TWN/CHN 3DS browserhax Guide

This page will install custom firmware on all stock 3DS family consoles with a region of TWN (available in Hong Kong and Taiwan)/ CHN (available in Mainland China). For all other regions (USA/EUR/JPN/KOR), see

This is currently the easiest way to install custom firmware on these consoles due to DSiWare and home menu quirks.

While this page has not been independently tested, the chance of bricking is not any greater than following on normal regions. If browserhax fails to work, your console would simply remain stock.

This guide will bring a console from stock to boot9strap by using old-browserhax to inject an exploited WiFi profile. Once the exploited WiFi profile has been injected, you will use Safe Mode (a recovery feature present on all 3DS consoles) to activate it.


In order to follow this guide, you must have:

  • Any 3DS/iQue 3DS console in the TWN or CHN regions on the latest firmware (11.13.0-37T/ 11.13.0-4C)
  • An SD card formatted as FAT32
    • If your SD card is smaller than 2GB, you will be unable to create a NAND backup, which is a critical backup file used in case of a catastrophic software issue
  • A working 3DS Internet Browser (used for browserhax)
  • Working Safe Mode (used for unSAFE_MODE)
    • Entering Safe Mode requires working left and right shoulder buttons

If you cannot fulfill any one of these prerequisites, STOP, as you will be unable to follow the entirety of this guide.

Safe Mode Test

The instructions provided here will test the console's ability to enter Safe Mode.

  1. With your system powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), then press (Power)
    • Keep holding the buttons until your console boots into Safe Mode
  2. After some time, your console should show a System Update screen
    • This indicates that the console has successfully entered Safe Mode

If you boot into the Home Menu instead of the System Update screen, the console has failed to enter Safe Mode. Try repeating these instructions a few more times, ensuring that you've properly held all of the buttons for the proper amount of time before determining that Safe Mode is inaccessible.

What you need

Section I - Prep Work

  1. Copy boot.firm and boot.3dsx from the Luma3DS .zip ( to the root of your SD card
    • The root of the SD card refers to the initial directory on your SD card where you can see the Nintendo 3DS folder, but are not inside of it
  2. Copy 3ds, arm11slot.bin, and browserhax_slot1_payload.bin from the old-browserhax archive ( to the root of your SD card
  3. Copy usm.bin from the unSAFE_MODE .zip ( to the root of your SD card

Screenshot: root of SD card

Section II - browserhax

  1. Power on your device with your SD card inserted
  2. Open the Internet Browser (visual aid)
  3. Type into the address bar
  4. Click on the "PROCEED TO HAXX" button
  5. Wait for the following to happen, in order:
    • The browser says "Haxx in progress, please wait ..."
    • The console shows a yellow screen
    • The console shows an orange screen
    • The sound stops and the swirling progress/loading icon on the top screen freezes
  6. Wait an additional 10 seconds, then turn the console off

Section III - unSAFE_MODE

  1. With your system still powered off, hold the following buttons: (Left Shoulder) + (Right Shoulder) + (D-Pad Up) + (A), then press (Power)
    • Keep holding the buttons until your console boots into Safe Mode
  2. Press "OK" to accept the update
    • There is no update. This is part of the exploit
  3. Press "I accept" to accept the terms and conditions
  4. The update will eventually fail, with error code 003-1099. This is intended behaviour
    Screenshot: 003-1099

  5. When asked "Would you like to configure Internet settings?", select "Yes"
  6. On the following menu, navigate to Connection 1 -> Change Settings -> Next Page (right arrow) -> Proxy Settings -> Detailed Setup (visual aid)
  7. Once you see B9S install SUCCESS on the top screen, press any button to reboot to Luma Configuration
    • If you are stuck on the B9S install SUCCESS screen, it is safe to forcefully turn off the console by holding the power button for 15 seconds

Section IV - Configuring Luma3DS

  1. Your device should automatically show the Luma Configuration menu
    • If you do not see the Luma Configuration menu, turn off the console and hold SELECT while turning on the console to access it
  2. Use the (A) button and the D-Pad to turn on the following:
    • "Show NAND or user string in System Settings"
    • (x) indicates that the option has been turned on
  3. Press (Start) to save and reboot
    • Your device should load the Home Menu after a short delay

Section V - Restoring WiFi Configuration Profiles

  1. Launch the Download Play application
  2. Wait until you see the two buttons
    • Do not select either of the options
  3. Press (Left Shoulder) + (D-Pad Down) + (Select) at the same time to open the Rosalina menu
  4. Select "Miscellaneous options"
  5. Select "Switch the hb. title to the current app."
  6. Press (B) to continue
  7. Press (B) to return to the Rosalina main menu
  8. Press (B) to exit the Rosalina menu
  9. Press (Home), then close Download Play
  10. Launch the Download Play application
  11. Your device should load the Homebrew Launcher
  12. Launch slotTool from the list of homebrew
  13. Select "RESTORE original wifi slots 1,2,3"
  14. Your device will reboot

Screenshot: slotTool removal

Continue to Finalizing Setup