Step 4: The app (in this example, the MSET), breaks the CFW patches (example: 4a-Delete "arm9loaderhax.bin" or the file in "path.txt" 4b-Break the CFW execution from memory 4c-Reboot(*) the console to a new app with high privilegies designed for this case ---CFW patches should be already disabled and the executable will not reload---) and when the patches are off, the app installs the stock official firmware file and cleans all the "non vanilla" files, extdatas (mostly for game based exploits) and keys.
Step 5: Done, you are on --by example: 11.3.0-#X-- SysNAND with no piracy related stuff to do...
(*) There are a lot of ways to do this, even loading this app from A9LH itself (just imagine Nintendo using a A9LH payload)[/USER]