Homebrew DSi Downgrading - The Complete Guide

[Ryccardo]

So, where do I have to start? I read in the guide that the European versions still couldn't because the upgown is not yet made for EUR systems then I'm somewhat confused

Which is true
You can use any method possible to backup and restore the nand (hardmod, any DSiware exploit compatible with fwtool - including the new flipnote one, not just the older, American-only ugopwn) and they are all equivalent

--------------------- MERGED ---------------------------

The first part of the guide mentions that you need to install an exploitable game but since the shop is closed down is it still possible to downgrade?

You can always backup the nand and get its CID via hardmod (using an appropriate SD reader - the kind that appears in Linux as "mmcblk?" instead of "sd?"), then allegedly bruteforce the ConsoleID

 

[AmandaRose]

So, where do I have to start? I read in the guide that the European versions still couldn't because the upgown is not yet made for EUR systems then I'm somewhat confused

ugoopwn or whatever the euro version is called has been available for euro dsi for over a week now just search this very site for it.

 

[lAkdaOpeKA]

So, where do I have to start? I read in the guide that the European versions still couldn't because the upgown is not yet made for EUR systems then I'm somewhat confused

Use dsi.cfw.guide, dsiguide.me is outdated

 

[gorgyrip]

Can someone please recommend me a cheap compatible card reader from aliexpress?
EDIT: I got this one: https://www.aliexpress.com/item/All...Mini-Micro-SD-SDHC-M2-MMC-XD/32830718369.html
I hope it will work.

 

[ElCJLokoshom21]

Hello Goodnight. I need your help, my flash card does not read my dsi and that I did downgrade to version 1.4 and still do not read it. Could you upload it in nand version 1.3?

 

[lAkdaOpeKA]

Hello Goodnight. I need your help, my flash card does not read my dsi and that I did downgrade to version 1.4 and still do not read it. Could you upload it in nand version 1.3?

Does it appear on the home menu and not launch or does it not appear at all?

 

[gorgyrip]

Is it possible to make it work with r4 carts that don't appear on the home menu? I downgraded to 1.4E and the cart that showed an error now works, but old r4 carts don't even show on the home menu. I also have a demo of mario vs donkey kong that doesn't show on the home menu. But those work if i start them from unlaunch. It would be great if I could start them from the home menu.

 

[AL_16]

Hello Goodnight. I need your help, my flash card does not read my dsi and that I did downgrade to version 1.4 and still do not read it. Could you upload it in nand version 1.3?

maybe U better to install Flipnote and CFW? HCfw is unblocking flashcards

 

[mightywii]

I finally got around to hardmoding my DSi so I could run the codeboot exploit and cfw. Thought I'd share some of the roadblocks I hit.

I bought the Anker card reader from the Amazon link in the guide, and the reader I received does NOT work in 1-bit bus mode or with my DSi eMMC at all. The model is AR200 and product code 68ANREADER-B2A. I had success with a cheap SoCal reader that I had used in the past with a slim 360, but even though it supports 1-bit bus, I had to use 4-bit to get it to work with my DSi (7 wires) https://www.amazon.com/d/Memory-Card-Readers/MemoryMarket®-MicroSD-MicroSDHC-MicroSDXC-compatible/B015IYV3TY/ I had to look up a guide on the 3DS to find that you have to plug the adapter into the reader, turn on the DSi, and then plug the reader into the computer to read the nand.

I got my eMMC CID by hooking it up to a rather old laptop that runs Linux. Took me a while to find out I needed to set the first byte to 0x00 and reverse it like in the RPi instructions. You have reinsert the adapter after turning the DSi on, and I could have used this to replace the usb reader altogether.

I got my Console ID by using SRL Extractor, took me forever before I realised I could use it with the DSi Browser.

I used TWLbf to search for my Console ID (found out about SRL Extractor right before it found the key), later I found out that bfCL can actually bruteforce both with only information from the nand dump.

 

[gorgyrip]

I used this card reader (the white one) and it worked:
https://www.aliexpress.com/item/MIN...044.html?spm=a2g0s.9042311.0.0.27424c4dKfdY0n
But every time i tried to open a micro sd adapter, the plastic broke. So I soldered the wires directly into the card reader (it still needs an empty micro sd adapter inserted for detection).

 

[Juanesgtgt]

I finally got around to hardmoding my DSi so I could run the codeboot exploit and cfw. Thought I'd share some of the roadblocks I hit.

I bought the Anker card reader from the Amazon link in the guide, and the reader I received does NOT work in 1-bit bus mode or with my DSi eMMC at all. The model is AR200 and product code 68ANREADER-B2A. I had success with a cheap SoCal reader that I had used in the past with a slim 360, but even though it supports 1-bit bus, I had to use 4-bit to get it to work with my DSi (7 wires) I had to look up a guide on the 3DS to find that you have to plug the adapter into the reader, turn on the DSi, and then plug the reader into the computer to read the nand.

I got my eMMC CID by hooking it up to a rather old laptop that runs Linux. Took me a while to find out I needed to set the first byte to 0x00 and reverse it like in the RPi instructions. You have reinsert the adapter after turning the DSi on, and I could have used this to replace the usb reader altogether.

I got my Console ID by using SRL Extractor, took me forever before I realised I could use it with the DSi Browser.

I used TWLbf to search for my Console ID (found out about SRL Extractor right before it found the key), later I found out that bfCL can actually bruteforce both with only information from the nand dump.

Could you help me bruteforce both CID and Console ID with bfCL?, I extracted the nand via hardmod, but I don't know how to use bfCL, and the documentation doesn't help a lot. Thanks.

 

[mightywii]

I used this card reader (the white one) and it worked:
https://www.aliexpress.com/item/MIN...044.html?spm=a2g0s.9042311.0.0.27424c4dKfdY0n
But every time i tried to open a micro sd adapter, the plastic broke. So I soldered the wires directly into the card reader (it still needs an empty micro sd adapter inserted for detection).

Thanks for the recommendation, that's the usb 3.0 version of the reader I used, ordered one as a backup. Pin 3 has two contacts so it can detect if a card is inserted, you can bridge them so you don't have to insert a card for it to work.

Could you help me bruteforce both CID and Console ID with bfCL?, I extracted the nand via hardmod, but I don't know how to use bfCL, and the documentation doesn't help a lot. Thanks.

The first example is in this post https://gbatemp.net/threads/twlbf-a...ole-id-or-emmc-cid.481732/page-5#post-7666257
Using that, you can bruteforce your console id, then you can bruteforce your eMMC ID.

 

[gorgyrip]

Thanks for the recommendation, that's the usb 3.0 version of the reader I used, ordered one as a backup. Pin 3 has two contacts so it can detect if a card is inserted, you can bridge them so you don't have to insert a card for it to work.


The first example is in this post https://gbatemp.net/threads/twlbf-a...ole-id-or-emmc-cid.481732/page-5#post-7666257
Using that, you can bruteforce your console id, then you can bruteforce your eMMC ID.

I'm also a little confused. I have a dsi motherboard. I think it came from a metallic blue dsi. It's european i think (i can't access the settings menu).
What should I use for console id?
08A2000000000100 for DSi
08A1900000000000 for some other DSi
08A1500000000000 for some other DSi

bfcl doens't work for me and when i'm using the following i'm getting an invalid parameters error:
twlbf_mbedtls console_id_bcd 08A2000000000100 001f A7EE8F9548FF6F270B8DDF1311935160 000000000000000000000000000055aa 0000 9BCE6F029370131A2A00DCE49F8F141E 00000000000000000000000000000000

 

[mightywii]

I'm also a little confused. I have a dsi motherboard. I think it came from a metallic blue dsi. It's european i think (i can't access the settings menu).
What should I use for console id?

First you bruteforce for the ranges provided, then for sequential values from the ranges provided. So like 08A15-08A21 and 08201-08204, and if that does not find it, expand to something like 08A10-08A14, or 08A22-08A25, etc.

bfcl doens't work for me and when i'm using the following i'm getting an invalid parameters error:
twlbf_mbedtls console_id_bcd 08A2000000000100 001f A7EE8F9548FF6F270B8DDF1311935160 000000000000000000000000000055aa 0000 9BCE6F029370131A2A00DCE49F8F141E 00000000000000000000000000000000

twlbf does not support that, only bfcl which requires a graphics card that can support OpenCL. Are those the real values from your nand? If so, I or someone on the twlbf thread will be able to brute it for you.

 

[gorgyrip]

First you bruteforce for the ranges provided, then for sequential values from the ranges provided. So like 08A15-08A21 and 08201-08204, and if that does not find it, expand to something like 08A10-08A14, or 08A22-08A25, etc.


twlbf does not support that, only bfcl which requires a graphics card that can support OpenCL. Are those the real values from your nand? If so, I or someone on the twlbf thread will be able to brute it for you.

Thank you. But someone with a compatible card got the console id for me and I got the CID on my pc using twlbf_mbedtls.
Now I'm trying to install unlaunch with tempnand but it doesn't work. My console gives an " error has occurred" on every app i run (weird, but the camera works if i don't start it from the app, but works when I press one of the shoulder buttons). I hope to revive it if i'll be able to install unlaunch. The nand works fine in no$gba.

EDIT: It was so simple. I loaded unlaunch in no$gba and from there I install it. After that i removed the footer and flash the nand back to the console. Now, from unlaunch I can start any app, no more errors. But if start the launcher and from there I start an app I get the error.
If i go into the settings and then internet, when it searches for a connection I get the error, so it must be something related to the wifi board (it was tested in another console, I also have tried multiple known working wifi modules).
I also tried hiyacfw, and I also get the error when I start any app.
I wish it was possible to edit the system menu not to check the wifi board.

 

[Ocelot124286]

X

The Biggest Loser, as an exploit game, is used exclusively for recovering your DSi's CID. The CID, or Chip Identification number, is used as part of your NAND's encryption, and is one of two parts of the encryption key. You can also recover the CID with a Raspberry Pi when you install your NAND reader. There's a few ways to get it, using "The Biggest Loser" is just one of them.

Couldn't you just dump your cid with fwTool and a flashcard?

*EDIT* I just learnt it won't work.

 

[SaiCnvrr]

I have a dsi of the Japanese version which I wanted to hardmode through arduino. You can help with this, I have no idea how to do it.

 

[Ocelot124286]

For anyone interested, here's approximately what the hard-mod will look like installed. Mind you, it was a test fit, so the hole is larger than it it needs to be to get the positioning right on the board below.

It works as intended, of course, and will look better next time, now that I know the correct positioning. The original DSi will look different, of course, as there isn't room under the battery door on the original.



To answer your question, it lets you re-enable all older flashcarts that were blocked, allows you to copy exploited DSiWare saves, that were disabled in 1.4.2FW, and allows you to use SUDOKU again as a DSiWare Exploit. This also makes your console brick-proof. Beyond that, you can install any homebrew you want to your SD card, and run it in DSi-Mode, with 4x the available RAM and 2x the available CPU speed. This makes homebrew run much better, and might just allow for a stable GBA emulator too. DSiWare and NDS backup loading through DSiWareHax might happen later, but right now, no, it's not supported.

How many wires is that?

 

[SaiCnvrr]

How many wires is that?

4 Wires

 

[Ocelot124286]

So where is GND on regular DSi?