# 3DS Unbricking Possible!



## YoshiInAVoid (Jan 26, 2014)

_Blue Screen of Death caused by Gateway 3DS card, resulting in a brick_​ 
krisztian1997 and bkifft have written some code available on Github which can be run on a Raspberry Pi or an Arduino (models without a 3.3v output will need either a voltage divider or an SD card shield) to unbrick a 3DS.

It requires a hardware mod, (opening up the 3DS and soldering some pins to the eMMC) but never the less, it is now possible without having to send in your 3DS to the Gateway team!

You must have a NAND backup (created previously from emuNAND) in order to restore the firmware after the eMMC has been unlocked and erased.

eMMC Pinout (dat3 only needed if using Arduino): http://gbatemp.net/attachments/vrije-opmerking_20140126_123816_01-jpg.6106/
Code (Arduino): https://github.com/krisztian1997/3dsunbricker
Code (Raspberry Pi): https://github.com/bkifft/RPU
Source: http://gbatemp.net/threads/3ds-unbricking-progress.361171/


----------



## redkeyboard (Jan 26, 2014)

Awesome news! It's amazing what those guys have done. Let's just hope Gateway doesn't try another method now that this one is fixable.


----------



## krisztian1997 (Jan 26, 2014)

redkeyboard said:


> Awesome news! It's amazing what those guys have done. Let's just hope Gateway doesn't try another method now that this one is fixable.


 
There is only one more method what can f*ck up the console and is permanent, setting the permanent write protection bit.


----------



## misterb98 (Jan 26, 2014)

Great news! It also looks like these are the same pins used for dumping your nand (except dat3, which you do not need for that function). Someone should make a commercial product for the 3ds XL that allows for easy dump/restore, unbricking, and extends the battery.

This almost warrants not having to be so afraid of GW 2.0b2... hopefully they won't do more damage in 2.0....

Edit: got double ninja'ed!

Edit2: Now the code just needs to be refined/polished and a compresensive tutorial released for the oncoming noob swarm!


----------



## krzz (Jan 26, 2014)

Awesome news. Now I hope that the Gateway 3DS Team will fix this BSOD problem.


----------



## bkifft (Jan 26, 2014)

just a short word of caution: my code unbricked a 3DS already, but it's still wonky as hell, spews debug output all over the place, reports failure even though it succeeds etc. Not really meant for end user usage right now. Heck, it's so prealpha it's omega.

I just cobbled it together to help one user and as a proof of concept. I'll receive a MMC card around wednesday and will try to clean up the code then and even build a more enduser friendly package.

But: It's released under the GPL, so if you want a go and tinker with it: go ahead. Just heed the warnings.


edit: my solution works with the 4 wire nand dump SD interface.


----------



## krisztian1997 (Jan 26, 2014)

misterb98 said:


> Great news! It also looks like these are the same pins used for dumping your nand (except dat3, which you do not need for that function). Someone should make a commercial product for the 3ds XL that allows for easy dump/restore, unbricking, and extends the battery.
> 
> This almost warrants not having to be so afraid of GW 2.0b2... hopefully they won't do more damage in 2.0....
> 
> Edit: got double ninja'ed!


 
You only need the extra DAT3 for arduino (my code ardu code is still untested because I couldnt find a test subject), raspberry pi works with the standard nand dumping wires.


----------



## Veho (Jan 26, 2014)

This is great news. Congratulations to the developers, great work, guys


----------



## YoshiInAVoid (Jan 26, 2014)

krisztian1997 said:


> You only need DAT3 for arduino, raspberry pi works with the standard nand dumping wires.


Updated first post. It seems that an Arduino is much harder to use than a Raspberry Pi since it requires an extra solder point, as well as a way to regulate the voltage to be 3.3v.


----------



## krisztian1997 (Jan 26, 2014)

YoshiInAVoid said:


> Updated first post. It seems that an Arduino is much harder to use than a Raspberry Pi since it requires an extra solder point, as well as a way to regulate the voltage to be 3.3v.


 
Yes, because arduino is only a small microcontroller, so working with SD card is a bit harder using SPI, while raspberry pi is an entire computer on a board.


----------



## YoshiInAVoid (Jan 26, 2014)

I know, I own both an Arduino Uno and a Raspberry Pi


----------



## Luigi2012SM64DS (Jan 26, 2014)

krzz said:


> Awesome news. Now I hope that the Gateway 3DS Team will fix this BSOD problem.


 
Keep hoping.
btw good job!


----------



## Tom Bombadildo (Jan 26, 2014)

Great job, figured this would happen.

Too bad this isn't user friendly at all though. Suppose this enables a couple people to set up de-bricking services for those non-Gateway users, but other than that...


----------



## Foxi4 (Jan 26, 2014)

Tom Bombadildo said:


> Great job, figured this would happen.
> 
> Too bad this isn't user friendly at all though. Suppose this enables a couple people to set up de-bricking services for those non-Gateway users, but other than that...


NAND Flashing isn't user-friendly at all as a general rule - it's something done by people with the know-how. If we had a correctly sized NAND clip, things would look differently.


----------



## YoshiInAVoid (Jan 26, 2014)

Might be able to offer an unbricking service in the UK; I'm setting up my Raspberry Pi now. If the tools seem to be working OK on an SD card, I'll try and brick my 3DS and test this for myself.


----------



## gamesquest1 (Jan 26, 2014)

YoshiInAVoid said:


> Might be able to offer an unbricking service in the UK; I'm setting up my Raspberry Pi now. If the tools seem to be working OK on an SD card, I'll try and brick my 3DS and test this for myself.


Make sure you have a nand dump XD


----------



## YoshiInAVoid (Jan 26, 2014)

gamesquest1 said:


> Make sure you have a nand dump XD


Already got one; going to make another just to check it isn't corrupted. Gotta be super careful


----------



## krisztian1997 (Jan 26, 2014)

YoshiInAVoid said:


> Already got one; going to make another just to check it isn't corrupted. Gotta be super careful


 
If you got an arduino and the sd shield you could test if SPI still work on 3ds...


----------



## YoshiInAVoid (Jan 26, 2014)

Unfortunately I do not have the SD Shield so I cannot test the Arduino code, sorry.


----------



## gamesquest1 (Jan 26, 2014)

I was thinking of offering a uk service, but seems it's already covered 
Good luck yoshi, and you ways well make a hardware dump while you have the wires connected........just to make 10000% sure


----------



## bkifft (Jan 26, 2014)

YoshiInAVoid said:


> Might be able to offer an unbricking service in the UK; I'm setting up my Raspberry Pi now. If the tools seem to be working OK on an SD card, I'll try and brick my 3DS and test this for myself.


currently my code will only work on (e)MMC devices. so if you want to test it first, you'll have to use an oldschool MMC card.

edit: oh, and as all it does is init the card, give some debug output and send the force erase command nothing will happen unless the card is already locked.


----------



## YoshiInAVoid (Jan 26, 2014)

bkifft said:


> currently my code will only work on (e)MMC devices. so if you want to test it first, you'll have to use an oldschool MMC card.
> 
> edit: oh, and as all it does is init the card, give some debug output and send the force erase command nothing will happen unless the card is already locked.


OK, thanks, I didn't know that. I just ordered a 64Mb MMC card from eBay (was only £1 or so). Could you provide me with some code to lock the card?


----------



## Ryukouki (Jan 26, 2014)

What you guys are doing has some real merit. Congratulations on the efforts thus far, and as of now you guys have a spot on the front page.


----------



## bkifft (Jan 26, 2014)

YoshiInAVoid said:


> OK, thanks, I didn't know that. I just ordered a 64Mb MMC card from eBay (was only £1 or so). Could you provide me with some code to lock the card?


 
sure, i can cobble something together for you. i'll just need some distance to this whole thing, spent nearly all my spare time this week on it.

you might be able to speed up my recovery by fulfilling the request i stated in the project readme *wink wink nudge nudge*


----------



## MichiS97 (Jan 26, 2014)

Just a question, with this progress going on I guess that there will be some unbricking services on here soonish but will those be available to Non-XL 3DS models too? I don't really understand much of this but AFAIK the XL doesn't need to be soldered because you can use Pogo-Pins (I don't know what this is but I think I get the gist) and the non-XL has some awkwardly positioned pins, so is there any hope for normal 3DS users who can't mod the hardware themselves, too? The brick didn't affect me (yet), but knowing that somebody could help me should my system brick would make me feel better ^^


----------



## bkifft (Jan 26, 2014)

MichiS97 said:


> Just a question, with this progress going on I guess that there will be some unbricking services on here soonish but will those be available to Non-XL 3DS models too? I don't really understand much of this but AFAIK the XL doesn't need to be soldered because you can use Pogo-Pins (I don't know what this is but I think I get the gist) and the non-XL has some awkwardly positioned pins, so is there any hope for normal 3DS users who can't mod the hardware themselves, too? The brick didn't affect me (yet), but knowing that somebody could help me should my system brick would make me feel better ^^


 
I think i remember reading in the nand backup mod thread a few tempers offering their service to do the mod even on regular 3DSes. Heck, as there is nothing illegal involved you can even ask your local smartphone repair store if they'd be willing to do it.


----------



## MichiS97 (Jan 26, 2014)

bkifft said:


> I think i remember reading in the nand backup mod thread a few tempers offering their service to do the mod even on regular 3DSes. Heck, as there is nothing illegal involved you can even ask your local smartphone repair store if they'd be willing to do it.


 
So I'd have to send them a tutorial on how to do the soldering and then just tell them, "yeah just hook a Raspberry Pi onto that" and to run the unbricking code?  Or is it possible that I can run the code with my PC too?


----------



## krisztian1997 (Jan 26, 2014)

MichiS97 said:


> So I'd have to send them a tutorial on how to do the soldering and then just tell them, "yeah just hook a Raspberry Pi onto that" and to run the unbricking code?  Or is it possible that I can run the code with my PC too?


 
They have to run the unbricking code using a raspi. For those who dont really understand, all what the code does is to do some low-level communication with the controller, then after the controller is initialized send CMD42 with 0x08 argument, wait some cycles untill the DAT0 line is not held low anymore and then reflash the NAND backup


----------



## bkifft (Jan 26, 2014)

MichiS97 said:


> So I'd have to send them a tutorial on how to do the soldering and then just tell them, "yeah just hook a Raspberry Pi onto that" and to run the unbricking code?  Or is it possible that I can run the code with my PC too?


Well, i was talking about the HW mod mainly. But if you can convince them that there may be a market in unbricking 3DSes I'm sure they'd be willing to spend the 30ish € on a raspberry.

Or just ask around your friends and family, the Raspberry is quite wide spread.

Or you could just buy a Raspberry Pi and use it for something else after the unbrick. It works great as a media player or a downloader client (torrent/jdownloader) for example and runs at 5Watt.


----------



## krisztian1997 (Jan 26, 2014)

bkifft said:


> Well, i was talking about the HW mod mainly. But if you can convince them that there may be a market in unbricking 3DSes I'm sure they'd be willing to spend the 30ish € on a raspberry.
> 
> Or just ask around your friends and family, the Raspberry is quite wide spread.
> 
> Or you could just buy a Raspberry Pi and use it for something else after the unbrick. It works great as a media player or a downloader client (torrent/jdownloader) for example and runs at 5Watt.


 
I wish I had got an raspi instead of my arduino... my arduino is booring compared to what your raspberry can do


----------



## MichiS97 (Jan 26, 2014)

bkifft said:


> Well, i was talking about the HW mod mainly. But if you can convince them that there may be a market in unbricking 3DSes I'm sure they'd be willing to spend the 30ish € on a raspberry.
> 
> Or just ask around your friends and family, the Raspberry is quite wide spread.
> 
> Or you could just buy a Raspberry Pi and use it for something else after the unbrick. It works great as a media player or a downloader client (torrent/jdownloader) for example and runs at 5Watt.


 

I was actually thinking of getting one anyway


----------



## bkifft (Jan 26, 2014)

krisztian1997 said:


> I wish I had got an raspi instead of my arduino... my arduino is booring compared to what your raspberry can do


 
well, the arduino is smaller, runs without an sd card that sticks half out from the board, consumes even less energy (good luck on running a raspberry on battery power), doesn't take as long to boot up, etc.

they both are good at what they are meant to do: the raspberry is a small PC style computer, the arduino is a microcontroller you can use without having to have a degree in electrical engineering.


edit: I am not affiliated with Farnell or any other raspberry distributor, I'm just a fan/addict (got six in total, four in permanent use).


----------



## Xzi (Jan 26, 2014)

Good work guys!  Looks like a Raspberry Pi/Arduino will run about $30 to $40, is that right?  Still a pretty cheap method of unbricking, and lots of other uses for those components.


----------



## krisztian1997 (Jan 26, 2014)

Xzi said:


> Good work guys! Looks like a Raspberry Pi/Arduino will run about $30 to $40, is that right? Still a pretty cheap method of unbricking, and lots of other uses for those components.


 
Arduino is much cheaper, but no one tested my code so far so go for the raspi method. Because Arduino is an opensource project anyone can take an atmega, flash the unlocker code and make an unbricker device for around $10


----------



## bkifft (Jan 26, 2014)

krisztian1997 said:


> Arduino is much cheaper, but no one tested my code so far so go for the raspi method. Because Arduino is an opensource project anyone can take an atmega, flash the unlocker code and make an unbricker device for around $10


 
well, i keep refreshing the the r4i page but they don't seem to be ready for release yet


----------



## gamesquest1 (Jan 26, 2014)

bear in mind if people do buy one they can always resell it if they dont want to keep hold of it, shouldnt be too much of a loss if you buy second hand in the first place 

just depends on if people want to recover without waiting for cheaper solutions to be found


----------



## Xzi (Jan 26, 2014)

krisztian1997 said:


> Arduino is much cheaper, but no one tested my code so far so go for the raspi method. Because Arduino is an opensource project anyone can take an atmega, flash the unlocker code and make an unbricker device for around $10


Alright, I'll keep that in mind.  I don't have a bricked 3DS *fingers crossed*, but I'm glad you guys managed to create a solution so quickly for those that do have one, and for peace of mind for the rest of us.


----------



## Sheimi (Jan 26, 2014)

Nice work guys. Hope you do solve everyone brick problems.


----------



## Ennea (Jan 26, 2014)

bkifft said:


> *snip*


 
Thanks for your hard work on the RasPi code. I have a question regarding what you've done: on GitHub, you're writing not to run the code with a kernel with the SD/MMC subsystem enabled. Could you explain that further? So far, I have no experience with the RasPi, and not a whole lot with Linux kernels.


----------



## YoshiInAVoid (Jan 26, 2014)

bkifft what are you compile flags?

I tried:

gcc main.c -std=c99

And get implict declaration of functions, "usleep", "sd_issue_command", as well as unknown type "useconds_t". I presume I am supposed to link to another library.

-lm not helping either...


----------



## bkifft (Jan 26, 2014)

Ennea said:


> Thanks for your hard work on the RasPi code. I have a question regarding what you've done: on GitHub, you're writing not to run the code with a kernel with the SD/MMC subsystem enabled. Could you explain that further? So far, I have no experience with the RasPi, and not a whole lot with Linux kernels.


 
Sure. The default kernel used in raspberry pi linux distributions has drivers for the SD slot integrated (else one couldn't run the default setup from SD card). In order to "abuse" the SD slot for unbricking those drivers mustn't be there as they would interfere with the communication. and as those drivers are built into the usual kernel images and not loaded as modules (external driver files) one has to use a custom built kernel without said SD/MMC drivers. You can find guides on compiling/building your own raspberry kernel, I will release a ready to flash linux image in a few days.

edit: somehow I mised a quite important "not" there... (in regards "not as modules")


YoshiInAVoid said:


> bkifft what are you compile flags?
> 
> I tried:
> 
> ...


 

strange, i don't link any libs explicitly and on the rasppi i don't have any c host flags set up. let me investigate.

edit: usleep and useconds_t should be defined in unistd.h. my built in compiler options:


Spoiler





```
[email protected]:~/perverseunbrick# gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/arm-linux-gnueabihf/4.6/lto-wrapper
Target: arm-linux-gnueabihf
Configured with: ../src/configure -v --with-pkgversion='Debian 4.6.3-14+rpi1' --with-bugurl=file:///usr/share/doc/gcc-4.6/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --program-suffix=-4.6 --enable-shared --enable-linker-build-id --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --with-gxx-include-dir=/usr/include/c++/4.6 --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --enable-gnu-unique-object --enable-plugin --enable-objc-gc --disable-sjlj-exceptions --with-arch=armv6 --with-fpu=vfp --with-float=hard --enable-checking=release --build=arm-linux-gnueabihf --host=arm-linux-gnueabihf --target=arm-linux-gnueabihf
Thread model: posix
gcc version 4.6.3 (Debian 4.6.3-14+rpi1)
```


----------



## Vengenceonu (Jan 27, 2014)

I wonder if the R4i team will see this thread and start offering "R4i Deluxe Unbricking Service... now with Ramble Pak"

On another note: So the only way the unbricking can be done is with Any micro-controller/mini computer (i.e Rasberry pi, beaglebone, arduino?) Hopefully a more user friendly method will reveal itself.


----------



## aliak11 (Jan 27, 2014)

I can unbrick 3DS's in the US. If it is an XL I can also install this mod http://imgur.com/a/kZk36. If you are interested, send me a PM.


----------



## keithbeat (Jan 27, 2014)

I guest that's how its done in the EAST but here in the WEST we don't put kill code in or product case in point "team xecuter " their product are clone all the time they just have good product awesome staff and awesome forum if you need help someone is always their so they don't have to worry about customers they will have one for life !!we are not fighting for the same cooked RAT burger here in the west were we don't have to do sh!t like that GATEWAY !!!!


----------



## lordofthereef (Jan 27, 2014)

I have a raspi and would be happy to do unbricking for people in the US at my cost (shipping, wires, etc... so a couple bucks). Or you can send me the card adapter with your 3DS and pay for return shipping. Have already done just the nand dump mod for a few people here.

Would need some small amount of directions for the raspi flash though.


----------



## redact (Jan 27, 2014)

aliak11 said:


> I can unbrick 3DS's in the US. If it is an XL I can also install this mod http://imgur.com/a/kZk36. If you are interested, send me a PM.


damn!  i just need to comment on how nice that looks


----------



## krisztian1997 (Jan 27, 2014)

lordofthereef said:


> I have a raspi and would be happy to do unbricking for people in the US at my cost (shipping, wires, etc... so a couple bucks). Or you can send me the card adapter with your 3DS and pay for return shipping. Have already done just the nand dump mod for a few people here.
> 
> Would need some small amount of directions for the raspi flash though.


bkiff is gonna release some intructions and his own kernel when the code is stable enough for end user use


----------



## sudeki300 (Jan 27, 2014)

aliak11 said:


> I can unbrick 3DS's in the US. If it is an XL I can also install this mod http://imgur.com/a/kZk36. If you are interested, send me a PM.


 
could the same MOD be installed onto the 3DS, or is there not enough room in the guts. great work by the way..........................sudeki300


----------



## Sparks43 (Jan 27, 2014)

Sweet Great work guys.

Could this be a step towards either hacking the 3ds fully or a possible firmware downgrade.

Either way its brilliant to see a solution to bricked 3ds systems


----------



## Wisenheimer (Jan 27, 2014)

I like how ethical hackers are so good at rooting out the unethical ones and fixing their malicious code.

I wonder if something like this could be used to permanent rewrite the firmware to something custom.


----------



## Joe88 (Jan 27, 2014)

Downgrading wont be possible with the efuses in place


----------



## Wisenheimer (Jan 27, 2014)

Joe88 said:


> Downgrading wont be possible with the efuses in place


 

I don't know much about architecture?  Do the efuses disable the parts of the chip where the firmware is located if an encryption key or something of that nature is not provided?


----------



## RiPPn (Jan 27, 2014)

aliak11 said:


> I can unbrick 3DS's in the US. If it is an XL I can also install this mod http://imgur.com/a/kZk36. If you are interested, send me a PM.


 

I was wondering when this type of service was going to pop up.  Your work looks great, I'm not in need now, but I'm replying so I can easily find you if/when I ever do.


----------



## ryuga93 (Jan 27, 2014)

Maybe I can offer unbricking service on my country and test it on arduino lol.so, who needs unbricking in Malaysia?


----------



## Duo8 (Jan 27, 2014)

Wisenheimer said:


> I like how ethical hackers are so good at rooting out the unethical ones and fixing their malicious code.
> 
> I wonder if something like this could be used to permanent rewrite the firmware to something custom.


 
Doubt that. This has nothing to do with the encryption.


Joe88 said:


> Downgrading wont be possible with the efuses in place


 
So it's confirmed that the 3DS has efuses?


----------



## krisztian1997 (Jan 27, 2014)

Duo8 said:


> Doubt that. This has nothing to do with the encryption.
> 
> 
> So it's confirmed that the 3DS has efuses?


 
if it uses efuses, then how its posible to update then downgrade using your own nand backup ? o.O


----------



## 3bbb7 (Jan 27, 2014)

awesome. Maybe people who get their consoles unbricked will learn to stop trusting companies who appear out of nowhere.


----------



## YoshiInAVoid (Jan 27, 2014)

bkifft said:


> Sure. The default kernel used in raspberry pi linux distributions has drivers for the SD slot integrated (else one couldn't run the default setup from SD card). In order to "abuse" the SD slot for unbricking those drivers mustn't be there as they would interfere with the communication. and as those drivers are built into the usual kernel images and not loaded as modules (external driver files) one has to use a custom built kernel without said SD/MMC drivers. You can find guides on compiling/building your own raspberry kernel, I will release a ready to flash linux image in a few days.
> 
> edit: somehow I mised a quite important "not" there... (in regards "not as modules")
> 
> ...


Would it be possible for you to provide a pre-compiled binary? Also, I'd like your modified Raspbian OS which disables SD / MCC drivers.


----------



## krisztian1997 (Jan 27, 2014)

YoshiInAVoid said:


> Would it be possible for you to provide a pre-compiled binary? Also, I'd like your modified Raspbian OS which disables SD / MCC drivers.


 
He already mentioned that he will provide a pre-compiled debian with removed drivers and all the unnecessary stuffs


----------



## bkifft (Jan 27, 2014)

YoshiInAVoid said:


> Would it be possible for you to provide a pre-compiled binary? Also, I'd like your modified Raspbian OS which disables SD / MCC drivers.


 
Currently I'm working on getting an as small as possible raspian image done (780 MB atm) as my upstream speed sucks balls and i don't want to wait 20h for the upload to finish.

Tomorrow or wednesday I should receive my MMC card to "refine (a blatant euphemism for throw out of the window and rewrite) my code.

I've already taken wednesday to friday off (gotta burn some of my overhours anyway and this project is a good reason to finally do it.)

So there should be a not-yet-public beta version available soon and the public release soon+a bit longer (see what i did there, GW?).

Edit: if you'd be willing to participate in said closed beta I'll gladly send you the links.


----------



## Spzjulien (Jan 27, 2014)

krisztian1997 said:


> He already mentioned that he will provide a pre-compiled debian with removed drivers and all the unnecessary stuffs


 
great i will wait for that .... then i can help unbrick 3DS In france .....


----------



## YoshiInAVoid (Jan 27, 2014)

bkifft said:


> Currently I'm working on getting an as small as possible raspian image done (780 MB atm) as my upstream speed sucks balls and i don't want to wait 20h for the upload to finish.
> 
> Tomorrow or wednesday I should receive my MMC card to "refine (a blatant euphemism for throw out of the window and rewrite) my code.
> 
> ...


Yes, please! PM me a beta as soon as it's ready


----------



## lordofthereef (Jan 27, 2014)

krisztian1997 said:


> bkiff is gonna release some intructions and his own kernel when the code is stable enough for end user use


 
cool deal. Looking forward to it. Good work folks!


----------



## naxil (Jan 27, 2014)

GREAT WORKS! we wait a good proof (with photo or video) about this unbrick!!!!
see ya Brickway... gbatemp defeat the enemys!!!!


----------



## aliak11 (Jan 27, 2014)

sudeki300 said:


> could the same MOD be installed onto the 3DS, or is there not enough room in the guts. great work by the way..........................sudeki300



There is no good place for the micro USB, I would have to cut a hole in the plastic.



mercluke said:


> damn!  i just need to comment on how nice that looks



Thank you!


----------



## krisztian1997 (Jan 28, 2014)

ple666 said:


> si ont as pas de dump il reste l'emunand reccuperable avec emunand tool,j'ai fait comme sa pour une 3ds sans dump orig ,pour les sd non compatible dump sd avec testdisk-6.14.win pour avoir acces a la partition cachée,ouvrir hxd et changer 3DSCARDNAND en R4IGOLDNAND et le programme fonctionne et réccupere l'émununand


Could you... talk in english ?


----------



## Cyan (Jan 28, 2014)

ple666:
you can use EmuNAND_tool only if you kept a copy of your 4.x emuNAND.
Most users used emuNAND to update to 7.x, I don't know if everyone keep a backup from each NAND version.


----------



## ryuga93 (Jan 29, 2014)

Cyan said:


> ple666:
> you can use EmuNAND_tool only if you kept a copy of your 4.x emuNAND.
> Most users used emuNAND to update to 7.x, I don't know if everyone keep a backup from each NAND version.


I have done backup for my 4.3 sysNAND and the 7.1 emuNAND.I think it is better to keep every version of the emuNAND you use.Who knows what will happen in the future


----------



## QuadrilocularXirotl (Jan 29, 2014)

misterb98 said:


> Great news! It also looks like these are the same pins used for dumping your nand (except dat3, which you do not need for that function). Someone should make a commercial product for the 3ds XL that allows for easy dump/restore, unbricking, and extends the battery.


 
Or maybe someone should make a commercial product that stops people from being total pirate scum.


----------



## bkifft (Jan 29, 2014)

Official release of the Raspberry Pi 3DS unbricker, guide at  https://github.com/bkifft/RPU/blob/master/RPU_guide.txt.

Good luck.


----------



## BLsquared (Jan 30, 2014)

Yoshi, what have you gotten yourself into...?


----------



## Cyberhax (Feb 8, 2014)

The MSP430 by TI might also be a good microcontroller for this. It is $10, has SPI, runs on 3.3v out of box and is compatible with Arduino code via Energia IDE.


----------



## eriol33 (Feb 20, 2014)

I was reading the instruction. so it's possible to unbrick without soldering and such by using raspberry pi? incredible.


----------



## Joe88 (Feb 20, 2014)

eriol33 said:


> I was reading the instruction. so it's possible to unbrick without soldering and such by using raspberry pi? incredible.


no you have to solder regardless of which method you use


----------



## eriol33 (Feb 21, 2014)

*sigh*, my hope is just flushed to toilet


----------



## Cyan (Feb 21, 2014)

There's a solderless solution for 3DSXL only, but you need to solder the pogo pins and RasPi together. Only the console's side is solderless.
For normal 3DS, you need to solder at least 1 very tiny point (the CLK) which is located at the back of the mother board.


----------



## bkifft (Feb 24, 2014)

Update: RPU can now unlock the eMMC.

The usual header: this will neither enable a downgrade nor running pirated porkemon [sic] on >4.5.

An anonymous source gave me the key required to generate the console specific eMMC lock/unlock password in exchange for posting his/her following statement in my initial release posts and the tool itself:



> If you are reading this your 3DS has most likely been bricked by a Virus called Gateway 3DS. If so return it and get a refund immediately.
> Because what they have done is they made a soft-mod for the 3DS but then decided that they would earn more money if they added their own AP.
> They also added a lot of obfuscation (to prevent pirates from pirating their card and software), which most likely also is the reason why some versions are not stable (and the brick code is triggered). And as you already see on your 3DS they added brick code in the 2.0_2b Version. This brick code is not even written correctly (else this unbricker wouldn't work). So they even failed at programming brick code.
> To sum it all up you bought a badly programmed Virus.
> ...


 
The good news: this makes it possible to unbrick even if you don't have a prior NAND backup.

The bad news: for now it has to be done in a quite roundabout way: unlock the eMMC/NAND -> dump it -> relock the eMMC/NAND -> force erase -> flash the NAND image -> unbricked.

The reason for this detour is that besides being locked, the eMMC also gets write protected (just like some people had already stated) and I wasn't able to remove said write protection yet (in this context: if anyone got any idea how on earth i could get the Pi to do CMD27 like it's supposed to work please let me know).

But said write protection gets wiped by a force erase too, thus offering a working solution for now (although I'd have preferred a single keypress unlock and will keep working on that).

I just pushed the changes to github, either do the online or offline update as described in the guide to get the new version.

As i believe not everyone to be interested in the technical details I'll put them in a spoiler:


Spoiler



The lock/unlock password is generated by encrypting the console specific CID (the unique serialnumber of the eMMC) with GW's master AES key (which I don't and don't want to have) using the 3DS AES engine in CTR mode. I had to look that one up as I only ever use CBC and XTS: CTR uses the block cipher to generate a keystream to be xored to the plaintext_ with no cleartext or cyphertext feedback whatsoever_. In other words: this keystream is constant for all 3DSes, thus enabling an unlock without using a working 3DS to generate the password. To get this keystream one has just to encrypt 16 bytes of 0x00, which my source did.

Lock/Unlock mechanism (in pseudocode, those functions are named differently and have different signatures on the 3DS as well as in RPU):

```
uint8_t CID_buffer[CID_length];
CID_buffer = read_CID(eMMC);
CID = AES_encrypt(CTR , GW_MASTERKEY, CID, CID_length ); //this is equivalent to CID = CID xor AES_encrypt(CTR , GW_MASTERKEY, 0x0, CID_length);
CID[0] = 5; //bit 0 and 2 set, meaning "set password" and "lock eMMC", for the unlock it's CID[0] = 2; //bit 1 set meaning "clear password" (unlock happens implicit)
CID[1] = 14; //next 14 bytes are the password
SD_command(eMMC, 42, CID, CID_length); //command 42 (lock/unlock) on the eMMC sending 16 bytes starting from &CID as data payload
```
 
Thanks GW for choosing the one AES mode which made this approach possible.


 
This is another piece of evidence that the bricking doesn't happen random, as (on the most objective level) the locking occurs using a deterministic (not random) console specific password. I don't want to and will not make any claims beyond that (even though personally I do believe it happens with intent as a clone deterrent gone horribly wrong, this IMHO still isn't decisive damning evidence).

Feasibility of the unlock -> dump -> lock -> force erase -> flash approach was proven by gamesquest1 (using the unmodified 2.0b2) and Inaki (using the region patched 2.0b2). Thanks for testing dudes.
Also thanks to krisztian1997, khalaan and of course the anonymous source. Love you guys (no homo).


p.s. I'll use this opportunity to once again draw attention to step 18 of the guide *nudge nudge wink wink know what i mean*


----------



## Foxi4 (Feb 24, 2014)

This thread is essentially a dupe of: http://gbatemp.net/threads/3ds-unbricking-progress.361171/

As such, I'll report this thread for locking - please follow the link above for any and all discussions regarding 3DS unbricking.


----------



## BORTZ (Feb 24, 2014)

We have enough Gateway threads around here, lets try to consolodate at least a few of them. For updates and discussions about 3DS unbricking, please use this topic.


----------

