Hacking 3DS unbricking progress

[krisztian1997]

The erase feature only works if there is a password set, otherwise it just returns an error because theres no reason to erase

 

[Moquedami]

Ah, that explains the rebel SD card then.
Until now Pizzatime and me had failed attempts with a Samsung, and Asus with a Toshiba.
Only Kahlaan made it work it seems. It would be nice to have pictures of his setup to try to reproduce the process and result.

 

[tobelight]

One question: if I do not backup nand and I unlocked the MMC, it is possible to extract thereafter NAND? (with Win32DiskImager ..button READ)

 

[krisztian1997]

One question: if I do not backup nand and I unlocked the MMC, it is possible to extract thereafter NAND? (with Win32DiskImager ..button READ)

nope, the console is dead then.

 

[bkifft]

One question: if I do not backup nand and I unlocked the MMC, it is possible to extract thereafter NAND? (with Win32DiskImager ..button READ)

only thing one could do then is to flash the emuNAND from the same console if it exists (which will most likely be a higher firmware than 4.5, so no more exploits but at least it would still work).

 

[gamesquest1]

Well their is still a small bit of hope if you set up emunand I have read you can extract the nand file from the emunand partition and use it to restore the 3ds to a working but updated condition.....you could atleast sell it on to cover the costs of a replacement 3ds on 4.x

....beat to the punch XD

 

[tobelight]

ok thank you. The person who bricked his console has not used your emunand no bakcup nand

I thought the brick arrived only emunand fashion is obviously not the case

 

[gamesquest1]

Ok well in that case, the only choice would be waiting to see if their is any hope of a unlocking method being found that doesn't wipe the nand......the chances are looking pretty slim

In the mean time don't even bother trying the current unlock methods as it would just eliminate the last chance of possible restore

 

[bkifft]

ok thank you. The person who bricked his console has not used your emunand no bakcup nand

damn... then this person would need the unlock password, which at the moment only a few persons can generate (and i am not one of them). the best bet would be to wait (not throwing it away yet though) and/or ask gateway for the password.

in no case should he/she use the force erase though, as then there would be nearly no chance to get it working again.

gamesquest1:
k, now the beater became the beatee

 

[ASUS]

If I connect the DAT1 and DAT2 the program will not work on Arduino?

 

[krisztian1997]

If I connect the DAT1 and DAT2 the program will not work on Arduino?

You dont need dat 1 and 2 for arduino. I been looking over our code all day but I cant find anything wrong with it, I tried sending CRC7, CRC16 and same result, my cards always boot up perfectly... its really annoying that me and ryuga has no idea what is wrong with arduino.

 

[Elusivo]

One question: if I do not backup nand and I unlocked the MMC, it is possible to extract thereafter NAND? (with Win32DiskImager ..button READ)

Did anybody try a file recovery program or something of the sorts after the force erase to try and recover the nand?

 

[ASUS]

When I connect the arduino and the SD adptador, like nothing connected.

0
0
0

 

[ASUS]

Did anybody try a file recovery program or something of the sorts after the force erase to try and recover the nand?

I've tried but it will give locked error.

 

[bkifft]

Did anybody try a file recovery program or something of the sorts after the force erase to try and recover the nand?

Shouldn't (better said mustn't) work according to the specifications: file recovery programs work by reading the raw information from a drive while ignoring the filesystem. This works because most delete operations don't remove the data itself, only the FS entries (like erasing a chapter name and page number from the index of a book, but leaving the chapter itself still inside; you can then no longer look it up easily but still find it when you skim over all the pages).

The force erase is specified to destroy the data itself (in the book analogy: you clear out the whole book using bleach or tipp-ex) so the raw information is gone for good.

(Foot note: it might as well be that the eMMC controller only pretends that the nand memory is clean, but the only way one should be able to access it is by decapping the emmc and probing the NAND using microprobes. which would still result in a garbled mess in most cases.)

 

[Elusivo]

ye, still would be cool to see a complete low level raw sector clone of the nand chip to a file, disregarding the filesystem or partition or whatever and see if it's all zeroed out or not

It's easy to recover whole partitions after quick format on windows for example, i understand it's different, but how long does the forced erase take? if it's quick it would mean that it doesn't overwrite the nand and probly everything is still there... ^^

 

[bkifft]

ye, still would be cool to see a complete low level raw sector clone of the nand chip to a file, disregarding the filesystem or partition or whatever and see if it's all zeroed out or not

It's easy to recover whole partitions after quick format on windows for example, i understand it's different, but how long does the forced erase take? if it's quick it would mean that it doesn't overwrite the nand and probly everything is still there... ^^

Inaki should be able to help you out with the dump of a force erased 3DS.

I've just taken a dump of my freshly force erased 64MB test MMC which i filled to capacity with a random file on ext4 beforehand, from what I've seen all 0xFF now (as such a file compresses down really well I'll attach it).

edit: yes, as the quick format just deletes the whole index while still leaving the books content (mostly) untouched.

As per the specification the force erase is allowed to take up to 3 minutes (and that is for 128GB memory), using RPU it finishes on the 3DS in less than 2 seconds.

And even if the NAND wouldn't get completely overwritten: the controller knows it's supposed to be deleted and simply tells you "nothing of interest here".

 

[gamesquest1]

someone should make a dump then force it to be locked again using clone launcher....unlock, then dump again and see if any of the contents are still intact, im presuming it must do something though, or the 3ds would just work after unlocking without needing a nand restore

 

[Elusivo]

ok, i just read from a website that using those low level commands it can fully wipe an emmc in seconds, so maybe everything does get overwriten, maybe something like a switch that flips everything too FF at same time... which makes some sense, as if it didn't really overwrite everything, it would make the force erase somewhat useless...

 

[Moquedami]

When I connect the arduino and the SD adptador, like nothing connected.

0
0
0

Strange.... my 3ds responds with 255
I don't know what 255 means though