This is a tutorial that shows you how to use ninfs (formerly fuse-3ds) to extract the contents of games, NAND backups, and SD card contents. This tutorial is a work in progress; please post a reply if something is confusing or needs a correction.

This supports Windows, macOS, and Linux. This tutorial mostly focuses on the GUI on Windows. For macOS/Linux steps plus CLI/installable-module usage, see the README and latest release at the repository.

What sets ninfs apart from others like ctrtool is that it doesn't need to decrypt separately first. Instead, files are decrypted as needed. For example, if you mount a CIA, you can see all of the files in it, and you only need to copy out what you need. This makes it much faster and more efficient, especially for larger games where it can take a while (and several gigabytes of space) to decrypt!

Want to see a video demonstration? Here is one with Pokémon Ultra Moon, using fuse-3ds v1.0.

Spoiler: Demonstration

In this short video, I show that the CIA is encrypted, then I use ninfs to mount it and browse its contents in Windows/File Explorer. I can also use the decrypted.cxi file to immediately start playing it in Citra.
(Note that slowness is due to the virtual machine, speed would be faster on a normal computer!)

Getting started

Windows users simply need two things:

• Install the latest release of WinFsp
• Download the latest release of ninfs at GitHub or the GBAtemp Download Center
  • You should download the win64 version if you're using 64-bit Windows.

Please see the latest release notes for macOS and Linux (+ alternative steps for Windows).

You also need the ARM9 bootROM. You can use boot9strap to dump it by holding START+SELECT+X at boot, and finding it at /boot9strap/boot9.bin on the SD card. You can find boot9strap setup at 3DS Hacks Guide.

For newer digital games (2015+), you also need a SeedDB. Check out the SeedDB list.

Setting up boot9/SeedDB

You will need boot9.bin or boot9_prot.bin, and seeddb.bin. This will be placed at %APPDATA%\3ds on Windows, and `~/.3ds` on macOS/Linux.

If one of the files could not be found, an error will be displayed.

Spoiler: Copy boot9 or SeedDB

Both boot9 and SeedDB use similar steps for setup. This part shows boot9 steps, but it is the same for SeedDB.

If you click "Fix boot9", you will see a dialog allowing you to choose the boot9 file, and the searched paths.

Click "Select boot9 to copy..." then find the boot9.bin or boot9_prot.bin file. If it is valid, it will be copied.

Using the GUI

Run ninfs (either the exe, or the module if you installed it). A console window will appear, then a GUI a few seconds later.

First, choose the type that you want at the top:

• CTR Cart Image (".3ds", ".cci")
• CDN contents (directory with "cetk", "tmd", and contents)
• CTR Importable Archive (".cia")
• Executable Filesystem (".exefs", "exefs.bin")
• Nintendo 3DS NAND backup ("nand.bin")
  • Using a directory instead of drive letter is highly recommended for this!
  • You need the OTP for this if the NAND backup does not have essential.exefs embedded by GodMode9. If you have essential.exefs as a separate file, you can extract it from that. If the Counter can't be automatically generated, you also need the CID.
  • You can write to the NAND. In the GUI, you need to enable this option. Otherwise, the mount will be read-only.
• NCCH (".cxi", ".cfa", ".ncch", ".app")
• Read-only Filesystem (".romfs", "romfs.bin")
• SD Card Contents ("Nintendo 3DS" from an SD card)
  • You need movable.sed from the system whose SD card contents you want to browse. You can get it from essential.exefs, or by copying it from CTRNAND -> private -> movable.sed.
  • You can write to the SD contents. In the GUI, you need to enable this option. Otherwise, the mount will be read-only.
• 3DSX Homebrew (".3dsx")
• Titles directory ("title" from NAND or SD)
  • To browse SD card titles, the contents must be decrypted first. You can use the SD Card Contents mount first to do that, then use this one.
• Nintendo DSi NAND backup ("nand_dsi.bin")
• Nintendo DS ROM image (".nds", ".srl")
• Nintendo Switch NAND backup ("rawnand.bin")

Once you choose the type, you need to choose the file (or directory) that you want to mount. This would be the game, NAND, or "Nintendo 3DS" SD card folder that you want.

Finally, click "Mount". If there are no errors, Windows Explorer/File Explorer will automatically open at the mount. Some example contents are shown below.

Spoiler: Root of a CIA mounted at F:

Spoiler: Root of an NCCH mounted at A:

Spoiler: Root of a NAND backup mounted at E:\NAND

Now you can copy out the files you want.

• If you mounted CCI, CDN, CIA, NCCH, or Titledir, you can see "decrypted.cxi" (or "decrypted.cfa" for non-executable contents) which acts like a decrypted version of the game. You can use it in applications that require decrypted contents like Citra.
• For NAND, you can use a tool like OSFMount to mount partitions like CTRNAND, TWLN, and TWLP. Make sure you used directory mount, not drive letter.
  If you enabled writing, you can also write back to the partitions. They will be re-encrypted as you write.
• For SD, you can browse the decrypted contents, and use something like the titledir mount to browse the installed games. You can also write to it, and the files you write will be re-encrypted.
  You can extract game saves and extdata with a tool like 3ds-save-tool.

Once you are done, click "Unmount". The mount will be removed.

Add to context/right-click menu

You can add "Mount with ninfs" to the context menu when you right-click on files. It will try to automatically detect the file type and show it in the GUI, so you can just click Mount.

Spoiler: Context Menu Demonstration

Open ninfs, click "Help & Extras", then click "Add to menu". Read the dialog, then click "Add entry" or "Remove entry" to add or remove the context menu entry.

If you move or rename the EXE, you will need to re-add it.

Troubleshooting

• I am using Windows 7, 8, or 8.1 and am getting "The procedure entry point ucrtbase.terminate could not be located in the dynamic link library api-ms-win-crt-runtime-l1-1-0.dll.".
  • You are missing "Update for Universal C Runtime in Windows". This was distributed via Windows Update. If you don't have it, you can install the update: https://support.microsoft.com/en-us/help/2999226/update-for-universal-c-runtime-in-windows
• I am on Windows 7 and am getting an error saying the driver is not signed when trying to install WinFsp.
  I am on Windows 7 and am getting "Cannot create WinFsp-FUSE file system: unspecified error."
  • It is likely you are missing SHA-2 code signing support. This was distrbuted via Windows Update. If you don't have it, you can install this security advisory: https://technet.microsoft.com/en-us/library/security/3033929.aspx

 

[ihaveahax]

Several releases have been put up since my last post here, so here is a summary of them. Some of the notable changes are a rename to ninfs, a standalone release for macOS, support for Nintendo Switch backups, and more.

https://github.com/ihaveamac/ninfs/releases/tag/v1.6

fuse-3ds v1.3

• Added option to skip a specific update
• Added option to prevent checking online for updates
• Fix detection of tkinter on Linux

fuse-3ds v1.3.1

• New custom icon
• First release of standalone macOS Application Bundle
• Minor GUI text updates

ninfs v1.4

• New feature to mount Nintendo Switch NAND images
  • This requires BIS keys, dumped with Lockpick_RCM or biskeydump.
• New project name: ninfs
• Fix incorrect developer common key 0
• Many other internal changes

ninfs v1.5

• Support split Nintendo Switch NAND backup files
  • Each part is expected to end in two digits (e.g. rawnand.bin.00, rawnand.bin.01, ...). Any part can be selected, the program will search for all parts starting with 00.
  • The command line argument -S or --split-files is used for a split backup.
  • The GUI will attempt to automatically detect this based on the filename.
• GUI: Automatically detect Nintendo DSi NAND backups
• GUI: Fix oversight breaking automatic detection of Nintendo 3DS NAND backups
• ExeFS: Always show code-decompressed.bin, even if .code is not compressed

ninfs v1.6

• CDN: Support using a tmd file to mount - #36
  • The GUI now expects a tmd file by default instead of a directory.
• SD: Support manual SD key input
  • --sd-key reads the key as a hexstring. It cannot be used at the same time as --movable.
  • The GUI currently does not accept the key as a hexstring, only a movable.sed file.
• CMDLINE: Support --boot9 for loading the ARM9 bootROM from any path
• SD: Workaround write corruption bug
• NANDHAC: Performance improvements to AES-XTSN crypto operations by @luigoalma
• CCI: Remove useless SeedDB option
• Stability or something, I guess.

 

[TurdPooCharger]

Edit - Nevermind. Ignore this post. Issue's resolved with some needed patience.

After several minutes, the program finished extracting my files.



****

Original Post,

@ihaveamac, I'm using the latest ninfs v1.6.1, installed WinFsp 2019.1, and updated to Python 3.7.3 on my Windows 8.1 64-bit computer. Also have the boot9.bin and June release seeddb.bin at C:\Users\<my user's profile>\AppData\Roaming\3ds.

When trying to use the "nand.bin" option on my nand.bin (1.82 GB) dumped from [S:] SYSNAND VIRTUAL (also tried it with otp → otp.bin extracted from essential.exefs), the specified empty New folder doesn't list any of the files.

I have no issues mounting CIAs or other image types. No difference when all my anti-virus programs are disabled in remedying this.

The problem could be something else on my main computer; no way to test ninfs on my spare 64-bit netbook with Linux Mint and Windows 7 (it's kaputt / currently saving money for a replacement mobo).

Spoiler: Empty folder

 

[PhotoGuyBob]

IHaveAMac, thanks for all your work on this. It's so rare to find tools like this that run on MacOS! I wonder if you could help me with a bug. I have my boot9 and SeedDB dumped, and I am attempting to mount CIA files from a .3DS file.. When I do so, it fails with the following error:


File "ninfs/pyctr/types/tmd.py", line 222, in load
KeyError: 0

It's the InvalidSignatureTypeError and it also fails to handle it.

Traceback (most recent call last):
File "ninfs/_pyi_main.py", line 31, in <module>
File "ninfs/main.py", line 80, in mount
File "ninfs/mount/cia.py", line 239, in main
File "ninfs/mount/cia.py", line 68, in __init__
File "ninfs/pyctr/types/tmd.py", line 224, in load
pyctr.types.tmd.InvalidSignatureTypeError: 0x00000000

I have Fuse installed.
I thought perhaps I was using the app wrong, and designated the type to mount as .3DS, but that seems to just lock up ninfs and Finder on me..
OSX Version: 10.14.5
PYthon Version: 2.7.10

 

[ihaveahax]

IHaveAMac, thanks for all your work on this. It's so rare to find tools like this that run on MacOS! I wonder if you could help me with a bug. I have my boot9 and SeedDB dumped, and I am attempting to mount CIA files from a .3DS file.. When I do so, it fails with the following error:


File "ninfs/pyctr/types/tmd.py", line 222, in load
KeyError: 0

It's the InvalidSignatureTypeError and it also fails to handle it.

Traceback (most recent call last):
File "ninfs/_pyi_main.py", line 31, in <module>
File "ninfs/main.py", line 80, in mount
File "ninfs/mount/cia.py", line 239, in main
File "ninfs/mount/cia.py", line 68, in __init__
File "ninfs/pyctr/types/tmd.py", line 224, in load
pyctr.types.tmd.InvalidSignatureTypeError: 0x00000000

I have Fuse installed.
I thought perhaps I was using the app wrong, and designated the type to mount as .3DS, but that seems to just lock up ninfs and Finder on me..
OSX Version: 10.14.5
PYthon Version: 2.7.10

What exactly do you mean by "I am attempting to mount CIA files from a .3DS file."? It looks like you're using the CIA mount, but you're not choosing a CIA file. Make sure you choose 'CTR Cart Image (".3ds", ".cci")'.

 

[PhotoGuyBob]

Thanks for the quick reply. Yeah, I think I may have been using the app incorrectly at first. Mounting it as a CTR does seem to be locking up the whole OS, though.. Gradually crashing the whole computer. Hopefully I can tinker a bit later today.

 

[jelbo]

Great tool, thanks a lot. I used it to extract a code.bin from a .cia

 

[perkel]

Getting error trying to mount .ncch:

Running: ['D:\\Emulators\\Nintendo - [3DS] Nintendo 3DS\\_tools\\ninfs-1.7b1-win64\\ninfs.exe', 'ncch', '-f', 'Z:\\content0.game.ncch', 'Y:']
ninfs v1.7b1 - https://github.com/ihaveamac/ninfs
Traceback (most recent call last):
File "ninfs\pyctr\types\exefs.py", line 209, in __init__
UnicodeDecodeError: 'ascii' codec can't decode byte 0xe3 in position 1: ordinal not in range(128)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "ninfs\_pyi_main.py", line 31, in <module>
File "ninfs\main.py", line 80, in mount
File "ninfs\mount\ncch.py", line 152, in main
File "ninfs\pyctr\types\ncch.py", line 245, in __init__
File "ninfs\pyctr\types\ncch.py", line 283, in load_sections
File "ninfs\pyctr\types\exefs.py", line 211, in __init__
pyctr.types.exefs.ExeFSNameError: could not decode from ascii: b'(\xe3\xa4N\xf0^w\xe3'
[7172] Failed to execute script _pyi_main

 

[ihaveahax]

Getting error trying to mount .ncch:

Running: ['D:\\Emulators\\Nintendo - [3DS] Nintendo 3DS\\_tools\\ninfs-1.7b1-win64\\ninfs.exe', 'ncch', '-f', 'Z:\\content0.game.ncch', 'Y:']
ninfs v1.7b1 - https://github.com/ihaveamac/ninfs
Traceback (most recent call last):
File "ninfs\pyctr\types\exefs.py", line 209, in __init__
UnicodeDecodeError: 'ascii' codec can't decode byte 0xe3 in position 1: ordinal not in range(128)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "ninfs\_pyi_main.py", line 31, in <module>
File "ninfs\main.py", line 80, in mount
File "ninfs\mount\ncch.py", line 152, in main
File "ninfs\pyctr\types\ncch.py", line 245, in __init__
File "ninfs\pyctr\types\ncch.py", line 283, in load_sections
File "ninfs\pyctr\types\exefs.py", line 211, in __init__
pyctr.types.exefs.ExeFSNameError: could not decode from ascii: b'(\xe3\xa4N\xf0^w\xe3'
[7172] Failed to execute script _pyi_main

Try the release I just put out, which has an option to support files that were decrypted with very old methods: "Assume decrypted" https://github.com/ihaveamac/ninfs/releases/tag/v1.7b2

 

[perkel]

Try the release I just put out, which has an option to support files that were decrypted with very old methods: "Assume decrypted" https://github.com/ihaveamac/ninfs/releases/tag/v1.7b2

Thanks !

 

[ReyVGM]

@ihaveamac , do you know what is this problem I'm having?

I'm trying to mount a DSI-1.MMC (DSi NAND renamed to work with no$gba). I'm using windows 7 64bit, I am NOT running as an admin, and I selected "Nintendo DSi NAND backup ("nand_dsi.bin") as the output.

If I select a drive letter ( Z: ) and mount, I can see the files inside just fine. But if I try to overwrite a file, it tells me there's no enough space. Even if I delete the same file I'm trying to overwrite (to make space), it still gives me the same message.

But if I instead create a new directory, then it will mount just fine BUT the directory will be empty.

Here's an image of what it says when I use a new directory for mounting.

Any help would be appreciated. Thanks.

 

[locutus77]

Hey there and happy new year.

one of my (and my sons) loved 2DS just died and I am in trouble restoring my and my sons saves to a new and fresh hacked 2ds xl.
i was able to run the tool in windows 10 and mac os but getting this error:

LocutusMacBookAir:~ locutus$ python3.7 -mninfs gui
Importing dependencies...
Creating new update config...
Wrote update config to /Users/locutus/Library/Application Support/fuse-3ds/update.cfg
Setting up GUI...
Doing final setup...
UPDATE: Checking for updates... (Currently running v1.7b2)
Starting the GUI!
UPDATE: No new version. (Latest is v1.7b2)
2020-01-03 10:41:50.094 Python[5287:65134] WARNING: <NSOpenPanel: 0x7ffb83726ad0> running implicitly; please run panels using NSSavePanel rather than NSApplication.

----------------------------------------------------------------------------------------------------

Running: ['/usr/local/bin/python3.7', '/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/ninfs', 'sd', '-f', '/Volumes/2DS_GELB', '/Users/locutus/Desktop/2DS_SD_CARD', '--movable', '/Volumes/2DS_GELB/gm9/out/movable.sed', '-r']

Failed to find f8fbf8f624d89e69b883e21e7cb2e5b5 in the SD dir.

----------------------------------------------------------------------------------------------------

I have no idea what this means and was not able to find more information here in that post or on github issues.
I put in the right boot9.firm and seeddb.bin and also the movable.sed.

the tool pops up an error message after hitting "mount" which say: "Failed to mount. Please check the output."
on windows both mount options aren't working, on mac os mount to folder option is the only one and is also throws this error.

the log file is empty.

Can someone please help me rescuing my and my sons saves?

kind regards from berlin

 

[KleinesSinchen]

Running: ['/usr/local/bin/python3.7', '/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/ninfs', 'sd', '-f', '/Volumes/2DS_GELB', '/Users/locutus/Desktop/2DS_SD_CARD', '--movable', '/Volumes/2DS_GELB/gm9/out/movable.sed', '-r']

Failed to find f8fbf8f624d89e69b883e21e7cb2e5b5 in the SD dir.

Don' try to mount 'SD:/' but 'SD:/Nintendo 3DS'
From the error output the path should probably be '/Volumes/2DS_GELB/Nintendo 3DS'

Can someone please help me rescuing my and my sons saves?

I know this is not gonna help you now but being GBAtemp's Backup Reminder I have to: Please use JKSM and/or Checkpoint and copy the backups to multiple locations from time to time! This will save you sooo much time and trouble if the SD/console fails, something get's deleted or whatever.

In general getting the saves back is possible as long as you have the SD contents and movable.sed – which you do. After obtaining the decrypted save files injecting them into the N2DSXL micro-SD may require repairing the CMACs.

 

[locutus77]

Don' try to mount 'SD:/' but 'SD:/Nintendo 3DS'
From the error output the path should probably be '/Volumes/2DS_GELB/Nintendo 3DS'

oh hell YES... that was the thing THX this was the one missing piece... one step further

I know this is not gonna help you now but being GBAtemp's Backup Reminder I have to: Please use JKSM and/or Checkpoint and copy the backups to multiple locations from time to time! This will save you sooo much time and trouble if the SD/console fails, something get's deleted or whatever.

In general getting the saves back is possible as long as you have the SD contents and movable.sed – which you do. After obtaining the decrypted save files injecting them into the N2DSXL micro-SD may require repairing the CMACs.

you are so right... i was so stupid in not taking care of good backups... now i have the salad (like we say in german with silly english skills )
i will promise in doing better just in the minute I was able to recover everything i will to save game exports with Checkpoint backup those somewhere else.

thx again... you saved my life and the importent pokemon saves of my son

 

[Chuardo]

My 3DS died but I have my movable.sed file and my Nintendo 3DS folder, I want to transfer my savefiles to another 3DS that I got, after putting Nintendo 3DS and movable.sed on ninfs it mounts a new Drive with the exact same files and folders that Nintendo 3DS already has, how do I decrypt them into .sav files so I can inyect them in another 3DS? I want to know what to use to get my saves off the decrypted "Nintendo 3DS SD Card" mount drive

 

[KleinesSinchen]

My 3DS died but I have my movable.sed file and my Nintendo 3DS folder, I want to transfer my savefiles to another 3DS that I got, after putting Nintendo 3DS and movable.sed on ninfs it mounts a new Drive with the exact same files and folders that Nintendo 3DS already has, how do I decrypt them into .sav files so I can inyect them in another 3DS? I want to know what to use to get my saves off the decrypted "Nintendo 3DS SD Card" mount drive

No, not exactly the same files and folders; ninfs decrypts anything you read from the newly mounted drive on the fly (and encrypts everything you write to the drive if writing is allowed).

You really should have backed up your saves with Checkpoint and/or JKSM from time to time. This would have saved a lot of trouble.


============
I'm currently not able to do any tests because my test console is partially disassembled. I was able to mass backup the saves with

cd /mnt/<ID_Number>
rsync -av title /home/username/savebackup/ --exclude=*.app --exclude *.tmd --exclude=*.cmd

This copies the folder structure and omits any files but the saves. Copy+paste of the decyrpted backup into the ninfs or GodMode9 mounted "Nintendo 3DS" directory of the new console (into the correct subfolder of course) should work. Don't forget fix CMACs for the drive in GodMode9 and deleting "Secure Value" for games using anti-savegame restore.

• Install games on the new console first because installing a .CIA overwrites the save.
  
• Create a backup of the SD content from the new console before writing the saves in there – just in case it does not work as intended.

 

[Kwyjor]

how do I decrypt them into .sav files so I can inyect them in another 3DS?

Copy the files from the mounted drive to anywhere else on your hard drive, and they will automatically be decrypted.

To get files you can import using JKSM or Checkpoint, you will need to run 3ds-save-tool on each of the .sav files after you decrypt them. 3ds-save-tool is a command-line Python program. Or you can mount your new SD card (with its new movable.sed), re-encrypt the .sav files by copying them to the appropriate subfolders, and then fix the CMACs, as suggested by KleinesSinchen.

Alternatively, I see save3ds has a Windows binary now, but that is also command-line only and I don't think it would be much easier to deal with that than it would be to use ninfs+3ds-save-tool.

There's also threeSD. It is supposed to be used for decrypting SD card data for use in Citra and not really for recovering data from the SD card of a dead 3DS. I haven't poked at it at all, but if you configure it correctly it might help you get decrypted and unpacked .sav files with slightly less hassle than using ninfs+3ds-save-tool.

 

[Equanzo]

Copy the files from the mounted drive to anywhere else on your hard drive, and they will automatically be decrypted.

To get files you can import using JKSM or Checkpoint, you will need to run 3ds-save-tool on each of the .sav files after you decrypt them. 3ds-save-tool is a command-line Python program.

How do you run the 3ds-save-tool?

 

[Kwyjor]

How do you run the 3ds-save-tool?

3ds-save-tool is a command-line Python program (or rather a set of different programs), so you need to install Python to run it, for starters.

Fortunately someone was just asking about that over here:
https://gbatemp.net/threads/help-with-getting-saves-off-an-o3ds-nand.592468/page-2#post-9550204

 

[T0biasCZe]

For SD, you can browse the decrypted contents, and use something like the titledir mount to browse the installed games. You can also write to it, and the files you write will be re-encrypted.

how to re-encrypt the decrypted files for different 3DS console ?

 

[Kwyjor]

how to re-encrypt the decrypted files for different 3DS console ?

Exactly like it says: mount the SD card using ninfs, and copy files to the mounted SD card. This automatically encrypts files, just like copying files off the mounted SD card automatically decrypts them.

This may not be an especially useful function since in some cases you will still have to fix the CMACs of the encrypted files using godmode9, and if you are dealing with save data, you may need to worry about Anti Savegame Restore. This is discussed in the post above.