Readme and additions to deprecated

README.md

@@ -4,6 +4,7 @@
 - Luigoalma for some asm help in ID1gen!
 - Aspargas2 (the Black Cat) for asm help in ID1gen as well!
 - TuxSH for [usr2arm9ldr](https://github.com/TuxSH/usr2arm9ldr) and some good advice!
+- ToxicAven for substantial mset9.py improvements!
 
 [MSET9 in action](https://zoogie.github.io/web/m9/(%20%CD%A1%C2%B0%20%CD%9C%CA%96%20%CD%A1%C2%B0).webm)
 
@@ -16,7 +17,7 @@ In the implementation for FSPXI:EnumerateExtSaveData (called by MSET to parse 3D
 As such, a file that starts with 8 hex digits can crash process9 if placed directly inside the extdata directory. It can crash in various ways based on subtle differences in the way the user triggers the crash event.<br>
 
 While mostly leading to null derefs, in one specific context, process9 jumps directly to an ID1 string being held in ARM9 memory. Surprisingly, the 3DS doesn't discern what characters are used for the ID1 directory name on the SD, only requiring exactly 32 chars. This allows the attacker to insert arm instructions into the unicode ID1 dirname and take control of the ARM9, and thus, full control of the 3DS.<br>
-[3Dbrew](https://www.3dbrew.org/wiki/3DS_System_Flaws#Process9)
+Source: [3Dbrew](https://www.3dbrew.org/wiki/3DS_System_Flaws#Process9)
 
 ## Can I do it?
 -- You need a 3ds 11.4-11.17, any region (probably, haven't tested them all)<br>
@@ -27,41 +28,29 @@ While mostly leading to null derefs, in one specific context, process9 jumps dir
 In release archive or, preferably, [3DS Hacks Guide- MSET9](https://3ds.hacks.guide/installing-boot9strap-(mset9).html).<br>
 
 ## Troubleshooting
-- [mset9.py shows error ".../title.db doesn't exist on sd card"?] Inside sdmc:/Nintendo 3DS/ID0/ID1/dbs, create empty files title.db and import.db. You need to create the dbs folder first. Now go to System Settings -> Data Management -> Nintendo 3DS -> Software and say yes to the prompts to build your database files. Now redo everything from the start.
-- [Swirling System Settings loop] This is just a general crash of arm9. Did you follow the instructions EXACTLY?
-- [Nothing happens when I reinstert card - just shows mii maker icon] Did you try option 2 on mset9.py on step 6? Go back to step
-- [Still can't get it to work] In some stubborn cases, it might be better to just start fresh with a spare blank SD card. For that, follow these steps:
-1. Format the spare SD card with SD formatter.<br>
-2. Put SD card into 3DS and turn on, wait for menu data to format automatically.<br>
-3. Go to Mii Maker and launch it, wait for extdata format, then exit. Turn off 3DS.<br>
-4. Take out SD card, put in computer and create the following two empty files (and dbs folder if needed):<br>
-sdmc:/Nintendo 3DS/aaaabbbbccccdddd1111222233334444/aaaabbbbccccdddd1111222233334444/dbs/title.db<br>
-sdmc:/Nintendo 3DS/aaaabbbbccccdddd1111222233334444/aaaabbbbccccdddd1111222233334444/dbs/import.db<br>
-(the long hex number folder names above are just examples, yours will be different)<br>
-5. Put SD card back in the 3DS and go to System Settings -> Data Management -> Nintendo 3DS -> Software and agree to the prompts to rebuild the database.<br>
-6. Proceed to step 1 on instructions.txt.<br>
+https://3ds.hacks.guide/troubleshooting.html#installing-boot9strap-mset9
 
 ## FAQ
 
-Q: This installs boot9strap and writes to NAND?<br>
-  A: Yes! What else ya gonna do with ARM9 control, a9lh? pastaCFW? sketchy tetris clones" :p<br><br>
-Q: That sounds dangerous, Zoogie!<br>
-  A: Yeah, it kinda is but the scene's been doing this dangerous stuff for years. Just sit out the beta phase if concerned.<br><br>
-Q: What happens if I fail to uninstall the exploit when I'm done?<br>
-  A: You'll have trouble launching previously installed titles, in addition to random crashes in FBI and System Settings. So make sure to clean up the exploit! (option 4 in the mset9.py menu does this)<br><br>
+- Q: This installs boot9strap and writes to NAND?<br>
+  A: Yes! What else ya gonna do with ARM9 control, a9lh? pastaCFW? sketchy tetris clones" :p
+- Q: That sounds dangerous, Zoogie!<br>
+  A: Yeah, it kinda is but the scene's been doing this dangerous stuff for years. Just sit out the beta phase if concerned.
+- Q: What happens if I fail to uninstall the exploit when I'm done?<br>
+  A: You'll have trouble launching previously installed titles, in addition to random crashes in FBI and System Settings. So make sure to clean up the exploit! (option 4 in the mset9.py menu does this)
 
-(the rest of this is more FYI than anything important)<br><br>
+(the rest of this is more FYI than anything important)
 
-Q: That file that triggers the exploit (002F003A.txt) ... it kinda looks like ... some virtual address, huh?<br>
-  A: It's the characters ":/", something we can't display in a typical file/folder name. A convenient fact of that file (besides triggering the overall crash) is that the first 8 chars of that hex filename are converted to a u32 that happens to exist 0x44 past SP, so I can use it to plug in the missing chars in the payload filepath "sdmc??b9", and keep the PC's OS happy.<br><br>
-Q: You suggested in the hack explanation above that FS_EnumerateExtData is the responsible function for allowing the crash in MSET/ARM9, could this be called in userland homebrew to take over ARM9?<br>
+- Q: That file that triggers the exploit (002F003A.txt) ... it kinda looks like ... some virtual address, huh?<br>
+  A: It's the characters ":/", something we can't display in a typical file/folder name. A convenient fact of that file (besides triggering the overall crash) is that the first 8 chars of that hex filename are converted to a u32 that happens to exist 0x44 past SP, so I can use it to plug in the missing chars in the payload filepath "sdmc??b9", and keep the PC's OS happy.
+- Q: You suggested in the hack explanation above that FS_EnumerateExtData is the responsible function for allowing the crash in MSET/ARM9, could this be called in userland homebrew to take over ARM9?<br>
   A: Maybe? I briefly played around with this very idea, but was unable to find a crash context that I could control, unlike the pre-userland method MSET9 is. Maybe this could be an exercise for the dedicated user to explore and flesh out this potential variant of MSET9! It could be useful down the line.<br>
-  Fun fact: The 8 digit hex file, if left in extdata, will also crash FBI when selecting the "Ext Save Data" option in its main menu. It's the only homebrew I know that calls FS_EnumerateExtData.<br><br>
-Q: You shortened SafeB9SInstaller.bin to SafeB9S.bin, why?<br>
-  A: Keeps FAT's 8.3 filename standard which avoids Long File Names, and thus enables significant space savings in the FatFs library. "B9" is also used for the same reason albeit not FatFs related. Small code footprint is of paramount importance everywhere in this exploit.<br><br>
-Q: Why doesn't this work on MAC?<br>
-  A: Because it refuses to render the following unicode craziness: 﫿餑䠇䚅敩ꄈ∁䬅䞘䙨䙙꫿ᰗ䙃䰃䞠䞸退ࠊꁱࠅ캙ࠄsdmc退ࠊb9<br>
-  ( ͡° ͜ʖ ͡°)<br>
+  Fun fact: The 8 digit hex file, if left in extdata, will also crash FBI when selecting the "Ext Save Data" option in its main menu. It's the only homebrew I know that calls FS_EnumerateExtData.
+- Q: You shortened SafeB9SInstaller.bin to SafeB9S.bin, why?<br>
+  A: Keeps FAT's 8.3 filename standard which avoids Long File Names, and thus enables significant space savings in the FatFs library. "B9" is also used for the same reason albeit not FatFs related. Small code footprint is of paramount importance everywhere in this exploit.
+- Q: Why doesn't this work on MAC?<br>
+  A: Because it refuses to render the following unicode craziness:<br> 﫿餑䠇䚅敩ꄈ∁䬅䞘䙨䙙꫿ᰗ䙃䰃䞠䞸退ࠊꁱࠅ캙ࠄsdmc退ࠊb9<br>
+  ( ͡° ͜ʖ ͡°)
 
 ## Additional Thanks
 These are repos containing homebrew binaries included in the release archive. Many thanks to the authors.<br>

_deprecated/index.html

@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html lang="en">
+<meta charset="UTF-8">
+<title>MSET9</title>
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<link rel="stylesheet" href="">
+<style>
+</style>
+<script src="lenny.js"></script> 
+<body>
+
+<div class="">
+ <h1>This is a Heading</h1>
+ <p>This is a paragraph.</p>
+ <p>This is Lenny.</p>
+ <p>This is Lenny.</p>
+ <p>This is Lenny.</p>
+ <p>This is Lenny.</p>
+ <p>This is Lenny.</p>
+ <p>This is a paragraph.</p>
+ <h1>This is a Heading</h1>
+</div>
+
+</body>
+</html> 

_deprecated/what.txt

@@ -1,5 +1,6 @@
 What are these unloved things here?
 
 mini_b9s_installer - old, handcrafted b9s installer brought out of retirement from unSAFE_MODE to MSET9. Then promptly put back in retirement if favor of usr2arm9ldr (b9) because it's goofy and hacky :p
-build.py - this creates a phtcache.bin suitable for piggybacking payloads into FCRAM. Loading direct from ID1 became possible so I retired this too. Still very effective despite that.
+index.html & lenny.js - loads further payloads into FCRAM for id1 to jump to. this was the first idea on how to present a payload reachable by mset9 since initially couldn't fit an fs loader in id1. pretty reliable but kind of unsettling, and not to mention: online required. yuck!
+build.py - this creates a phtcache.bin suitable for piggybacking payloads into FCRAM. Loading files direct from ID1 became possible so I retired this too. Still very effective despite that.
 mset9.py - due to the feature-laden rewrite offered by Aven, I put my somewhat messy and beta-ish version in semi-retirement here. this script manages the install and removal of mset9 to the 3ds sd card.