Azahar's new update fixes a nasty 3DS emulator security flaw

The open-source development team behind the Azahar 3DS emulator released version 2126.2 on October 8, delivering a major security patch and several performance fixes.

AYN Thor owners: This is what we've been training for!! The AYN Thor is my favourite console right now. I'm excited to try this out to see if it fixes any issues I've experienced in Azahar.

For those catching up, Azahar is a continuation of the Citra 3DS emulator codebase. When Nintendo filed a federal lawsuit against Tropic Haze in early 2024, the resulting $2.4 million settlement forced the immediate takedown of both the Yuzu Switch emulator and Citra. The 3DS emulation community scattered, but open-source developers eventually consolidated their efforts into Azahar. The project is maintained by prominent homebrew contributors, including PabloMK7 (creator of the Mario Kart 7 mod CTGP-7) and OpenSauce04. They have spent the last two years refining high-level emulation accuracy and performance for PC, Linux, macOS, and Android.

Nintendo officially shut down the 3DS eShop in March 2023 and terminated online multiplayer servers in April 2024. With the official digital storefront gone, projects like Azahar are the only way to preserve and play the handheld's massive library of digital-exclusive titles.

Closing a remote code execution loophole

The headline change in version 2126.2 is a security patch. The update addresses an oversight tracked as GHSA-h74v-5mw8-qg8r, where specially crafted CIA (CTR Importable Archive) files could execute arbitrary code in the host environment when installed by a user. If you regularly download homebrew or modified packages from untested sources, this patch closes a dangerous vulnerability that could compromise your PC or handheld.

Visual bugs also get some attention. The xBRZ texture filter previously rendered incorrectly when using the Vulkan backend. The development team resolved the issue, restoring the intended appearance for upscaled textures.

Handling of large HTTP downloads inside emulated 3DS applications is now more memory efficient. This directly improves stability when downloading large games straight from the eShop servers. The update also adds a new 3GX loader flag called allow_homebrew_load, which lets users load 3GX plugins for homebrew applications if the plugin supports the feature.

Android fixes and technical changes

On the Android side, the developers fixed a crash that triggered if the gpu_drivers directory contained a subdirectory. This is particularly relevant for handhelds like the AYN Thor, where users frequently swap custom GPU drivers to squeeze better performance out of demanding 3DS games.

Desktop users get various improvements to GDB and RPC servers. Script developers need to update their RPC clients to match the new breaking changes.

Under the hood, creating a copy of the kernel shared and config pages using svcMapProcessMemoryEx is now possible. The release notes describe this as a technical accuracy change with little to no end-user impact, but it brings the emulator one step closer to matching original 3DS hardware behavior.