-PLEASE NOTE THIS /WILL/ REQUIRE FLASHING A MODIFIED NAND BACKUP TO YOUR CONSOLE. ALWAYS MAKE SURE YOUR MODIFIED NAND BACKUP WORKS IN EMUNAND BEFORE FLASHING TO AVOID A BRICKED CONSOLE!!!!!!!!!!
-AFAIK, THIS ONLY WORKS WITH ESHOP CONTENT DOWNLOADED ON THAT CONSOLE. NO YOUR DOWNLOADED CIA'S WILL NOT WORK IN SYSNAND WITH THIS METHOD.
-MYSELF/GBATEMP ARE NOT RESPONSIBLE IF YOU BRICK YOUR CONSOLE DOING THIS. (As long as you test your modified NAND backup inside of emuNAND before flashing it, you should be fine.)


Shoutouts to cearp and liomajor for helping me with this.


Requirements:

-4.x Console (9.x downgraded to 4.x will work. It's just to get XORPads. You /can/ modify your 9.x backup if you wish to restore back to 9.x with your eShop content).
-LINKED emuNAND and sysNAND (If you've system transferred from another console to your current emuNAND, this will also work. Adding moving the file "movable.sed" makes this possible).
-emuNAND with wanted eShop content downloaded and installed
-Backup of sysNAND that you want to move eShop content to
-Backup of emuNAND with eShop content (you will be overwriting this emuNAND to test your modified sysNAND before flashing it to your console. You can always write it back with emuNANDTool)
-File pack located below
-Hex Workshop

Guide:
Step 1: Make a backup of the sysNAND you want to add eShop content to. Store this somewhere safe.
Step 2: Make sure your emuNAND has the eShop content you want moved. Back this up with emuNANDTool. Store it somewhere safe.
Step 3: Copy the TOSD folder to your 3DS' BIG SD card.
Step 4: Install the DS Profile Exploit if needed. Follow the usual steps to get into 3DS_Multi_Decryptor.
Step 5: Choose the "NAND FAT16 XORPAD" Option
Step 6: Let the process finish, then power off your console
Step 7: Copy the newly created nand.fat16.xorpad file to your working directory.
Step 8: COPY your EMUNAND WITH ESHOP CONTENT to your working directory.
Step 9: Rename the previously mentioned emuNAND backup to emuNAND.bin.
Step 10: Drag the "emuNAND.bin" onto "dragNandDumpForFat16.bat"
Step 11: Let the process finish
Step 12: Double click "decrypt.bat". If you haven't renamed any files, this should spit out a file named emuNAND.bin.out
Step 13: Open up emuNAND.fat16.bin.out inside of WinImage.
Step 14: Navigate to the "dbs" folder.
Step 15: Copy the ticket.db file to your working directory/somewhere safe.
Step 16 (ONLY IF YOU'VE SYSTEM TRANSFERRED TO EMUNAND): Go back to the root of your emuNAND in WinImage. Navigate to the "private" folder. Copy the movable.sed file to your working directory/somewhere safe.
Step 17: Close winimage. Move "emuNAND.bin, emuNAND.fat16.bin, emuNAND.fat16.bin.out" to a backup folder, just in case.
Step 18: Copy the SYSNAND IMAGE YOU WANT TO MODIFY to your working directory. Rename this to emuNAND.bin. Follow steps 9-13 to get this image open in WinImage.
Step 19: Navigate to the "dbs" folder. Copy the previously extracted ticket.db to that folder, overwriting the old one.
Step 20 (ONLY IF YOU'VE SYSTEM TRANSFERRED TO EMUNAND): Navigate to the "private" folder. Copy the previously extracted "movable.sed" into that folder, overwriting the old one.
Step 21: Close WinImage.
Step 21.5: Rename "emuNAND.fat16.bin.out" to "test.bin"
Step 22: Open a command prompt window, CD to your working directory
Step 23: Paste the following command into the prompt "padxorer.exe test.bin nand.fat16.xorpad". Let the process finish.
Step 24: Open up "emuNAND.bin" and "test.bin.out" inside of Hex Workshop. Shrink the bar with '0 1 2 3 4 5 6 7 8 9 A B C D..." so your workspace looks like this in BOTH FILES: http://i.imgur.com/kZOUWa0.png
Step 25: Go to your "emuNAND.bin" tab, and press CTRL+G to open the "goto" prompt
Step 25: Make sure the offset is "Hex", "From Where" is "Beginning of File", and paste "B930000" in the Offset box. Click ok
Step 26: Go to test.bin.out, Press CTRL+A to highlight everything and CTRL+C to copy all the data.
Step 27: Go back to emuNAND.bin, Highlight everything from the B930000 offset to the bottom of the file. Press CTRL+V to overwrite it with the content of test.bin.out.
Step 28: Inject the newly modified emuNAND.bin to your emuNAND. (If you did the System Transfer steps, it will take you to the 3DS' setup screen. Follow the steps.)
VERIFY THAT THIS BOOTS PROPERLY IN EMUNAND BEFORE FLASHING TO YOUR SYSNAND. IF IT DOESN'T, START THE PROCESS OVER AND DOUBLE CHECK YOUR DID THE STEPS IN HEX WORKSHOP PROPERLY.
Step 29: Double check that all your eShop content is showing up properly in the newly modified emuNAND.
Step 30: Power off your 3DS. Copy the newly modified emuNAND to your 3DS' BIG SD Card. Rename the file to NAND.bin.
Step 31: Boot into the GW menu holding "L". Scroll over to the "Downgrade Console" option, and select it while holding "up". Let the process finish and reboot your console.
Step 33: Pop your 3DS' big SD card back in your computer. Restore your ORIGINAL EMUNAND backup you made earlier.
Step 34: Congratulations! You should now have your emuNAND eShop content on sysNAND!

 

[caitsith2]

This guide proved quite useful, in helping me get legit CIA integrated into my 9.6 emunand. I first moved the ticket.db from my 9.6 to my 9.2 backup, injected that, installed the legit CIA, then moved the ticket.db back to my 9.6 emunand. Not bothering to put them on my sysnand, since I plan to always boot into an emunand every single time.

 

[urherenow]

Just bricked my N3DS without actually bricking it completely.

Anyway, what I did is take the movable.sed, and ticket.db from my current 9.5 emunand just as the instructions say to, and replaced the ones in my 9.0 nand dump with them. I then deleted the data/<ID0> folder from the nand dump, and then injected the one from emunand.

Did the last bit because they were unlinked (I know, this was probably dumb). Anyway, it *seemed* to work in emunand, so I flashed it to sysnand. Sysnand took a longer time to boot up than I was used to (thought I had a black screen brick for a second) but it did work, and so did my installed games! I was happy I could finally run DSiWare and GBA VC on my N3DS now via sysnand.

But then I realized that while Ninjhax works, Brahma doesn't, and neither does libkhax. They fail on the arm11 exploit. Never the less... GW is broken also. All of this even though I am on sysnand 9.0. GW is broken with both CN and OOT. My only option now is to solder

Edit: What's really strange is that all of my Street Pass and Mii Plaza progress from emunand were showing up, but data management could not read anything. Anyway, I will try one more thing before soldering. I'll go ahead and buy SSBB tomorrow and update to 9.2 with it.

 

[Arkansaw]

just theorycrafting.. someone suggested that I could use this to system transfer from 9.7 sysnand o3ds to another 9.7 emunand (9.2 sysnand) o3ds, move the ticket to sysnand, then system transfer again from the second o3ds to 9.2 sysnand n3ds via firmware spoof? sounds good?

 

[Arkansaw]

My emunand was system transferred from 9.7 sysnand, so I need to replace the data folder as well with the contents from emunand. That was the only problem I encountered

 

[vastrolorde]

how bout system transfering legit cias installed by pbt cfw. then rx tools update to 9.7 emunand from old 3dsxl to new 3dsxl 9.7 sysnand? have anyone managed to do it?

 

[urherenow]

how bout system transfering legit cias installed by pbt cfw. then rx tools update to 9.7 emunand from old 3dsxl to new 3dsxl 9.7 sysnand? have anyone managed to do it?

The riddle has been solved and tutorials put up on manual system transfer. The magic bit was to delete the last 0x20 bytes from Movable.sed (so its entire size is 0x120) and zero out the 4 bytes next to "SEED" at the top. Inject that and delete the data/<ID0> folder, then re-encrypt and inject it to the nand and flash it. Power on and you'll be greeted with the language select screen. IF you're hard modded, you can power off right then and there and make another dump. This time, inject the contents of data/<ID0> (which you'll notice now matches the name of Nintendo 3ds/<ID0> from your SD card now) and copy everything from the old SD card to the new one.

That's it. Everything transferred including any installed game that is legit. This is assuming, of course, that the target system is actually associated with your NNID. Now I'm hard modded and fully transferred over.

 

[xdarkmario]

I've decrypted my NAND, where do i find my mii plaza data?

 

[Philip3ds]

I need help with the Hex Workshop. I don't know where to shrink the bar.

 

[Deleted-19228]

It's been 9 months and no one noticed that the OP has a pirated serial number for WinImage? LOL