Hacking Restore firm0firm1.bak to SysNAND? (a.k.a Uninstall B9S)

[Searinox]

The full NAND backup I have, I meant if like, the firm0firm1.bak and sector thing were like a kind of otp.bin in that they'd be needed to recover a brick.

 

[gamesquest1]

The full NAND backup I have, I meant if like, the firm0firm1.bak and sector thing were like a kind of otp.bin in that they'd be needed to recover a brick.

Nope, as long as you install successfully then you can delete them, a nand backup trumps a firm backup

 

[Deleted User]

I used D9WIP to inject A9LH FIRM0 and FIRM1 (from previous NAND backup) into FIRM partitions, replacing B9S FIRM's and it got bricked -- black screen =(
That's the result.

Don't try it guys, pls. Even with secret sector thing.

 

[MelonGx]

Yes there are. If you have A9LH and you're updating to bootstrap, dump a backup first.

If you're starting from the beginning, you can still make a dump after you install B9S and use that to get rid of it if you want. All you have to do is pick the right option in D9/GM9. Unless you installed actual sighax, it's removed just like A9LH was if you don't tell the program not to touch the firm, else it restores it anyway.

No it doesn't.
B9S-installed NAND backup will always have the B9S inside F0F1.
It is (censored) to say "you can uninstall A9LH/B9S by restoring a hax-installed NAND just not choosing (keep hax)".

BTW, @d0k3 sent me an alternative method to uninstall B9S.
1) Dump B9S-installed NAND (keep encrypted!)
2) Inject firm0firm1.bak (it's already encrypted) to the NAND's correct location (seems to be available with hardmod B9S program?)
3) Restore the modified NAND without keeping hax

 

[EmuAGR]

Isn't that firm0firm1.bak a copy from a A9LH'd firm partition in case A9LH was intalled? AFAIK, restoring that would brick since 0x96 sector is unmodded by B9S intaller.

 

[Quantumcat]

If you're starting from the beginning, you can still make a dump after you install B9S and use that to get rid of it if you want.

How? Then the backup will have b9s in it.

 

[The Real Jdbye]

No it doesn't.
B9S-installed NAND backup will always have the B9S inside F0F1.
It is (censored) to say "you can uninstall A9LH/B9S by restoring a hax-installed NAND just not choosing (keep hax)".

BTW, @d0k3 sent me an alternative method to uninstall B9S.
1) Dump B9S-installed NAND (keep encrypted!)
2) Inject firm0firm1.bak (it's already encrypted) to the NAND's correct location (seems to be available with hardmod B9S program?)
3) Restore the modified NAND without keeping hax

You should only have to inject firm0firm1.bak, since B9S doesn't modify anything else, but of course any illegitimate titles you have installed will be left over, like injected FBI, and injected FBI might not be easy to get rid of. I don't know the specifics of how injected FBI is stored on the system, but if it changes the title version to a higher one than what's available on NUS, it won't be overwritten by a new update and may never be overwritten by a future update, and it won't be possible to uninstall or remove it without CFW.

I used D9WIP to inject A9LH FIRM0 and FIRM1 (from previous NAND backup) into FIRM partitions, replacing B9S FIRM's and it got bricked -- black screen =(
That's the result.

Don't try it guys, pls. Even with secret sector thing.

From what you said, you didn't write the A9LH secret sector to NAND. In that case, that's your problem. A9LH requires a corrupted secret sector (that's how the exploit works), and without it, it will just see two corrupted FIRMs, and with no fallback, it'll just give up.
It would have been a good idea for Nintendo to make it read firm from CTRNAND if both firm0 and firm1 fail checks, but I guess that would have made the console less secure.

 

[Majickhat55]

If someone wants Nintendo's help, he/she must uninstall any exploit to avoid the console's repairment to be rejected by Nintendo.

Agreed, but most people that use hacks are out of warranty anyway, and a lot of people buy used so they don't have one. Nintendo isn't the only place that can repair their consoles. Just sayin'.

How? Then the backup will have b9s in it.

Well you could still use the Decrypt9 payload as safehax to dump the NAND prior to installing B9S. I guess it's an extra step but a useful one IMO.

 

[Quantumcat]

Agreed, but most people that use hacks are out of warranty anyway, and a lot of people buy used so they don't have one. Nintendo isn't the only place that can repair their consoles. Just sayin'.

Well you could still use the Decrypt9 payload as safehax to dump the NAND prior to installing B9S. I guess it's an extra step but a useful one IMO.

It's not in the guide though, so 99% of people won't know to do this.

 

[Majickhat55]

It's not in the guide though, so 99% of people won't know to do this.

Yeah I wonder why....... Guess it's unnecessary these days. I'm just a stickler for backups Lol

 

[Sheimi]

I would do this. Just speculation. What if you took firm0 and firm1 from a nand dump you did pre a9lh and restore it?

 

[Ryccardo]

I would do this. Just speculation. What if you took firm0 and firm1 from a nand dump you did pre a9lh and restore it?

Should work... assuming the kernel version from that backup can boot the operating system you now have installed

But since you implied having a full backup, just reflash that one...

 

[MelonGx]

You should only have to inject firm0firm1.bak, since B9S doesn't modify anything else, but of course any illegitimate titles you have installed will be left over, like injected FBI, and injected FBI might not be easy to get rid of. I don't know the specifics of how injected FBI is stored on the system, but if it changes the title version to a higher one than what's available on NUS, it won't be overwritten by a new update and may never be overwritten by a future update, and it won't be possible to uninstall or remove it without CFW.

You're right but off topic.
This thread mainly discusses about uninstalling B9S.

It's not in the guide though, so 99% of people won't know to do this.

Yes.
Backing-up F0F1 is quite enough because B9S only modifies F0F1 and it reduces much time of the process from backing-up the full NAND.
The problem is both the updated guide(tm) and current sighax softwares don't reserve a friendly enough software method for restoring integrated F0F1 backup.

GodMode9 and D9WIP have only the seperated F0 and F1 restore direct access.
B9STool can restore the integrated F0F1 but it will brick A9LH and B9S installed system.
Hardmod can restore the integrated F0F1 too but it's a hardware method which isn't available for everyone.

d0k3's alternative method (Dump raw NAND -> Use Hardmod tool to inject integrated F0F1 backup to the dumped raw NAND -> Restore modified NAND without keeping hax by using D9WIP/GM9) should be the most friendly software method currently though.

 

[DearMusic]

Hi MelonGx,

I really want to remove my B9S, and what d0k3 said is very confusing to me.
Sorry I am just a noob trying to get rid of B9S, would you have time to help me figure out what I should be doing?

The first step you said was to Dump raw NAND. How do I go about doing that?
Is it from Dycrypt9? Or from GodMode9? Or what tool might I be missing?

The second step you said was to use Hardmod tool to inject integrated F0F1 backup to the dumped raw NAND.
I could not understand any word that was said in this step... How do I inject? How do I intergrade my F0F1 into NAND?

The last step I think I know what to do... The previous 2 step though, I don't really understand...

Can you maybe help me a bit?

 

[DocKlokMan]

No it doesn't.
B9S-installed NAND backup will always have the B9S inside F0F1.
It is (censored) to say "you can uninstall A9LH/B9S by restoring a hax-installed NAND just not choosing (keep hax)".

BTW, @d0k3 sent me an alternative method to uninstall B9S.
1) Dump B9S-installed NAND (keep encrypted!)
2) Inject firm0firm1.bak (it's already encrypted) to the NAND's correct location (seems to be available with hardmod B9S program?)
3) Restore the modified NAND without keeping hax

Thank you for this, I successfully uninstalled B9S using the firm0firm1.bak file that was made from a stock console (not one that previously had A9LH on it) using the restore-firm0firm1 script from hardmod-b9s-installer (which just copies the firm0firm1.bak to address 0xB130000 of your NAND.bin backup from GodMode9). Once I had an unpatched NAND.bin I mounted it in GodMode9, copied firm0.bin and firm1.bin to my sysNAND, overwriting the B9S ones, and successfully booted a stock console.

If you had A9LH and upgraded to B9S, do not do this. A9LH needs a specially corrupted secret_sector as well which does not get restored via this method and without it you will brick your console. This is only do-able on consoles that were completely stock when running SafeB9SInstaller for the first time.

 

[Engezerstorung]

Hi,

If someone previously installed A9LH with guide, then updated it with b9s with guide methode again
And if that personne have a nand clean nand backup created before installing A9LH.
Is restoring it will uninstal b9s and all hack trace? (how do you restore in godmod, navigate to location and select it? what is the exacte option for not keeping b9s while restoring?)
If there is this pre-A9LH backup available, and all backups kept are from installing a9lh then updating to b9s using guide, what would be the method to totally unhack the console

Thank you for the infos

ps: if the console in non banned at this point, will unhacking it will avoid being banned in the future or is this "already too late"?

ps2: if the console is banned in the future, is it possible to unlink the nnid to put it on a legit console and get back eshot and stuff? I heard that Nintendo can unlink if we call them (console broke, lost, stolen,...) will they say yes or will they say "i see that the console have been ban for hack, so stfu"

 

[Quantumcat]

Hi,

If someone previously installed A9LH with guide, then updated it with b9s with guide methode again
And if that personne have a nand clean nand backup created before installing A9LH.
Is restoring it will uninstal b9s and all hack trace? (how do you restore in godmod, navigate to location and select it? what is the exacte option for not keeping b9s while restoring?)
If there is this pre-A9LH backup available, and all backups kept are from installing a9lh then updating to b9s using guide, what would be the method to totally unhack the console

Thank you for the infos

ps: if the console in non banned at this point, will unhacking it will avoid being banned in the future or is this "already too late"?

ps2: if the console is banned in the future, is it possible to unlink the nnid to put it on a legit console and get back eshot and stuff? I heard that Nintendo can unlink if we call them (console broke, lost, stolen,...) will they say yes or will they say "i see that the console have been ban for hack, so stfu"

1. Yes you can remove b9s that way. Choose the non-safe option in GodMode9.
2. Probably already too late - Nintendo already gathered the info. It is a bad idea to remove CFW because then you may end up with a banned, stock console and won't be able to unban.
3. With system transfer, I am not sure if the ban will transfer though. So might be a bad idea.

 

[SciresM]

GodMode9 doesn't have such a choice to restore firm0firm1.bak.
Does cutting the firm0firm1.bak to firm0.bin (4.0MB) + firm1.bin (4.0MB) then restoring to SysNAND work?

Boot9strap installation fixes the secret sector to match stock.

Just re-writing the FIRMs you backed up will brick you, because the secret sector won't be corrupted properly.

 

[JackAttackYT]

Dont know if right place but if i restore a nand backup before i did b9s 1.2 (nand backup was 1.0) would it work? Bring back b9s 1.0?

 

[Anon--0]

Boot9strap installation fixes the secret sector to match stock.

Just re-writing the FIRMs you backed up will brick you, because the secret sector won't be corrupted properly.

I would trust that guy