Tutorial
Updated
Hardmod - downgrade New 3DS to 2.1 for OTP dumping
Hi all
After trying the emunand 2.1 downgrade method last night unsuccessfully, I have just succeeded in downgrading my hard modded New 3DS from 9.2 to 2.1 in order to dump the OTP. It was fairly straightforward, but I thought I would post the method I used so others can follow it. Just to be clear, if you have a hard mod you don't have to use the emunand method for downgrading to 2.1 which makes things much more straightforward.
This tutorial assumes the following:
If you follow this guide and do not have both a hardmod and a valid sysnand backup, you will hardbrick your console and this will not be recoverable.
I tested this using the following configuration:
Ok, technicalities out of the way. Lets get started.
Part 1: Prepare your SD card
You need the following homebrew apps on your SD card:
Once all of this is copied over, your SD card should look like this:
You will also need the following on your computer:
Part 2: Dump your console’s xorpads
Part 3: Downgrade to 2.1
Part 4: Unbrick SysNAND
If everything went according to plan, when you power on your console you will be running 2.1. You can now dump the OTP, and when you have it you can re-flash your 9.2 sysnand and go back to normal.
After trying the emunand 2.1 downgrade method last night unsuccessfully, I have just succeeded in downgrading my hard modded New 3DS from 9.2 to 2.1 in order to dump the OTP. It was fairly straightforward, but I thought I would post the method I used so others can follow it. Just to be clear, if you have a hard mod you don't have to use the emunand method for downgrading to 2.1 which makes things much more straightforward.
This tutorial assumes the following:
- You have a hard mod installed on your 3DS and know how to use it to read and write the NAND
- You know how to verify a SysNAND backup using md5
- You know how to back up your sysnand, emunand and SD card
- You know how to access hax to get to the Homebrew Launcher
- You know how to install homebrew apps on your 3DS
- You know how to install CIAs using FBI
- You know how to use the command prompt or terminal on the OS you are running on your computer
- You know how to use a hex editor
If you follow this guide and do not have both a hardmod and a valid sysnand backup, you will hardbrick your console and this will not be recoverable.
I tested this using the following configuration:
- EUR New 3DS (non-XL)
- Hard mod
- 9.2 SysNAND
- Cubic Ninja as Homebrew entrypoint
Ok, technicalities out of the way. Lets get started.
Part 1: Prepare your SD card
You need the following homebrew apps on your SD card:
- Homebrew Launcher
- FBI (3dsx and CIA versions)
- SysUpdater (only the CIA is needed)
- MiniPasta
- TinyFormat
- Decrypt9WIP
- 2.1 downgrade pack for your region in SD:/updates/
- load.bin and code.bin in the root directory of the SD card
Once all of this is copied over, your SD card should look like this:
You will also need the following on your computer:
- A hex editor
- 3DSFAT16tool (Windows, Linux)
- The NCSD Header from an Old 3DS
Part 2: Dump your console’s xorpads
- Launch hax and run Decrypt9
- Select “XORpad Generator Options”
- Select “CTRNAND Padgen” and follow the instructions to dump to nand.fat16.xorpad
- Press B to go back to the main menu, and the press SELECT to unmount your SD card
- Put your SD card in your computer and copy nand.fat16.xorpad from the SD card to your computer
- Rename nand.fat16.xorpad to nand.fat16_0x5_.xorpad on your computer
- Delete nand.fat16.xorpad from the SD card
- Put the SD card back in your console, press B and then choose “CTRNAND Padgen 0x4” to dump nand.fat16.xorpad
- Press B to go back to the main menu, and the press SELECT to unmount your SD card
- Put your SD card in your computer and copy nand.fat16.xorpad from the SD card to your computer
- Rename nand.fat16.xorpad to nand.fat16_0x4_.xorpad on your computer
- Delete nand.fat16.xorpad from the SD card
- Put the SD card back in your console, press B and then quit Decrypt9 back to HBL
Part 3: Downgrade to 2.1
- From HBL, run TinyFormat, and format SysNAND
- Reboot the console and complete the initial setup without linking NNID
- Launch hax and run MiniPasta
- Launch hax and run FBI
- Install FBI.cia and sysupdater.cia to SysNAND (SD as the destination)
- Press START to exit FBI
- Launch MiniPasta
- If your 3DS hangs while launching MiniPasta at this point, just power cycle, launch hax, and run MiniPasta again
- Unwrap SysUpdater and open it
- Press Y to downgrade
- Wait for the CIAs to be install and for the console to boot
- SysNAND is now downgraded to 2.1, but is bricked (you will be stuck on a black screen)
- Power off your console
- Remove the SD card from your console, connect it to your computer, delete the “Nintendo 3DS” folder, and place it back in your console
Part 4: Unbrick SysNAND
- Connect your hard mod adapter cable to the 3DS and computer
- Take two backups of SysNAND, one called 2.1.bin and another called 2.1a.bin
- Compare the md5sums of the two images. They should be identical. If they are not, then something is wrong with your hard mod
- If the two md5sums match, you have a good 2.1 SysNAND backup and can delete 2.1a.bin as you will now be working on 2.1.bin
- Move 2.1.bin, nand.fat16_0x4_.xorpad, nand.fat16_0x5_.xorpad and 3DSFAT16tool into the same directory
- Open up a command prompt, cd to the directory containing the files you moved in step 5
- Enter the following commands:
Mac/Linux users:
Code:./3DSFAT16tool -d -n 2.1.bin ctr.bin nand.fat16_0x5_.xorpad ./3DSFAT16tool -i -o 2.1.bin ctr.bin nand.fat16_0x4_.xorpad
Windows users:
Code:3DSFAT16tool.exe -d -n 2.1.bin ctr.bin nand.fat16_0x5_.xorpad 3DSFAT16tool.exe -i -o 2.1.bin ctr.bin nand.fat16_0x4_.xorpad
- Open 2.1.bin and NCSD_header_o3ds.bin into your hex editor
- Copy all of NCSD_header_o3ds.bin
- In 2.1.bin, select everything from offset 0x200 to the beginning of the file. If your hex editor displays the offsets in decimal, this is the first 512 bytes
- Paste to replace this selection with the contents of NCSD_header_o3ds.bin
- Save the file and exit
- Using your hard mod, flash 2.1.bin to your console’s sysnand
If everything went according to plan, when you power on your console you will be running 2.1. You can now dump the OTP, and when you have it you can re-flash your 9.2 sysnand and go back to normal.
Last edited by mashers,