Hacking Sys-trans'd NAND injected into GW2.0b1 EmuNAND

[damysteryman]

EDIT: all mentions of RedNAND and emuNAND have been changed to just emuNAND to avoid confusion until it is decided which term is the "proper" one to use. If a mod could please change the topic title to reflect this, that would be much appreciated

Hello again GBATemp!

With the release of Gateway 2.0b1 and its NAND redirection feature, I wanted to try getting all my content on the latest 6.3 firmware while still having an older firmware available to use Gateway.

But apparently the "emuNAND" is not compatible with the system transfer feature. But I had already have the ability to dump and restore NAND via hardware, so I tried a different approach, that is, by injecting it manually into the 3DS's SD's "emuNAND" partition that Gateway 2.0b1 uses.

Here is my little story through all this:
After grabbing the GW2.0b1 release, I decided to try to get my existing 6.3.0-12E NAND with all of my stuff associated with it running under Gateway 2.0 "emuNAND" on my new 3DS XL (4.4.0-10E). But this was all system-transferred from my launch 3DS though. However, I had modded my 3DS XL to be able to dump and write its NAND contents (as per the lovely "nand flash dump (3DS XL)" thread that I am sure everybody has seen by now ).

So I had my initial 4.4 dump, and then made my latest 6.3 dump.
I successfully managed to inject my 6.3 already-system-transferred NAND that I had backed up, using a hex editor that had support for editing a physical drive directly.

When I looked at the extra partition that Gateway created, I noticed that it is pretty much a 1:1 copy of the NAND on the 3DS at the time of being created by the "format emuNAND" option, and then just unused garbage at the end of the dump to pad out the partition (Since the actual NAND dump is not quite 1GB).

Only, it is NOT QUITE a 1:1 copy of the NAND. What they have done, is they have taken the first sector (was 512 bytes for me), put some sort of Gateway dummy sector at the beginning, where that first sector was, and then taken the original first sector of data, and tacked it onto the end of the NAND dump in the partition, before the garbage data starts.

So, after rearranging my 6.3 NAND dump I made by dumping via hardware, by putting that first sector at the end, I then inject this rearranged dump into the "emuNAND" partition using Hex Workshop starting at the 2nd sector (sector 1) instead of the first (sector 0), which is the Gateway dummy one.

Then booted up 3DS XL, then tried booting up Gateway to load up this NAND instead... and it worked! I was on GW3D 6.3.0-12E, with all my system transferred stuff just like I wanted

And here is a quick list to summarise what I did:
1. Installed internal NAND to SD/MMC interface into 4.4.0-10E firmare 3dS XL to dump/restore Real NAND.
2. Dumped the NAND with 4.4 firmware on it and backed it up.
3. Did system transfer from launch 3DS to 3DS XL's Real NAND (which required updating to latest 6.3.0-12E firmware).
4. Dumped the NAND again, with 6.3 firmware and all system transferred stuff in it.
5. Backed up the entire contents of my 3DS's SD card (with all system-transfer related content, like paid software and saves etc).
6. Reflashed back to 4.4 firmware dump to be able to use Gateway 3DS.
7. Updated Gateway 3DS to 2.0b1, and set up "emuNAND" on 3DS's card (formatting it all).
8. Used PC to rearrange that first sector of my hardware-dumped 6.3 NAND to the end of the dump with hex editor.
9. Injected rearranged dump into "emuNAND" partition using Hex Workshop overriding existing NAND there (I tried using hxd, but could not find a way to inject it with hxd)
10. Loaded up Gateway via DS profile, and my 6.3 NAND was loaded!

So, just to be clear:
I did not actually do a system transfer directly to the "emuNAND", I transferred to Real NAND and backed up my NAND via hardware, then injected the hardware backup into the SD card's "emuNAND" partition using Hex Workshop.

I hope that explains it well enough; I do not believe this is really good enough of a post to really be a full-blown, noob-friendly tutorial on this, just an explanation of what I did and how I did it, since the regular system transfer feature is apparently not working with Gateway 2.0's "emuNAND" mode.

...Now I suddenly wonder if anyone would be interested in making a PC app that automatically does this sector rearrangement and injecting process to make it easier for others...?


However, now...
I am going to reflash my 6.3 NAND dump back to real NAND and not really use "emuNAND" yet myself.
But why?
Because I found cannot play my existing save files on my newer game carts on it (like my pokaymanz and zelda saves and TBH I am too scared to even try my Zelda ABLW cart on "emuNAND", mainly due to one report of someone having their save file wiped from their retail cart!).

I read this thread and this thread and it seems to explain as to why the saves are incompatible, mainly a conflict regarding the different KeyY keys used by "emuNAND" firmware, and an actual up-to-date firmware on Real NAND (prolly explains that one reported case of zelda save wipe).

So, going by that, if you want to play newer games on Gateway "emuNAND" it would be best to either use the gateway cart+ROM, or start a new save on a legit cart that you use ONLY while in "emuNAND" mode (since said cart would then end up with saves not being recognised on actual Real NAND firmware, just like how a cart of a newer game used on Actual Real NAND fails on "emuNAND").

I hope this was an imformative and interesting read for you all
Enjoy!

 

[Snailface]

This redNand/emuNand thing is getting annoying lol

redNAND-- is an unreleased nand redirection exploit written by Smealum (w/ help from friends) that has not been released publicly.
emuNAND-- is GW team's version of the above and it's a different codebase.

I know it may just be semantics for some, but it can cause confusion.

I'm not bashing the OP, in fact, it's an excellent post overall.

 

[damysteryman]

Ah ok, still trying to get the whole EmuNAND/RedNAND semantics thing right myself.
I do remember briefly talking to Pong20302000 on IRC sometime last week, something about how all these NAND redirection solutions should not be called EmuNAND at all since they are redirecting NAND access, and not actually emulating it, and I do agree with him.

But eh, I will edit the first post in the meantime until the whole community actually decides what the "official" term should be.

And thanks, glad you like the post

 

[lambstone]

Wow, this is actually pretty cool.

So the TL;DR version is, it is possible to do a faux-systemTransfer to a newer 3DS that involves NAND dumping/flashing and Hex editing to emuNand have your transferred stuff from old 3DS.

Noob version is... Go away, you can't possible hope to achieve this. You'll end up asking "how i can haz system transfer"

 

[damysteryman]

Yeah, pretty much. Dump hackable real NAND via hardware, system transfer to real NAND, back that up, then revert back to hackable NAND, then edit the partition directly with a hex editor to override the existing emuNAND with the good one you backed up.

And yeah, I guess you could say that
The main requirements that IMO are anti-noob would be soldering the NAND to SD/MMC reader connector for dumping/flashing, and using a hex editor to edit the SD card's partition directly, and I simply could not be bothered trying to write a tutorial on how to do all that

 

[kyogre123]

Now, another important difference is that your games won't show on the actual NAND that contains the 4.5 firmware version, or am I wrong?

Another user confirmed to me that games gotten through emuNAND get their keys written on the emulated NAND, as well as on the actual NAND that contains the older firmware, so these games can be detected (and played) on the regular NAND.

 

[mvmiranda]

Yeah, pretty much. Dump hackable real NAND via hardware, system transfer to real NAND, back that up, then revert back to hackable NAND, then edit the partition directly with a hex editor to override the existing emuNAND with the good one you backed up.

And yeah, I guess you could say that
The main requirements that IMO are anti-noob would be soldering the NAND to SD/MMC reader connector for dumping/flashing, and using a hex editor to edit the SD card's partition directly, and I simply could not be bothered trying to write a tutorial on how to do all that

That's a pretty cool hack!
I didn't quite catch something. Did you use two consoles for system transfer? Why?
Can we use only 1 console? I'm asking because I have a 3DS XL Mario Kart 7 I've modded to be able to backup/restore NAND via HW. I backup UP my 4.3 FW (while MY GW doesn't arrive) and I updated to 6.3 and bought a couple of games.

Can I inject my 6.3 bought games to my emuNAND without using a second 3DS (if what I got was right after all)?

Thanks!

 

[Tomobobo]

Ok, so I did it too.

But mine doesn't work.. I end up with 6.3 official... GW mode through DS profile settings causes errors, and the blue card causes errors..

Only thing I can think of is my emuNand somehow got officialized...

I'm gonna restart, go back to 4.5, redo the whole emuNand and dump it before updating it like a tard.

edit: Maybe I should explain some more.. I had 4.5, backed it up with gateway, ran emunand format, got gw3d 6.3.x working and booting, then went to eshop, prompted for update, updated 3ds. Then I started doing the attempt at getting gw3d 6.3.x on the real nand, but fail.

 

[mattrunks]

Ok, so I did it too.

But mine doesn't work.. I end up with 6.3 official... GW mode through DS profile settings causes errors, and the blue card causes errors..

Only thing I can think of is my emuNand somehow got officialized...

I'm gonna restart, go back to 4.5, redo the whole emuNand and dump it before updating it like a tard.

edit: Maybe I should explain some more.. I had 4.5, backed it up with gateway, ran emunand format, got gw3d 6.3.x working and booting, then went to eshop, prompted for update, updated 3ds. Then I started doing the attempt at getting gw3d 6.3.x on the real nand, but fail.

u dun goofd and i feel bad for you son i got 99 problems but a non compatible gateway 3ds aint one.

 

[hashcheck1]

Ok, so I did it too.

But mine doesn't work.. I end up with 6.3 official... GW mode through DS profile settings causes errors, and the blue card causes errors..

Only thing I can think of is my emuNand somehow got officialized...

I'm gonna restart, go back to 4.5, redo the whole emuNand and dump it before updating it like a tard.

edit: Maybe I should explain some more.. I had 4.5, backed it up with gateway, ran emunand format, got gw3d 6.3.x working and booting, then went to eshop, prompted for update, updated 3ds. Then I started doing the attempt at getting gw3d 6.3.x on the real nand, but fail.

i thinks its because you update via going through eshop. you are meant to update in system settings area

 

[Celice]

This redNand/emuNand thing is getting annoying lol

redNAND-- is an unreleased nand redirection exploit written by Smealum (w/ help from friends) that has not been released publicly.
emuNAND-- is GW team's version of the above and it's a different codebase.

I know it may just be semantics for some, but it can cause confusion.

I'm not bashing the OP, in fact, it's an excellent post overall.

Watching Smea's youtube video on oct 30th, he seems to suggest that his redNAND operates differently from the Gateway's thing, which is why he wanted a different name for the process. I don't have the knowledge needed to make such a distinction, but if what Smea said was true, then this isn't quite a semantic difference but an actual and referential difference, seeing as they are two distinct processes rather than two ways to refer to one distinct process.

 

[justinkb]

Repeat after me:

Don't try to enter the eShop when running off the real nand.

 

[tHciNc]

Ok, so I did it too.

But mine doesn't work.. I end up with 6.3 official... GW mode through DS profile settings causes errors, and the blue card causes errors..

Only thing I can think of is my emuNand somehow got officialized...

I'm gonna restart, go back to 4.5, redo the whole emuNand and dump it before updating it like a tard.

edit: Maybe I should explain some more.. I had 4.5, backed it up with gateway, ran emunand format, got gw3d 6.3.x working and booting, then went to eshop, prompted for update, updated 3ds. Then I started doing the attempt at getting gw3d 6.3.x on the real nand, but fail.

You sure you didnt Check system settings to check version, then left settings and went to E-Shop ?? If this is the case, you where prompted as when falling back out of settings, you are back in the systemNAND, so since 4.1-4.5 shop would prompt for update and would be updating the SystemNAND, the flag here is you where already on GW3D 6.3.x the latest firmware, the eShop wouldnt prompt for an update

 

[tHciNc]

Watching Smea's youtube video on oct 30th, he seems to suggest that his redNAND operates differently from the Gateway's thing, which is why he wanted a different name for the process. I don't have the knowledge needed to make such a distinction, but if what Smea said was true, then this isn't quite a semantic difference but an actual and referential difference, seeing as they are two distinct processes rather than two ways to refer to one distinct process.

At the end of the day they are both just redirecting to the sd image, Smea's being more just a classic mode redirection, Dunno why some started using redNAND, when GW team specifically use EmuNAND and people are having more than enough trouble just dealing with that lol, causes unneeded confusion and uncertainty, and when people start second guessing themselves, mistakes happen .......

 

[Tomobobo]

I'm starting to think danmysteryman did something different his emuNand on real nand, cause gateway mode doesn't happen for me.

I have my 4.5 backed up and I can read/write the real nand.

I did the same thing he says he did.

I take 4.5 3DS backup and format emuNand

I boot into emunand and update it.

The system restarts, I take out the SD card from the 3DS and dump it, replace the first 512 bytes with the last 512 and delete the last 512 to make the dump the same size as every other nand. (this part is pretty fishy to me, these first 512 bytes can be swapped between versions of official firmware as well as taking whatever the extra data gateway tosses in the end of the emunand they all boot)

I write the "GW emuNAND" to real nand and boot.

It's official 6.3.0-12U and entering the profile > NDS profile (holding L or not) causes error and restart prompt. I can't install gateway, even though it should already be there because the blue card won't boot.

Edit: I think he's doing something different ahhah, he's loading a different emunand through emunand.. I'm flashing emuNands to real nands.

 

[CalebW]

I'm starting to think danmysteryman did something different his emuNand on real nand, cause gateway mode doesn't happen for me.

I have my 4.5 backed up and I can read/write the real nand.

I did the same thing he says he did.

I take 4.5 3DS backup and format emuNand

I boot into emunand and update it.

The system restarts, I take out the SD card from the 3DS and dump it, replace the first 512 bytes with the last 512 and delete the last 512 to make the dump the same size as every other nand. (this part is pretty fishy to me, these first 512 bytes can be swapped between versions of official firmware as well as taking whatever the extra data gateway tosses in the end of the emunand they all boot)

I write the "GW emuNAND" to real nand and boot.

It's official 6.3.0-12U and entering the profile > NDS profile (holding L or not) causes error and restart prompt. I can't install gateway, even though it should already be there because the blue card won't boot.

Correct me if I'm wrong, but are you trying to enter gateway mode while the real nand on the 3ds is 6.3? Because if you are then it won't work because Nintendo patched it.

 

[justinkb]

I don't know what the hell this guy is doing... Writing 6.3 image to the real nand makes no sense if you want to do anything with it.

 

[Tomobobo]

What I want is to not have to boot 4.5 to be in GW3D 6.3. Booting straight to GW6.3 installed on real nand saves a bunch of time.

I came in here thinking he was doing the same thing, but I was very wrong.

 

[justinkb]

Impossible. You misunderstand entirely how it works.

 

[Tomobobo]

Yeah that's what I'm figuring out. I guess what I should have been trying for is a 4.5 nand with gw installed so I don't have to boot the blue card to install it.