Hacking Completely botched system transfer..

Noroxus · May 1, 2019

So, today I wanted to system transfer my data from my N3DS to my N3DSXL. I took both SD cards out and booted into Luma, then chose system transfer and configured it. Everything went smoothly at first and my N3DS formatted. Then, my N3DSXL booted up. I powered it off and put my original SD in it in hopes it would read the old ID0 folder.

But, it didn’t. It rebooted and then greeted me with the design shop notification as if I had formatted the system. Data management was completely empty and another ID0 folder was created in /Nintendo3DS. I started booting up applications, didn’t work. I tried Homebrew, and it froze. The console seemed completely incapable of doing anything. So I NAND restored it. It was fine again.

Then I wanted to NAND restore my N3DS, but nope. For some reason I have completely gotten rid of my 200trillion NAND backups from last year.
Theres probably no way out of this situation, so I wanted to ask if there’s any way to dump the old applications I had on the old NAND and of that is impossible, if there’s anyway to extract the installed titleIDs I had on there to see what stuff I had installed on it, because I haven’t used the old one in a long time....

The only backups I have are from boot9strap lol...
So yeah people don’t delete backups it’s a bad idea

TurdPooCharger · May 1, 2019

On your n3DS (source system), try this gm9 script's "Fix movable.sed KeyY" on its <ID0> subfolder. It may or may not work. If you get a match and exchange the movable.sed KeyY, you'll need to recheck Data Management for missing tickets.

PrincessLillie · May 1, 2019

TurdPooCharger said:
If you get a match and exchange the movable.sed KeyY, you'll need to recheck Data Management for missing tickets.

And if you have missing tickets, please run faketik to restore them.

Noroxus · May 2, 2019

TurdPooCharger said:
On your n3DS (source system), try this gm9 script's "Fix movable.sed KeyY" on its <ID0> subfolder. It may or may not work. If you get a match and exchange the movable.sed KeyY, you'll need to recheck Data Management for missing tickets.

very impressive script, sadly it simply loops for me...
Probably because the format was part of the system transfer... and not the standard one

EDIT: I cant even cancel it in GM9 lol

TurdPooCharger · May 2, 2019

Noroxus said:
very impressive script, sadly it simply loops for me...
Probably because the format was part of the system transfer... and not the standard one

EDIT: I cant even cancel it in GM9 lol

As mentioned in the post, it will do a full 256 iterations sweep depending on that counter value. Give it 1.5 hour to complete.

Noroxus · May 2, 2019

TurdPooCharger said:
As mentioned in the post, it will do a full 256 iterations sweep depending on that counter value. Give it 1.5 hour to complete.

Oh god, I completely skipped that part.
My bad

Noroxus · May 2, 2019

Yeah, sadly it didnt manage to find KeyY.... too bad

TurdPooCharger · May 2, 2019

Noroxus said:
Yeah, sadly it didnt manage to find KeyY.... too bad

Did that Nintendo 3DS folder originate from another system you owned?
In other words, was the n3DS involved a previous System Transfer that received that folder?

If so, you will need to find someone with a hacked 3DS who last had you listed on their Friend List.
It is possible to reconstruction the exact KeyY using the 1st half of it extracted from their friendsave.bin.

Save file(s) RECOVERY.. HELP!

Noroxus · May 2, 2019

TurdPooCharger said:
Did that Nintendo 3DS folder originate from another system you owned?
In other words, was the n3DS involved a previous System Transfer that received that folder?

If so, you will need to find someone with a hacked 3DS who last had you listed on their Friend List.
It is possible to reconstruction the exact KeyY using the 1st half of it extracted from their friendsave.bin.

Save file(s) RECOVERY.. HELP!

I am not certain about possible system transfers before I bought the system, however I do have another hacked 3DS that had me on the friendlist.
Just to be certain here, since it derives the KeyY through friendsave.bin does it use LFCS_B to recover the key? If yes that would explain why the system transfer failed. I do not have the OG LFCS_B anymore but instead use one from a friend of mine. Sadly I can no longer find the backup of the OG one either....

TurdPooCharger · May 2, 2019

Noroxus said:
I am not certain about possible system transfers before I bought the system, however I do have another hacked 3DS that had me on the friendlist.
Just to be certain here, since it derives the KeyY through friendsave.bin does it use LFCS_B to recover the key? If yes that would explain why the system transfer failed. I do not have the OG LFCS_B anymore but instead use one from a friend of mine. Sadly I can no longer find the backup of the OG one either....

The KeyY isn't derived from the friendsave.bin but rather whenever a friend adds you to their Friend List, their 3DS/2DS records a copy of that 1st half.

The KeyY is 0x10 (16) bytes string found in the movable.sed. The 1st half of that key is derived from the LocalFriendCodeSeed_B from whichever starting system it came from.

files on sd card not loading on 3ds [post #9]

If you swapped out the n3DS's original LFCS_B by borrowing one from a different system, and didn't make a back up of the SysNAND *.bin image that contained that deleted LFCS_B,
your n3DS will not be able to recreate an intact KeyY (minus the 0x118 offset counter value).

***

Luckily, GodMode9 does a neat trick when you first hack the n3DS. It makes backed up copies of several important NAND files on the first encounter of using that program.

GodMode9 → [S:] SYSNAND VIRTUAL/essential.exefs → press (A) → Mount as EXEFS image.
Press (A) on frndseed and movable to Copy to 0:/gm9/out.

Use a hex editor like HxD to compare those two (2) files against the ones found:

[1:] SYSNAND CTRNAND/private/movable.sed
[1:] SYSNAND CTRNAND/rw/sys/LocalFriendCodeSeed_B

(Study the previous linked thread about how movable.sed contains a copy of LFCS_B).
DO NOT PUBLICLY SHARE OR SHOW THEM.

If you notice these observations,

The frndseed (from essential.exefs) and the current LocalFriendCodeSeed_B in the 1:/drive are different.
The movable (from essential.exefs) contains a copy of frndseed.
The movable (from essential.exefs) and the current movable.sed in the 1:/drive do not share the same frndseed.

Try renaming and swapping in movable, and rerunning the script's KeyY finder like in this post:

[Question] System is broken, but the SD card was saved... [post #6]

***

If all the above doesn't work, we can continue discussion through PM in regards to pulling the 1st half of the KeyY from out of your friendsave.bin.

Hacking Completely botched system transfer..

Margen67 Supporter

Meh.

(Future) VTuber

Margen67 Supporter

Meh.

Margen67 Supporter

Margen67 Supporter

Meh.

Margen67 Supporter

Meh.

Similar threads

Popular threads in this forum