Homebrew ALL 3 Methods to get unbanned from recent ban wave

Zm1231 · Apr 30, 2017

So i have something Odd I setup my Cousins O3DS with A9lh I have done this plenty of times before This system has never been modded or run homebrew before until i finished putting a9lh on it. After i got it set up I started to install Games for him via Freeshop after i installed the games I exited Free Shop and installed the Updates for the games via the update message that is shown when launching the game well after 3 games had been updated i was hit with a 002-0102 error message saying Nintendo has restricted this system. I have no idea how this happened as nothing has been played early, Gateway has never been used on this system. It just happened from installing updates. I Made a nand backup and tired different methods in this guide and none worked. I even tried the current public LocalFriendCode_B that is banned and injected it and it still says its banned after i tired a few methods here I restored my nand backup just to be back before i tested any methods. What can be done about this and how did it get banned?

gamemasteru03 · Apr 30, 2017

Weird was it preowned?

XP_version1 · May 22, 2017

Can this be done with Godmode or does it have to be Decrypt9?

R3V3RS3 · May 22, 2017

Hi! My New3DS XL has been banned a few months ago. Thanks to Decrypt9 and my old 2DS, I can connect to online features and enter to the eShop, but I can't use PokeBank anymore because of the NNID ban. Is there any kind of transfer that allows me to use this feature? Thanks!

gamemasteru03 · May 22, 2017

XP_version1 said:
Can this be done with Godmode or does it have to be Decrypt9?

Well this guide is written for decrypt9 but if you know how to do it on god mode 9 you can.

R3V3RS3 said:
Hi! My New3DS XL has been banned a few months ago. Thanks to Decrypt9 and my old 2DS, I can connect to online features and enter to the eShop, but I can't use PokeBank anymore because of the NNID ban. Is there any kind of transfer that allows me to use this feature? Thanks!

Well sorta. All the methods are private though, If you pm p2fm he can enable you to make a new nnid that could work but it requires 2 3ds's(one banned one not banned). I also belive joom talked about a method that used 2 3ds's that could get your old nnid back. But ounce again these methods are private...

gamemasteru03 · May 22, 2017

Ok I added BS9 support to the guide (Just required changing stuff to say a9lh and BS9 the process is still the same) and did some minor changes. Enjoy :yay3ds:

eworm · May 23, 2017

Joom said:
The reason why you can still access the eShop but not Pokebank is because Pokebank requires an NNID, and you can't link an NNID to a banned console (022-2812). The device's ID itself is banned, and this can't be (permanently) changed due to this part being OTP locked. A developer here made a modification to Luma that changed the ID to 1234 in RAM, but Nintendo caught on and now requires legitimate IDs signed by CTCert. So, to totally unban a console (in memory only) one has to dump the CTCert and device ID from the ITCM (ARM9 RAM) from an unbanned console, and inject them into the ITCM of a banned one using an A9LH payload. This is why a sacrificial 3DS is required (it can technically still be used, but going online with it could be detrimental).

Joom said:
I'm excited for the bootrom to be dumped because I'd like to know if we can manipulate CTCert directly, thus removing the necessity for a second console.

Quoting this from some pages back, because - correct me if I'm wrong - this might be possible now, right? With sighax/boot9strap being out?

gamemasteru03 · May 23, 2017

eworm said:
Quoting this from some pages back, because - correct me if I'm wrong - this might be possible now, right? With sighax/boot9strap being out?

Maybe, I guess we just have to wait and see if he releases anything.

proflayton123 · May 23, 2017

eworm said:
Quoting this from some pages back, because - correct me if I'm wrong - this might be possible now, right? With sighax/boot9strap being out?

This above is what I did with two of my 3DS systems

I have a way of dumping the CTCert, although I'm not sure with the ARM9 RAM, maybe from the arm9 bootrom in a hex editior?

Sent from my iPhone using Tapatalk

gamemasteru03 · May 23, 2017

proflayton123 said:
This above is what I did with two of my 3DS systems

I have a way of dumping the CTCert, although I'm not sure with the ARM9 RAM, maybe from the arm9 bootrom in a hex editior?

Sent from my iPhone using Tapatalk

Would you mind explaining what you did?

proflayton123 · May 23, 2017

gamemasteru03 said:
Would you mind explaining what you did?

With the help of @p2fm, hold on

Sent from my iPhone using Tapatalk

https://ariankordi.net/tutorial/miiverse/

Joom · May 23, 2017

proflayton123 said:
With the help of @p2fm, hold on

Sent from my iPhone using Tapatalk

https://ariankordi.net/tutorial/miiverse/

I don't see anything covering what you were talking about. All I see is "Soon™" on the FAQ page. The rest of that is for accessing Miiverse from anywhere, unless I'm just missing something.

eworm said:
Quoting this from some pages back, because - correct me if I'm wrong - this might be possible now, right? With sighax/boot9strap being out?

No idea yet because I don't have much time to mess around with the 3DS these days, but using the ITCM method still works with B9S (duh). Problem is that I don't have permission to release anything, and probably won't ever at least until something else is released publicly by somebody else or when the 3DS hits EoL (aka, when it's useless). This isn't me being stingy, but the original developer being incredibly cautious since we don't want Nintendo patching the only thing we know to use at this point in time.

I can give a hint, though. Dump the ITCM to your SD with GodMode9 (MEMORY VIRTUAL > itcm.mem), copy it to a PC that has dd (Linux and OS X has this natively, and you can use Cygwin on Windows), and do the following:

Code:

dd if=itcm.mem of=DeviceID.bin bs=1 skip=14340 count=4
dd if=itcm.mem of=CTCert.bin bs=1 skip=14360 count=104

What you do from here is up to you. Also, if you use a mismatched console (your source console is an O3DS and your banned console is an N3DS, for example) you'll need a way to patch the eShop to disable update checks. Otherwise it'll throw up an update nag every time you attempt to access it since NIM sees that you're missing titles for the console you're reporting to be. Luma had this functionality prior to 6.5, but it was stripped out since it apparently caused problems. You can look through this commit for reference.

ThunderbInazuma · May 23, 2017

Joom said:
I don't see anything covering what you were talking about. All I see is "Soon™" on the FAQ page. The rest of that is for accessing Miiverse from anywhere, unless I'm just missing something.

No idea yet because I don't have much time to mess around with the 3DS these days, but using the ITCM method still works with B9S (duh). Problem is that I don't have permission to release anything, and probably won't ever at least until something else is released publicly by somebody else or when the 3DS hits EoL (aka, when it's useless). This isn't me being stingy, but the original developer being incredibly cautious since we don't want Nintendo patching the only thing we know to use at this point in time.

I can give a hint, though. Dump the ITCM to your SD with GodMode9 (MEMORY VIRTUAL > itcm.mem), copy it to a PC that has dd (Linux and OS X has this natively, and you can use Cygwin on Windows), and do the following:

Code:

dd if=itcm.mem of=DeviceID.bin bs=1 skip=14340 count=4 dd if=itcm.mem of=CTCert.bin bs=1 skip=14360 count=104

What you do from here is up to you. Also, if you use a mismatched console (your source console is an O3DS and your banned console is an N3DS, for example) you'll need a way to patch the eShop to disable update checks. Otherwise it'll throw up an update nag every time you attempt to access it since NIM sees that you're missing titles for the console you're reporting to be. Luma had this functionality prior to 6.5, but it was stripped out since it apparently caused problems. You can look through this commit for reference.

Just Curious, that method uses this:

"(The technical way) Dump the device cert from a hacked O3DS/N3DS/2DS, and use Telerik Fiddler to change the headers on it and inject it into the NAND of your hyperbanned system. This method hasn't been publicly released completely yet due to its complexity, but might get simpler soon. You can dump the certs though using the tutorials linked." (http://miiversepedia.wikia.com/wiki/Hyperban)

Joom · May 23, 2017

ThunderbInazuma said:
Just Curious, that method uses this:

"(The technical way) Dump the device cert from a hacked O3DS/N3DS/2DS, and use Telerik Fiddler to change the headers on it and inject it into the NAND of your hyperbanned system. This method hasn't been publicly released completely yet due to its complexity, but might get simpler soon. You can dump the certs though using the tutorials linked." (http://miiversepedia.wikia.com/wiki/Hyperban)

No. What I use uses a boot9 FIRM payload to inject the CTCert and DeviceID of an unbanned console into the ITCM of a banned one. No NAND injection involved. Also, what tutorials is this talking about? I don't see any linked.

ThunderbInazuma · May 23, 2017

Joom said:
No. What I use uses a boot9 FIRM payload to inject the CTCert and DeviceID of an unbanned console into the ITCM of a banned one. No NAND injection involved.

Ok. Btw, could you tell me who is the one who doesn't give you permission ( I wanted to ask him if he/she need any help).

Joom said:
Also, what tutorials is this talking about? I don't see any linked.

Didn't saw that xD

Joom · May 23, 2017

ThunderbInazuma said:
Ok. Btw, could you tell me who is the one who doesn't give you permission ( I wanted to ask him if he/she need any help).

Sorry, they don't want to be known. It's nobody on this site anyway.

ThunderbInazuma · May 23, 2017

Joom said:
Sorry, they don't want to be known. It's nobody on this site anyway.

Ok, thanks anyway

Joom · May 23, 2017

ThunderbInazuma said:
Didn't saw that xD

Seems like that Wiki was ripped from this one.
http://le-miiverse-resource.wikia.com/wiki/Hyperban

PF2M sure seems salty. Also, you need the unbanned DeviceID as well.

gamemasteru03 · May 23, 2017

proflayton123 said:
With the help of @p2fm, hold on

Sent from my iPhone using Tapatalk

https://ariankordi.net/tutorial/miiverse/

Joom said:
I don't see anything covering what you were talking about. All I see is "Soon™" on the FAQ page. The rest of that is for accessing Miiverse from anywhere, unless I'm just missing something.

No idea yet because I don't have much time to mess around with the 3DS these days, but using the ITCM method still works with B9S (duh). Problem is that I don't have permission to release anything, and probably won't ever at least until something else is released publicly by somebody else or when the 3DS hits EoL (aka, when it's useless). This isn't me being stingy, but the original developer being incredibly cautious since we don't want Nintendo patching the only thing we know to use at this point in time.

I can give a hint, though. Dump the ITCM to your SD with GodMode9 (MEMORY VIRTUAL > itcm.mem), copy it to a PC that has dd (Linux and OS X has this natively, and you can use Cygwin on Windows), and do the following:

Code:

dd if=itcm.mem of=DeviceID.bin bs=1 skip=14340 count=4 dd if=itcm.mem of=CTCert.bin bs=1 skip=14360 count=104

What you do from here is up to you. Also, if you use a mismatched console (your source console is an O3DS and your banned console is an N3DS, for example) you'll need a way to patch the eShop to disable update checks. Otherwise it'll throw up an update nag every time you attempt to access it since NIM sees that you're missing titles for the console you're reporting to be. Luma had this functionality prior to 6.5, but it was stripped out since it apparently caused problems. You can look through this commit for reference.

Intresting... I will look into these methods and will see if I can add them to the guide and make them more user friendly. This might be a challenge for me because I do not have a banned 3ds anymore

.

proflayton123 · May 23, 2017

How to dump DeviceID though?

Sent from my iPhone using Tapatalk

Homebrew ALL 3 Methods to get unbanned from recent ban wave

Did this unban you and if so which method did?

Method 1 unbanned me!!!

Method 2 unbanned me!!!

The now dead method 3 unbanned me!!!

I bricked :(

I did not get unbanned but I didn't brick

Well-Known Member

Nintendo nerd

Active Member

Active Member

Nintendo nerd

Nintendo nerd

Well-Known Member

Nintendo nerd

The Temp Loaf'

Nintendo nerd

The Temp Loaf'

❤❤❤

Well-Known Member

❤❤❤

Well-Known Member

❤❤❤

Well-Known Member

❤❤❤

Nintendo nerd

The Temp Loaf'

Similar threads

Popular threads in this forum