See https://github.com/Plailect/Guide/wiki/Hardmod-Downgrade

 

[James310]

When I was in 10.3 version i backed up my nand.bin with gateway ultra.

So many things is wrong in that sentance...

 

[gamesquest1]

Actually, it's possible (although troublesome) to do more than this, simply because of a weakness in the 3DS encryption scheme.

• NAND is divided into well-known partitions
• Each sector of each partition will have a constant XorPad
• The data stored in that sector is OLDDATA ^ XORPAD
• If you want to store new data in that sector, result will be NEWDATA ^ XORPAD

Thus, if you can predict BOTH the sector where information is stored, and can cause the 3DS to store known values there (or otherwise know the expected data), you can update it. Here's why (just XOR'ing both sides by the same value to get to next lines):

• X ^ X == 0
• oldEncryptedSector ^ UpdateXor == newEncryptedSector
• OldData ^ XorPad ^ UpdateXor == NewData ^ XorPad
• OldData ^ UpdateXor == NewData
• UpdateXor == NewData ^ OldData (no XorPad value needed)

Put another way, the XORPAD is exposed when the sector and expected data are known:

• OldEncryptedData ^ XorPad == ClearData
• OldEncryptedData == ClearData ^ XorPad
• OldEncryptedData ^ ClearData == XorPad

Thus, if you know post the sector number where the information is stored, and the cleartext data, you can trivially update it. Since the firmware partitions store everything at a known offset, the XorPad can be reconstructed.

In contrast, the CtrNand partition uses a FAT16 file system, allowing files to be stored in nearly any sector. Thus, it's much harder to RE the xorpad using only the encrypted data (+ analytics on expected data + which bits change when), especially where the file system operations are not easily controlled from user-mode apps.

yeah thats pretty much what i said , if you have the plaintext of the specific offset off the file you intend to fix then you can make an xorpad but for most people who brick they almost certainly wouldn't know exactly what it was they flashed to brick nor where the 3DS would have stored it on the nand, plus with some bricks being caused by the installation of o3ds titles on a n3ds or vise versa i doubt anyone truely could be bothered trying to map out/predict where exactly a bunch of system titles would be stored, basically as a theoretical thing sure there is a certain level of possibility, but practically for the kinds of people who screw up their sysnand and haven't even made a nand backup i would take a leap and say it would be way too much effort with no promise of results

 

[suhaib10]

Hey guys I need some help, my friend's n3ds is on 10.6 if he hardmods it and change the native_firm to 10.2.
Will this allow browserhax use on 10.6 or will he still need an alternate method, like OOT or CN do access homebrew to downgrade.

 

[Robert McCoy]

It's reported to work with the 10.6 but has anyone here tried it? Can you make a video demonstrating it works with the latest update i.e. 10.6? In your free time of course.

 

[vb_encryption_vb]

It's reported to work with the 10.6 but has anyone here tried it? Can you make a video demonstrating it works with the latest update i.e. 10.6? In your free time of course.

There is no need for a video. Native_Firm wasn't updated.

 

[Robert McCoy]

There is no need for a video. Native_Firm wasn't updated.

Thanks for the reply

 

[HoloryTV]

Little question please, my old 3ds is in 10.3.0-28 so when I try to use browser it asking to update the console.

If I refuse I can't use it, how to do ?
Thanks !

 

[James310]

http://yls8.mtheall.com/3dsbrowserhax.php , you can bypass it now...

 

[HoloryTV]

http://yls8.mtheall.com/3dsbrowserhax.php , you can bypass it now...

I listened that it bas been patched, am I wrong ?

Thx for answer

 

[James310]

I listened that it bas been patched, am I wrong ?

Thx for answer

"Where" did you listen because it's not and this fix was discovered yesterday...

 

[HoloryTV]

"Where" did you listen because it's not and this fix was discovered yesterday...

It work love u my dear !

 

[tvall]

if i uploaded my nand backup somewhere, could someone do this for me? wine and winxp dont like the ctrtool.exe in that autofirm archive

edit: nvm. set up a win7 vm.

btw, 10.5 o3dsxl -> 9.2 -> 2.1 -> back to 9.2 -> 10.6 w/ a9lh

 

[dg_dex]

[n3DS - 9.2 -> 10.6 -> 10.2 -> 9.2] confirmed running stable. I'm using menuhax with GW as we speak.

 

[samurayjp]

I have a bicked 3ds wich I don't know what firmware. When I turn it on the blue light flashes, but no screen and no sound.

Could I use this to modify a early firmware?
Probably 2.+

 

[Spore2]

I have a bicked 3ds wich I don't know what firmware. When I turn it on the blue light flashes, but no screen and no sound.

Could I use this to modify a early firmware?
Probably 2.+

AFAIK this method can't be used to unbrick a 3DS. It only works to patch 10.4 up fw so that it works like a 10.3 fw restoring memchunkhax2

 

[samurayjp]

I have access and can dump and inject nand through hardmod.
Does anyone know if you can change (restore ou update) this nand (possibly damaged) and reinject?

 

[Lightyose]

So many things is wrong in that sentance...

I meant 9.2U sorry...

 

[Arubaro]

(Necrobump, sorry)
Would be in theory possible to use this method to "downgrade" from 11.0 to 10.7 and then use the regular method?

 

[Deleted member 370671]

(Necrobump, sorry)
Would be in theory possible to use this method to "downgrade" from 11.0 to 10.7 and then use the regular method?

https://www.reboot.ms/forum/threads/downgrade-3ds-11-0-to-9-2-using-hardmod.2403/
I assume it still requires an entrypoint like OOT/CN/PSMD/VVVVVV/CoE since the browser doesn't seem to be downgraded during the process, but at least it's still possible.

 

[Plailect]

For users who do not speak Italian to make an account on Reboot.ms, the instructions and files have been re-added to the main guide.

https://github.com/Plailect/Guide/wiki/Hardmod-Downgrade