Hacking Restore firm0firm1.bak to SysNAND? (a.k.a Uninstall B9S)

MelonGx

Well-Known Member
OP
Member
Joined
Jan 8, 2009
Messages
1,653
Trophies
1
XP
915
Country
China
Boot9strap installation fixes the secret sector to match stock.

Just re-writing the FIRMs you backed up will brick you, because the secret sector won't be corrupted properly.
OK we need more tutorials for this since we lack software methods to restore secretsector0x96.bak (is it named as this?) and the latest SafeB9SInstaller has divided F0F1 into firm0_enc.bak + firm1_enc.bak.
 

gamesquest1

Nabnut
Former Staff
Joined
Sep 23, 2013
Messages
15,153
Trophies
2
XP
12,247
OK we need more tutorials for this since we lack software methods to restore secretsector0x96.bak (is it named as this?) and the latest SafeB9SInstaller has divided F0F1 into firm0_enc.bak + firm1_enc.bak.
Tbh if a9lh gets abandoned and everyone upgrades thus fixes their secret sector then everyone will be fine, and if/when ntrboothax is released people will have even less reason to complain

Although the people doing random stuff by themselves and not totally understanding what they are doing don't really have much room to complain, the first step of most guides is "make a nand backup and keep it safe" if you plan to go back to stock that is what you should be restoring not just random bits unless you completely understand the process and accept the risks

Not to mention there is pitfalls from trying to manually uninstall b9s without just restoring a full backup confirmed working nand backuo, if you installed b9s on stock 9.2 then updated to 11.4 sysnand, restoring a backup of the 9.2 FIRM would also result in a brick even though the secret sector is valid

TL: DR avoid trying to uninstall a9lh/b9s without just restoring a full nand backup
 
  • Like
Reactions: Ryccardo

MelonGx

Well-Known Member
OP
Member
Joined
Jan 8, 2009
Messages
1,653
Trophies
1
XP
915
Country
China
the first step of most guides is "make a nand backup and keep it safe" if you plan to go back to stock that is what you should be restoring not just random bits unless you completely understand the process and accept the risks
Noobs always didn't do that since the latest guide(tm) didn't teach them to backup a full NAND before installing B9S.
To help a guy with no full backup but only F0 F1 SS0x96 backups to back to stock is the key problem in this thread.

BTW, latest SafeB9SInstaller divides firm0firm1.bak into firm0_enc.bak and firm1_enc.bak.
I haven't confirmed that whether the F0 & F1 restoring in latest GM9 did an encryption or not.
If not, then they're available to be directly restored by GM9.
If yes, then we should find more compatible methods.
 
Last edited by MelonGx,

N64

Well-Known Member
Member
Joined
Apr 16, 2014
Messages
425
Trophies
0
XP
267
Country
United States
i'm exploring the idea of restoring to stock. i have nand backups from when I did A9LH. is there anyway to check whether they are stock nand backups or if they are a9lh backups? I'm 99% certain they are stock backups, but would prefer 100% certainty before moving forward (if I choose to do that)
 

Ryccardo

Penguin accelerator
Member
Joined
Feb 13, 2015
Messages
7,696
Trophies
1
Age
28
Location
Imola
XP
6,922
Country
Italy
i'm exploring the idea of restoring to stock. i have nand backups from when I did A9LH. is there anyway to check whether they are stock nand backups or if they are a9lh backups? I'm 99% certain they are stock backups, but would prefer 100% certainty before moving forward (if I choose to do that)
You can run them through Decrypt9's backup verifier - they should fail firm0 but pass firm1 if they have A9LH

This doesn't tell you about the secret sector (iirc), but as long as you flash the full backup it won't matter as long as the backup itself isn't corrupted
 
  • Like
Reactions: N64

Snap00

Active Member
Newcomer
Joined
Jun 12, 2017
Messages
26
Trophies
0
Age
44
XP
126
Country
Swaziland
Hi Guys, i've also dealt with this topic in the last days.

Well you could still use the Decrypt9 payload as safehax to dump the NAND prior to installing B9S. I guess it's an extra step but a useful one IMO.

That would be the best way, to get a clean Backup from the nand. But in my case (i've also worked with the tutorial on 3ds.guide), my nand gets backedup with GM9, after B9S was already installed, so firm0 & firm1 were already modified.

B9S-installed NAND backup will always have the B9S inside F0F1.
It is (censored) to say "you can uninstall A9LH/B9S by restoring a hax-installed NAND just not choosing (keep hax)".

BTW, @d0k3 sent me an alternative method to uninstall B9S.
1) Dump B9S-installed NAND (keep encrypted!)
2) Inject firm0firm1.bak (it's already encrypted) to the NAND's correct location (seems to be available with hardmod B9S program?)
3) Restore the modified NAND without keeping hax

I've used the hardmod-b9s-installer1.0 to inject my backuped firm0firm1.bak in my nand.bin (which contained B9S), so it should be stock now, but i didn't restored it until now, because :

GodMode9 and D9WIP have only the seperated F0 and F1 restore direct access.
B9STool can restore the integrated F0F1 but it will brick A9LH and B9S installed system.
Hardmod can restore the integrated F0F1 too but it's a hardware method which isn't available for everyone.

d0k3's alternative method (Dump raw NAND -> Use Hardmod tool to inject integrated F0F1 backup to the dumped raw NAND -> Restore modified NAND without keeping hax by using D9WIP/GM9) should be the most friendly software method currently though.

So now im not sure that the backup which i created is good. What means "the integrated F0F1" ? I've used the "restore-firm0firm1.exe" Application from the hardmod-b9s-installer1.0 to inject my backuped firm0firm1.bak (created by the SafeB9SInstaller) in my nand.bin (created by GodMode9). I think it should work after i restore it with GodMode9 !? But for sure, i don't wanna risk a brick...

You can run them through Decrypt9's backup verifier - they should fail firm0 but pass firm1 if they have A9LH

This doesn't tell you about the secret sector (iirc), but as long as you flash the full backup it won't matter as long as the backup itself isn't corrupted

I've tried this, but in the latest releases of GodMode9 & Decrypt9, i could find only an option called "Validate NAND Dump" or "Verify file", which says, that both backups (the one with modified firm0.bin & firm1.bin and the one with stock restored firm0.bin & firm1.bin) are valid. It doesn't gives any further information about the content of firm0 & firm1...

1. Yes you can remove b9s that way. Choose the non-safe option in GodMode9.

In the actual release of GM9, i found only the option "Restore SysNand (safe)"...
The actual Decrypt9WIP gives more options, as "NAND RESTORE" without "(keep hax) and one called "NAND RESTORE (forced)". Don't know which one i should try, or whether i should try anything at all...

I wish there would be a Safe B9S Uninstaller, which allows to restore the firm0.bin & firm1.bin (from the firm0firm1.bak, and also from the new firm0_enc.bak & firm1_enc.bak backup formats).

Even the HackMii Installer for the Wii had an uninstall funtion for BootMii in Boot2. ;-)

In this sense, many greetings, Snap.
 
  • Like
Reactions: Quantumcat

MelonGx

Well-Known Member
OP
Member
Joined
Jan 8, 2009
Messages
1,653
Trophies
1
XP
915
Country
China
@Snap00
So now im not sure that the backup which i created is good. What means "the integrated F0F1" ? I've used the "restore-firm0firm1.exe" Application from the hardmod-b9s-installer1.0 to inject my backuped firm0firm1.bak (created by the SafeB9SInstaller) in my nand.bin (created by GodMode9). I think it should work after i restore it with GodMode9 !? But for sure, i don't wanna risk a brick...
1. Dump NAND.bin from GM9
2. Restore firm0firm1.bak with HardMod B9S Installer
3. Inject the modified NAND.bin with copying it to GM9's S:SYSNAND VIRTUAL drive or D9WIP's Restore NAND
should work.

Always keep an unmodified NAND.bin for emergency!
 
Last edited by MelonGx,

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
@Snap00

1. Dump NAND.bin from GM9
2. Restore firm0firm1.bak with HardMod B9S Installer
3. Inject the modified NAND.bin with copying it to GM9's S:SYSNAND VIRTUAL drive or D9WIP's Restore NAND
should work.

Always keep an unmodified NAND.bin for emergency!
Afaik restoring firm0firm1 would brick the system if it was created on a system that had a9lh due to secret sector not being properly corrupted with a a9lh-hacked FIRM.
 

MelonGx

Well-Known Member
OP
Member
Joined
Jan 8, 2009
Messages
1,653
Trophies
1
XP
915
Country
China
Afaik restoring firm0firm1 would brick the system if it was created on a system that had a9lh due to secret sector not being properly corrupted with a a9lh-hacked FIRM.
Actually I don't know more about this.
Do you mean an A9LH -> B9S's F0F1 is invalid if secret_sector_0x96 isn't restored first?
@SciresM
 
Last edited by MelonGx,

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
Actually I don't know more about this.
Do you mean an A9LH -> B9S's F0F1 is invalid if secret_sector_0x96 isn't restored first?
@SciresM
Yes. If I am not mistaken you would need to restore the corrupted secret sector that A9LH requires if you upgraded from A9LH to B9S. Otherwise you will end up with a brick due to how A9LH works.
 

MelonGx

Well-Known Member
OP
Member
Joined
Jan 8, 2009
Messages
1,653
Trophies
1
XP
915
Country
China
Yes. If I am not mistaken you would need to restore the corrupted secret sector that A9LH requires if you upgraded from A9LH to B9S. Otherwise you will end up with a brick due to how A9LH works.
Then I have no idea since I don't know how to restore secret_sector_0x96.bak first.
 

Ryccardo

Penguin accelerator
Member
Joined
Feb 13, 2015
Messages
7,696
Trophies
1
Age
28
Location
Imola
XP
6,922
Country
Italy
I've tried this, but in the latest releases of GodMode9 & Decrypt9, i could find only an option called "Validate NAND Dump" or "Verify file", which says, that both backups (the one with modified firm0.bin & firm1.bin and the one with stock restored firm0.bin & firm1.bin) are valid. It doesn't gives any further information about the content of firm0 & firm1...



In the actual release of GM9, i found only the option "Restore SysNand (safe)"...
The actual Decrypt9WIP gives more options, as "NAND RESTORE" without "(keep hax) and one called "NAND RESTORE (forced)". Don't know which one i should try, or whether i should try anything at all...
Good, no A9LH in that backup
Just restore it with a non-keep-a9lh option to ensure kernel partitions and secret sector are all flashed
To do a non-"safe" restore with GM9, just paste the backup over (sysnand virtual)/nand.bin or nandmin.bin
 
Last edited by Ryccardo,

Snap00

Active Member
Newcomer
Joined
Jun 12, 2017
Messages
26
Trophies
0
Age
44
XP
126
Country
Swaziland
Thank you Guys for all the replies !

@Snap00

1. Dump NAND.bin from GM9
2. Restore firm0firm1.bak with HardMod B9S Installer
3. Inject the modified NAND.bin with copying it to GM9's S:SYSNAND VIRTUAL drive or D9WIP's Restore NAND
should work.

Always keep an unmodified NAND.bin for emergency!

Yeah that's the reason why i will restore the stock firm0 & firm1. I just want a 100% proper nand backup left.

I think the firm0.bin & firm1.bin files are also unique on every device (otherwise they wouldn't backuped during the B9S installation), right ?

Somewhere i've read, when the system was updatet to a newer firmware release, a restore with an old backup (created on a lower firmware version) can also brick the device !?

So to keep a clean backup up to date, which allows to go back to stock at everey time, i have to do the following process :
1. Restore the clean backup which was generetad on the actual firmware. 2. Update the System to the new firmware. 3. Make a new backup on the new firmware.
That means also, i have to backup / restore all my safe- & userdata and dump / reinstall all the titles i have installed on the system, everytime i update the device... :-/

Thats quite different to the nand backups which were created on the Wii using BootMii. Those backups contained all the system data, so a restore back to a lower firmware was possible.
It looks like the nand backups which made with GM9/D9WIP, doesn't contains the complete system data from all the nand partitions...

Good, no A9LH in that backup
Just restore it with a non-keep-a9lh option to ensure kernel partitions and secret sector are all flashed
To do a non-"safe" restore with GM9, just paste the backup over (sysnand virtual)/nand.bin or nandmin.bin

Ah, i've seen, there's a file called nand.bin in the "S:SYSNAND Virtual" Folder, but didn't know i can just overwrite it with my bakup file. Thank you, and also MelonGx for this explanation !

Afaik restoring firm0firm1 would brick the system if it was created on a system that had a9lh due to secret sector not being properly corrupted with a a9lh-hacked FIRM.

Okay, now i understand. I modded my 3DS quite 3 weeks ago with B9S v1.0 (A9LH wasn't on it before). So my backup isn't critical in this point.
I've also read, that the B9S installer will recover the secret sector, when it was modified due to an earlier A9LH installation ?

a friend of mine wants to return to stock but doesnt have a nand backup prior to b9s what coul he do ?

If your friend has a backup after B9S and the backuped firm0firm1.bak (generated by the SafeB9SInstaller < v1.2) he can go the same way as me. Use the "restore-firm0firm1.exe" application from the hardmod-b9s-installer1.0 to inject the clean firm0firm1.bak to his nand.bin and restore it with GM9/D9WIP (without keeping the hax).

Is there already a possibility to restore the new firm0_enc.bak & firm1_enc.bak files (generated by the SafeB9SInstaller v1.2) ?

Thanks again for all your help, Snap.
 
Last edited by Snap00,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    BakerMan @ BakerMan: hot take: freddy fazbear's pizzeria simulator is peak fnaf