Hacking [POC] Removing Update Nag on EmuNAND

[d0k3]

It might not work. As what the link tells you, it get contents and place those into the content folder, with their content index as the name.
Also i doubt what if the file creation failed, would it halt?
But there is something more interesting. You may want to compare the title folder within two decrypted NAND partitions of the same region and version.
Since the .app files contains nothing about its content id, an easy fixed TMD (yep that tool) and a valid file could be injected.
I highly doubt that, since you can inject an app, you may even decrypt NAND, replace older files to newer files, and encrypt it back and flash to get a higher firmware.
This may be a better but risky solution for those having trouble with their own 7.x/8.x consoles since this doesn't need NTR to be run.
However an update, such as 9.0 to 9.2 is still needed to correct those .app and .tmd file names. That injection is still a partial update.

Spoiler: Steps?

0.Backup everything, NAND.bin, EmuNAND.bin. And generate the xorpads.
Yes the xorpads generation may be a little difficult if they only have GW.
1.Format EmuNAND to get an EmuNAND of current version.
2.Dump this EmuNAND out and apply the xorpads. Backup the Decrypted NAND, say A and B.
3.Use partial decrypted CIAs, or use the decrypted titlekey to decrypt those Encrypted System Update CIAs. Or others installed ones (only the files).
4.Get the new files to be injected, and mark some of those to be overwritten.
5.Build injected app and tmd. Replace the old one.
6.Repeat till you replace all those system titles needed. And Use tools to replace the files of Decrypted NAND A.
7.Encrypt the NAND back, and inject it to the emunand.
8.Use tools to update the EmuNAND to 9.2, thus fix the naming problem, and may be also the signatures.
9.Dump EmuNAND, fix it to be a valid NAND.bin.
10.Flash the NAND.bin. Good luck.

Still i do doubt if they have a way to run a decryptor to get the xorpads.. I would not make a tool this time. Hope they do nothing wrong.

You mean using the same techniques as in H&S injection for system updating? That might very probably work, but you'd have to run a CFW to even be able to run that system. Somewhat risky, I guess. But still possible.

 

[Syphurith]

You mean using the same techniques as in H&S injection for system updating? That might very probably work, but you'd have to run a CFW to even be able to run that system. Somewhat risky, I guess. But still possible.

The real problem is if they can run a Decryptor to get the xorpads..
GW can help you install Browser maybe.. But you would need it to function well.

Also i mean, use emunand to build an image, and the emunand get partial update to fix the names.
They may even get a lower version if they want (no good). And BBM updates!

Maybe i just dreamed. LOL. Back for bed. Have a good day you!

EDIT: @d0k3 Forgot a WTF version of this. Dump NAND, EmuNAND. Use BBM to update EmuNAND to 9.2.
Dump EmuNAND. Get EmuNAND.bin fixed for NAND.bin. Use GW to "downgrade" to flash it in.

 

[d0k3]

On the matter of getting that feature into Decrypt9, it would in fact be nice to have. However, I think a lot of users would just not care enough for a import.db backup until it would be too late. Sure, you could also grab the import.db from an earlier NAND backup, but maybe the forgetful user doesn't even have that.

What I'm thinking about now, can we also manually edit the import.db? Maybe even find out what other stuff to remove from it? There is documentation about it on 3Dbrew.org, however, what I could really use is data. I'd need a 'clean' import.db (with no installs / updates pending) and a 'tainted' one (with the update nag), preferably both from the exact same system. Can anyone help me with it? We might also have to get that file decrypted on your system, so there might be more work involved. And, a note about this... The import.db is really just that, a database. There is no copyrighted stuff in there, so sharing should be okay, but there is the possibility that you don't want it out in the open. In that case, send me a PM.

 

[d0k3]

Just a quick heads up... I did some research on this. In fact, once we get a handle on the IVFC hash tree thhe import.db has, the only thing we'd need to change in the import.db would be one byte. We could also utilize the import.db to determine exactly which files we can safely delete. That means we wouldn't even have to be in possession of a good import.db to reset the update.nag.

Problem here is the IVFC hash tree - don't know if we can figure this out. There is some info on 3Dbrew, though:
http://www.3dbrew.org/wiki/Savegames#DIFF

Anyways, if someone would be willing to help experiment, to help code or can give useful hints - just write here in thread.

 

[dmc310]

Hopefully it will make it it easier as I am still getting update nags and scared of accidentally hitting A button lol

 

[Ronhero]

Of we could in theory stick an old native firm it wouldn't allow for a nag

 

[d0k3]

Hopefully it will make it it easier as I am still getting update nags and scared of accidentally hitting A button lol

Do you have them on EmuNAND? Or maybe, you've got a hard mod and have them on SysNAND? If so, we could try something, but only if we can be 100% sure you can go back if it goes wrong (as it is with experiments, it has a rather high probability to do so atm).

 

[royant1]

What I did was to remove the update from sysnand (L+R+A+Dpad UP) and inject import.db from sysnand to emunand using RXtools. Seems to work fine.

 

[leonmagnus99]

i want to try this as i despise the update nag too, would i have to format my emunand for this proccess? i really dont want to mess up my nands as they are both great.

i use the N3ds XL , this guide is clear and all.. but i think it will mess up my CIA games i have over 60 games installed i wouldnt want to re-install every game..

 

[d0k3]

i want to try this as i despise the update nag too, would i have to format my emunand for this proccess? i really dont want to mess up my nands as they are both great.

i use the N3ds XL , this guide is clear and all.. but i think it will mess up my CIA games i have over 60 games installed i wouldnt want to re-install every game..

It's pretty easy... just make a backup of your EmuNAND.bin in EmuNAND tool first, apply the fix and if something went wrong, you just flash back the old backup.

What I did was to remove the update from sysnand (L+R+A+Dpad UP) and inject import.db from sysnand to emunand using RXtools. Seems to work fine.

Not a bad idea at all. In theory you just need a clean import.db (it's very likely you could even use one from a different 3DS console).

Of we could in theory stick an old native firm it wouldn't allow for a nag

Flashing the native firm... You mean flashing the FIRM0/FIRM1 partitions?

 

[Ronhero]

Flashing the native firm... You mean flashing the FIRM0/FIRM1 partitions?

No the cia file; I'll check for the title id when I get home

 

[d0k3]

brooo ! i need help with the nag you seem to be smart with these kind of things.

i think i still have the inject tool in my laptop somewhere.. could you please tell me what exactly i have to do to make the NAG dissappear.. ?

ich bin verwirrt , with the guide.. and i dont want to mess up my Emunand or my MSD T.T sooo i hope you can clarify it for me abit ??

Danke !

(from @leonmagnus99, in a PM)

You need:

• EmuNAND tool
• 3DSFAT16Tool
• OSFmount (or similar)
• Decrypt9

In short, what you have to do:

1. Use EmuNAND tool to dump your EmuNAND.bin from your SD. Keep that dump somewhere safe, as long as you have this, nothing bad can happen.
2. Use Decrypt9 to generate the NAND FAT16 XORpad (in XORpad Generator Options)
   
3. Use 3DSFAT16Tool with the EmuNAND.bin and the xorpad to dump the FAT16 .BIN image from the EmuNAND.bin
4. Modify the .BIN image with OSFMOUNT (ie. replace the import.db)
   
5. Use 3DSFAT16Tool to inject the modified FAT16 .BIN image to EmuNAND.bin (NOT into your only copy of the file)
   
6. Use EmuNAND tool to inject your EmuNAND.bin to your SD.

If you don't have an earlier copy of your import.db, get it from your nag-free SysNAND. To get the NAND.bin from there file use Decrypt9's SysNAND Dump/Backup feature (it is in one of the submenus).

 

[leonmagnus99]

(from @leonmagnus99, in a PM)

You need:

i will try this now , thank you very much.

 

[d0k3]

I have a 'tested' method of editing a tainted import.db to remove the update nag. In the tainted import.db, only a single byte has to be changed. 'Tested' is in hyphens, because by now only one person has tested it. There's also a certain risk this modification might mess up your EmuNAND (in fact, injecting an older import.db has that risk, too). And it might not help you at all, it is not sufficiently tested. Should be acceptable, as everyone knows how to make a backup of their EmuNANDs.

So... if anyone is interested I could post a short tutorial or code a small tool to do the modification for you. You'd have to test it for me, though. Just let me know!

By the way, Decrypt9 can now dump & inject the import.db.

 

[Hiatus]

I have a 'tested' method of editing a tainted import.db to remove the update nag. In the tainted import.db, only a single byte has to be changed. 'Tested' is in hyphens, because by now only one person has tested it. There's also a certain risk this modification might mess up your EmuNAND (in fact, injecting an older import.db has that risk, too). And it might not help you at all, it is not sufficiently tested. Should be acceptable, as everyone knows how to make a backup of their EmuNANDs.

So... if anyone is interested I could post a short tutorial or code a small tool to do the modification for you. You'd have to test it for me, though. Just let me know!

By the way, Decrypt9 can now dump & inject the import.db.

Nice find! I'd love to help test it out if time permits (I've been rather busy). Feel free to PM me

 

[d0k3]

I figured I could as well give you my tool.

How it works:

• Dump your import.db via Decrypt9
• Drag and drop the import.db on importfix.exe (attached)
• Inject your import.db via Decrypt9

There's a reason why I didn't simply include this function in Decrypt9. This is highly experimental and might mess up your EmuNAND. In fact, even injecting an older import.db has the potential to mess up your EmuNAND. Don't(!!!) use this with your SysNAND, and have backups of your EmuNAND available. You have been warned. Don't come whining if you lose your EmuNAND setup or even brick your 3DS (if you're 'brave' enough to do this to your SysNAND).

Source code is included for the curious among you.

 

[ZeCroque]

So I gave it a try I dumped import.db from emunand using decrypt9, and used your tool. It gave me an oversized import.db (16320kb) and of course decrypt9 has refused to import it :/ However, I've dumped import.db from Sysnand and injected it into emuNand and it worked! update NAG seems gone for now, thanks

So, to remove the update nags, basics instruction would be :
-(If you have update NAG on sysNand) Power on your console holding L+R+A+↑+Power, then dismiss update
-Backup your emuNand
-Open decrypt9, go to sysNand options>File Dump>Dump import.db
-Go back and go to emuNand options>File Import>Import import.db

Noobfriendly enough isn't it? ^^

 

[d0k3]

So I gave it a try I dumped import.db from emunand using decrypt9, and used your tool. It gave me an oversized import.db (16320kb) and of course decrypt9 has refused to import it :/ However, I've dumped import.db from Sysnand and injected it into emuNand and it worked! update NAG seems gone for now, thanks

So, to remove the update nags, basics instruction would be :
-(If you have update NAG on sysNand) Power on your console holding L+R+A+↑+Power, then dismiss update
-Backup your emuNand
-Open decrypt9, go to sysNand options>File Dump>Dump import.db
-Go back and go to emuNand options>File Import>Import import.db

Noobfriendly enough isn't it? ^^

Thanks for testing! However, you say there was trouble dumping it from EmuNAND? Could you try again? It is almost impossible dumping import.db works from SysNAND but not from EmuNAND.

Edit: One moment... The importfix tool bloated the import.db, correct? Dammit, I should have seen that earlier. Fix coming up!

 

[d0k3]

... and the importfix executable is now fixed, the resulting import.db can now be injected to the EmuNAND via Decrypt9. Check this post for the download!

 

[calebsw]

This is awesome! Such a quick and easy fix. I guess I've used the exe without the bloated bug, but it worked marvelously. I just dumped import.db from old (nag-less) emunand, drop import.db on the exe, then inject it to the new/current emunand, and now i'll be on my way! I'm really just posting so I can find this thread again, because liking a post doesn't leave a log in my profile