ROM Hack [Help needed] Transferring extdata content from regular New3DS in 2021

[LostRabbit]

hey everyone,

im quite new to the scene and have been browsing forums for quite some time now. Theres a lot of old threads, guides , video-tutorials and stuff but nothing really helped me fix my problem so far.

So, here is the situation: I have multiple 3DS consoles. A few regular clean Old3DS, another clean New3DS and one New3DS that is hacked, got Luma installed, FBI, Godmode and all that stuff.

The most important and last one, is a New3DS too, XL, zelda hyrule edition with IPS in very good condition. It has no cfw installed and runs "Ver. 11.0.0-33E". Im able to launch homebrew launcher via soundhax and backup saves and start ftp Really served me well and its the only one i really care about. Now, the problem is that there is a lot of data on its sd card i want to get decrypted in order to get it to work in citra. I have decrypted my own game cartridges of pokemon ORAS and got it to work, imported that save file from that original 3DS and it all works fine now, except, im missing those battle videos stored on that sd card which are encrypted.

As far as i know, its possible to obtain that key using some kind of brute force method involving your friend code and that 32-digit "ID0".
Most of the guides refer to that "brute force movable"-website, but that service is not available anymore.

Im not exactly experienced when it comes to that stuff. The only way i can see is to install cfw on that very console too.. but i actually never wanted to do that :/

Is there somebody around who can help me there? Is there a working method i can get that movable.sed myself without having to install a custom firmware on that device? Or maybe that isnt really necessary in my case?

I know that im quite late with all that stuff, but thank you so much for anyone willing to help me out.

 

[KleinesSinchen]

Idea 1:
Easiest thing that comes to my mind when wanting to keep a device unmodified while simultaneously needing full access is ntrboot. It can be used to boot into GodMode9 (answer the question about the embedded backup with "No" if the 3DS should stay 100% unmodified/virgin). It is also possible to boot into Luma3DS without actually modifying anything and start save managers (Checkpoint, JKSM) from the Homebrew Launcher with Rosalina injection. Only downside of this method: You need to have an ntrboot cart.

Idea 2:
An older JKSM release supporting being started from *hax. My previous results with this years ago were mixed, full of crashes and I didn't check for extdata, only the main save.

Idea 3:
I happen to have a N3DS on 11.0.0-25E with Homebrew Launcher via Soundhax -- but complete virgin NAND (never installed CFW). I managed to get godmode.bin (old release v1.2.8) loaded with Soundhax → udsploit → Safehax and I was able to copy 1:/private/movable.sed to SD:/gm9/out -- though I didn't test mounting the SD contents with ninfs (which would require using my main PC -- and this beast is off in summer most of the time). I wouldn't recommend this method as I have no idea if this is intended usage (I'm not a developer, just the "Testing Sina").

Idea 4:
Sad to see Seedminer service is gone. It got us through some years of no 3DS mode kernel exploits.
Setup the Seedminer application yourself to obtain KeyY from movable.sed -- Can't help you with that never did this.
Or ask somebody else who has Seedminer set up if they can run the bruteforce. @IC_ Didn't you have a Seedminer installation?
=============

My clear favorite - as so often - is ntrboot.

Wow. This got way longer than intended. I really hope that I didn't make a fool of myself and overlooked some obvious easy way of decrypting extdata without installing B9S.

Good luck and have fun!

 

[IC_]

Or ask somebody else who has Seedminer set up if they can run the bruteforce. @IC_ Didn't you have a Seedminer installation?

Yes, I still have it.

 

[LostRabbit]

Thank you for your quick replies! thank you Sinchen for your ideas. Took me a while trying to understand #3 and #4., had to look it up. Was thinking about getting a proper ntr boot card and go for #1 ^^

Yes, I still have it.

yea? thats awesome! does that mean you could be able to solve this problem? is that much of an efford?


Edit: the folder on my sd card looks like this:

/Nintendo 3DS/dfc61b131ee4598cf5592eaace441374/

My Friend Code: 3282 - 8339 - 5530

 

[IC_]

Thank you for your quick replies! thank you Sinchen for your ideas. Took me a while trying to understand #3 and #4., had to look it up. Was thinking about getting a proper ntr boot card and go for #1 ^^



yea? thats awesome! does that mean you could be able to solve this problem? is that much of an efford?


Edit: the folder on my sd card looks like this:

/Nintendo 3DS/dfc61b131ee4598cf5592eaace441374/

My Friend Code: 3282 - 8339 - 5530

My friend code is 2982-1377-6981

 

[LostRabbit]

My friend code is 2982-1377-6981

alright! im online and you are added

 

[IC_]

alright! im online and you are added

I sent the file in a private message. I don't really understand the rest of this process myself, so I don't think I can help you beyond this.

 

[LostRabbit]

Thats great! Huge thanks to IC_, now i got that movable.sed.

Have been fiddling around with those files for a while now, cant get it to work with citra tho. Must have done something wrong.. but that should be able to be figured out. Gotta read some more into this. Maybe i can post some screens tomorrow

Again, thank you very much for your assistance.

 

[KleinesSinchen]

Thats great! Huge thanks to IC_, now i got that movable.sed.

Have been fiddling around with those files for a while now, cant get it to work with citra tho. Must have done something wrong.. but that should be able to be figured out. Gotta read some more into this. Maybe i can post some screens tomorrow

Again, thank you very much for your assistance.

Please report back your solution if you find one. I only have a vague idea decrypting the SD contents with ninfs. How to integrate them with Citra? Never really used the emulator beyond testing which of games boot and seem playable. I guess there must be some kind of howto/manual for copying saves from real console to Citra on their page.

Glad to hear you're making progress. And thanks to you, @IC_, for keeping the mining installation which can still be helpful in some special cases such as this one.

 

[IC_]

Please report back your solution if you find one. I only have a vague idea decrypting the SD contents with ninfs. How to integrate them with Citra? Never really used the emulator beyond testing which of games boot and seem playable. I guess there must be some kind of howto/manual for copying saves from real console to Citra on their page.

Glad to hear you're making progress. And thanks to you, @IC_, for keeping the mining installation which can still be helpful in some special cases such as this one.

Of course, I never liked the idea of everyone depending on that one central website that can and did go down.

 

[KleinesSinchen]

Of course, I never liked the idea of everyone depending on that one central website that can and did go down.

The service has helped several hundred thousandths of people getting access to B9S. I was (and still am) skeptical in all cases with centralized infrastructure collecting whatever data. That said, I wouldn't have felt bad for using it (never needed it) and definitely have trusted them way more than Google (where I would never sign up).

Nevertheless, the way it was implemented wasn't bad, but pretty impressive. Convenient for the end user. Abuse protection with some Captcha is annoying... but all in all: Volunteers offering their resources for everybody to use.

Having several thousand people, possibly coming from some random video, asking for mining help on the forum (or godforbid Discord) does not scale. The service served it's purpose and now isn't worth keeping it up for very occasional usage.

Let's hope @LostRabbit can decrypt and use extdata.


Slightly off-topic: I'm positively surprised that this thread didn't get the usual "flat" answers as near instant replies:

https://3ds.hacks.guide/ (without any text)

-
Or
-

Install CFW already!
https://3ds.hacks.guide/

 

[LostRabbit]

Please report back your solution if you find one. I only have a vague idea decrypting the SD contents with ninfs. How to integrate them with Citra? Never really used the emulator beyond testing which of games boot and seem playable.

Sure! Im gonna keep you all updated.

Meanwhile, been trying some more stuff. This is what i did:

Spoiler: 01 Ninfs

Ninfs mounted that folder instantly, without bringing up any error messages.

After that, this is how it looks:

Spoiler: 02 Mounted Drive

This pretty exactly looks like if i hadnt used ninfs at all and just copied everything over via usb adapter.
Is that what its supposed to do?

Well, this is what all of this looks in citra:

Spoiler: 03 Citra

As you can see, the citra folder structure is quite different. There is a folder called "btvideo", the files in there are smaller in size and named differently.

So now im not quite sure which part went wrong. Is it the decryption? Maybe its supposed to look like this? Was expecting files and folders to look like what you can see in the last two pics, so i could copy everything over.

Maybe i missed something crucial. Thanks alot for your help

Slightly off-topic: I'm positively surprised that this thread didn't get the usual "flat" answers as near instant replies

Yup, me too. Kinda expected something like that tbh. Glad you replied with so much commitment.

Im new and here to learn, not an expert who knows everything. I try to use the search function before i start asking stupid questions. It just aint really easy to give yourself a proper overview, things have been changing a lot over all these years ^^

 

[KleinesSinchen]

They expect you to have full CFW on the Citra page:
https://citra-emu.org/wiki/dumping-extra-data-from-a-3ds-console/

When my concentration allows it, I will look into this and try it myself. Can you tell me what to do in Pokemon Omega Ruby to get something in extdata? I just played the game from start to finish two years ago and didn't pay attention to any files.


Ninfs showing the same folder/file structure makes sense. The files should be decrypted -- not be something completely different.

For me your screenshots are looking good.

 

[LostRabbit]

Thank you so much, Sinchen

No hurries tho, ive got everything backed up.

As written above, i got several 3ds consoles. Im gonna give that special original one some rest and use the hacked one for now.

They expect you to have full CFW on the Citra page:
https://citra-emu.org/wiki/dumping-extra-data-from-a-3ds-console/

yea, you are right. have seen that too. actually been browsing their site alot these days.. which was rather frustrating tbh

Ninfs showing the same folder/file structure makes sense. The files should be decrypted -- not be something completely different.

For me your screenshots are looking good.

Oh, alright. Thats great to hear!


Meanwhile i have tried to at least transfer all that stuff from my original n3ds to the hacked one:

1. used godmode and copied movable.sed from SYSNAND CTRNAND directory to that consoles sd card
2. copied everything from that sd card to a different folder of my pc
3. used ninfs to mount everything like i showed in my last post. then, i added an additional mount using the "Nintendo 3DS" folder and the dumped movable.sed for that second console.
4. i of course tried to copy all the stuff from one /000011c5/ folder to the other one...

and yes, that did not work. lol. the process of copying over looked fine, but in the end, non of these files where to be found ingame.

Well, that was worth a try, I seriously had not expected this to be so darn difficult

After some more research, i found posts like these:

Spoiler

https://gbatemp.net/threads/black-screen-at-the-start-of-the-3ds.543980/page-3#post-8765376

https://gbatemp.net/threads/copying-sd-card-content-to-other-systems-sd-card-id0.556297/

Jeez I dont even understand half of what is written there.

That could have been some kind of workaround tho: Transfer stuff to that hacked console where i can run all kinds of software to then properly prepair all of this data for use with citra.

Can you tell me what to do in Pokemon Omega Ruby to get something in extdata? I just played the game from start to finish two years ago and didn't pay attention to any files.

Sure! So, after the main story is finished, you can get access to a location called battle resort. thats where the battle maison is.
https://bulbapedia.bulbagarden.net/wiki/Battle_Resort#Battle_Maison_Replica

Thats where i used to challenge trainers, get streaks of 200-300 consecutive wins and save many of those precious battle videos i wanna export. you are asked if you wanna save that replay after every battle.

Alternatively, you can also battle a friend via wifi battle or something, it lets you save the replay afterwards

Again: Im not that much in a hurry, but i would love to get this solved. Any kind of help is highly appreciated!!

 

[KleinesSinchen]

Okay. I will try my best at the weekend, but cannot promise anything because of my serious concentration issues.
Multiplayer is out of question (that would be ridiculous battling myself with two 3DS consoles - It is depressing enough to do trading this way in order to complete the Pokedex).

We'll see what can be done. I'll PM you on weekend if this is okay.

 

[LostRabbit]

Alrighty, that would be awesome!

Guess you are a lot more competent when it comes to these things. Let's see what you can find out, i'm honestly running out of ideas with this stuff.

that would be ridiculous battling myself with two 3DS consoles - It is depressing enough to do trading this way in order to complete the Pokedex

yes! well, i actually often trade with myself too, but theres also my little sister, she helps me feel a bit less strange and depressed ^^

 

[KleinesSinchen]

So… a little late; but I'm happy to say: "This is solved."

The pages
https://citra-emu.org/wiki/dumping-save-data-from-a-3ds-console/
https://citra-emu.org/wiki/dumping-extra-data-from-a-3ds-console/
state that one needs B9S and Checkpoint for exporting saves and extdata from a 2|3DS.

But… @LostRabbit's extdata (Pokemon fight recordings) from a non-CFW N3DS finally seems to be working in my Citra installation. That is satisfying after hours of frustration yesterday.

The 3DS, its inner workings and encryption have been reversed engineered to what feels like a 150%. I bet for the half-gods, who have achieved all of this and who can read ARM assembly like a children's book, everything is easy and clear. For me mere mortal it wasn't and it isn't. The (homebrew/CFW) end users don't even have to think about encryption keys and how stuff works… it simply works. Missing full access with B9S/Luma3DS/GodMode9 changes this.

My idea was that KeyY in movable.sed would be enough to decrypt everything with the help of the excellent tool ninfs and thanks to the awesome help from @IC_ we already had this one. LostRabbit was able to decrypt her extdata and I could see some clear text parts with a hexeditor. "Mission accomplished." I thought and injected the files with ninfs into my SD:/Nintendo 3DS folder just to get greeted with the "extdata is corrupted" message. Now I know what getting a FALCON… PUNCH!! must feel like.

This means there is another layer of decryption/unpacking required and I did find a tool for this: https://github.com/wwylele/3ds-save-tool
But this tool relies on some secret keys (that probably must not be shared on GBAtemp). To my knowledge the access to boot9.bin, which is not a big deal since B9S exists and we have full system control right from power-on, should suffice. But I have no idea how to extract or derive keys from it. There is https://github.com/yellows8/boot9_tools which promises to do it from a file named protected_boot9 (which I don't have). Again: For the genius developers that built all homebrew/CFW tools for the 3DS, this is probably trivial. As a non-developer I wish there was more easy to understand documentation (maybe there is and I'm too dumb to find it with search engines). Skimming through the complex source of the 3DS save managers and ninfs didn't help me to find out how they get the keys. My inability to fully concentrate for more than a few minutes didn't help either in a multi-hour PC session.

As a last resort, I decided to ask a fairy (that was flying past my window) to give me the keys 3DS Save File Extraction Tools need . The fairy was in good mood and granted my wish.


I really would like to know how to do this correctly (get all those keyX and normalkey from a CFW 3DS console). One might say this is a moot discussion ("Install CFW already!"). I disagree with such statements. Not wanting to modify a specific console is a valid opinion. In addition to that decrypting saves on a PC might become necessary if a console gets damaged beyond repair. I would have to lookup the details… TurdPooCharger mentioned that Seedminer would still be possible if the friendcode of a 2|3DS is saved on another console (in friend list). This might allow data recovery for an unmodified 2|3DS in certain cases.


=============
To make this small noob-research complete, I will later try:

Idea 2:
An older JKSM release supporting being started from *hax. My previous results with this years ago were mixed, full of crashes and I didn't check for extdata, only the main save.

Of course this requires userland homebrew access.