)
   • Keep holding the buttons until the console boots into Safe Mode
2. Press "OK" to accept the update
   • There is no update. This is part of the exploit
3. Press "I accept" to accept the terms and conditions
4. The update will eventually fail, with error code 003-1099. This is intended behaviour
5. When asked "Would you like to configure Internet settings?", select "Yes"
6. On the following menu, navigate to Connection 1 -> Change Settings -> Next Page (right arrow) -> Proxy Settings -> Detailed Setup
   • Here is a visual representation
7. Once you see B9S install SUCCESS on the top screen, press any button to reboot to Luma Configuration

Section V - Configuring Luma3DS

1. Your device should automatically show the Luma Configuration menu
2. Use the (A) button and the D-Pad to turn on the following:
   • "Show NAND or user string in System Settings"
3. Press (Start) to save and reboot
   • Your device should load the Home Menu after a short delay

Section VI - Restoring WiFi Configuration Profiles

1. Launch the Download Play application
2. Wait until you see the two buttons
   • Do not press either of the buttons
3. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
4. Select "Miscellaneous options"
5. Select "Switch the hb. title to the current app."
6. Press (B) to continue
7. Press (B) to return to the Rosalina main menu
8. Press (B) to exit the Rosalina menu
9. Press (Home), then close Download Play
10. Relaunch the Download Play application
11. Your device should load the Homebrew Launcher
12. Launch slotTool from the list of homebrew
13. Select "RESTORE original wifi slots 1,2,3"
14. Your device will then reboot

---

Continue to Finalizing Setup

---