I might be totally wrong on this, but hear me out. Can't you first get ahold of a OoT card to perform the exploit, install emuNAND and backup your original NAND. Then after that install a CIA to your sysNAND and push the save file to that CIA? Unless I am missing something this seems like a good method to get the hack working without card
The CIA won't launch in SysNAND unless it was pulled from a preinstalled 3DS copy, and there aren't any OoT CIAs that were preinstalled AFAIK.