Hacking [PSA]DSiware downgrade can be done with hyperbanned 3DS as a source

[Wojton]

Just performed a successful DSiware downgrade with hyperbanned 3DS as a source. Source 3DS had both 002-0102 and 022-2812 ban.

• I've used this method to bypass 002-0102 ban (regain access to eShop) and unlink my NNID from banned console (changing the console ID, stored at the end of SecureInfo_A AND injecting a blank nnidsave.bin is neccessary on the banned console!) Accessing NNID settings still resulted in 022-2812 error, but it allowed me to use System Transfer again.
  
• I've purchased Fieldrunners with no NNID linked to the source 3DS and System Transfered it to unbanned, target 3DS without any issues.
  
• Most importantly, it seems that SecureInfo_A and LocalFriendCodeSeed_B didn't get transferred from the banned, source 3DS - I have used a hex editor to compare these files dumped from source console before the transfer and dumped from target console after the transfer with hex editor, their contents are completely different.
  
• Target console has A9LH installed now and remains unbanned after the process - no issues with accessing NNID settings, eShop, playing games online.

I haven't found any informations on that so I decided to mention it here. That said, use this information at your own risk - I take no responsibility if your target console ends up getting banned after performing a system transfer - I'm just saying that was not the case for me. I would also like to know if there are any other files (that are checked by Nintendo servers) that I should compare to make sure they haven't been transferred? If so, which ones?

 

[fodder]

I'm pretty sure the everything Nintendo checks for 022-2812 is in OTP (and SecureInfo_A, which would be stupid if it transferred over because the target system would essentially have the same serial as the source system), or some write only area, so that shouldn't transfer, since well, it should be technically impossible.

For 002-0102, it seems all they check is LocalFriendCodeSeed_B, which has been confirmed to not change in multiple tests by multiple people, so it's looking good (and probably safe), granted you can initiate the system transfer in the first place.

Will be trying this myself tomorrow, I'll post in this thread how it goes as well.

 

[Queno138]

And your Source 3DS remains hyperbanned?

This method states that System Transfer from banned (source) to unbanned (target) unbans source 3DS (while target may get banned)

Any confirmation from OP @Wojton?

 

[fodder]

And your Source 3DS remains hyperbanned?

This method states that System Transfer from banned (source) to unbanned (target) unbans source 3DS (while target may get banned)

Any confirmation from OP @Wojton?

According to who?

--------------------- MERGED ---------------------------

According to who?

nvm you edited the post my bad

 

[Queno138]

According to who?

nvm you edited the post my bad

yeah sorry, I realised I forgot to hyperlink the "the method" XD


Also, I'm wondering:

1: backup nand from target
2. systrans source (banned) > target (unbanned)
3. restore nand to Target (which may have been potentially banned)

Do the apps still work for Target, and would Target get unbanned?/
Restoring nand to target won't unban it, read this:

I've just restored a NAND backup that was not linked to my NNID and the system is still banned from creating a new NNID. The target 3DS does take the full ban.

 

[fodder]

yeah sorry, I realised I forgot to hyperlink the "the method" XD


Also, I'm wondering:

1: backup nand from target
2. systrans source (banned) > target (unbanned)
3. restore nand to Target (which may have been potentially banned)

Do the apps still work for Target, and would Target get unbanned?

idk I don't understand that post, it makes no sense to me that the source would get unbanned & target banned

 

[Queno138]

idk I don't understand that post, it makes no sense to me that the source would get unbanned & target banned

It seems like the console ID may have been moved during the system transfer,
and the source is assigned a new one/signature changed/assigned new one from server,
hence why the source becomes unbanned (and the targets banned).

Having actual confirmation will be good.

I have the same model as a unit from a friend,
but I don't want to risk banning his model and other file related shenanigans.

 

[fodder]

It seems like the console ID may have been moved during the system transfer,
and the source is assigned a new one/signature changed/assigned new one from server,
hence why the source becomes unbanned (and the targets banned).

Having actual confirmation will be good.

I have the same model as a unit from a friend,
but I don't want to risk banning his model and other file related shenanigans.

But how? Isn't that loaded from bootrom to RAM?

 

[Queno138]

But how? Isn't that loaded from bootrom to RAM?

That's what I don't undertstand.

I have 2 Japanese units of my own, except the banned is N3DS, and my not banned is 2DS.
If I wasn't affected by the N3DS > 2DS transfer lock, (edit: note, apparently N3DS can't transfer to 03DS family units)
I would have tested this myself.

 

[fodder]

also @Wojton how did you download Steel Diver without an NNID linked? Did you have it DL'd before?

 

[NBAPwns13]

Hope you guys can keep me updated. I can do a 03ds banned ---> n3dsxl, but im scared to risk getting my target banned

 

[Queno138]

Hope you guys can keep me updated. I can do a 03ds banned ---> n3dsxl, but im scared to risk getting my target banned

from the thread I tagged earlier, I read that:
1. your target will definitely be banned
2. restoring nand dump won't resolve it

worse part is, you can't transfer from N3DS to O3DS to get your N3ds unbanned, if you ever regret it.

edit: it's this:

I've just restored a NAND backup that was not linked to my NNID and the system is still banned from creating a new NNID. The target 3DS does take the full ban.

If we can do what @MattKimura suggested,
Perhaps we could all take turns per week to transfer to one device,
to make that the one banned device (if it even works that way..)

 

[Wojton]

also @Wojton how did you download Steel Diver without an NNID linked? Did you have it DL'd before?

I've used basehaxx instead of steelhax.

And your Source 3DS remains hyperbanned?

This method states that System Transfer from banned (source) to unbanned (target) unbans source 3DS (while target may get banned)

Any confirmation from OP @Wojton?

I disagree with that statement. In my case, source 3DS remained banned after the transfer. Furthermore, System Tranfer doesn't generate a new movable.sed as some people suggest - it only swaps movable.sed between the source and target console - meaning that if you try to use the obtained movable.sed on the banned console, turn it into unbanned Localfriendcodeseed_B, the end result is exactly the same as if you've copied Localfriendcodeseed_B from the target (unbanned) console to the banned one, meaning that if you end up getting banned again, the other console will get banned too.

 

[fodder]

I've used basehaxx instead of steelhax.

Thank ya, I also realized that you could use browserhax (it seems) to do this as well

 

[Wojton]

Thank ya, I also realized that you could use browserhax (it seems) to do this as well

While I've read that browserhax update nag is bypassable on firmware 10.7.0-32/11.0.0-33 if all connections to Nintendo servers are blocked by router, it only works with some routers and the exploit itself is quite unreliable, so I personally wouldn't use it for downgrading. I recommend using other homebrew entrypoints if possible.

 

[fodder]

While I've read that browserhax update nag is bypassable on firmware 10.7.0-32/11.0.0-33 if all connections to Nintendo servers are blocked by router, it only works with some routers and the exploit itself is quite unreliable, so I personally wouldn't use it for downgrading. I recommend using other homebrew entrypoints if possible.

Gotcha. And to confirm, source system stays banned, right?

 

[Wojton]

Gotcha. And to confirm, source system stays banned, right?

It did in my case, yes. Its not much of a surprise given that console-specific files (which are likely used by Nintendo servers to determine whether the console is blacklisted or not) didn't get transferred to the target system. This is also why the target console remained unbanned after the process.

 

[Deleted User]

in my past experience a system transfer bans the target. my old 3ds was banned from using credit cards and when i did a system transfer it banned the new one

 

[Queno138]

It did in my case, yes.

1. Are both units on A9LH?
2. Have either units done system transfer before, prior to the ban?

Trying to see if there's a correlation between the method purportedly working and system transfer/A9 usage

 

[Wojton]

1. Are both units on A9LH?
2. Have either units done system transfer before, prior to the ban?

Trying to see if there's a correlation between the method purportedly working and system transfer/A9 usage

1.Before the transfer, only the source console was A9LH'd, obviously. Now, both consoles are running A9LH.
2.Not that I know of, no.