Hardware Repairing dead new 3ds LL

[ClickCLK]

Hello all. Recently I bought two dead 3ds LL consoles (japan region) from eBay. One of them was quickly repaired just by swapping parts, but the other isn't so easy.

One of this console's motherboards isn't turning on. All it does is charging battery (orange light glows) and when power button is pressed blue light starts to glow. I can power it off if I press power key for 15 or so seconds, but thats it. It consumes (as I remeber) 0.04 or 0.07 mA of power, it doesn't click and turn off by itself when screens or their backlight are disconnected (working console does this), it doesn't turn off by itself even when i power up motherboard only, with nothing (except battery board) attached to it.
Motherboard doesn't look physically damaged, there are no traces of liquid spillage or corrosion on it, everything looks normal. My guess was its an issue with software.

I tried to recover it using hardware method from the guide ( https://3ds.hacks.guide/installing-boot9strap-(hardmod) ) - it doesn't boot (nothing changed, really: only blue light, doesn't turn off, power consumption was still the same). Tried to flash nand backup from my second 3ds LL (which, I repeat, is working) - still same, so I flashed original, unmodified backup back. I physically desoldered EMMC chip and tested it on hardware programmer (z3x easy jtag plus) - chip works ok, no errors, everything reads and writes as it should, so I soldered EMMC back in its place.

Is this a software issue? will getting ntrboot flashcard fix my problem or is this a hardware issue? I can solder well (I can reball CPU if there'll be a need for it), but I don't know how to diagnose this console. If someone with experience in repairing this types of bricks can help me I will be very grateful.

P.S: While I was swapping parts between consoles I checked most of the parts: both screen on both console are working, both boards with battery connector are working, batteries are working, sd readers are working, other parts I didn't tested.

 

[IC_]

I think this is a hardware issue but I don’t know if it’s possible to fix it

 

[ClickCLK]

I think this is a hardware issue but I don’t know if it’s possible to fix it

If its a hardware issue, what can cause this behaviour? It seems like this console doesn't even try to boot. Judging by my experience (I fixed smartphones), this can be caused by one (or combination) of this factors:
1) emmc and/or ram and/or cpu chips are dead - emmc is tested and is working, ram and cpu is untested.
2) cold solder between emmc/ram/cpu and motherboard - I reballed emmc and reflowed ram (and many other chips). I can't reflow the cpu because of white glue-like substance underneath it, but will reball it if there'll be a need for this.
3) a problem with fimware (bricked, wrong firmware flashed, damaged boot partitions and so on) - this is possible, can be fixed using ntrboot, I think
4) emmc/ram/cpu aren't properly powered.

Maybe I am wrong and there is some other issue (idk, I repaired 3ds only once prior to this, there was a problem with backlight).

Are there any difference booting from ntrboot and booting from nand modified with hardware flasher?

 

[IC_]

I heard that this issue is caused by sleep mode and sometimes it’s fixed by reinserting the battery but you probably already did that
Maybe @TurdPooCharger can help

 

[KleinesSinchen]

3) a problem with fimware (bricked, wrong firmware flashed, damaged boot partitions and so on) - this is possible, can be fixed using ntrboot, I think
Are there any difference booting from ntrboot and booting from nand modified with hardware flasher?

Yes, ntrboot is different and worth a try because it bypasses the NAND entirely (the console tries booting from ntr cartridge before anything else and this even works if there is garbage data on the NAND).
If there is no severe hardware damage you should be able to boot GodMode9 (place it as boot.firm in the root of your SD).

Tried to flash nand backup from my second 3ds LL (which, I repeat, is working)

Ahh. No! NAND images are not interchangeable between two consoles.

so I flashed original, unmodified backup back.

Good. Try ntrboot with the original data on the NAND.

===

I heard that this issue is caused by sleep mode and sometimes it’s fixed by reinserting the battery but you probably already did that

Obviously yes. For a reflow you need to access the motherboard. The battery is the first thing to remove.

 

[ClickCLK]

Ahh. No! NAND images are not interchangeable between two consoles.

I thought so, but there was some unbricking guide, where it was said that this'll even work with very damaged firmware and no backup, so I gave it a try. Nothing changed anyway, so I reverted back to original.

I'll gladly try ntrboot, but my flashcards wasn't compatible with it, and seeing how much clones there are I don't know what/where to buy.

I have an idea, but only as last resort: replace cpu and emmc pair from working console to dead one and if it'll boot I'll know for sure that it is a problem with cpu or firmware and not with anything else, but this task is very time consuming and, I guess, it'll reduce reliability of both systems, because there'll be no glue underneath cpu on both of them.

 

[Razor83]

Possibly an MCU brick?

 

[ClickCLK]

Possibly an MCU brick?

What is an MCU brick? Dead CPU?

 

[KleinesSinchen]

What is an MCU brick? Dead CPU?

The MCU is not the CPU. [3dbrew]

As far as I know the MCU can be permanently damaged with (hopefully not existing) malware and in the past there had been discussions about MCU bricks on N3DS system when downgrading them to firmware 2.1 (I came much later to 3DS hacking and do not really know about this).

 

[TurdPooCharger]

I heard that this issue is caused by sleep mode and sometimes it’s fixed by reinserting the battery but you probably already did that
Maybe @TurdPooCharger can help

@ClickCLK, I'm shaking my head in disbelief. I commend you for knowing how to hardware repair electronics at a professional level using stuff like a heat reflow work station or oven, but your repair attempts at jumping straight to heavy duty stuff has complicated matters. Your chance of fixing that 2nd n3DSLL is very low and efforts should have first gone into figuring out if the problem was a relatively simple software issue.

I'm surprised you haven't heard before about CFW hacking and fixing the 3DS firmware with ntrboot (get the R4i Gold 3DS Plus) → GodMode9 → CTRTransfer.

Only after exhausting software approaches, a less radical method to quickly determine a faulty n3DSLL motherboard would have been to temporary swap the 2nd one's mobo into the working 1st n3DSLL.

***

Your problem reminds me of repressive feeling of a secondhand story my biology teacher once told my class. Our lessons at the time was watching David Attenborough's series of animal courtship (aka, animal porn), and we learned that whales of all things can get genital pubic lices. A student of his from a previous year said she once had pubic lices... And that she got rid of hers by using Raid.

The takeaway? Not all problems are nails. Not all of them can or should be fixed with a hammer.

 

[ClickCLK]

@TurdPooCharger, I sincerely thank you for commending my soldering skills. I don't know if you read my posts, but I stated earlier that I thought (and still think) that it is a software issue, and that I tried to recover it using modded nand backup flashed using hardware method (this changed nothing, so I reverted to stock). Also, I did check most of components on other working n3ds ll (which I did mention too) - both screens are working, cameras are working, subboard with battery connector is working, sd reader is working, main board is not working.

I know about ntrboot (mentioned in the first post), but I don't have compatible flash card at hand and was asking can it help if hardware method didn't. I started soldering only after attempts at software methods didn't work. I do know about cfw (I have a o3ds which I bought on preorder and it was just laying in its box until ninjhax and then pastcfw and rxtools came out. I installed a9lh on it, later I installed b9s on it, but not used this system much), I installed cfw and changed region from japan to eu on my second n3ds ll (I bought 2 of them, this one was easy to repair just by swapping parts around) same day as it was repaired and it works great.

Also, to clarify that my chances of repairing this console is the same as when it was untouched: I used to work at electronic repair shops for 7+ years (quit last week because I need to finish my studying at university), and did really hard repair jobs. For example, two weeks ago I swapped cpu + ram + nand + baseband + baseband eeprom + wifi chips from one very damaged (by liquid) board to another icloud locked board on iphone se and it works now. FYI most of this chips are BGA (except wifi chip) and have epoxy glue-like substance underneath them (which we call "compound"). To make matters worse ram chip on most iphones is soldered on top of cpu chip (its chip on chip on board), which means that it must be soldered by laying solder balls on ram chip on top of solder balls on cpu chip (this is a really hard process imo). I don't mean to brag about my skills, just wanted to make it clear that I, in fact, can consistently solder electronic components. So please ignore any thoughts that this n3ds ll console was harmed more than it was when soldering, because it wasn't, and I'm confident in it.

So questions remain: what can I try to do to fix it? Can ntrboot help me when hardware flashing modified nand backup method didn't work? Is it a software problem? If it's not - what part of the motherboard can be the culprit? How can I check it? And so on.

Please sorry for such a long post or any errors, English isn't my primary language.

P.S: @TurdPooCharger, I'm really grateful that your are trying to help, but please, do read my posts in this thread, most of the things you said were already stated in them. Thank you.

 

[TurdPooCharger]

@TurdPooCharger, I sincerely thank you for commending my soldering skills. I don't know if you read my posts, but I stated earlier that I thought (and still think) that it is a software issue, and that I tried to recover it using modded nand backup flashed using hardware method (this changed nothing, so I reverted to stock). Also, I did check most of components on other working n3ds ll (which I did mention too) - both screens are working, cameras are working, subboard with battery connector is working, sd reader is working, main board is not working.

I know about ntrboot (mentioned in the first post), but I don't have compatible flash card at hand and was asking can it help if hardware method didn't. I started soldering only after attempts at software methods didn't work. I do know about cfw (I have a o3ds which I bought on preorder and it was just laying in its box until ninjhax and then pastcfw and rxtools came out. I installed a9lh on it, later I installed b9s on it, but not used this system much), I installed cfw and changed region from japan to eu on my second n3ds ll (I bought 2 of them, this one was easy to repair just by swapping parts around) same day as it was repaired and it works great.

Also, to clarify that my chances of repairing this console is the same as when it was untouched: I used to work at electronic repair shops for 7+ years (quit last week because I need to finish my studying at university), and did really hard repair jobs. For example, two weeks ago I swapped cpu + ram + nand + baseband + baseband eeprom + wifi chips from one very damaged (by liquid) board to another icloud locked board on iphone se and it works now. FYI most of this chips are BGA (except wifi chip) and have epoxy glue-like substance underneath them (which we call "compound"). To make matters worse ram chip on most iphones is soldered on top of cpu chip (its chip on chip on board), which means that it must be soldered by laying solder balls on ram chip on top of solder balls on cpu chip (this is a really hard process imo). I don't mean to brag about my skills, just wanted to make it clear that I, in fact, can consistently solder electronic components. So please ignore any thoughts that this n3ds ll console was harmed more than it was when soldering, because it wasn't, and I'm confident in it.

So questions remain: what can I try to do to fix it? Can ntrboot help me when hardware flashing modified nand backup method didn't work? Is it a software problem? If it's not - what part of the motherboard can be the culprit? How can I check it? And so on.

Please sorry for such a long post or any errors, English isn't my primary language.

P.S: @TurdPooCharger, I'm really grateful that your are trying to help, but please, do read my posts in this thread, most of the things you said were already stated in them. Thank you.

You should always exhaust all software repair options before concluding it's an hardware issue. No matter how proficient you are at your trade, doing hardmod and removing the NAND chip this early in debugging placed unnecessary risks on that motherboard. I leave it that in your situation before making this thread, you weren't afforded with enough familiarity about ntrboot or the tool at hand (ie, compatible DS flashcart) to have done it any differently. This would be hindsight or something out of your control.

Get the R4i Gold 3DS Plus flashcart and follow the ntrboot guide. You can substitute SafeB9SInstaller using GodMode9 as boot.firm on the SD card root. As long as the game cart reader, SD slot reader, magnetic sleep switch, and bootloader are intact, your n3DSLL should boot SafeB9SInstaller or GodMode9 even if the eMMC is fried, damaged, or removed.

My best guess as to why the n3DSLL fails to boot HOME Menu is that the previous owner hacked it, removed the custom firmware, and left behind mismatching or unsigned files (SecureInfo_A/B from region changing, franken firmware, homebrew edited system titles, etc). If and only if ntrboot fails to elicit a boot response should you look back into SMD/SMT repairs.

 

[ClickCLK]

@TurdPooCharger, thanks for your answer. I'll try ntrboot, but it'll be some time before I get R4i Gold 3DS Plus or some other compatible card (shipping and all). In the meantime i'd really like to understand, what is the difference between booting modified nand backup flashed via hardmod and booting ntrboot? As I understand it, ntrboot is something like pandora battery + memory card was on the psp: if 3ds detects that a cart with some very specific information is present in cart slot and specific key combo is pressed right after power on, then bootloader (which is stored someplace other than nand) boots right off microsd card inserted in 3ds, completely ignoring nand chip (which will be initialised somitime later). Is this correct? If it is, then it means that 3ds doesn't check for any console specific information in firmware, so the system can boot. What I can't understand is, when you modify nand with hardware flasher using the guide ( https://3ds.hacks.guide/installing-boot9strap-(hardmod) ) and trying to boot from it, does 3ds cheks for any console-specific information in firmware before launching b9s or not? If it does, then ntrboot can help, but if it isn't then there is no difference between this methods (for my purposes, and assuming that emmc chip is ok).

BTW, i tried to make ntrboot cart with 3 flash carts:
- dstt - tried to flash it on o3ds, ds lite and dsi xl - ds an dsi flashers didn't work at all and 3ds flasher said it was uncompatible
- two identical r4 carts (don't know which one exactly as they wasn't mine and I don't have them now, I remember that label was white or silver and this cart was mentioned in the list of compatible flash carts) - tried to flash it on dsi xl and new 3ds LL, both systems looked like they flashed this carts, but nothing changed after flashing was completed - they still booted as regular flash carts, so I guess nothing was written to them.
All 3 of this carts, I think, are cheap clones, so I'm not surprised they didn't work, but it was a shame nontheless.

 

[TurdPooCharger]

@TurdPooCharger, thanks for your answer. I'll try ntrboot, but it'll be some time before I get R4i Gold 3DS Plus or some other compatible card (shipping and all). In the meantime i'd really like to understand, what is the difference between booting modified nand backup flashed via hardmod and booting ntrboot? As I understand it, ntrboot is something like pandora battery + memory card was on the psp: if 3ds detects that a cart with some very specific information is present in cart slot and specific key combo is pressed right after power on, then bootloader (which is stored someplace other than nand) boots right off microsd card inserted in 3ds, completely ignoring nand chip (which will be initialised somitime later). Is this correct? If it is, then it means that 3ds doesn't check for any console specific information in firmware, so the system can boot. What I can't understand is, when you modify nand with hardware flasher using the guide ( https://3ds.hacks.guide/installing-boot9strap-(hardmod) ) and trying to boot from it, does 3ds cheks for any console-specific information in firmware before launching b9s or not? If it does, then ntrboot can help, but if it isn't then there is no difference between this methods (for my purposes, and assuming that emmc chip is ok).

BTW, i tried to make ntrboot cart with 3 flash carts:
- dstt - tried to flash it on o3ds, ds lite and dsi xl - ds an dsi flashers didn't work at all and 3ds flasher said it was uncompatible
- two identical r4 carts (don't know which one exactly as they wasn't mine and I don't have them now, I remember that label was white or silver and this cart was mentioned in the list of compatible flash carts) - tried to flash it on dsi xl and new 3ds LL, both systems looked like they flashed this carts, but nothing changed after flashing was completed - they still booted as regular flash carts, so I guess nothing was written to them.
All 3 of this carts, I think, are cheap clones, so I'm not surprised they didn't work, but it was a shame nontheless.

Oh god, the Sony PSP. I had an early phat model that came with firmware 1.50. Good times were had when playing Chrono Trigger for the first time on that beautiful wide screen.
I stopped following that homebrew scene at psp-hacks.net?? forum (now better known as wololo.net?? these days) as the crowd in those early days was super toxic and degrading towards the devs. Shit was fucked seeing that general attitude carry over to PS3 scene.

I'm not knowledgeable about how Pandora battery works. All I remember is something about a crazy Hispanic dude who stumbled upon it after tinkering around with a battery. I think Sony repair technicians accidentally sent out one of their official Pandora batteries to a customer as theirs are colored red, and that led him to look into it more.

Here's info about the 3DS bootloader. It's initialized by the ARM9 and ARM11 CPUs upon turning on the 3DS. You make heads and tails how (dis)similiar that is compared to Pandora battery.

The reason why you can't use the raw NAND image dumped from another n3DSLL (even same model and region) is because they're console uniquely encrypted. I think that encryption is handled by something called the otp.bin (one time protection programmable *) that's flashed in the ARM9 bootrom at factory. There are ways around that borrowing or using a different system's NAND image through Lazarus3DS. To ensure I'm not giving you false info, I call upon the guru @ihaveamac to correct the record as he's much more versed in subject field.

About flashcarts as can be read from the 3ds.hacks.guide ntrboot page and The ultimate list of NTRBoot compatible flashcards.

• Only DSTT with certain flash chips are ntrboot compatible.
  
• DS flashcarts in ntrboot mode doesn't show its icon in HOME Menu nor will they launch playing DS games.
• Only the Acekard 2i is the except where ntrboot and DS modes work side-by-side if the 3DS system is already hacked.

 

[ihaveahax]

The reason why you can't use the raw NAND image dumped from another n3DSLL (even same model and region) is because they're console uniquely encrypted. I think that encryption is handled by something called the otp.bin (one time protection) that's flashed in the ARM9 bootrom at factory. There are ways around that borrowing or using a different system's NAND image through Lazarus3DS. To ensure I'm not giving you false info, I call upon the guru @ihaveamac to correct the record as he's much more versed in subject field.

OTP means One-Time Programmable, because it can only be written one-time to the SoC. It contains data used to generate encryption keys unique to the system. All the system partitions are encrypted using these keys. The process to generate these keys can be viewed here: https://github.com/ihaveamac/ninfs/...bba0276699fcb/ninfs/pyctr/crypto.py#L432-L521 or https://github.com/yellows8/boot9_t...78c3b008ebb2761/boot9_aeskeytool_conunique.sh

 

[ClickCLK]

@TurdPooCharger, @ihaveamac thank you guys for helping me out. I'll wait for an ntrboot compatible flash cart and when I try it I'll post results.

 

[ClickCLK]

So I got myself a flashcart today, flashed it with ntrboot, flashed my o3ds with stock backup of 1.0.0-0e (no hacks whatsoever, this dump was made using hardware method before I attempted to run ninjhax on this system when it first came out), checked ntrboot there - it worked. Tried it on my dead n3ds LL - no luck, nothing changed. It doesn't boot, only blue light. I don't have access to my laboratory power supply unit at the moment to check if its power consumption is still the same, but I guess it is.

I really need help from someone with knowledge in hardware repair of this systems. Does anyone know which chips\components are binded together and are console specific? Maybe I can swap them from my working n3ds LL to this dead one and check if this problem is with this chips, or maybe someone knows how I can diagnose this system? Maybe there's a forum for hardware repairs like this? I know a couple of places where I can get help on xbox\ps consoles, but they don't deal with nintendo systems there.

 

[ClickCLK]

I was at my workplace yesterday and had some time to work with this console. Checked power consumption - it's approximately 0.09a with or without ntrboot, so nothing changed. I tried to reball cpu and ram, and, just for testing purposes, tried to power on this n3ds ll without this chips - and it STILL shows the same symptoms - blue light starts to glow, it turns off after 13 seconds of pressing power button, power consumption is 0.02a, so I guess it doesn't even try to initialize cpu/ram when powering on, and poweron process is handled by mcu, so maybe it's mcu bricked. Tried to reball mcu and try to power on without it - it doesn't turn on at all when mcu is desoldered and everything went back as it was when I soldered it back in its place. I guess it's mcu bricked.

I'll try to resolder mcu chip from my working n3ds ll to this dead one when I'll be at work again, but I don't know when I'll get this chance. I'll report when it'll be done.

Also, here's some photos just for fun.

 

[ClickCLK]

So I got to the bottom of this today. Swapped mcu, pmic and ram chips between my working n3ds LL and dead one - working was still working and dead was still dead. Desoldered emmc from working console - it started to show bootrom error. Desoldered emmc from dead one - still 0,09a and nothing on screens. Also, just for testing purposes, tried too boot working console from ntrboot - it doesn't boot and doesn't show a bootrom error, just black screens and blue light, power consumption is 0,11a (and yes, I did everything correctly, checked multiple times on my working o3ds). Anyway, next I swapped SoC chips between this boards and board from a dead console started to show bootrom error! Soldered to this board emmc chip from working board and it now boots fine, except upper screen doesn't work, only backlight, but I think this is not a related issue and I'll fix it later, didn't have enough time today.

Tl;dr: the problem was dead SoC.

Will post photos of SoC swapping process and bootrom error next post (for proof).

Huge thanks to @Sono and evryone in this thread who helped me with this repair attempt.

 

[ClickCLK]