The 3DS Piracy Tool With a Trap Inside It

In January 2014, 3DS owners started switching on their consoles and finding a blue error screen instead of a menu. No games, no music, just a few numbers that meant nothing. Removing the cartridge did not help, because whatever had happened was no longer in the cartridge. It was in the console. The obvious suspect was Nintendo. It wasn't Nintendo. The bricking code came from Gateway, the company selling the flashcart these people had bought to get around Nintendo's copy protection in the first place. Clone cartridges had started shipping Gateway's launcher, and Gateway's answer was not an error message. It was a routine that reached down to the 3DS NAND controller and left the console unable to reach its own system storage. Not a locked file. A locked filing cabinet. This is Brickgate: a fight between two groups selling access to somebody else's hardware, in which the owner of that hardware was the only person nobody was protecting. CHAPTERS 0:00 A blue screen where your games should be 0:51 The suspect everyone got wrong 1:30 2013, and what Gateway was actually selling 2:26 launcher.dat and privileged access 3:56 emuNAND, and why updates felt safe 4:50 The clones arrive 6:05 The response Gateway could have chosen 6:31 When copying becomes the delivery system 7:03 January 2014: bricks appear on GBAtemp 7:53 "What is this code doing here?" 8:33 The delay that let it spread 9:40 Why the damage is so hard to undo 11:19 Gateway's statement 12:21 The defence, and where it fails 13:13 Who counts as a target 14:21 Back to the repair bench 15:43 What replaced the red cartridge 17:17 Unlocked is not the same as owned