dsi/exploits/dist/dsiwarehaxinj

DSiWareHaxInj v1.1

The injectrawsav app and the dsisavpatch python app, allows you to inject exploit(s) retrieved automatically from a server into DSiWare exported from the data management menu to SD card.
You can only copy these DSiWare exploits to ``internal memory'' after injecting the exploit into DSiWare on SD card, if you already have the target DSiWare and if your DSi system version is still 1.4.1.(System update 1.4.2 blocks copying exploits to ``internal memory'')
DSiWare exploits can't be used on 3DS at all.

Usage of the exploit is described below:

   1. Export the target DSiWare to SD card via the data management menu. See the below instructions for the list of target DSiWare.
   2. The exploit will then be injected into the DSiWare application via client software. See the below client software usage instructions. The client software uploads DSi-specific data from the DSiWare application to a web server, then injects the retrieved data into the DSiWare application.
   3. Copy the output binary to SD card with the same filename as the original.
   4. Copy the exploit from SD card to ``internal memory'' via the data management menu.
   5. See the below link for this step.
   6. Now boot.nds on SD card will be run.

The data uploaded by the client software includes the anonymous DSi-unique console ID, and other data required for modifying the DSiWare binary on SD card. This data is used for logging unique web server requests.
The tracker for the client software and DSiWare exploits is available here: http://bugs.hackmii.com/
Client software source code licensed under GNU GPLv2 is available here: https://github.com/yellows8/dsi

Usage of the client software from step 2 of the above instructions:
Choose an exploit available for your region and system from here: http://bootmii.org/dsiexploits/downloads/exploitslist
Copy /private/ds/title/<titleid.bin> from SD card to hard-drive where the client software is located. Then run the client software with the chosen DSiWare titleid .bin input.

Builds of injectrawsav are stored in the builds directory.
For Linux/Mac run this terminal command: ./injectrawsav <titleid.bin>
For Windows, you can either drag and drop the input <titleid.bin> onto injectrawsav.exe, or run this from command-line:  injectrawsav.exe <titleid.bin>
For dsisavpatch.py, run it with this from terminal/command-line: python dsisavpatch.py <titleid.bin>

The output of the client software is <titleidhax.bin>. Copy this output file to /private/ds/title/ on SD card. Rename /private/ds/title/<titleid.bin> on SD card to <titleidbak.bin>, then rename <titleidhax.bin> to <titleid.bin>. Continue with the above instructions at step 3.

Removing DSiWare Exploits:
Rename /private/ds/title/<titleid.bin> to <titleidhax.bin>, then rename /private/ds/title/<titleidbak.bin> <titleid.bin>.
Then copy the DSiWare application from SD card to ``internal memory'' via the data management menu.

Credits:
libcurl for the http library used by injectrawsav.
Steve Reid's SHA1 implementation.
John Hall's 8x8 font, used by the SD card loader: http://overcode.yak.net/12