[Tutorial] "Manual System Transfer" for Saves/Content

DISCLAIMER: I AM NOT LIABLE FOR ANY LOSS OF DATA OR DAMAGE TO YOUR SYSTEM! You proceed with this tutorial at your own peril!
PLEASE MAKE BACKUPS FOR EACH STEP AS YOU GO! This will make it easier to recover if some step fails/a mistake is made.
Unless you have a hard-mod for your console, it is HIGHLY recommended to attempt this tutorial on EmuNAND on the target system to avoid bricks.
YOU HAVE BEEN WARNED!!!

This tutorial will instruct you how to do a "Manual System Transfer" from one 3DSsystem to another 3DS system.
It is reversible back to the original system, but will invalidate content on the target system as a normal system transfer would.
Due to this fact, PLEASE BACKUP ANY SAVES YOU CARE ABOUT on the target system with SaveDataFiler/etc. before you proceed.
This method will ONLY transfer saves and give you the ability to install content on the target system.
This method will NOT move your NNID over to the target system/re-link it. This is a server-side thing and must be done by Nintendo.
This method should be especially useful for people with region-changed systems that want to move over saves for Mii Plaza/etc.
This tutorial is a HIGH LEVEL process. Many steps will not be completely spelled out, so if you don't understand a specific term/procedure, please consult the forums.

THANKS TO EVERYONE WHO HELPED MAKE THIS TUTORIAL POSSIBLE!!!


Requirements:
Both the source and target systems must be on exploitable firmwares (for the purpose of this guide, this basically means <= 9.2 SysNAND FW)!
The method used to run unsigned code on the source system (for example Gateway, or a 4.5 CFW) must also be able to be run on the target system for full transfer.
Example: If you utilize a 4.5 exclusive CFW on your source system, you wouldn't be able to transfer with that onto a New 3DS as New 3DS systems cannot run 4.5 FW.

Note: I personally used this method between the 9.7 EmuNAND of an original 3DS system to a region-changed 9.5 EmuNAND New 3DS system.
I also utilized a Gateway card for running my transferred content on the target, New 3DS system. Other methods are possible, but again, they must be compatible between systems.
For optimal results, you will want to utilize firmwares on both systems in the same major version (for example, 9.x and 9.x on both systems).


Limitations:
This method will NOT transfer over your NNID from the source system to the target system as a legit system transfer would.
This method was mainly born from the issues stemming from region-changing a 3DS system and then wanting to transfer content to that system.
Personally, having done this method between my US O3DS and my originally JPN N3DS, my NNID was left on my O3DS and all my saves were copied to the N3DS.
From there I continue to make future purchases on the O3DS under my NNID and then manually install said purchases on the N3DS with Gateway.
Please note this part of the procedure is specific to my issues with not being able to system transfer from a US O3DS to a region-changed N3DS completely, but hopefully this tutorial will still be useful for you!


Let's get this show on the road!

A. Source System
1. Dump/extract your source NAND

• On the source system, you will first need to dump the NAND you will be pulling your save data from (either SysNAND or EmuNAND).
• This can be done either through something like the Gateway menu with a SysNAND backup or EmuNANDTool to extract your EmuNAND from your SD card.

2. Extract the Fat16 CTR partition from your source NAND backup

• This can be done with a script such as Cearp's "3DSFAT16tool.py" python script.

3. Generate NAND XORPads for your source NAND

• This can be done with a tool such as Decrypt9 (which runs through Ninjhax and is currently the only method to generate XORPads for the New 3DS).

4. Decrypt your NAND backup with the XORPads from the previous step

• This can be done by simply xor-ing your extracted Fat16 CTR partition with your NAND XORPads (using something like the "XOR Tool" in 3DSExplorer).

5. Mount your decrypted NAND backup for editing

• This can be done with a tool such as WinImage in Windows or directly as an ISO in Mac OSX.

6. Extract necessary files/saves from source NAND

• The files you want to extract and are safe from your source NAND are as follows:
  • NAND://private/movable.sed - THIS IS THE MAIN FILE FOR THIS PROCESS! It is the file which identifies/is used to decrypt the saves from your source NAND/SD card.
  • NAND://dbs/ticket.db - This file will be used later to recover our purchased content for the target system.
  • NAND://data/<ID0>/extdata - You may extract and save all the subfolders in this folder (<ID0> will be a randomly generated number, matching the number of your save folder in the "Nintendo 3DS" folder on your SD card).
  • NAND://data/<ID0>/sysdata - Extract and save ONLY the following folders! (For reference, these titles are for US systems and may vary by region - consult: http://3dbrew.org/wiki/System_SaveData for your region):
    • 000200bd - Miiverse
    • 0001000f - Unknown
    • 0002021b - Nintendo Zone
    • 0002021d - Face Raiders
    • 0002021e - AR Games
    • 00010011 - FS module (for Anti Savegame Restore games like Animal Crossing/PKMN/Smash)
    • 00010022 - Pedometer
    • 00010026 - Streetpass (active games)
    • 00010032 - Friends
    • 00010034 - Spotpass
    • 00010035 - News
    • 00020093 - Game Notes
    • 00020094 - Internet Browser
    • 00020096 - Friend List
    • 00020212 - Activity Log
    • 00020214 - Nintendo 3DS Camera
    • 00020215 - Nintendo 3DS Sound
    • 00020217 - Mii Maker
    • 00020218 - Mii Plaza

Note: These are the only saves I have tested to work and transfer safely. If you try to transfer saves for more system apps (such as NNID/config) I cannot guarantee success/positive results.
Further Note: I CAN confirm that if you transfer the app of something like Config from original 3DS to New 3DS, you will likely have weird results for screen display/etc. [DON'T TRY THIS!!!]

B. File Modification
1. Open your "movable.sed" file from the source system in you favored hex editor (such as "HxD").
2. Once open, you will want to remove the last 0x20 bytes from the file (actually shrinking the size of the file from 0x140 to 0x120).
3. At the beginning of the file, clear the 4 BYTES after the 'SEED' value (each byte should consist of two hex-based numbers, such as '00' or 'AF'; when clear, the value for that byte should show '00'/'.').

• For example, the beginning of your file after modification should show '53 45 45 44 00 00 00 00' or "SEED...."

4. Save changes to your "movable.sed" file and close it (Recommend saving in a new copy of the file in case any mistakes are made!).
Note: Thanks to motezazer for the instructions on this step! (This was the most important step of this process!)

Note: REMEMBER! THIS METHOD WILL INVALIDATE EXISTING CONTENT/SAVES ON THE TARGET SYSTEM! Please backup any important saves before proceeding!
C. Target System
1. Dump/extract your target NAND

• On the target system, you will need to dump the NAND you will be injecting your save data to (either SysNAND or EmuNAND).

• This can be done either through something like the Gateway menu with a SysNAND backup or EmuNANDTool to extract your EmuNAND from your SD card.

2. Extract the Fat16 CTR partition from your target NAND backup

• This can be done with a script such as Cearp's "3DSFAT16tool.py" python script.

3. Generate NAND XORPads for your target NAND

• This can be done with a tool such as Decrypt9 (which runs through Ninjhax and is currently the only public method to generate XORPads for the New 3DS).

4. Decrypt your NAND backup with the XORPads from the previous step

• This can be done by simply xor-ing your extracted Fat16 CTR partition with your NAND XORPads (using something like the "XOR Tool" in 3DSExplorer).

5. Mount your decrypted NAND backup for editing

• This can be done with a tool such as WinImage in Windows or directly as an ISO in Mac OSX.

6. Inject your MODIFIED "movable.sed" file to your target NAND

• Simply copy your modified file and overwrite the existing "movable.sed" file.

7. Delete the contents of the of the NAND://data folder

• This step is necessary to reinitilize the system with the new "movable.sed" file. Do NOT delete the "data" folder itself!

8. Re-encrypt your target NAND with XORPads

• This can be done by simply xor-ing your extracted Fat16 CTR partition again.

9. Inject your modified Fat16 CTR partition into your target NAND

• Use the injection function of a script such as "3DSFAT16tool.py", for example.

10. Flash/inject your modified target NAND to the target system

• Using either a hardware restore method (Gateway menu/hard-mod) or software (EmuNANDTool for EmuNAND).

11. Boot into the target NAND

• Let the system boot up to the start of the system setup procedure. Once you get to the system setup start screen, you may power off the system without going through the setup.

12. Extract your target NAND again
13. Extract your Fat16 CTR partition again
14. Decrypt your partition with XORPads again
15. Mount your decrypted partition for editing again
16. This time, inject your "extdata" and "sysdata" saves from the source system into the newly created folder under NAND://data/<ID0>

• Overwrite any existing saves with your source system data.

17. Re-encrypt your target NAND with XORPads again
18. Inject your modified Fat16 CTR partition into your target NAND again
19. Flash/inject your modified target NAND to the target system again
Note: DO NOT POWER ON YOUR SYSTEM YET!

D. SD Card Content
*. Now that we have prepared and transferred the NAND content from the source system to the target system, we much now transfer our SD card content to get ALL our saves for system titles
1. From the source system, start by copying the following folders and their contents from the source SD card the target SD card:

• SDMC://Nintendo 3DS/<ID0>/<ID1>/backups
• SDMC://Nintendo 3DS/<ID0>/<ID1>/extdata

Note: <ID1> won't match between source/target SD card folders, but <ID0> should match. This is normal.
2. Next, we will need to obtain any system application updates/DLC you had on your source system on the target system

• This can be done utilizing your "ticket.db" from the source system and a script like "FunkyCIA2.py" (again by Cearp ) to obtain the CIAs
• For reference, the title IDs of the Mii Plaza update and DLC are:
  • 0004000e00021800 - Mii Plaza Update
  • 0004008c00021800 - Mii Plaza DLC

3. You may now insert your target SD card and boot up the target system

• Once you have reached the home menu, install the CIAs obtained from the previous step using your favorite CIA management tool (I recommend FBI, by Steveice10 ).

4. You may now run system apps and your save data should be intact and available!

• If you had updated the Mii Plaza/purchased DLC and then tried run your transferred save without installing them in the target system, you would get an error saying your save is not on the correct version.
• Note: The main limitation of this transfer method is we cannot yet locally transfer the tickets for purchased content from from one system's "ticket.db" file to another.
• In a legit system transfer, the tickets are sent to Nintendo from the source console and then returned to the target console, rewritten with the console ID of the target system.
• For this reason, we must utilize CIAs/unsigned installations for our purchased on content on the target system.

E. Remaining SD Card Content
*. Once you have achieved access to your system applications saves on the target system, you can proceed with installing and transferring the saves of your other purchased content
1. Obtain CIAs for your remaining purchased content

• Utilize your ticket "ticket.db" from the source system again and something like "FunkyCIA2.py" to obtain CIAs of your purchased content.

2. Install CIAs on your target system

• Utilize an installer such as FBI.

3. Once installed, copy your saves for the associated content from the source SD card to the target SD card

• Locate the matching title ID and save file on the source SD card and copy it to the appropriate folder on the target SD card.
• For example: On the source SD card, your save for Animal Crossing: New Leaf [US] (titleID: 0004000000086300) would be in the folder:
  • SDMC://Nintendo 3DS/<ID0>/<ID1>/title/00040000/00086300/data/00000001.sav
• Copy that save file to the corresponding folder on your target SD card and your save should now be accessible on the target system!

Closing Thoughts:
I really hope this tutorial has helped some people who may be in the same boat I was, wanting to transfer my content from my O3DS to my region-changed N3DS.
Thank you for your reading and have a "Nintacular" day!

 

[urherenow]

Wish you could have read the tutorial I already posted before (I guess it got deleted) I believe a few steps are better in mine. For instance, you end up suggesting Ninjhax and decrypt9 for the xorpad. If the source system is an O3DS and you have Cubic Ninja, you can skip those steps entirely! Using CN and rxtools, you can dump your nand.fat16 directly. Already decrypted. You only need an xorpad for the target nand.

Next thing: NAND://dbs/ticket.db <-- you do not need to do this and it may not even be wise (doesn't it have info from the old 3DS in it?). Your tickets get updated when your system checks the eshop anyway. If you must, use NTR and spoof your firmware to visit and download something from eshop. You will have your tickets transferred directly (and properly) to your new system this way.

1. From the source system, start by copying the following folders and their contents from the source SD card the target SD card:

• SDMC://Nintendo 3DS/<ID0>/<ID1>/backups
• SDMC://Nintendo 3DS/<ID0>/<ID1>/extdata

Note: <ID1> won't match between source/target SD card folders, but <ID0> should match. This is normal.
2. Next, we will need to obtain any system application updates/DLC you had on your source system on the target system

I simply deleted the previous Nintendo 3ds/<ID0> folder in its entirely and copied the whole contents of my old SD card to the new one (so it does indeed use the same <ID1> folder>. I also injected the extdata and sysdata folders in their entirety. Before I started the process, I removed any non-legit file from the source, and on the target, I used NTR to spoof the firmware and update Mii plaza and such. In the end, I had all of my contents and games on the target and they all run. Again... updating Mii plaza and visiting the eshop (one, or both... not sure) updated my tickets already with everything I owned.

 

[Arkansaw]

so the main problem of this method is that you don't have a properly signed ticket.db anymore? so practically this is not useful for legit purchases

It is better to describe this method as a way to duplicate/copy data for use on another system, it is not a real transfer since the original system still need to be retained

 

[mokonayoshi]

Again, you rule dude, thanks for this.
But I have a question: I don't want to overwrite the Mii Maker data and I don't really want to transfer any data besides Mii Plaza and Activity Log. Can I just move that or I have to move everything?

 

[yifan_lu]

I did the first part differently:

1. https://github.com/yifanlu/3DSSystemTools/tree/master/3DSTransferDevice export seed from source console
2. Import seed to target console
3. Dump CTRNAND on both consoles
4. Copy data from source 3DS over and replace the config savedata with the one from destination 3DS. Delete destination data.

You don't have to dump the nand twice.

 

[Wowfunhappy]

This will be super useful when I'm done with finals and can get back to work on my New 3DS. Thanks.

I'm somewhat confused by this:

• Note: The main limitation of this transfer method is we cannot yet locally transfer the tickets for purchased content from from one system's "ticket.db" file to another.
• In a legit system transfer, the tickets are sent to Nintendo from the source console and then returned to the target console, rewritten with the console ID of the target system.

For this reason, we must utilize CIAs/unsigned installations for our purchased on content on the target system.

So you'd have to continue booting into Gateway mode to play games you'd purchased on your original console? That kind of sucks.

 

[Ichii Giki]

So you'd have to continue booting into Gateway mode to play games you'd purchased on your original console? That kind of sucks.

This is an annoying limitation, but for how I did it, it is required. Going full Gateway hasn't been that painful, especially with the new MSET downgrade option allowing for no more card swapping. I haven't even seen any noticeable battery drain from leaving in the Gateway card all the time. Also, using Gateway all the time allowed me to finally rip all my carts and now I don't have to carry any around, all installed on my EmuNAND! Convenient!

Again, you rule dude, thanks for this.
But I have a question: I don't want to overwrite the Mii Maker data and I don't really want to transfer any data besides Mii Plaza and Activity Log. Can I just move that or I have to move everything?

You can just move over the saves you want, but the problem with moving Mii Plaza and not Mii Maker is that the Mii Plaza data will be expecting your default Mii from the source system. I would recommend exporting your existing Miis on the target system with QR codes, copying the Mii Maker save as well, then re-importing your saved Miis from the QR codes. However, to reiterate about your original question, you can just move over the data you want from the source system (Mii Plaza/Activity Monitor/etc.) and it should be fine. Still, any existing saves on your target console would be invalidated/unreadable after the movable.sed change, so you would have to reset them.

Using CN and rxtools, you can dump your nand.fat16 directly.

Next thing: NAND://dbs/ticket.db <-- you do not need to do this and it may not even be wise (doesn't it have info from the old 3DS in it?). Your tickets get updated when your system checks the eshop anyway. If you must, use NTR and spoof your firmware to visit and download something from eshop. You will have your tickets transferred directly (and properly) to your new system this way.

In the end, I had all of my contents and games on the target and they all run. Again... updating Mii plaza and visiting the eshop (one, or both... not sure) updated my tickets already with everything I owned.

I am aware of rxTools and I use it on my O3DS. I was just trying to give general instructions for each step that would be consistent from Source system to Target system. Note that each step of my tutorial is a general instruction (such as, "Dump/extract your Source NAND"), with many possible ways to accomplish the prescribed instruction (in this example, Gateway/Hardmod/EmuNANDTool/etc.). In this way, my High Level tutorial instructions can apply to many different scenarios (for example: a 9.x O3DS -> 9.x N3DS, or a 4.5 CFW O3DS -> 4.5 CFW O3DS).

Ticket.db IS recommended for my scenario. The ticket.db file simply contains your tickets for all the titles you have purchased (albeit with your console ID encoded). However when you use a script such as "FunkyCIA2", this script downloads CIAs from Nintendo with your tickets so they can then be installed on another console with a different console ID. This is why I included this file in my tutorial. I assume in your tutorial you were transferring between systems of the same region, so your situation/requirements differed from my own.

I understand your tutorial is more for transferring data after a failed, legit system transfer where at least your NNID does get moved to the Target system by Nintendo. My method was mostly born from the O3DS to region-changed N3DS scenario where a legit system transfer is not possible/extremely complex and moving over your NNID to the target system is very difficult. I bypass this by using an unsigned code execution option (like Gateway). I believe both tutorials are valid and serve different scenarios. Thank you for your input!

 

[mokonayoshi]

Well, I followed the guide and I can confirm it worked! At least what I wanted who was the Mii Plaza data.
However, something strange happened.
Somehow, the Mii Maker data didn't transferred correctly (it was a clean app, no data at all) but my Mii Plaza data still had my old Mii from the original system. Anyway, I just made another Mii with gold pants and switched it. Thanks for everything!

 

[Soul_Alchemist]

Ichii Giki, I have some problems with this part:

Re-encrypt your target NAND with XORPads again

I have 3 files:

FAT16.bin (partition)
A.xorpad
B.xor

I modified B.xor and saved the changes. How am I supposed to re-encrypt it again? Running the Xor Tool from 3DS Explorer mixing FAT16.bin with B.xor, or A.xorpad with B.xor, or do I need to use B.xor on my extracted Nand or.... I'm just confused about this part.


Can you tell me how to Re-encrypt my target NAND again?



BTW, searching "Re-encrypt your target NAND with XORPads again" on google brings me back to this post...

 

[Ichii Giki]

Ichii Giki, I have some problems with this part:



I have 3 files:

FAT16.bin (partition)
A.xorpad
B.xor

I modified B.xor and saved the changes. How am I supposed to re-encrypt it again? Running the Xor Tool from 3DS Explorer mixing FAT16.bin with B.xor, or A.xorpad with B.xor, or do I need to use B.xor on my extracted Nand or.... I'm just confused about this part.


Can you tell me how to Re-encrypt my target NAND again?



BTW, searching "Re-encrypt your target NAND with XORPads again" on google brings me back to this post...

To re-encrypt, you would XOR your modified NAND file (B.xor in your case) again with your XORpads (A.xorpad in your case) using 3DS Explorer (B.xor with A.xorpad). You would then take the result of this and inject the re-encrypted file back into your NAND file and flash that EmuNAND/etc. Hope this helps!

 

[Soul_Alchemist]

It worked Ichii Giki, Thank you so much!

I used this to transfer my Activity Log and it worked fine, with a small "bug", games I haven't played on my current EMUNAND won't show up on my Activity Log, but, as soon as I play them all the old data and playtime is instantly restored correctly for that game.

As a side note, if anyone has problems reinjecting the FAT16 partition for your NEW3DS, I used this 3DSFAT16tool.py:

https://gist.github.com/swarzesherz/651f69b2e8e5c370a0f4/d9b77da4b3a6d2ed909944c7d1e01d0ec6803296

If you don't have numpy installed, you can literally erase the "import numpy" line in notepad or IDLE. It's not needed for reinjecting. (But I can't guarantee everything else will work correctly if you erase "import numpy").

 

[Demonofelru]

This seems like just what I was looking for couple question would this work for an o3ds emunand 9.7 to a n3ds 9.0 emunand even though it is a lower firmware? Also don't 100% get all the steps yet am going to do more studying, but as long as I make sure to inject to emunand on target system this should be relatively safe correct?

 

[Selim873]

So I'll still have to make a whole new NNID on the target system, but I'll have to rebuy my digital games, though the saves will carry on. Is that right? I heard the eShop doesn't even work on region changed systems.

 

[Ichii Giki]

This seems like just what I was looking for couple question would this work for an o3ds emunand 9.7 to a n3ds 9.0 emunand even though it is a lower firmware? Also don't 100% get all the steps yet am going to do more studying, but as long as I make sure to inject to emunand on target system this should be relatively safe correct?

9.7 to 9.0 for this procedure should be okay, and yeah, doing things on EmuNAND is the safest/reversible way to do it. I went from 9.7 EmuNAND O3DS to 9.5 EmuNAND N3DS without issue.

So I'll still have to make a whole new NNID on the target system, but I'll have to rebuy my digital games, though the saves will carry on. Is that right? I heard the eShop doesn't even work on region changed systems.

You could make a new NNID on the target system (for certain things that require it like Pokemon Shuffle for coin check-ins), but it is not entirely necessary. You will not have to 'rebuy' anything on the target system. If you have the ability to follow this procedure from the source to target system, you should also be able to make CIAs from your existing eShop content on the source system and then install those on the target system, no new purchases required, and then carry over your saves. You are correct that the eShop does not work directly on region-changed systems at this time.

 

[Selim873]

9.7 to 9.0 for this procedure should be okay, and yeah, doing things on EmuNAND is the safest/reversible way to do it. I went from 9.7 EmuNAND O3DS to 9.5 EmuNAND N3DS without issue.



You could make a new NNID on the target system (for certain things that require it like Pokemon Shuffle for coin check-ins), but it is not entirely necessary. You will not have to 'rebuy' anything on the target system. If you have the ability to follow this procedure from the source to target system, you should also be able to make CIAs from your existing eShop content on the source system and then install those on the target system, no new purchases required, and then carry over your saves. You are correct that the eShop does not work directly on region-changed systems at this time.

This is probably the best answer I've gotten on this! Thank you!

 

[Cosmic_Link]

Thank you very much for this awesome guide! It was exactly what I needed to get my legit system transferred content to show on my sysnand on my N3DS.

Successfully got all my content and save datas from 9.8E to show on 9.0E.

 

[xdarkmario]

Can a backup mii Plaza save data using savefiler?

 

[Ichii Giki]

Can a backup mii Plaza save data using savefiler?

Sadly no. Built-in games like Mii Plaza and Face Raiders, for example, save their data in the NAND itself, so you have to use a method like this tutorial to transfer that data. SaveDataFiler would only be useful in this instance for backing up Mii EXTdata from MiiMaker, for example, but not progress for the Mii Plaza games. If you have other existing save data for different games, but still wanted to use the method described in this tutorial, you can simply back up your existing installed game saves with SaveDataFiler, follow this tutorial, then reinstall you games and restore your SDF saves. I know this method would be laborious/time consuming, but it is possible.

 

[xdarkmario]

Maybe I'll do it once, but the thing is that me and xors don't get along. I just have terrible luck with getting those, errors that some people never even heard of. Hate xor. But I'll try on a virtual windows 7

 

[xdarkmario]

One more thing, what if i was able to install mii streetpass plaza on the SD card instead of nand as a installed.cia and will the native 3ds savedata option become available?