Hacking Legit CIAs and system transfers

[Quantumcat]

What would happen if you did the following:

- loaded a bunch of legit CIA files onto a compatible 3DS (system A).

- updated said system A to latest firmware

- system transferred from a different 3DS (system B) onto system A and left SD cards where they started

- redownloaded all bought eShop software

- system transferred from system A to system B, switching SD cards afterwards

Would this result in system B containing all the legit CIA games?

 

[Zidapi]

What would happen if you did the following:

- loaded a bunch of legit CIA files onto a compatible 3DS (system A).

- updated said system A to latest firmware

- system transferred from a different 3DS (system B) onto system A and left SD cards where they started

- redownloaded all bought eShop software

- system transferred from system A to system B, switching SD cards afterwards

Would this result in system B containing all the legit CIA games?

In theory it should work, but last I heard (and admittedly, it was some time ago) it didn't actually work as it should. In practice only a few titles made the trip across, with the majority of games not transferring.

I did have a theory for why this occurs; it is that the 3DS tracks the number of system transfers that the ID has made (there was a system transfer limit at one time), and that when you perform a system transfer, the transfer count of both the target and source systems are totalled together.

The scenario is often the same as the one you've suggested. That is, System B (the user's primary system) is transferred to System A (which is loaded with pirated preinstalled games). After one week the user attempts to transfer from System A back to System B, after which they discover that only one of the preinstalled games is listed in their purchase history.

Since it's impossible to have 10 preinstalled games without having made at least 10 system transfers, only one license is transferred with the rest of the preinstalled games deemed illegitimate.

This is of course pure speculation on my part, based on anecdotal evidence from members of this forum.

 

[DjoeN]

What would happen if you did the following:

1 - loaded a bunch of legit CIA files onto a compatible 3DS (system A).

2 - updated said system A to latest firmware

3 - system transferred from a different 3DS (system B) onto system A and left SD cards where they started

4 - redownloaded all bought eShop software

5 - system transferred from system A to system B, switching SD cards afterwards

Would this result in system B containing all the legit CIA games?

Will not work

First: Nintendo lifted awhile ago the limit on system transffers you can do.

I and others have tested this:
1. Install all legit cia's to a 9.2 system (A) (hardmodded) (See 1a)
2. Update 9.2 sysnand to 9.8 sysnand (A)
3. System transffered to another 3DS on latest FW (B)
4. Try to redownload all legit cia's again (B)
5. You don't come that far

1a. Works fine,
2a. After updating to 9.8, all games worked fine, checked NNID and says already downloaded, you could wipe them and redownload them (doesn't matter if a NNID was linked before or you linked aftwerwards)
3a. System transffer A to B, smooth without problems, everything transffers, but the legit cia's will not show up, you can't redownload them.
made a backup of the SD before the transffer, using the backup doesn't matter, the legit cia's don't show up.
4a. All legit cia's you installed show can't be redownloaded, you only have the option to buy them.

Conclusion: It doesn't work even if you try 1 game or 2 or all 16 (Europe), something more is missing to be able to system transffer, somehow when transffering it checks and finds you don't legally have the right to system transffer the legit cia installed games, we don't know what and nobody took a look at it again. (took me more then 3 months to try all possible combinations and options cause of the 7 days between transffers)

Note:
If you system transffer from a legit bought pre-installed console to another console with a pre-installed game, it will work, you then can if you bought another 3ds with pre-installed game, system transffer to that and all pre-installed games will transffer and work.
So, It only works when you bought everything legit.

...

Since it's impossible to have 10 preinstalled games without having made at least 10 system transfers, only one license is transferred with the rest of the preinstalled games deemed illegitimate.

This is of course pure speculation on my part, based on anecdotal evidence from members of this forum.

You can have more then 10 pre-installed games on 1 system, that is if you bought those all and system transffered them every time to another console with the 7 days wait each time.

Buy (All consoles with pre-installed game) A+B+C+E+F+G+H+I+J+K+L+M
System transffer A to B, wait 7 days, System transffer B to C, wait 7 days, system transffer C to D, etc...
M will have all pre-installed games you transffered, playable and redownloadable (You need at least a 32Gb Sd for that)

 

[Zidapi]

You can have more then 10 pre-installed games on 1 system, that is if you bought those all and system transffered them every time to another console with the 7 days wait each time.

Buy (All consoles with pre-installed game) A+B+C+E+F+G+H+I+J+K+L+M
System transffer A to B, wait 7 days, System transffer B to C, wait 7 days, system transffer C to D, etc...
M will have all pre-installed games you transffered, playable and redownloadable (You need at least a 32Gb Sd for that)

Thanks for weighing in with both your own experiences, and for providing concise summary of all the experiments the community undertook in trying to solve this mystery. It really reaffirms confidence in my theory of the system transfers being tallied, making "legit" games illegitimate.

I understand how the process of transferring preinstalled games is supposed to work, I did a lot of reading about it late last year before the new3DS was released. I was wanting to transfer from my 3DSXL to a 2DS with Pokemon X preinstalled, then from that to a 2DS with Pokemon OmegaRuby, then finally from that to my new3DS.

10 was just an example number I used because I knew there was at least 10 European preinstalled games.

 

[DjoeN]

...

10 was just an example number I used because I knew there was at least 10 European preinstalled games.

It's 16
- Pokemon Alpha Sapphire (RF)
- Pokemon Omega Ruby (RF)
- Pokemon X (RF)
- Pokemon Y (RF)
- Animal Crossing New Leaf (EU)
- Fire Emblem Awakening (EU)
- Kirby Triple Deluxe (EU)
- Legend of Zelda: Majoras Mask 3D (EU)
- Luigi's Mansion 2 (EU)
- Mario Kart 7 (EU)
- Monster Hunter 3 Ultimate (EU)
- Monster Hunter 4 Ultimate (EU)
- New Super Mario Bros. 2 Special Edition (EU)
- Super Mario 3D Land (EU)
- Super Smash Bros. For 3DS (EU)
- Tomodachi Life (EU)

Us has only 12 (Pokemon game sincluded, since these are regionfree)

 

[gamesquest1]

i think its probably that legit consoles with the legit cia files have the game actually recorded to their legacy account (the pre NNID way of tracking purchases), when you install a legit cia they system still see's it as signed and legit, but the game will not be added to the new consoles legacy account, they will play sure, and the system will assume it owns them, and as the injected ticket is legit you can re-download them and update etc....but the legacy account never has ownership of the title, so when it comes to transferring the actual ticket is never re-downloaded from nintendo as they have no record of the source console legitimately owning the title

this is all just basesed on @yifan_lu 's investigating why eshop doesn't work on region switched consoles stemming from pre-installed content being tied to the legacy account of each console which is non-transferable

 

[yifan_lu]

The ticket tied to your account and the tickets installed in the device can be different. When you install a "legit CIA", you are installing the ticket onto the device. Because the console id is zero, the ticket is seen as valid by the device. However, this does not magically upload the ticket to your nintendo account. There is no ECS/IAS command for "uploading" tickets. When you buy a console with something preinstalled, that ticket is attached to your eshop (legacy) account as well as installed onto the device. When you transfer/link NNID, that ticket is transferred. However, if you extract the ticket and manually install it onto another system, that ticket is gone when you system transfer (system transfer does not move tickets from the device, it links the new device to your legacy/nnid account and redownloads them on the other device). You can download from eshop your "legit cias" (oxymoron) and pirated cias (with sig patched tickets) because mint works by telling the ninja servers "I have tickets for these titles, let me download them." In fact all pirates have to really do is install tickets and not bulky CIAs and then just leech from nintendo's servers, but pirates aren't the brightest bunch.

 

[gamesquest1]

The ticket tied to your account and the tickets installed in the device can be different. When you install a "legit CIA", you are installing the ticket onto the device. Because the console id is zero, the ticket is seen as valid by the device. However, this does not magically upload the ticket to your nintendo account. There is no ECS/IAS command for "uploading" tickets. When you buy a console with something preinstalled, that ticket is attached to your eshop (legacy) account as well as installed onto the device. When you transfer/link NNID, that ticket is transferred. However, if you extract the ticket and manually install it onto another system, that ticket is gone when you system transfer (system transfer does not move tickets from the device, it links the new device to your legacy/nnid account and redownloads them on the other device). You can download from eshop your "legit cias" (oxymoron) and pirated cias (with sig patched tickets) because mint works by telling the ninja servers "I have tickets for these titles, let me download them." In fact all pirates have to really do is install tickets and not bulky CIAs and then just leech from nintendo's servers, but pirates aren't the brightest bunch.

yeah you put it better than i did , thanks for taking the time to clarify that....so there you go guys you cannot system transfer fake legit titles, end of the virus piracy idea....of course it will end up being brought up again....same as "can i boot into emunand instead of sysnand" or "can i use a cia of CN to boot pasta/GW" threads pop up every few weeks

 

[vipernig]

Thanks for the info. So on the stickied thread Hashtastrophe info was incorrect. I was inquiring there for the same thing and had to go through a huge thread where I found the legit CIAs and yup games won't transfer.

 

[Quantumcat]

Will not work

First: Nintendo lifted awhile ago the limit on system transffers you can do.

I and others have tested this:
1. Install all legit cia's to a 9.2 system (A) (hardmodded) (See 1a)
2. Update 9.2 sysnand to 9.8 sysnand (A)
3. System transffered to another 3DS on latest FW (B)
4. Try to redownload all legit cia's again (B)
5. You don't come that far

1a. Works fine,
2a. After updating to 9.8, all games worked fine, checked NNID and says already downloaded, you could wipe them and redownload them (doesn't matter if a NNID was linked before or you linked aftwerwards)
3a. System transffer A to B, smooth without problems, everything transffers, but the legit cia's will not show up, you can't redownload them.
made a backup of the SD before the transffer, using the backup doesn't matter, the legit cia's don't show up.
4a. All legit cia's you installed show can't be redownloaded, you only have the option to buy them.

Conclusion: It doesn't work even if you try 1 game or 2 or all 16 (Europe), something more is missing to be able to system transffer, somehow when transffering it checks and finds you don't legally have the right to system transffer the legit cia installed games, we don't know what and nobody took a look at it again. (took me more then 3 months to try all possible combinations and options cause of the 7 days between transffers)

Note:
If you system transffer from a legit bought pre-installed console to another console with a pre-installed game, it will work, you then can if you bought another 3ds with pre-installed game, system transffer to that and all pre-installed games will transffer and work.
So, It only works when you bought everything legit.



You can have more then 10 pre-installed games on 1 system, that is if you bought those all and system transffered them every time to another console with the 7 days wait each time.

Buy (All consoles with pre-installed game) A+B+C+E+F+G+H+I+J+K+L+M
System transffer A to B, wait 7 days, System transffer B to C, wait 7 days, system transffer C to D, etc...
M will have all pre-installed games you transffered, playable and redownloadable (You need at least a 32Gb Sd for that)

You missed something. I want to transfer the normal one over, re downloading eShop stuff to the modded console, then transfer back, **** moving the SD cards***** at this time. So no redownloading of the CIA files ever occurs.

 

[DjoeN]

You missed something. I want to transfer the normal one over, re downloading eShop stuff to the modded console, then transfer back, **** moving the SD cards***** at this time. So no redownloading of the CIA files ever occurs.

No i did not
Moving the SD cards you always have to do when system transffering (except when doing from a O3Ds to N3DS, unless you used a MicroSD with adaptor on your O3DS)
(ok, you don't but then you have to redownload everything)

The point is, Any legit CIA you installed and try to transffer will not work, even if you move the SD where all games are installed.
This only works with legally bought/obtained games

Like said, it only works with pre-installed games legally bought with the console!, not with installed legit cia's you downloaded and installed with fbi or any other installer, swap sd / redownload or whatever, it will not work.

But feel free to waste your time on it and try it out be sure to make backups of EVERYTHING before you do (NAND / EMUNAND / SD) and label them good in a folder (Backup NAND O3DS - 30-06-2015 / Backup EMUNAND O3DS - 30-06-2015 / Backup SD O3DS - 30-06-2015), Keep in mind you can NOT transffer back from a N3DS to O3DS

 

[Quantumcat]

No i did not
Moving the SD cards you always have to do when system transffering (except when doing from a O3Ds to N3DS, unless you used a MicroSD with adaptor on your O3DS)
(ok, you don't but then you have to redownload everything)

The point is, Any legit CIA you installed and try to transffer will not work, even if you move the SD where all games are installed.
This only works with legally bought/obtained games

Like said, it only works with pre-installed games legally bought with the console!, not with installed legit cia's you downloaded and installed with fbi or any other installer, swap sd / redownload or whatever, it will not work.

But feel free to waste your time on it and try it out be sure to make backups of EVERYTHING before you do (NAND / EMUNAND / SD) and label them good in a folder (Backup NAND O3DS - 30-06-2015 / Backup EMUNAND O3DS - 30-06-2015 / Backup SD O3DS - 30-06-2015), Keep in mind you can NOT transffer back from a N3DS to O3DS

Darn I guess that would have been too easy. Well if one or two make it across, could you just do it lots of times? If two made it over every time it would only take ... 4 months for the lot :-p

I wonder if Nintendo had this in mind when they made there be a limited number of system transfers in the beginning / having to wait a week between transfers.

 

[gamesquest1]

Darn I guess that would have been too easy. Well if one or two make it across, could you just do it lots of times? If two made it over every time it would only take ... 4 months for the lot :-p

I wonder if Nintendo had this in mind when they made there be a limited number of system transfers in the beginning / having to wait a week between transfers.

none will make it across, basically how the system transfer works is, the 3DS basically transfers access to its legacy account over to the target console, from there the target console downloads the associated tickets....so the tickets are never sent directly from the console, anything that doesn't exist on nintendo's server will be lost during the system transfer, what some people might of experienced getting one across was that they had a system that originally came bundled with a game but it had been uninstalled (i.e the system was formatted before they bought it) and they bought the console second hand and were unaware they actually had the rights to download said game all along....upon transferring, that legit legit game actually had a legit ticket server side for the target console to receive, but all the rest didn't so they were lost

in regards to the whole "and if i used the original SD"....basically all that happens is you then have the games pre-downloaded and encrypted to match the target console, but the system has no ticket to play them which results in them showing up in data management, but greyed out with a cross on them iirc....so the system acknowledges the game exists on the SD, but it also realizes you have no ticket to play so its just left there to taunt you in data management

 

[cearp]

In fact all pirates have to really do is install tickets and not bulky CIAs and then just leech from nintendo's servers, but pirates aren't the brightest bunch.

well we could have a solution like that, but it is more reliable to download a big file on your computer in your own time, then download it on the 3ds itself, which requires also requires having eshop access
it is nicer not to have to rely on the CDN for all time, and have the the whole game backed up (theoretically talking like a pirate)

 

[gamesquest1]

well we could have a solution like that, but it is more reliable to download a big file on your computer in your own time, then download it on the 3ds itself, which requires also requires having eshop access
it is nicer not to have to rely on the CDN for all time, and have the the whole game backed up (theoretically talking like a pirate)

well its not like the idea of plain old ticket databases hasn't been talked about, its a much more practical idea than people who are that way inclined fighting the never ending battle of re-uploading huge files, getting taken down, re-upping rinse and repeat....the principle of just having 1 download that effectively gives the end user access to every game on CDN with only a tiny download size would be extremely more practical for the uploaders of said games

then there is the alternative of a titlekey DB so you can download on your computer, keep a backup if you like and not have to worry too much about continued eshop access

 

[Quantumcat]

Did it possible to get tickets onto a compatible 3DS so that they will move with the system transfer? Or absolutely impossible to get non-paid-for games onto an upgraded 3DS?

Is there an article that explains tickets in a technical way so I can understand what they are and how the console uses them?

 

[Rizzorules]

But feel free to waste your time on it and try it out

Just like you

 

[yifan_lu]

Did it possible to get tickets onto a compatible 3DS so that they will move with the system transfer? Or absolutely impossible to get non-paid-for games onto an upgraded 3DS?

Is there an article that explains tickets in a technical way so I can understand what they are and how the console uses them?

http://3dbrew.org/wiki/Ticket