[Tutorial] "Manual System Transfer" for Saves/Content

DISCLAIMER: I AM NOT LIABLE FOR ANY LOSS OF DATA OR DAMAGE TO YOUR SYSTEM! You proceed with this tutorial at your own peril!
PLEASE MAKE BACKUPS FOR EACH STEP AS YOU GO! This will make it easier to recover if some step fails/a mistake is made.
Unless you have a hard-mod for your console, it is HIGHLY recommended to attempt this tutorial on EmuNAND on the target system to avoid bricks.
YOU HAVE BEEN WARNED!!!

This tutorial will instruct you how to do a "Manual System Transfer" from one 3DSsystem to another 3DS system.
It is reversible back to the original system, but will invalidate content on the target system as a normal system transfer would.
Due to this fact, PLEASE BACKUP ANY SAVES YOU CARE ABOUT on the target system with SaveDataFiler/etc. before you proceed.
This method will ONLY transfer saves and give you the ability to install content on the target system.
This method will NOT move your NNID over to the target system/re-link it. This is a server-side thing and must be done by Nintendo.
This method should be especially useful for people with region-changed systems that want to move over saves for Mii Plaza/etc.
This tutorial is a HIGH LEVEL process. Many steps will not be completely spelled out, so if you don't understand a specific term/procedure, please consult the forums.

THANKS TO EVERYONE WHO HELPED MAKE THIS TUTORIAL POSSIBLE!!!


Requirements:
Both the source and target systems must be on exploitable firmwares (for the purpose of this guide, this basically means <= 9.2 SysNAND FW)!
The method used to run unsigned code on the source system (for example Gateway, or a 4.5 CFW) must also be able to be run on the target system for full transfer.
Example: If you utilize a 4.5 exclusive CFW on your source system, you wouldn't be able to transfer with that onto a New 3DS as New 3DS systems cannot run 4.5 FW.

Note: I personally used this method between the 9.7 EmuNAND of an original 3DS system to a region-changed 9.5 EmuNAND New 3DS system.
I also utilized a Gateway card for running my transferred content on the target, New 3DS system. Other methods are possible, but again, they must be compatible between systems.
For optimal results, you will want to utilize firmwares on both systems in the same major version (for example, 9.x and 9.x on both systems).


Limitations:
This method will NOT transfer over your NNID from the source system to the target system as a legit system transfer would.
This method was mainly born from the issues stemming from region-changing a 3DS system and then wanting to transfer content to that system.
Personally, having done this method between my US O3DS and my originally JPN N3DS, my NNID was left on my O3DS and all my saves were copied to the N3DS.
From there I continue to make future purchases on the O3DS under my NNID and then manually install said purchases on the N3DS with Gateway.
Please note this part of the procedure is specific to my issues with not being able to system transfer from a US O3DS to a region-changed N3DS completely, but hopefully this tutorial will still be useful for you!


Let's get this show on the road!

A. Source System
1. Dump/extract your source NAND

• On the source system, you will first need to dump the NAND you will be pulling your save data from (either SysNAND or EmuNAND).
• This can be done either through something like the Gateway menu with a SysNAND backup or EmuNANDTool to extract your EmuNAND from your SD card.

2. Extract the Fat16 CTR partition from your source NAND backup

• This can be done with a script such as Cearp's "3DSFAT16tool.py" python script.

3. Generate NAND XORPads for your source NAND

• This can be done with a tool such as Decrypt9 (which runs through Ninjhax and is currently the only method to generate XORPads for the New 3DS).

4. Decrypt your NAND backup with the XORPads from the previous step

• This can be done by simply xor-ing your extracted Fat16 CTR partition with your NAND XORPads (using something like the "XOR Tool" in 3DSExplorer).

5. Mount your decrypted NAND backup for editing

• This can be done with a tool such as WinImage in Windows or directly as an ISO in Mac OSX.

6. Extract necessary files/saves from source NAND

• The files you want to extract and are safe from your source NAND are as follows:
  • NAND://private/movable.sed - THIS IS THE MAIN FILE FOR THIS PROCESS! It is the file which identifies/is used to decrypt the saves from your source NAND/SD card.
  • NAND://dbs/ticket.db - This file will be used later to recover our purchased content for the target system.
  • NAND://data/<ID0>/extdata - You may extract and save all the subfolders in this folder (<ID0> will be a randomly generated number, matching the number of your save folder in the "Nintendo 3DS" folder on your SD card).
  • NAND://data/<ID0>/sysdata - Extract and save ONLY the following folders! (For reference, these titles are for US systems and may vary by region - consult: http://3dbrew.org/wiki/System_SaveData for your region):
    • 000200bd - Miiverse
    • 0001000f - Unknown
    • 0002021b - Nintendo Zone
    • 0002021d - Face Raiders
    • 0002021e - AR Games
    • 00010011 - FS module (for Anti Savegame Restore games like Animal Crossing/PKMN/Smash)
    • 00010022 - Pedometer
    • 00010026 - Streetpass (active games)
    • 00010032 - Friends
    • 00010034 - Spotpass
    • 00010035 - News
    • 00020093 - Game Notes
    • 00020094 - Internet Browser
    • 00020096 - Friend List
    • 00020212 - Activity Log
    • 00020214 - Nintendo 3DS Camera
    • 00020215 - Nintendo 3DS Sound
    • 00020217 - Mii Maker
    • 00020218 - Mii Plaza

Note: These are the only saves I have tested to work and transfer safely. If you try to transfer saves for more system apps (such as NNID/config) I cannot guarantee success/positive results.
Further Note: I CAN confirm that if you transfer the app of something like Config from original 3DS to New 3DS, you will likely have weird results for screen display/etc. [DON'T TRY THIS!!!]

B. File Modification
1. Open your "movable.sed" file from the source system in you favored hex editor (such as "HxD").
2. Once open, you will want to remove the last 0x20 bytes from the file (actually shrinking the size of the file from 0x140 to 0x120).
3. At the beginning of the file, clear the 4 BYTES after the 'SEED' value (each byte should consist of two hex-based numbers, such as '00' or 'AF'; when clear, the value for that byte should show '00'/'.').

• For example, the beginning of your file after modification should show '53 45 45 44 00 00 00 00' or "SEED...."

4. Save changes to your "movable.sed" file and close it (Recommend saving in a new copy of the file in case any mistakes are made!).
Note: Thanks to motezazer for the instructions on this step! (This was the most important step of this process!)

Note: REMEMBER! THIS METHOD WILL INVALIDATE EXISTING CONTENT/SAVES ON THE TARGET SYSTEM! Please backup any important saves before proceeding!
C. Target System
1. Dump/extract your target NAND

• On the target system, you will need to dump the NAND you will be injecting your save data to (either SysNAND or EmuNAND).

• This can be done either through something like the Gateway menu with a SysNAND backup or EmuNANDTool to extract your EmuNAND from your SD card.

2. Extract the Fat16 CTR partition from your target NAND backup

• This can be done with a script such as Cearp's "3DSFAT16tool.py" python script.

3. Generate NAND XORPads for your target NAND

• This can be done with a tool such as Decrypt9 (which runs through Ninjhax and is currently the only public method to generate XORPads for the New 3DS).

4. Decrypt your NAND backup with the XORPads from the previous step

• This can be done by simply xor-ing your extracted Fat16 CTR partition with your NAND XORPads (using something like the "XOR Tool" in 3DSExplorer).

5. Mount your decrypted NAND backup for editing

• This can be done with a tool such as WinImage in Windows or directly as an ISO in Mac OSX.

6. Inject your MODIFIED "movable.sed" file to your target NAND

• Simply copy your modified file and overwrite the existing "movable.sed" file.

7. Delete the contents of the of the NAND://data folder

• This step is necessary to reinitilize the system with the new "movable.sed" file. Do NOT delete the "data" folder itself!

8. Re-encrypt your target NAND with XORPads

• This can be done by simply xor-ing your extracted Fat16 CTR partition again.

9. Inject your modified Fat16 CTR partition into your target NAND

• Use the injection function of a script such as "3DSFAT16tool.py", for example.

10. Flash/inject your modified target NAND to the target system

• Using either a hardware restore method (Gateway menu/hard-mod) or software (EmuNANDTool for EmuNAND).

11. Boot into the target NAND

• Let the system boot up to the start of the system setup procedure. Once you get to the system setup start screen, you may power off the system without going through the setup.

12. Extract your target NAND again
13. Extract your Fat16 CTR partition again
14. Decrypt your partition with XORPads again
15. Mount your decrypted partition for editing again
16. This time, inject your "extdata" and "sysdata" saves from the source system into the newly created folder under NAND://data/<ID0>

• Overwrite any existing saves with your source system data.

17. Re-encrypt your target NAND with XORPads again
18. Inject your modified Fat16 CTR partition into your target NAND again
19. Flash/inject your modified target NAND to the target system again
Note: DO NOT POWER ON YOUR SYSTEM YET!

D. SD Card Content
*. Now that we have prepared and transferred the NAND content from the source system to the target system, we much now transfer our SD card content to get ALL our saves for system titles
1. From the source system, start by copying the following folders and their contents from the source SD card the target SD card:

• SDMC://Nintendo 3DS/<ID0>/<ID1>/backups
• SDMC://Nintendo 3DS/<ID0>/<ID1>/extdata

Note: <ID1> won't match between source/target SD card folders, but <ID0> should match. This is normal.
2. Next, we will need to obtain any system application updates/DLC you had on your source system on the target system

• This can be done utilizing your "ticket.db" from the source system and a script like "FunkyCIA2.py" (again by Cearp ) to obtain the CIAs
• For reference, the title IDs of the Mii Plaza update and DLC are:
  • 0004000e00021800 - Mii Plaza Update
  • 0004008c00021800 - Mii Plaza DLC

3. You may now insert your target SD card and boot up the target system

• Once you have reached the home menu, install the CIAs obtained from the previous step using your favorite CIA management tool (I recommend FBI, by Steveice10 ).

4. You may now run system apps and your save data should be intact and available!

• If you had updated the Mii Plaza/purchased DLC and then tried run your transferred save without installing them in the target system, you would get an error saying your save is not on the correct version.
• Note: The main limitation of this transfer method is we cannot yet locally transfer the tickets for purchased content from from one system's "ticket.db" file to another.
• In a legit system transfer, the tickets are sent to Nintendo from the source console and then returned to the target console, rewritten with the console ID of the target system.
• For this reason, we must utilize CIAs/unsigned installations for our purchased on content on the target system.

E. Remaining SD Card Content
*. Once you have achieved access to your system applications saves on the target system, you can proceed with installing and transferring the saves of your other purchased content
1. Obtain CIAs for your remaining purchased content

• Utilize your ticket "ticket.db" from the source system again and something like "FunkyCIA2.py" to obtain CIAs of your purchased content.

2. Install CIAs on your target system

• Utilize an installer such as FBI.

3. Once installed, copy your saves for the associated content from the source SD card to the target SD card

• Locate the matching title ID and save file on the source SD card and copy it to the appropriate folder on the target SD card.
• For example: On the source SD card, your save for Animal Crossing: New Leaf [US] (titleID: 0004000000086300) would be in the folder:
  • SDMC://Nintendo 3DS/<ID0>/<ID1>/title/00040000/00086300/data/00000001.sav
• Copy that save file to the corresponding folder on your target SD card and your save should now be accessible on the target system!

Closing Thoughts:
I really hope this tutorial has helped some people who may be in the same boat I was, wanting to transfer my content from my O3DS to my region-changed N3DS.
Thank you for your reading and have a "Nintacular" day!

 

[Ichii Giki]

Or should I extract and inject all the folders you described?

You should be able to just use the saves you care about if you don't want to copy over all your old data.

Im guessing moving the ticket.db would have let all the old games load up, but id rather not take the chance on it restoring something odd.

Any ideas on how to restore the friend code too or is that too late?

You can't just move the ticket.db of one system to another, as the tickets stored in the file are encoded with the unique identifier of the source console. There is not, as of yet, a proper method for us to write our own complete entries as Nintendo does to the ticket.db file.

It is odd that the friend code changed. Some file/piece of information must not have been copied over when you did the process. You may be able to try copying the Friends module save from the source system to the target system again and see if the friend code properly shows up.

@Ichii Giki - Is there some other way? E. g. decrypting those saves, converting them to european ones? Any help will be apreciated!

I am not sure if it is possible to do this transfer method between regions. Did you have all appropriate Mii Plaza updates/DLC installed to match your saves? The saves would show as corrupt/inaccessible if you didn't have the matching Mii Plaza updates/DLC installed as well (I had this same issue during my testing, but my saves worked after installing the corresponding updates/DLC).

its a shame this guide is out of date and is very vague on some steps.

Now it appears that Decryptor9 cant generate proper xorpads from 10.6 on new 3ds (my target system)... but sounds like fix is coming soon.. looks like Im going to have to wait.

The guide isn't out of date and vague so much as it is written in a very general manner to outline the basic Manual Transfer process so people can apply the overall concept to many different possible tools/methods, past, present and future. In this way, the overall spirit/message of the guide stays up to date, allowing people to apply the process to new systems/versions/tools as the state of the 3DS homebrew scene progresses.

Also, the method for generating Xorpads really hasn't changed significantly between system versions, so the newest version of Decrypt9WIP (https://github.com/d0k3/Decrypt9WIP/releases) should be adequate. Is your target system on 10.6 SysNAND? If it is on 10.6 SysNAND, you would need to downgrade the system to 9.2 SysNAND and then create and update an EmuNAND to 10.6 (or now newest 10.7) to follow this Manual Transfer process.

 

[TheGlow]

You can't just move the ticket.db of one system to another, as the tickets stored in the file are encoded with the unique identifier of the source console. There is not, as of yet, a proper method for us to write our own complete entries as Nintendo does to the ticket.db file.

It is odd that the friend code changed. Some file/piece of information must not have been copied over when you did the process. You may be able to try copying the Friends module save from the source system to the target system again and see if the friend code properly shows up.

The gift that keeps on giving. It looks like this also caused a glitched with her Mii. She cant edit it, gets an error that it's locked. Cant remove it because it says you cannot delete your personal Mii.
I told her I may need to just go ahead and nuke it all and start over.

 

[Nirmonculus]

This is quite daunting, but I'll give it a go when my Jpn n3ds comes in.
XD

 

[Zedjones]

Wish you could have read the tutorial I already posted before (I guess it got deleted) I believe a few steps are better in mine. For instance, you end up suggesting Ninjhax and decrypt9 for the xorpad. If the source system is an O3DS and you have Cubic Ninja, you can skip those steps entirely! Using CN and rxtools, you can dump your nand.fat16 directly. Already decrypted. You only need an xorpad for the target nand.

Next thing: NAND://dbs/ticket.db <-- you do not need to do this and it may not even be wise (doesn't it have info from the old 3DS in it?). Your tickets get updated when your system checks the eshop anyway. If you must, use NTR and spoof your firmware to visit and download something from eshop. You will have your tickets transferred directly (and properly) to your new system this way.


I simply deleted the previous Nintendo 3ds/<ID0> folder in its entirely and copied the whole contents of my old SD card to the new one (so it does indeed use the same <ID1> folder>. I also injected the extdata and sysdata folders in their entirety. Before I started the process, I removed any non-legit file from the source, and on the target, I used NTR to spoof the firmware and update Mii plaza and such. In the end, I had all of my contents and games on the target and they all run. Again... updating Mii plaza and visiting the eshop (one, or both... not sure) updated my tickets already with everything I owned.

By non-legit files, what exactly do you mean?

 

[urherenow]

By non-legit files, what exactly do you mean?

If you installed .cias of games you don't own.

 

[Zedjones]

If you installed .cias of games you don't own.

Thanks. And to clear one more thing up, you said you replaced the sysdata and extdata folders in their entirety. Did you also replace ID0 on NAND://data/ or did you leave it as it was?

Edit: I think I get what you did now. The ID0 should be the same after reinitializing the system with the new moveable.sed, correct?

 

[urherenow]

Thanks. And to clear one more thing up, you said you replaced the sysdata and extdata folders in their entirety. Did you also replace ID0 on NAND://data/ or did you leave it as it was?

Edit: I think I get what you did now. The ID0 should be the same after reinitializing the system with the new moveable.sed, correct?

correct. Just follow the tutorial and even the exact contents of the SD card can be copied over as well.

 

[Cinnamon]

Thanks to this guide, I managed to salvage the saves and tickets from a previously bricked NAND.bin and move them to my current one.
I only used the movable.sed since I didn't care about the system titles.

 

[froggestspirit]

I did most of this just by using GodMode9, (and a hex editor for movable.sed). It seems to be working fine. I want to make all of my consoles read and work from the same SD card (minus my new3ds).
Edit: If you do it this way, don't touch ticket.db. Not sure if it properly decrypts it

 

[placebooooo]

You put the xorpad and the nand_file in the two boxes of the XOR Tool section of 3DSExplorer. Then you XOR them by clicking the button and saving the output file. That output file will be a decrypted disk image that you can open with something like WinImage in Windows or directly as an ISO in Mac OSX (as specified in Section A - Step 5 of the tutorial).

I keep getting an error when I try to open the decrypted disk with winimage; it just won't open. Sorry, I'm finding it very difficult to follow this guide but I am trying my best. I'm trying to transfer my cia saves from my old 3ds to my new 3dsxl

 

[Ichii Giki]

I keep getting an error when I try to open the decrypted disk with winimage; it just won't open. Sorry, I'm finding it very difficult to follow this guide but I am trying my best. I'm trying to transfer my cia saves from my old 3ds to my new 3dsxl

What specific error are you getting when trying to open the decrypted disk image with WinImage? It's possible the image wasn't actually decrypted properly in some previous step.

If you're just trying to move game saves and don't care about system title saves like Friends, MiiPlaza, etc., an easier solution for you would probably be to use a more recent homebrew application like JK Save Manger. It is a fantastic save manager that is great for exporting saves in a portable format that could then be easily copied and imported on another system. Give it a shot!

 

[placebooooo]

What specific error are you getting when trying to open the decrypted disk image with WinImage? It's possible the image wasn't actually decrypted properly in some previous step.

If you're just trying to move game saves and don't care about system title saves like Friends, MiiPlaza, etc., an easier solution for you would probably be to use a more recent homebrew application like JK Save Manger. It is a fantastic save manager that is great for exporting saves in a portable format that could then be easily copied and imported on another system. Give it a shot!

I managed to mount the ctrnand.bin using osfmount program (and extracted the ticket and movable sed etc). I would have used JK save manager, but I don't have my old 3ds xl anymore (sold it on craigslist). All I have is the nand.bin, xorpad, and sd card of my old 3ds xl. I have been struggling to follow this guide as I have no idea what I am doing. I don't even think I xor'd my stuff properly etc. Currently, I am having troubles hex editing the movable.sed for my old 3ds xl; I don't see the 00 00 00 00 numbers as in your example. I'm trying to follow this as best as I can; Other members here have also helped but no luck, I just have no idea what I'm doing :/

 

[Sketchy1]

What are the last 0x20 bytes? (Am new to hex editing)

 

[Sketchy1]

Nvm, just figured out its the last 32 bytes

 

[Sketchy1]

Anybody know a good guide for generating xorpads with decrypt9 for this?

 

[Mr Skinner]

My girlfriend has a Nintendo 3ds in 9.5.0. she would like to use Luma 3ds + A9LH in 3ds, but is afraid of losing all StreetPass data she conquered the over all these years. It would be possible to extract the desired saves and insert them already with the Luma 3ds working?

 

[Mr Skinner]

My girlfriend has a Nintendo 3ds in 9.5.0. she would like to use Luma 3ds + A9LH in 3ds, but is afraid of losing all StreetPass data she conquered the over all these years. It would be possible to extract the desired saves and insert them already with the Luma 3ds working?

Responding here for future reference, I managed to keep all street pass data mii plaza and saves, making a hardmod on Nintendo 3ds of my girlfriend, who was in version 9.5.0.

That is, if you do not want to lose files and have an alternative method, you have to backup the nand. Then just follow Plailetc's tutorial to install A9LH in github and "Part 3 (arm9loaderhax) In the" Section IV - Restoring the System ":

Open Hourglass9 from arm9loaderhax by holding Start on boot
Go to "SysNAND Backup / Restore ..."
Select "Restore SysNAND (keep a9lh)"
Confirm and restore from NANDmin.bin
(This archive NANDmin.bin will be the image obtained in hardmod, renamed. In my case, version 9.5.0 made before the downgrade, during Harmod process)

Note: Do not worry about the absence of .sha file. Hourglass9 will flash even without the file, ignoring in the process. Just make sure, during the process of obtaining the NAND via hardmod you have a valid NAND using the 3DS NAND Checker.

 

[Sketchy1]

OK so it it possible to salvage my saves without reinstalling cia's?

 

[Hyoretsu]

What's the procedure if I just want to move over my Mii Plaza save and Streetpass+Spotpass data?

 

[Sketchy1]

What's the procedure if I just want to move over my Mii Plaza save and Streetpass+Spotpass data?

The same thing only you take street and spotpass files. BTW if your nand was dumped via decrypt9 you can Mount it directly and skip the xorpad junk