Cubic Ninja

Despite its poor reception, the game would eventually gain infamy due to an exploit allowing users to execute homebrew code on their console.

• Title — Cubic Ninja • Developer — AQ Interactive • Platforms — Nintendo 3DS • Released — Nintendo 3DS Nintendo eShop:March 28, 2013 • Genre — Puzzle • Modes — Single-player, multiplayer

Cubic Ninja is a puzzle-based platforming game, in which the player manipulates CC, a ninja cube, through various levels, whilst avoiding enemies and traps contained within. The game is controlled primarily using the 3DS' gyroscope, requiring the player to tilt the console in the direction they want CC to move. The game can also be set to use the circle pad instead. Using power-ups collected from scrolls, CC can shrink, gain a shield, throw shuriken at enemies, and unlock all of the doors in a level. The game contains 100 levels, including several boss battles. Players can unlock different characters, such as cubes made of rubber and titanium, that exhibit different properties when used. Cubic Ninja also features survival and time trial modes, along with a level editor; levels can be shared with others via QR codes.

On November 17, 2014, the game became the subject of notoriety when Jordan "Smealum" Rabet publicized that a user mode exploit in the game would allow all existing 3DS models (including the 2DS and the New Nintendo 3DS) to execute homebrew code. The exploit, known as Ninjhax, requires users to place a boot file on the device's SD card, and then use the level sharing feature of Cubic Ninja to scan a malformed QR code. The code in question is a buffer overflow which triggers the download and execution of a launcher program, which can then be used to run applications. The data from the exploit is stored within the game's save data. While Ninjhax was originally to be released on August 30, 2014, Rabet held off its release due to the unveiling of the New Nintendo 3DS, believing that any release before then would give Nintendo time to address the exploit on the new revision. The exploit was ultimately released on November 21, 2014, to coincide with the release of the New 3DS in Australia and New Zealand. Owing to his stance, Rabet noted that the exploit does not enable the use of unlicensed games, but did note that it could possibly be used to bypass the console's region lock. The discovery—which is the first ever public software-based homebrew exploit for the 3DS family—triggered a surge in demand for the game, whose poor reception had led to its classification as a "bargain bin" title by critics. Copies of Cubic Ninja quickly sold out at a number of major video game retailers, while copies of the game from online retailers began increasing in price, ranging from US$25, to its original MSRP of $40 to as high as $500. Shortly after the announcement, Nintendo pulled Cubic Ninja from eShop, presumably in an effort to prevent widespread use of the exploit—the game was only available digitally in Japan, however. Rabet also pointed out that, ironically, despite the increased attention the game received, the studio who developed Cubic Ninja became defunct only months after its release through a merger that formed Marvelous AQL. On July 17, 2015, Ninjhax 2.0 was made available, which is compatible with 3DS firmware versions more recent than 9.2. This new revision became the second homebrew exploit that did not require the use of the 3DS system's web browser, the first being the savegame exploit found in The Legend of Zelda: Ocarina of Time 3D nicknamed "OoT3Dhax". This new version of Ninjhax allows users with system versions 9.0 to 11.5. However, *hax 2.0 and all of its derivatives cannot run on all the firmware versions that Ninjhax 1.0 and its derivatives could, due to how it gains different privileges than Ninjhax 1.0. On May 9, 2016, Nintendo released system update 11.0 that patched lots of homebrew exploits including a patch for Ninjhax that revoked access of Cubic Ninja to web services. On September 18, 2016, Ninjhax was updated to no longer require web services, requiring multiple QR codes to be scanned instead.