(Very Bad Tutorial) Perform an unauthorized System Transfer
Key Notes
1 - This tutorial will clone a donor NAND from a source 3DS → target 3DS. This is similar to performing Lazarus3DS.
2 - This method is not recommended when sharing HOME Menu games installed on SD cards between two systems.
3 -
A target 3DS with a cloned NAND connecting online and using Nintendo services risks both systems getting banned.
4 - For instructions on how to properly System Transfer between two 3DS systems with custom firmware, please refer to these:
You will need the following
Section I - Prepare the SD card
In order for the donor NAND to have a better chance of working on the target system (o2DS), the latest custom firmware should be installed on both the SD card and CTRNAND on the source system (o3DS). At the time of writing this (Nov-19, 2018), the essential custom firmware trifecta consists of Luma3DS v9.1, boot9strap v1.3, and GodMode9 v1.7.1.
If your 3DS system is using Luma3DS v7.0.5 or older (arm9loaderhax), you should update the custom firmware by following this guide:
On top of that, the latest 3DS firmware is needed to ensure there are no missing system modules for hardware changes in slightly revised 2DS/3DS models; in computer terms, these would be known as the hardware drivers. The latest 3DS firmware (as of writing) is version 11.8.0-41.
Section III - Extract the donor NAND files
Now that the o3DS has everything updated and perhaps a game installed on the SD card, you will proceed with copying your NAND image in a direct manner. However, take note that messing with the CTRNAND and related drives can cause a softbrick if one is not careful and diligent. With this in mind, certain precautionary steps which may seem redundant should be followed in case anything goes wrong.
Section IV - Copy files from the SD card to a computer, etc.
Files from the SD card will need to be copied for a later section. You will eventually create something called an EmuNAND or RedNAND [emulated/redirected], and this procedure will reformat and delete everything on the card.
Section V - Review the target system (o2DS)
Just like the source system, make sure the target system's custom firmware are up-to-date. However, updating the 3DS firmware is not required.
Section VI - Create an EmuNAND and implant the donor NAND files
As was mentioned before in Section III, messing with the CTRNAND and related drives is not something that should be taken lightly. To mitigate the risk of softbricking the o2DS, you will be using an EmuNAND setup. In this day and age for 3DS custom firmware, EmuNAND/RedNAND does not serve a useful purpose outside of dev work, debugging, and sandbox research; others may argue needing an EmuNAND for their Gateway 3DS flashcart or prolonging the lifespan of their NAND chip on the motherboard. While that discussion is outside the scope of this tutorial, just know you don't want to mistakenly modify the SysNAND [system].
Section VII - Enable EmuNAND
Outcome ∅ - The o2DS is stable in EmuNAND when using the donor NAND.
After exploring HOME Menu, using Homebrew Launcher, and playing your game of choice, you discover the o2DS functions correctly. However, this is too soon to celebrate. You have some followup testing to do:
Outcome A - The o2DS is stable in SysNAND when using the donor NAND.
The o2DS continues to function correctly when testing everything (minus the Internet).
Conclusion
The o2DS original NAND image is somehow corrupt, despite previous attempts of CTRTransfer and updates through Recovery Mode. You will need to attempt repairing its firmware by making a CTRTransfer image and flashing it on top of its original NAND.
You might be asking, what's the difference between CTRTransfer and SysNAND images? Why does one need to restore the o2DS original broken NAND image before using CTRTransfer?
While SysNAND and CTRTransfer images are related, there are key differences between the two.
Outcome B - The o2DS crashes in SysNAND with the donor NAND, despite being stable in EmuNAND.
This would be a very strange turn of events...
Conclusion
Despite the rarity and near zilch (if any reported natural wear & tear occurance), the o2DS physical NAND chip on the motherboard that houses your SysNAND CTRNAND has started to fail. While flash memory can and do expire from usage, silicon manufacturing for eMMC at 1-2 GB size have long ago matured to the point that there should be a near zero defective yield rate. The rest of that o2DS should be falling apart long before its onboard NAND is supposed to go bad. However, we don't live in a perfect world, and faulty chips do slip through in production because batches are checked in sample sizes.
Outcome C - The o2DS crashes in EmuNAND with the donor NAND.
Sigh...
Conclusion
It can be anyone's guess in what is physically wrong with that o2DS.
***
Once the EmuNAND and illigitimate System Transfer testing has concluded, you should remove all traces of the donor NAND from the SD card and SysNAND.
Do not attempt this if you don't have a good reason to.
Key Notes
1 - This tutorial will clone a donor NAND from a source 3DS → target 3DS. This is similar to performing Lazarus3DS.
2 - This method is not recommended when sharing HOME Menu games installed on SD cards between two systems.
3 -
A target 3DS with a cloned NAND connecting online and using Nintendo services risks both systems getting banned.4 - For instructions on how to properly System Transfer between two 3DS systems with custom firmware, please refer to these:
You will need the following
- Two (2) 3DS systems of the same series.
- old & old: o2DS, o3DS, o3DSXL
- new & new: n3DS, n3DSXL, n2DSXL
- 4 GB or larger (micro) SD card.
- Minimum size of 4 GB. Nothing smaller.
- (Optional) A small size *.cia game (~15 MB or smaller).
- For testing and demonstration purposes.
- Source: o3DS
- Target: o2DS
Section I - Prepare the SD card
1. If the SD card is a standard type (not micro), ensure the read-only slider switch is not in the LOCK position.
2. Copy everything off the SD card onto a computer.
3. Reformat the card using MiniTool Partition Wizard (free edition) with these settings:
- Format: FAT32
- Cluster Size: 32 KB
- Partition: Primary
- Disk: MBR
MiniTool Partition Wizard Software Tutorial Guide
4. With the card empty, do a Full Write + Verify Test with H2testw.- Delete Partition
- Initialize to MBR Disk -or- Convert GPT to MBR Disk (if it's in GPT Disk)
- Rebuild MBR
- Create a New Partition [ Create as: Primary | File System: FAT32 | Cluster Size: 32 KB ]
○ Unless this was previously done before on this card, do not skip this step.
5. If the card passes, delete the *.h2w test files.
○ If an error is reported, stop the test. Replace the defective SD card, and go back to step 1.
○ We need to be absolutely certain this card can perform the tasks ahead.
○ We need to be absolutely certain this card can perform the tasks ahead.
6. Build a test setup using the CFW starter kit archive found here.
○ Do not borrow files from the o3DS and o2DS main setups.
○ Optional: If you would like to, add one (1) small sized *.cia game of your choice for later testing.
○ Optional: If you would like to, add one (1) small sized *.cia game of your choice for later testing.
7. On the root of the SD card, create three (3) folders with these names:
Section II - Review the source system (o3DS)- 01 - CTRNAND
- 02 - TWLN
- 03 - TWLP
In order for the donor NAND to have a better chance of working on the target system (o2DS), the latest custom firmware should be installed on both the SD card and CTRNAND on the source system (o3DS). At the time of writing this (Nov-19, 2018), the essential custom firmware trifecta consists of Luma3DS v9.1, boot9strap v1.3, and GodMode9 v1.7.1.
If your 3DS system is using Luma3DS v7.0.5 or older (arm9loaderhax), you should update the custom firmware by following this guide:
On top of that, the latest 3DS firmware is needed to ensure there are no missing system modules for hardware changes in slightly revised 2DS/3DS models; in computer terms, these would be known as the hardware drivers. The latest 3DS firmware (as of writing) is version 11.8.0-41.
8. Insert the SD card into the o3DS, turn on the system, and hold (Select) to access Luma3DS v9.1 configuration. Select (x) Show NAND or user string in System Settings. Do not select any other options.
9. Press (Start) once and hold (Start) to access Luma3DS chainloader. Select SafeB9SInstaller and press the <Left> <Down> <Right> <Up> <A> combination to update boot9strap. If the update goes through, you should see "SigHaxed FIRM install success!".
○ If you had fastboot3ds instead of boot9strap, you'll have to reinstall this later once the donor NAND is created. Sorry bud.
10. Press (A) and hold (Start) to access Luma3DS chainloader again. Select GodMode9 and go to this directory:
- [0:] SDCARD ()/luma/payloads
○ If you mistakenly selected a different file, press (Select) to clear the clipboard.
12. Press (Y) → Move path(s). This will relocate the SafeB9SInstaller.firm out of the luma folder.
○ This is good practice to familiarize yourself in how to navigate and manipulate files in GodMode9.
○ Another purpose of this exercise is to have a cleaner setup for the next step.
○ Another purpose of this exercise is to have a cleaner setup for the next step.
13. Press (HOME) → Scripts... → GM9Megascript → Scripts from Plailect's Guide → Setup Luma3DS to CTRNAND, etc.
○ This will install Luma3DS and GodMode9 on the SysNAND CTRNAND that will allow the o3DS to boot without an SD card.
○ Steps 10–12 were done to prevent SafeB9SInstaller from getting installed on the CTRNAND.
○ Steps 10–12 were done to prevent SafeB9SInstaller from getting installed on the CTRNAND.
14. Exit out of the script by pressing (B) several times and choose the Exit option. Press (A) to relock write permissions.
15. Using the techniques from steps 11–12, move SafeB9SInstaller.firm back in the luma/payloads folder.
○ This *.firm file will be needed later for the target system (o2DS).
16. Press (Power) → Poweroff system to turn off the o3DS. Remove the SD card, turn on the o3DS, and check if these are bootable:
- GodMode9, by holding (Start)
- Luma3DS v9.1 configuration, by holding (Select)
- Remember to select (x) Show NAND or user string in System Settings.
- HOME Menu
18. With the o3DS turned off, reinsert the SD card and boot back to HOME Menu.
19. Go to System Settings → Internet Settings → Connection Settings. Remove all Connection (1,2,3) profiles with Delete Settings.
○ Remember the warning from bulletin #3 in the Key Notes above? Let's make sure this doesn't happen to your o3DS and o2DS.
20. To be extra safe, turn off the WiFi at HOME Menu → HOME Menu design → Wireless Communication / NFC: OFF.
○ This can also be done by pressing [L-shoulder + (Down) d-pad + (Select)] to access Rosalina menu → System configuration... → Toggle wireless.
21. Inject Homebrew Launcher into one of the system titles. Watch this if you're not familiar with using this feature:
22. (Optional) In Homebrew Launcher, open FBI and install the small size *.cia game of your choice. If you did not have any particular game in mind beforehand, you may instead pick a homebrew app in the SD → cias folder. Launch the game or title, and make a quick save.
22. (Optional) In Homebrew Launcher, open FBI and install the small size *.cia game of your choice. If you did not have any particular game in mind beforehand, you may instead pick a homebrew app in the SD → cias folder. Launch the game or title, and make a quick save.
Section III - Extract the donor NAND files
Now that the o3DS has everything updated and perhaps a game installed on the SD card, you will proceed with copying your NAND image in a direct manner. However, take note that messing with the CTRNAND and related drives can cause a softbrick if one is not careful and diligent. With this in mind, certain precautionary steps which may seem redundant should be followed in case anything goes wrong.
23. Restart the o3DS or access Rosalina menu → Reboot. Hold (Start) and open GodMode9.
24. Press (HOME) → Scripts... → NANDManager → <X> Backup SysNAND → <A> yes to create a SysNAND *.bin image.
○ Unless you already have a fairly recent backup, this step is for safety.
○ The image will be about 1 GB (old series) or 1.2 GB (new series) named like this:
25. Press <UP> Exit Script. Look in the 0:/gm9/out/ directory and verify the *.bin and *.sha are indeed there. Press (B) several times to go back to [root].○ The image will be about 1 GB (old series) or 1.2 GB (new series) named like this:
- ######_XX########_sysnand_000.bin
26. Enter the [1:] SYSNAND CTRNAND directory. Hold the L-shoulder button and press right (d-pad) to highlight everything in yellow. Let go of the L-shoulder button. Press (Y) to [CLIPBOARD] select everything. If a selection mistake is made, press (Select) to undo the clipboard list.
27. Back out with (B) button, and enter the [0:] SDCARD () directory. Go in the 01 - CTRNAND folder. Press (Y) → Copy path(s). This will make a 1-to-1 copy of your CTRNAND files.
○ DO NOT USE Move path(s) as this will cut and paste those files out of the 1:/ directory.
DO NOT USE Move path(s) as this will cut and paste those files out of the 1:/ directory.28. Repeat the process in steps 26 and 27 for these as well:
- [2:] SYSNAND TWLN → 02 - TWLN
- [3:] SYSNAND TWLP → 03 - TWLP
Section IV - Copy files from the SD card to a computer, etc.
Files from the SD card will need to be copied for a later section. You will eventually create something called an EmuNAND or RedNAND [emulated/redirected], and this procedure will reformat and delete everything on the card.
30. Insert the SD card into a computer. Look in the smdc:/gm9/out directory. If you wish to keep the recently backed up o3DS SysNAND image for personal safekeeping, this would be a good time to cut and paste this over somewhere. If this backup has no further use to you, delete the *.bin and *.sha files. Don't put the NAND *.bin image in the same folder for the next step.
31. On the computer, create a folder called TARGET SYSTEM. Copy and paste everything on the SD card to that folder. Don't use cut or delete as those files are still needed on the card. For the created set in TARGET SYSTEM, rename these three (3) folders:
31. On the computer, create a folder called TARGET SYSTEM. Copy and paste everything on the SD card to that folder. Don't use cut or delete as those files are still needed on the card. For the created set in TARGET SYSTEM, rename these three (3) folders:
- 01 - CTRNAND → 04 - CTRNAND
- 02 - TWLN → 05 - TWLN
- 03 - TWLP → 06 - TWLP
Section V - Review the target system (o2DS)
Just like the source system, make sure the target system's custom firmware are up-to-date. However, updating the 3DS firmware is not required.
33. Repeat steps 9–14 for the o2DS. You can delete SafeB9SInstaller.firm and boot9strap folder after updating B9S.
○ Deleting the boot9strap files is kinda pointless at this step, but this is to show they're not needed anymore.
○ Repeat step 16. Boot the o2DS without the SD card: Luma3DS v9.1 configuration, GodMode9, and HOME Menu.
○ Repeat step 20. Turn off the o2DS WiFi for even more safety. Turn off the o2DS.
○ Repeat step 16. Boot the o2DS without the SD card: Luma3DS v9.1 configuration, GodMode9, and HOME Menu.
○ Repeat step 20. Turn off the o2DS WiFi for even more safety. Turn off the o2DS.
Section VI - Create an EmuNAND and implant the donor NAND files
As was mentioned before in Section III, messing with the CTRNAND and related drives is not something that should be taken lightly. To mitigate the risk of softbricking the o2DS, you will be using an EmuNAND setup. In this day and age for 3DS custom firmware, EmuNAND/RedNAND does not serve a useful purpose outside of dev work, debugging, and sandbox research; others may argue needing an EmuNAND for their Gateway 3DS flashcart or prolonging the lifespan of their NAND chip on the motherboard. While that discussion is outside the scope of this tutorial, just know you don't want to mistakenly modify the SysNAND [system].
34. Insert the SD card into the o2DS, turn the system on, and boot GodMode9.
35. Create an EmuNAND by pressing (HOME) → More... → SD format menu → RedNAND size (min) → 32KB Clusters → ¦ ¦ → combo presses → <A> yes.
○ Creating an EmuNAND (or RedNAND) will delete everything on the SD card.
○ These drives should exist now:
Creating an EmuNAND (or RedNAND) will delete everything on the SD card.○ These drives should exist now:
- [4:] EMUNAND CTRNAND
- [5:] EMUNAND TWLN
- [6:] EMUNAND TWLP
36. Turn off the o2DS. Remove the SD card and insert it into the computer. Cut and paste all the files from the TARGET SYSTEM folder to the card.
○ Delete the empty TARGET SYSTEM folder if you like.
37. Eject the SD card and insert it back to the o2DS. Boot GodMode9. Repeat steps 24–25: back up the SysNAND.
○ For this step, you really don't want to skip backing up the o2DS NAND *.bin image.
○ From personal anecdote, it is easy to confuse the SysNAND for the EmuNAND because they look the same inside.
○ I myself may or may not have mistakenly deleted my SysNAND drives before... Good thing for NAND backups!
○ Depending what the o2DS does in EmuNAND with the donor NAND, you'll need that *.bin image for further troubleshooting.
○ From personal anecdote, it is easy to confuse the SysNAND for the EmuNAND because they look the same inside.
○ I myself may or may not have mistakenly deleted my SysNAND drives before... Good thing for NAND backups!
○ Depending what the o2DS does in EmuNAND with the donor NAND, you'll need that *.bin image for further troubleshooting.
38. Go to [4:] EMUAND CTRNAND. Hold L-shoulder button and press (right) d-pad to highlight everything in yellow. Let go of the L-shoulder button. Press (X) → <A> yes → button combo to delete everything. Once prompted, relock the write permissions.
39. Go to 0:/04 - CTRNAND directory. Highlight everything in yellow. Press (Y) to [CLIPBOARD] select everything. Go back to [4:] EMUAND CTRNAND. Press (Y) → Move path(s) → <A> yes → button combo to cut and paste these files over. Relock the write permissions.
40. Repeat steps 38–39 for the other two (2) sets of drive & folder:
- 05 - TWLN → [5:] EMUNAND TWLN
- 06 - TWLP → [6:] EMUNAND TWLP
42. In [root], highlight white the [4:] EMUNAND CTRNAND. Hold the R-shoulder button and press (A) → Fix CMACs for drive → <A> yes → button combo. This will automatically calculate and correct the mismatching hashes between the donor NAND and target system.
Section VII - Enable EmuNAND
43. Boot Luma3DS v9.1 configuration and select these two options:
- (x) Autoboot EmuNAND
- (x) Show NAND or user string in System Settings
44. Boot HOME Menu. If you notice the wireless LED indicator turning on, quickly access Rosalina Menu to turn off the WiFi.
45. Go to System Settings. Look for the Emu 11.8.0-41E. Verify the o2DS is indeed using EmuNAND with the NAND borrowed from the o3DS.
****○ Congratulations. You've now mastered the homebrew dark art of performing an unauthorized System Transfer. With this knowledge, use wisely.
Outcome ∅ - The o2DS is stable in EmuNAND when using the donor NAND.
After exploring HOME Menu, using Homebrew Launcher, and playing your game of choice, you discover the o2DS functions correctly. However, this is too soon to celebrate. You have some followup testing to do:
46. Go back to GodMode9 and copy the EmuNAND over to the SysNAND.
- I really hope you backed up that SysNAND image in step 37. Last call.
- (HOME) → Scripts... → NANDManager → <LEFT> Transfer Emu to Sys, etc.
○ System Settings: look for the Sys 11.8.0-41E
The o2DS continues to function correctly when testing everything (minus the Internet).
Conclusion
The o2DS original NAND image is somehow corrupt, despite previous attempts of CTRTransfer and updates through Recovery Mode. You will need to attempt repairing its firmware by making a CTRTransfer image and flashing it on top of its original NAND.
48A. On the o2DS, GodMode9 → [S:] SYSNAND VIRTUAL → ctrnand_full.bin → Copy to 0:/gm9/out.
○ This will produce the CTRTransfer image derived from the donor NAND.
49A. (HOME) button → Scripts... → NANDManager → <R> Restore SysNAND (Safe) → ######_XX########_sysnand_000.bin (from step 37).
○ Restore the o2DS original NAND backup to its SysNAND CTRNAND.
50A. Go to 0:/gm9/out/ctrnand_full.bin → CTRNAND options... → Transfer image to CTRNAND → Transfer to SysNAND, etc.
○ Finally, this will reinstall system titles from the donor NAND and (should) fix the underlying bug.
51A. Give it another go in HOME Menu. *crosses fingers*
You might be asking, what's the difference between CTRTransfer and SysNAND images? Why does one need to restore the o2DS original broken NAND image before using CTRTransfer?
While SysNAND and CTRTransfer images are related, there are key differences between the two.
- SysNAND is encrypted and usable only for the 2DS or 3DS system it was made from.
- CTRTransfer, depending [old|new] series, can be thought as a universal SysNAND usable by any hacked 3DS/2DS.
- SysNAND contains your personal files such as LocalFriendSeedCode_B, movable.sed, SecureInfo_B, etc.
- CTRTransfer does not reflash or overwrite those personal info. Your 3DS or 2DS retains its unique identity.
- This is not to say a privately created CTRTransfer does not contain those files! You have to manually remove them yourself.
- Publically shared CTRTransfer found at 3ds.hacks.guide has those stripped out. No being sneaky.
Outcome B - The o2DS crashes in SysNAND with the donor NAND, despite being stable in EmuNAND.
This would be a very strange turn of events...
48B. Follow steps 48A–51A but substitute the SysNAND with EmuNAND.
Conclusion
Despite the rarity and near zilch (if any reported natural wear & tear occurance), the o2DS physical NAND chip on the motherboard that houses your SysNAND CTRNAND has started to fail. While flash memory can and do expire from usage, silicon manufacturing for eMMC at 1-2 GB size have long ago matured to the point that there should be a near zero defective yield rate. The rest of that o2DS should be falling apart long before its onboard NAND is supposed to go bad. However, we don't live in a perfect world, and faulty chips do slip through in production because batches are checked in sample sizes.
Outcome C - The o2DS crashes in EmuNAND with the donor NAND.
Sigh...
48C. Disassemble the o2DS and remove its motherboard. Go to an electronic repair specialist who has an oven or workstation heat gun. Although there's a slim chance of success, reflowing the solders may fix the unknown component if the issue is broken solder joints.
DO NOT USE YOUR KITCHEN OVEN AS THIS WILL CONTAMINATE YOUR FUTURE BAKED FOODS!!!
If you have your own heat gun, and there are no locally available electronic repair shops, you may try reflowing the motherboard yourself.Conclusion
It can be anyone's guess in what is physically wrong with that o2DS.
- CPU, GPU, RAM, front camera, missing or failed SMD, lifted/broken traces, etc.
***
Once the EmuNAND and illigitimate System Transfer testing has concluded, you should remove all traces of the donor NAND from the SD card and SysNAND.
- SysNAND Restore (Safe) the image (from step 37) if CTRTransfer recovery was not followed in outcomes A or B.
- Use MiniTool Partition Wizard to delete and merge partitions back together for the SD card using step 3.
Last edited by TurdPooCharger,
, Reason: Previous pictures expired from imgbb.com.
