Hacking Sys-trans'd NAND injected into GW2.0b1 EmuNAND

[justinkb]

Also impossible. The blue card is necessary every time DS mode is used to reinput the profile data which contains the exploit payload (which loads launcher.dat). As long as you don't enter DS mode after running GW installer.nds, there is no need to do it again every time...

 

[tHciNc]

people need to think of it like this, EmuNAND is still running through 4.5 but enabling emulation of 6.3, all rules around it are still 4.5 based, example the new keyY, since the flags dont exist in 4.5, thats why saves corrupt/delete even though running on a EmuNAND of latest version, Issue being its not actually booting into 6.3 ever

 

[justinkb]

Clearly it's possible for gateway team to improve the redirection / emulation (root access after all), we will see what kind of fixes they can come up with in the next updates.

 

[Parasite X]

I bet if we asked for system transfer they would support it in a later version of emuNand

 

[Parasite X]

Question since it was backed up nand that you use did your games on your original nand remain ?

 

[Parasite X]

EDIT: all mentions of RedNAND and emuNAND have been changed to just emuNAND to avoid confusion until it is decided which term is the "proper" one to use. If a mod could please change the topic title to reflect this, that would be much appreciated

Hello again GBATemp!

With the release of Gateway 2.0b1 and its NAND redirection feature, I wanted to try getting all my content on the latest 6.3 firmware while still having an older firmware available to use Gateway.

But apparently the "emuNAND" is not compatible with the system transfer feature. But I had already have the ability to dump and restore NAND via hardware, so I tried a different approach, that is, by injecting it manually into the 3DS's SD's "emuNAND" partition that Gateway 2.0b1 uses.

Here is my little story through all this:
After grabbing the GW2.0b1 release, I decided to try to get my existing 6.3.0-12E NAND with all of my stuff associated with it running under Gateway 2.0 "emuNAND" on my new 3DS XL (4.4.0-10E). But this was all system-transferred from my launch 3DS though. However, I had modded my 3DS XL to be able to dump and write its NAND contents (as per the lovely "nand flash dump (3DS XL)" thread that I am sure everybody has seen by now ).



So I had my initial 4.4 dump, and then made my latest 6.3 dump.
I successfully managed to inject my 6.3 already-system-transferred NAND that I had backed up, using a hex editor that had support for editing a physical drive directly.

When I looked at the extra partition that Gateway created, I noticed that it is pretty much a 1:1 copy of the NAND on the 3DS at the time of being created by the "format emuNAND" option, and then just unused garbage at the end of the dump to pad out the partition (Since the actual NAND dump is not quite 1GB).

Only, it is NOT QUITE a 1:1 copy of the NAND. What they have done, is they have taken the first sector (was 512 bytes for me), put some sort of Gateway dummy sector at the beginning, where that first sector was, and then taken the original first sector of data, and tacked it onto the end of the NAND dump in the partition, before the garbage data starts.

So, after rearranging my 6.3 NAND dump I made by dumping via hardware, by putting that first sector at the end, I then inject this rearranged dump into the "emuNAND" partition using Hex Workshop starting at the 2nd sector (sector 1) instead of the first (sector 0), which is the Gateway dummy one.

Then booted up 3DS XL, then tried booting up Gateway to load up this NAND instead... and it worked! I was on GW3D 6.3.0-12E, with all my system transferred stuff just like I wanted

And here is a quick list to summarise what I did:
1. Installed internal NAND to SD/MMC interface into 4.4.0-10E firmare 3dS XL to dump/restore Real NAND.
2. Dumped the NAND with 4.4 firmware on it and backed it up.
3. Did system transfer from launch 3DS to 3DS XL's Real NAND (which required updating to latest 6.3.0-12E firmware).
4. Dumped the NAND again, with 6.3 firmware and all system transferred stuff in it.
5. Backed up the entire contents of my 3DS's SD card (with all system-transfer related content, like paid software and saves etc).
6. Reflashed back to 4.4 firmware dump to be able to use Gateway 3DS.
7. Updated Gateway 3DS to 2.0b1, and set up "emuNAND" on 3DS's card (formatting it all).
8. Used PC to rearrange that first sector of my hardware-dumped 6.3 NAND to the end of the dump with hex editor.
9. Injected rearranged dump into "emuNAND" partition using Hex Workshop overriding existing NAND there (I tried using hxd, but could not find a way to inject it with hxd)
10. Loaded up Gateway via DS profile, and my 6.3 NAND was loaded!

So, just to be clear:
I did not actually do a system transfer directly to the "emuNAND", I transferred to Real NAND and backed up my NAND via hardware, then injected the hardware backup into the SD card's "emuNAND" partition using Hex Workshop.

I hope that explains it well enough; I do not believe this is really good enough of a post to really be a full-blown, noob-friendly tutorial on this, just an explanation of what I did and how I did it, since the regular system transfer feature is apparently not working with Gateway 2.0's "emuNAND" mode.

...Now I suddenly wonder if anyone would be interested in making a PC app that automatically does this sector rearrangement and injecting process to make it easier for others...?


However, now...
I am going to reflash my 6.3 NAND dump back to real NAND and not really use "emuNAND" yet myself.
But why?
Because I found cannot play my existing save files on my newer game carts on it (like my pokaymanz and zelda saves and TBH I am too scared to even try my Zelda ABLW cart on "emuNAND", mainly due to one report of someone having their save file wiped from their retail cart!).

I read this thread and this thread and it seems to explain as to why the saves are incompatible, mainly a conflict regarding the different KeyY keys used by "emuNAND" firmware, and an actual up-to-date firmware on Real NAND (prolly explains that one reported case of zelda save wipe).

So, going by that, if you want to play newer games on Gateway "emuNAND" it would be best to either use the gateway cart+ROM, or start a new save on a legit cart that you use ONLY while in "emuNAND" mode (since said cart would then end up with saves not being recognised on actual Real NAND firmware, just like how a cart of a newer game used on Actual Real NAND fails on "emuNAND").

I hope this was an imformative and interesting read for you all
Enjoy!

Question since it was backed up nand that you use did your games on your original nand remain ?

 

[damysteryman]

Ok, been reading the replies in the thread and it looks like some people are still confused about it all.

What I did, was I set up the emuNAND on my SD card using GW2.0b1 GUI Menu, then, instead of using the emuNAND that GW2.0b1 created, I replaced it with another NAND I created by dumping via hardware.

So I got NAND hardware dump I made and -> put it onto the SD card inside that emuNAND partition, after GW2.0b1 formatted my SD and made that partition.

I do not think I can really explain it any simpler than that...

The main reason I did it all was to have all my paid content and everything up to date like I had it, but being able to reenable and use gateway on it too, but then reflashed my 3DS back to the way it was before (all stuff and up to date on real NAND) once I found out I could not use my pokemon and zelda saves on the emuNAND.

That is pretty much it.

I was not trying to use the GW patched NAND on Real NAND or anything like that (I do not think that is even possible, at least not without some sort of root key to sign as official AFAIK), but rather to use my Real NAND dump with all my stuff on my GW emuNAND.

Also a few more little things to try clear up confusion:
1. All the dumping and restoring was done on the new 3DS XL I got.
2. The launch 3DS was my "master" 3DS with all my stuff, and I wanted my brand new GW compatible 3DS XL to become my new "master" 3DS with everything on it, hence the system transfer from one to the other.
3. SInce the 3DS XL was brand new when I transferred everything, I did not have any content on the original 4.4 firmware NAND it had before the system transfer.
4. Since a system transfer was done from my launch 3DS, the launch 3DS's SD card is now the 3DS XL's SD card, and therefore that was the SD card used, with all my paid purchases on it, and now the GW stuff on it too, including launcher.dat and the emuNAND (even though I am using any GW stuff ATM, until they somehow get support for the new KeyY method needed for the newer game saves).

OK, I HOPE that clarifies everything for everyone.

 

[Ennea]

*snip*

Just a short question for you: which hex editor did you use? I've tried a few, but they all fail at reading the portion of the SD card actually holding the NAND data.

 

[damysteryman]

I used Hex Workshop as mentioned in the first post.

I used "Disk" -> "Open Disk (Ctrl+D)".
In the dialog that popped up, I made sure I selected either "Physical Drives" or "All" in the drop box, then selected the "Physical Disk x" that corresponded to my SD card. Then after rearranging the dump I made earlier (move first sector data to end of dump), I injected the rearranged dump by using "Disk" -> "Restore Sectors..." and then selecting the file to restore into it (the rearranged dump file) and told it to restore starting at sector 1 (which is the second sector on the SD, not overwriting the first sector, which is the "Gateway dummy sector").

I did try using hxd at first, but could not find a way to dump/restore sectors or selections to/from file.
If someone can manage to do it with ease with hxd, please tell us here in the thread. Or if someone made an app that got the dump, rearranged it, and wrote it to the SD in one go, that would be even better, definitely more noob friendly too.

 

[Ennea]

I used Hex Workshop as mentioned in the first post.

Eek, I missed that. Sorry ._. And thanks.

 

[Pong20302000]

I used Hex Workshop as mentioned in the first post.

I used "Disk" -> "Open Disk (Ctrl+D)".
In the dialog that popped up, I made sure I selected either "Physical Drives" or "All" in the drop box, then selected the "Physical Disk x" that corresponded to my SD card. Then after rearranging the dump I made earlier (move first sector data to end of dump), I injected the rearranged dump by using "Disk" -> "Restore Sectors..." and then selecting the file to restore into it (the rearranged dump file) and told it to restore starting at sector 1 (which is the second sector on the SD, not overwriting the first sector, which is the "Gateway dummy sector").

I did try using hxd at first, but could not find a way to dump/restore sectors or selections to/from file.
If someone can manage to do it with ease with hxd, please tell us here in the thread. Or if someone made an app that got the dump, rearranged it, and wrote it to the SD in one go, that would be even better, definitely more noob friendly too.

lol i just made SD card Images with the Tool used to Write 3DS roms to SD card
now have a choice of RedNAND images

 

[damysteryman]

Ennea
lol no problem, you are welcome.

Pong20302000
Which app is this you speak of?
I am using win32diskinager to write 3DS roms to microsd, do you mean this one?

 

[tHciNc]

Pong... Why do you continue choose to use RedNAND instead of EmuNAND like all the actual cart teams use,Are you openly but discreetly admitting the fact you are using smea's exploit ?? Or just trying to cause even more confusion amongst the majority of people who have enough trouble just with EmuNAND, as if you are using their product you are creating an EmuNAND not a RedNAND regardless of what you call it

Ennea
lol no problem, you are welcome.

Pong20302000
Which app is this you speak of?
I am using win32diskinager to write 3DS roms to microsd, do you mean this one?

win32diskimager would image your sd fine, but it definately wouldnt rearrange, and wouldnt it image the whole card and contents not just the NAND image ??

 

[Ennea]

Even with Hex Workshop, though, I can't seem to be able to access the portion with the NAND data. I get sectors equivalent to around 850 MB, which is the partition that's left on the ~2 GB SD card after it was re-formatted by Gateway's menu. HxD didn't work either. Did I miss out on anything? Or maybe this is hardware (SD card reader) related? What I want to do is back up the NAND data on the SD card. No more, no less.

 

[damysteryman]

That is weird.

When opening the disk, I amde sure NOT to choose the SD's normal partition, but made sure to open the "Physical drive", which is the entire SD card. And, for me at least, the 1GB Gateway partition is right at the beginning of the entire SD card contents, before the regular FAT32 partition.

So the NAND should be right at the beginning of the SD card. But keep in mind, it is not exactly 1GB, just the Gateway partition is, and when backing up the NAND, backup from the second sector (not the first dummy one), right until the one with the text "NCSD" in it, but then, after dumping all that, grab that last sector with "NCSD" in it and rearrange it back to the beginning of the dump file you made, since it is actually the first sector of the NAND dump.

 

[Ennea]

Thanks a lot, I'll give it a try later. I won't require any re-arranging though, since I'm backing this up for Gateway purposes only, in case my SD card ever dies and Ninty has implemented counter-measures by then. Thanks for the additional information, however

 

[tHciNc]

If its for gateway only how they they employ counter measures when you possibly might not be ever updating your actual system again, anything cartridge based can always be worked around, and if you just want a dump of your EmuNAND, just go into the gateway gui and backup the nand to sd again and copy it to pc ???

 

[Pong20302000]

Pong... Why do you continue choose to use RedNAND instead of EmuNAND like all the actual cart teams use,Are you openly but discreetly admitting the fact you are using smea's exploit ?? Or just trying to cause even more confusion amongst the majority of people who have enough trouble just with EmuNAND, as if you are using their product you are creating an EmuNAND not a RedNAND regardless of what you call it

win32diskimager would image your sd fine, but it definately wouldnt rearrange, and wouldnt it image the whole card and contents not just the NAND image ??

because the NAND isnt Emulated, its Redirtected then patch on the fly
so i refuse to call it something its not.

once you have the SD image you can use HxD to edit the NAND image on it also

 

[Deleted User]

Even with Hex Workshop, though, I can't seem to be able to access the portion with the NAND data. I get sectors equivalent to around 850 MB, which is the partition that's left on the ~2 GB SD card after it was re-formatted by Gateway's menu. HxD didn't work either. Did I miss out on anything? Or maybe this is hardware (SD card reader) related? What I want to do is back up the NAND data on the SD card. No more, no less.

You should have a NAND.BIN file around 950MB in size. You didn't dump your NAND file fully, because your SD card is full. The Gateway menu also would have said "ERROR SD Full" when you were dumping it...

 

[damysteryman]

Pong20302000:
Yeah, I tried using HxD, and I can edit the SD NAND, but the main problem I had with HxD was that I could not copy the 943MB dump and paste it over the SD one. Due to its sheer size, HxD could not do that as it did not have enough memory to do so, and I could not find a way to import and override it directly from file like Hex Workshop can.

That is the main reason I did not use HxD, else I would be using it instead of Hex Workshop.