Basically, all you need to install .cias is ARM11 kernel access. But these can only be signed .cias, ARM9 kernel is needed for unsigned .cias. There is downgrading protection with system apps and normal apps, however it's flawed: You can delete an app and then install it directly afterwards, effectively making these protections void. Thus the MSET downgrade hack was formed. So in theory, if you had ARM11 kernel access you could do this remove->install trick on all system apps and modules, including the NATIVE_FIRM title. To remedy the two stored straight on the NAND used by the bootloader, you actually already have the xorpads needed for those. If you know what version you're already on, you can use that NATIVE_FIRM image to retrieve an xorpad for it, and use that xorpad to write an older NATIVE_FIRM (note, these are still signed FIRM images here). This probably isn't possible though for the N3DS, due the fact that the 9.6 and up NATIVE_FIRM binaries are stuck behind new encryption. You could at least though return some usermode exploits I suppose.
You might say though, why not just write the NATIVE_FIRM only? This could maybe work for a few firmware versions with minimal updates relying on new stuff in the FIRM, but if the firmware introduced any significant changes it will most likely fail to work.
