Hacking [GUIDE] The EmuNAND/Save Data Mega Guide GBATemp Doesn't Deserve

[The Minish LAN]

The EmuNAND/Save Data Mega Guide GBATemp Doesn't Deserve
mods feel free to edit the title

There are way too many people running around asking the same questions
and getting the same answers, so here we go.

Running the exploit
So, you finally get to use that shiny new Gateway 3DS flashcart sitting
that's been sitting on your shelf for a month. Gateway 3.0 is out!

If you are on firmware 4.5-9.2, here are your options:

1. Bookmark http://go.gateway-3ds.com/ and navigate there using the web browser
whenever you want to run the exploit
2. Use the android app to do the above even if you don't have an internet connection
3. Downgrade to 4.x and use the old DS Profile exploit

BUT WAIT! Don't do any of those things yet! There are other things
you need to know before starting. The next few sections will explain some
info that you should know before you so much as breathe on that gateway card:

1. How 3DS memory works
2. What EmuNAND does
3. Why that might cause problems
4. How to fix those problems
5. Everything about Save data
6. Why you should think hard before downgrading to 4.x

1. How 3DS memory works
I'm going to talk relatively precisely about how things work, because I think
people on this site generally talk very loosely about various things, and it
confuses beginners.

First let's talk about how the 3DS system memory works. It can basically be
divided into two sections: "stuff that gets saved to SD", and "stuff that
gets saved to system memory (NAND)".

Stuff that gets saved to SD: Games, extra save data that games wish
to save to SD

Stuff that gets saved to system memory (NAND): System firmware,
housekeeping info like which titles are installed, system settings, unique info
that differentiates this 3DS system from another

Most people already know this, but data written to SD by a certain 3DS system
(or, a system with certain unique data in its NAND) can only be read and written
by that same 3DS system. Unique data in that 3DS's NAND enables it to
read/write data to a specific folder on SD. If you put the same SD card into
another 3DS, that 3DS will have to make another folder for itself, because
it doesn't have the same unique NAND data as the 3DS that wrote to SD
in the first place.

2. What EmuNAND does
Here's pretty much what happens when you press "Format EmuNAND" in the Gateway launcher:

1. Your SD card's partition table is wiped (data is lost)
2. A small (~1-2GB, maybe?) partition is created
3. A larger partition is created to fill the remaining unallocated space on the SD card
4. An exact copy of your system NAND is made and placed on the SD card's small partition

When you launch Gateway mode or Classic mode, the NAND copy on your SD card
is loaded instead of the 3ds's system NAND. Pretty neat, huh! This allows
you to update the copy of your console's firmware that lives on your SD without
updating your console's actual firmware. It also allows really neat things,
like the ability to install .cia files without worrying about bricking your NAND
firmware. If you install a .cia that bricks your EmuNAND, you can just inject an
EmuNAND backup that i'm sure you made ahead of time, and you're good to go.

3. Why that might cause problems
Mostly this is just why that might cause one relatively big problem. You see, your EmuNAND
really does start off as an exact copy of your system NAND. It has the same unique info,
the same everything. That means that when it wants to write to SD, it can and does write to
the same SD data folder that your system nand uses. This can lead to issues with themes
and cia installations. One of the big issues: If your system NAND and EmuNAND use the same
data folder, going into Data Management while using system NAND will delete ALL
.cias installed to EmuNAND, and ALL of their data. Bad bad bad.

4. How to fix those problems
The main issue is that your system NAND and your EmuNAND have the same unique data, so they
both think that they are the same 3DS and write to the same data folder. You want your
system NAND and EmuNAND to think that they are different systems, so that they will
behave like different systems. Thankfully, performing a System Format on either
system NAND or EmuNAND will achieve this.

But don't do that yet. First you need to create a NAND backup and an EmuNAND backup.
You can make a NAND backup from the Gateway launcher, and you can make an EmuNAND
backup by using EmuNAND Tool.
You're going to want to keep this EmuNAND backup (one of a fresh copy of your NAND),
as well as a backup of a freshly formatted (using System Format, that is) EmuNAND,
as well as a "recent" backup of your EmuNAND.

After you have a backup of your system NAND and your fresh EmuNAND in a safe place,
you can proceed to format one of the two. You're good to go, as long as you don't
have save data from eshop games that you want to be able to use on EmuNAND.

Here are some things to consider when deciding which NAND to format:

1. Your friend code will change on whichever NAND you format
2. You will not be able to access your old Streetpass Mii Plaza data
when you're running on whichever NAND you format
3. You will not be able to access eshop game save data when you're
running on whichever NAND you format
4. You will be able to use the eshop account linked with the console on EmuNAND
regardless of which NAND you format.

However, there is a way to keep your eshop saves. Read on if you'd like to know how.
My recommendation is to format EmuNAND, because there's a much lower chance
that you'll lose things from your system NAND that way.

5. Everything about save data

.3ds saves (all)
These are the ez pz saves. They were made using a Gateway card running a
.3ds rom. There are two types of rom files: Card 1 and Card 2:

Card 1: On a retail cart, the save data would be saved to seperate memory
outside of the game ROM itself, but still on the cart. The way Gateway handles this
is by making a <titleid>.sav file on the SD card. This file can be transferred to
different systems without issue.

Card 2: On a retail cart, the save data gets stored after the ROM, in the same
memory. I'm not 100% sure about this, but I think gateway does it in pretty much
the same way: the save data gets saved to the .3ds file. To back this up, you need
to use savedatafiler. Look for "CTR card"

Just a note, savedatafiler would also work for Card 1 games, but Gateway needs
to fix something for that to work. This means that you can't transfer saves from
Card 1 games to .cia games. Our great savior LioMajor has found a way to
transfer saves from card1 games to .cia! It works on MT Card, though.

One way to fix this is to convert your Card 1 .3ds files to Card 2. It'll only work before
you make your save though. After doing this, you can use savedatafiler to move your
save between the .3ds and .cia. You can use this tool to convert a Card 1 .3ds file into
a Card 2 one. Remember, you have to start a new save if you do this, so do it sooner
rather than later!

.cia files (all) and eshop games (<6.0.0 only, see very last "save data" section)
I'm going to write about eshop games next, because they are the next easiest to
understand. Eshop games, and their saves, are saved to the SD card. They can only
be accessed by the 3DS when it's running on the NAND that they were originally
installed with. Or, more precisely, the NAND that has the same unique info as
the NAND that installed it. This information also holds true for .cia files
(that's almost exactly what eshop games are).

I'm relatively certain, though, that save data is stored encrypted
on the SD card. If you want to back up or transfer a save, you have to use a
program called savedatafiler. It can extract and inject saves to/from the SD card.
It also has the ability to extract and inject saves in card 2 game carts, which I'll
talk about further down.

So, if you have eshop games that you want to back up the save data for,
savedatafiler is the way to do it. Here's the process (as long as the eshop
game and save data haven't been deleted from your SD card):

1. Make you have savedatafiler.3ds (renamed from .csu) on the Gateway red card
2. Backup your EmuNAND using EmuNAND tool
3. Inject your "fresh" EmuNAND backup using EmuNAND tool. This is the one that
has the same NAND data as your sysNAND did when you first started. If you don't
have a backup like this, you can also try injecting your original sysNAND backup.
4. Boot into Gateway mode
5. For each game you want to backup, find the titleid on http://3ds.essh.co/
6. Find the corresponding titleid slot in the first tab of savedatafiler and follow
the directions on the top screen to backup your save (don't choose the "secure" way)
7. The third tab of savedatafiler should show all of the data you've backed up
8. Reinject the backup you made at step 2
9. Install the eshop games again, either from eshop or .cia
10. Open savedatafiler, go to the 3rd tab, and import all of the save data

Your saves should be imported and usable! You can use a similar process for
transferring .cia or eshop saves to a different 3DS.

Note: If, after reading this section, you still have questions about how to use
savedatafiler, see this awesome guide by lemanuel.

Retail carts (<6.0.0 only, see very last "save data" section)

If you're trying to extract a Pokemon X/Y/OR/AS save, look here.
Otherwise, read on...

So this issue is, uh, complicated.

First thing's first, here's how things are supposed to work:

1. You dump your retail cart rom (or maybe obtain it another way?)
2. You dump your retail cart save
3. You rename your .3ds dump to .3dz and put it on your Gateway red card
4. You rename your .sav dump to <titleid>.sav and put it on your SD card
5. Load up the .3ds dump

Now I'm going to tell you that this will work with like 15% of games. Sorry
This will only work if that game's save is 512kb in size. If it isn't then it'll
read as corrupt. That's not the only issue though...

All retail games released after 6.0.0
In firmware 6.0.0-11, nintendo introduced a new way of encrypting save data.
Games that include a 6.0.0-11 or higher firmware on the retail cart use this encryption.
This is where things get dicey. One of the keys used for the encryption is loaded on
console boot. It doesn't get reloaded when you boot into EmuNAND. This used to be
an issue for 4.x users wanting to play retail carts with this kind of encryption.

Gateway basically overcame this issue by making those games playable in Classic mode
using the 4.x key loaded at boot. This meant that the games would save fine, but you couldn't
open that save on a 9.x sysnand console, and the reverse was true as well.

Well, now those 9.x sysnand saves will work in Classic mode, as long as your console is on
sysnand 9.x. Gateway properly uses the 9.x key that was loaded at boot... but if you dump
the same saves with the Gateway launcher, they won't work. I'm pretty sure this is a bug,
and I've sent an email to Gateway about it. You can read about that here.

There are two bottom lines here. The first is that dumped saves won't work under the
following conditions:

1. The game's save is not 512kb in size
2. The game uses >6.0 encryption for saving

The second bottom line is that you will lose the ability to play retail saves that use
>6.0 encryption on your 3ds if you downgrade to system NAND 4.x.
Additionally, if you have >6.0 eshop games that you started playing on a >6.0 system,
and you weren't in gateway mode, you won't be able to keep those saves either*. This is because of
the aforementioned mismatch in the keys used to encrypt and decrypt saves. Basically, if
you want to continue to be able to play retail games with >6.0 save encryption, you need to
stay on the system NAND version you are currently on. You'll need to stay at that system NAND
version until gateway fixes all of these save compatability issues.

THE ISSUES IN THIS SECTION ONLY APPLY TO RETAIL CARTS! See "Eshop games and .cia files" for backing up eshop/cia saves!


* This statement seems to be contested. I can't test it myself because I don't have any eshop
games that fit the criteria, but we have two conflicting stories about this.


6. Why you should think hard before downgrading to 4.x
See the last two paragraphs in the previous section.

I LOVE YOU

 

[DanielJavierGuzz]

Quick question:

"Thankfully, performing a System Format on either
system NAND or EmuNAND will achieve this."

I have seen multiples guides saying how to do it by formatting the nand and this is the first time that I read this.
Do I just enter my emunand system with rxtools and perform a system format? Is that easy? (I already have my nand/emunand/saves backup).

 

[lemanuel]

Quick question:

"Thankfully, performing a System Format on either
system NAND or EmuNAND will achieve this."

I have seen multiples guides saying how to do it by formatting the nand and this is the first time that I read this.
Do I just enter my emunand system with rxtools and perform a system format? Is that easy? (I already have my nand/emunand/saves backup).

Either formatting sysnand or emunand will be able to make them unlinked, yes (Formatting with the option from system settings).
In any case, usually it's recommended to use sysnand since you'll lose what you have installed. All registers from the NAND will be deleted and a new system folder will be created on the SD card for the NAND (since it "forgets" the location of the old one). So if you have stuff on emunand which you don't want to lose, you should format sysnand instead (emunand is a copy of sysnand anyway and so it should contain everything you already had on sysnand).

 

[DanielJavierGuzz]

Either formatting sysnand or emunand will be able to make them unlinked, yes (Formatting with the option from system settings).
In any case, usually it's recommended to use sysnand since you'll lose what you have installed. All registers from the NAND will be deleted and a new system folder will be created on the SD card for the NAND (since it "forgets" the location of the old one). So if you have stuff on emunand which you don't want to lose, you should format sysnand instead (emunand is a copy of sysnand anyway and so it should contain everything you already had on sysnand).

Thanks for the reply! I just bought a bigger SD (which brought me some problems while installing cias when I moved my current emunand to it) and I don't have that many things in my emunand. I want to create a new, clean emunand, so yeah, that's exactly what I want, thanks again ^-^

 

[Ace Overclocked]

Sorry for the stupid question but my Pokemon Y retail cart save doesn't work on emunand, i can only play it on +6 sysnand and i have 4.5 sysnand with rxtools, any way around this?

 

[Lnkcld]

So if I want to continue using my save from Legend of Legacy (which was played on my other legit N3DS 9.x system), I need to reformat my N3DS sysNand (which is currently on 4.5 from the MSet 4.5 exploit) so it returns to sysNand 9.0?

I think I'd rather start over, playing on a Gateway is annoying if I have to access the exploit through the LoZ constantly.

Additionally, is this something that would be hard for gateway to fix? I don't know if it's low priority or difficult since it seems like this has been a problem forever.

 

[es_pablo]

Hello.
Just a question about savegame on Pokémon y and the gateway issue of corrupted savegame.
I got Pokémon y playng on a europe 3ds, don't know the firmware when started playng...
Next, i got a japanese 3ds with 6.3 firmware. I back up the nand and downgrade it to 4.5. Bought the gateway, make the emunand and update to 10.3 (the europe 3ds where play Pokémon Is also up to 10.3).
So now, when i try play Pokémon on jap 3ds it say my save Is corrupted.
The question Is: if i restore my orginal nand (6.3) can i then still launch emunad or create a new emunand and play whit Pokémon or Is it all useless?
Thanks.
Saw now i'm asking, more or less, the same of the user above me. Sorry. Maybe an answer can help both.

 

[Ace Overclocked]

Sorry for the stupid question but my Pokemon Y retail cart save doesn't work on emunand, i can only play it on +6 sysnand and i have 4.5 sysnand with rxtools, any way around this?

bump

 

[Bimmel]

.3ds saves (all)
These are the ez pz saves. They were made using a Gateway card running a
.3ds rom. There are two types of rom files: Card 1 and Card 2:

Card 1: On a retail cart, the save data would be saved to seperate memory
outside of the game ROM itself, but still on the cart. The way Gateway handles this
is by making a <titleid>.sav file on the SD card. This file can be transferred to
different systems without issue.

Card 2: On a retail cart, the save data gets stored after the ROM, in the same
memory. I'm not 100% sure about this, but I think gateway does it in pretty much
the same way: the save data gets saved to the .3ds file. To back this up, you need
to use savedatafiler. Look for "CTR card"

Thanks for your awesome guide.

I got a, I think, simple question.

I used a public header with Triforce Heroes and changed it from .3ds to .3dz. I started a new game and played it online for some hours.

Then I got banned. My fault, I am totally aware of that.

So I injected a private header in my .3dz and wanted to start playing again - only to see that I can't access my save anymore.

My save file should be still on the Gateway SD-card, but I deleted my old .3dz .. what can I do to save my data? Is there a way?

 

[Ryft]

Does anyone know if there is a way to transfer cia save files from one 3DS emunand to another? I tried using savedatafiler and copying over the .dat files but I always get an error when trying to import. Is there something I'm doing wrong?

 

[Mr Chomp]

I keep getting an error trying to backup a 2DS's sysNand using EmuNAND9. Whenever i load it using go.gateway-3ds.com url it goes really slow and gives me an error sayign to failed to create nand.bin

 

[Skeet1983]

Hi guys
I have a N3DS with SysNAND at 9.0 and EmuNAND at 10.3. Today I bought physical "Mario and Luigi Paper Jam" in the US and got a little bit into game and saved. I was hoping I could transfer save to GW, but am unable to do so. I even created save in GW mode for game and backed it up with Savedatafiler. Anyone with GW and this game able to transfer save from physical card/cart to game in GW? Thoughts/help appreciated on this

 

[Apache Thunder]

.... (your SaveDataFiler needs to be r53438 or newer to delete the secure value).

I disagree with the minimum revision you mentioned. My copy of SaveDataFiler is r53176 and it can reset the Secure Value just fine. Can restore Pokemon saves with it just fine after resetting secure value.

 

[daxtsu]

I disagree with the minimum revision you mentioned. My copy of SaveDataFiler is r53176 and it can reset the Secure Value just fine. Can restore Pokemon saves with it just fine after resetting secure value.

I wasn't sure of the exact one needed at that stage, all I knew at that point was of the first leaked one, which didn't have it, and then 55438, which indeed had the secure value erase function.

 

[Apache Thunder]

55438 seems much newer then what I have. I believe the one I am using is from SDK 5.5.0. Unless there's a newer one I'm not aware of....

 

[Lunatics]

Hey guys I have pokemon AS on a 3ds sysnand 7.2. If I boot gateway in classic mode, will I be able to load my retail cart/save on t here without it being corrupted since it works on my sysnand?

 

[3DS5HAX]

I need Help!!!!!!!!!!! I had downgraded my 3ds xl (o3ds) to 9.2.0U but then I Accidently updated my system to 10.50 while I was trying to format the system I'm on 10.5U I got homebrew with menuhax but when I try to downgrade I get an error saying "Failed to read CIA File ! can someone help me right now I'm currently downloading a new 9.2.0u CIA files since the one that I have doesn't work. ill see if it works or not I'm on windows 10, also I have tried all methods like teracopy then name sysupdater to boot.3dsx and all of that. do you have to be on 10.3 to downgrade? because I saw a video of someone with a o3ds on 10.5 and downgrading to 9.2.0

 

[DingusPingus]

I need Help!!!!!!!!!!! I had downgraded my 3ds xl (o3ds) to 9.2.0U but then I Accidently updated my system to 10.50 while I was trying to format the system I'm on 10.5U I got homebrew with menuhax but when I try to downgrade I get an error saying "Failed to read CIA File ! can someone help me right now I'm currently downloading a new 9.2.0u CIA files since the one that I have doesn't work. ill see if it works or not I'm on windows 10, also I have tried all methods like teracopy then name sysupdater to boot.3dsx and all of that. do you have to be on 10.3 to downgrade? because I saw a video of someone with a o3ds on 10.5 and downgrading to 9.2.0

the only way to downgrade to 9.2 from 10.5 is with a hardmod, if you aren't familiar with soldering I wouldn't recommend trying

--------------------- MERGED ---------------------------

Hey guys I have pokemon AS on a 3ds sysnand 7.2. If I boot gateway in classic mode, will I be able to load my retail cart/save on t here without it being corrupted since it works on my sysnand?

yes it will work fine

 

[fsancar]

i´m a noob, and need your guidance master, because i think I´m in trouble, i have an old 3ds that is dead, but i recover the sd card in witch i had 3 eshop games (pokemon x/ruby and SSB for 3ds) now that I get a new 3ds (sysnand 9.2, emunand on reinand 10.6) i don´t know how to get my old saves on the new 3ds, I allready backup the files in my PC (copy paste the o3ds sdcard) and install a .cia o savedatafiller in the emunand, but how can i get the old saves in my new 3ds (I already download the games from the eshop)

 

[BloodRose]

i´m a noob, and need your guidance master, because i think I´m in trouble, i have an old 3ds that is dead, but i recover the sd card in witch i had 3 eshop games (pokemon x/ruby and SSB for 3ds) now that I get a new 3ds (sysnand 9.2, emunand on reinand 10.6) i don´t know how to get my old saves on the new 3ds, I allready backup the files in my PC (copy paste the o3ds sdcard) and install a .cia o savedatafiller in the emunand, but how can i get the old saves in my new 3ds (I already download the games from the eshop)

Same question here really. I used a totally different SD card for the downgrade and CFW install but I need a way to restore saves from eshop games used on the old stock 10.7 profile to the new 10.7 emuNAND.