(Very Bad Tutorial) Perform an unauthorized System Transfer

Do not attempt this if you don't have a good reason to.​

Key Notes
1 - This tutorial will clone a donor NAND from a source 3DS → target 3DS. This is similar to performing Lazarus3DS.
2 - This method is not recommended when sharing HOME Menu games installed on SD cards between two systems.
3 - A target 3DS with a cloned NAND connecting online and using Nintendo services risks both systems getting banned.

4 - For instructions on how to properly System Transfer between two 3DS systems with custom firmware, please refer to these:

• 3DS system transfer today- Whats the best way?
• CFW to CFW system transfer

You will need the following

• Two (2) 3DS systems of the same series.
  • old & old: o2DS, o3DS, o3DSXL
  • new & new: n3DS, n3DSXL, n2DSXL

• 4 GB or larger (micro) SD card.
  • Minimum size of 4 GB. Nothing smaller.

• (Optional) A small size *.cia game (~15 MB or smaller).
  • For testing and demonstration purposes.

For this example, we will designate:

• Source: o3DS
• Target: o2DS

o3DS | o2DS | SD card

Section I - Prepare the SD card

1. If the SD card is a standard type (not micro), ensure the read-only slider switch is not in the LOCK position.

Read-only slider switch

2. Copy everything off the SD card onto a computer.​

3. Reformat the card using MiniTool Partition Wizard (free edition) with these settings:

• Format: FAT32
• Cluster Size: 32 KB
• Partition: Primary
• Disk: MBR

MiniTool Partition Wizard Software Tutorial Guide

1. Delete Partition
2. Initialize to MBR Disk -or- Convert GPT to MBR Disk (if it's in GPT Disk)
3. Rebuild MBR
4. Create a New Partition [ Create as: Primary | File System: FAT32 | Cluster Size: 32 KB ]

​

4. With the card empty, do a Full Write + Verify Test with H2testw.

○ Unless this was previously done before on this card, do not skip this step.​

5. If the card passes, delete the *.h2w test files.

○ If an error is reported, stop the test. Replace the defective SD card, and go back to step 1.
○ We need to be absolutely certain this card can perform the tasks ahead.​

6. Build a test setup using the CFW starter kit archive found here.

○ Do not borrow files from the o3DS and o2DS main setups.
○ Optional: If you would like to, add one (1) small sized *.cia game of your choice for later testing.​

7. On the root of the SD card, create three (3) folders with these names:

• 01 - CTRNAND
• 02 - TWLN
• 03 - TWLP

​

Section II - Review the source system (o3DS)
In order for the donor NAND to have a better chance of working on the target system (o2DS), the latest custom firmware should be installed on both the SD card and CTRNAND on the source system (o3DS). At the time of writing this (Nov-19, 2018), the essential custom firmware trifecta consists of Luma3DS v9.1, boot9strap v1.3, and GodMode9 v1.7.1.

If your 3DS system is using Luma3DS v7.0.5 or older (arm9loaderhax), you should update the custom firmware by following this guide:

• A9LH to B9S

On top of that, the latest 3DS firmware is needed to ensure there are no missing system modules for hardware changes in slightly revised 2DS/3DS models; in computer terms, these would be known as the hardware drivers. The latest 3DS firmware (as of writing) is version 11.8.0-41.

8. Insert the SD card into the o3DS, turn on the system, and hold (Select) to access Luma3DS v9.1 configuration. Select (x) Show NAND or user string in System Settings. Do not select any other options.

​

9. Press (Start) once and hold (Start) to access Luma3DS chainloader. Select SafeB9SInstaller and press the <Left> <Down> <Right> <Up> <A> combination to update boot9strap. If the update goes through, you should see "SigHaxed FIRM install success!".

○ If you had fastboot3ds instead of boot9strap, you'll have to reinstall this later once the donor NAND is created. Sorry bud. ​

10. Press (A) and hold (Start) to access Luma3DS chainloader again. Select GodMode9 and go to this directory:

• [0:] SDCARD ()/luma/payloads

11. Press (Y) on SafeB9SInstaller.firm to [CLIPBOARD] select this file. Back out to the root of the SD card or the 0: directory.

○ If you mistakenly selected a different file, press (Select) to clear the clipboard.

CLIPBOARD

12. Press (Y) → Move path(s). This will relocate the SafeB9SInstaller.firm out of the luma folder.

○ This is good practice to familiarize yourself in how to navigate and manipulate files in GodMode9.
○ Another purpose of this exercise is to have a cleaner setup for the next step.

Move path(s)

13. Press (HOME) → Scripts... → GM9Megascript → Scripts from Plailect's Guide → Setup Luma3DS to CTRNAND, etc.

○ This will install Luma3DS and GodMode9 on the SysNAND CTRNAND that will allow the o3DS to boot without an SD card.
○ Steps 10–12 were done to prevent SafeB9SInstaller from getting installed on the CTRNAND.​

14. Exit out of the script by pressing (B) several times and choose the Exit option. Press (A) to relock write permissions.​

15. Using the techniques from steps 11–12, move SafeB9SInstaller.firm back in the luma/payloads folder.

○ This *.firm file will be needed later for the target system (o2DS).​

16. Press (Power) → Poweroff system to turn off the o3DS. Remove the SD card, turn on the o3DS, and check if these are bootable:

• GodMode9, by holding (Start)
• Luma3DS v9.1 configuration, by holding (Select)
  • Remember to select (x) Show NAND or user string in System Settings.
• HOME Menu

17. Go to HOME Menu → System Settings. Check if the o3DS is using the latest 3DS firmware. For EUR region 3DS, this should be Sys 11.8.0-41E on the upper screen in the bottom, right corner. If this is not the latest version, turn on the WiFi and update the 3DS firmware in Other Settings → System Update.​

18. With the o3DS turned off, reinsert the SD card and boot back to HOME Menu.​

19. Go to System Settings → Internet Settings → Connection Settings. Remove all Connection (1,2,3) profiles with Delete Settings.

○ Remember the warning from bulletin #3 in the Key Notes above? Let's make sure this doesn't happen to your o3DS and o2DS. ​

20. To be extra safe, turn off the WiFi at HOME Menu → HOME Menu design → Wireless Communication / NFC: OFF.

○ This can also be done by pressing [L-shoulder + (Down) d-pad + (Select)] to access Rosalina menu → System configuration... → Toggle wireless.​

21. Inject Homebrew Launcher into one of the system titles. Watch this if you're not familiar with using this feature:

• [Video Tutorial] How to Inject Homebrew Into Official App - Stealth Homebrew w/ Rosalina Menu

22. (Optional) In Homebrew Launcher, open FBI and install the small size *.cia game of your choice. If you did not have any particular game in mind beforehand, you may instead pick a homebrew app in the SD → cias folder. Launch the game or title, and make a quick save.​

Section III - Extract the donor NAND files
Now that the o3DS has everything updated and perhaps a game installed on the SD card, you will proceed with copying your NAND image in a direct manner. However, take note that messing with the CTRNAND and related drives can cause a softbrick if one is not careful and diligent. With this in mind, certain precautionary steps which may seem redundant should be followed in case anything goes wrong.

23. Restart the o3DS or access Rosalina menu → Reboot. Hold (Start) and open GodMode9.​

24. Press (HOME) → Scripts... → NANDManager → <X> Backup SysNAND → <A> yes to create a SysNAND *.bin image.

○ Unless you already have a fairly recent backup, this step is for safety.
○ The image will be about 1 GB (old series) or 1.2 GB (new series) named like this:

• ######_XX########_sysnand_000.bin

​

25. Press <UP> Exit Script. Look in the 0:/gm9/out/ directory and verify the *.bin and *.sha are indeed there. Press (B) several times to go back to [root].​

26. Enter the [1:] SYSNAND CTRNAND directory. Hold the L-shoulder button and press right (d-pad) to highlight everything in yellow. Let go of the L-shoulder button. Press (Y) to [CLIPBOARD] select everything. If a selection mistake is made, press (Select) to undo the clipboard list.

Highlight Yellow & CLIPBOARD [SYSNAND CTRNAND]

27. Back out with (B) button, and enter the [0:] SDCARD () directory. Go in the 01 - CTRNAND folder. Press (Y) → Copy path(s). This will make a 1-to-1 copy of your CTRNAND files.

○ DO NOT USE Move path(s) as this will cut and paste those files out of the 1:/ directory.​

28. Repeat the process in steps 26 and 27 for these as well:

• [2:] SYSNAND TWLN → 02 - TWLN
• [3:] SYSNAND TWLP → 03 - TWLP

29. Turn off the o3DS and remove the SD card. You are now done with using the source system.​

Section IV - Copy files from the SD card to a computer, etc.
Files from the SD card will need to be copied for a later section. You will eventually create something called an EmuNAND or RedNAND [emulated/redirected], and this procedure will reformat and delete everything on the card.

30. Insert the SD card into a computer. Look in the smdc:/gm9/out directory. If you wish to keep the recently backed up o3DS SysNAND image for personal safekeeping, this would be a good time to cut and paste this over somewhere. If this backup has no further use to you, delete the *.bin and *.sha files. Don't put the NAND *.bin image in the same folder for the next step.

31. On the computer, create a folder called TARGET SYSTEM. Copy and paste everything on the SD card to that folder. Don't use cut or delete as those files are still needed on the card. For the created set in TARGET SYSTEM, rename these three (3) folders:

• 01 - CTRNAND → 04 - CTRNAND
• 02 - TWLN → 05 - TWLN
• 03 - TWLP → 06 - TWLP

32. Safely eject the SD card and insert it in the o2DS.​

Section V - Review the target system (o2DS)
Just like the source system, make sure the target system's custom firmware are up-to-date. However, updating the 3DS firmware is not required.

33. Repeat steps 9–14 for the o2DS. You can delete SafeB9SInstaller.firm and boot9strap folder after updating B9S.

○ Deleting the boot9strap files is kinda pointless at this step, but this is to show they're not needed anymore.
○ Repeat step 16. Boot the o2DS without the SD card: Luma3DS v9.1 configuration, GodMode9, and HOME Menu.
○ Repeat step 20. Turn off the o2DS WiFi for even more safety. Turn off the o2DS.​

Section VI - Create an EmuNAND and implant the donor NAND files
As was mentioned before in Section III, messing with the CTRNAND and related drives is not something that should be taken lightly. To mitigate the risk of softbricking the o2DS, you will be using an EmuNAND setup. In this day and age for 3DS custom firmware, EmuNAND/RedNAND does not serve a useful purpose outside of dev work, debugging, and sandbox research; others may argue needing an EmuNAND for their Gateway 3DS flashcart or prolonging the lifespan of their NAND chip on the motherboard. While that discussion is outside the scope of this tutorial, just know you don't want to mistakenly modify the SysNAND [system].

34. Insert the SD card into the o2DS, turn the system on, and boot GodMode9.​

35. Create an EmuNAND by pressing (HOME) → More... → SD format menu → RedNAND size (min) → 32KB Clusters → ¦ ¦ → combo presses → <A> yes.

○ Creating an EmuNAND (or RedNAND) will delete everything on the SD card.
○ These drives should exist now:

• [4:] EMUNAND CTRNAND
• [5:] EMUNAND TWLN
• [6:] EMUNAND TWLP

EmuNAND drives

36. Turn off the o2DS. Remove the SD card and insert it into the computer. Cut and paste all the files from the TARGET SYSTEM folder to the card.

○ Delete the empty TARGET SYSTEM folder if you like.​

37. Eject the SD card and insert it back to the o2DS. Boot GodMode9. Repeat steps 24–25: back up the SysNAND.

○ For this step, you really don't want to skip backing up the o2DS NAND *.bin image.
○ From personal anecdote, it is easy to confuse the SysNAND for the EmuNAND because they look the same inside.
○ I myself may or may not have mistakenly deleted my SysNAND drives before... Good thing for NAND backups!
○ Depending what the o2DS does in EmuNAND with the donor NAND, you'll need that *.bin image for further troubleshooting.​

38. Go to [4:] EMUAND CTRNAND. Hold L-shoulder button and press (right) d-pad to highlight everything in yellow. Let go of the L-shoulder button. Press (X) → <A> yes → button combo to delete everything. Once prompted, relock the write permissions.

Deleting EmuNAND CTRNAND

39. Go to 0:/04 - CTRNAND directory. Highlight everything in yellow. Press (Y) to [CLIPBOARD] select everything. Go back to [4:] EMUAND CTRNAND. Press (Y) → Move path(s) → <A> yes → button combo to cut and paste these files over. Relock the write permissions.​

40. Repeat steps 38–39 for the other two (2) sets of drive & folder:

• 05 - TWLN → [5:] EMUNAND TWLN
• 06 - TWLP → [6:] EMUNAND TWLP

41. (Optional) Delete the 04 - CTRNAND, 05 - TWLN, and 06 - TWLP (empty) folders. To individually highlight items in yellow, press the L-shoulder button on each of the three (3). Press (X) → <A> yes to delete.​

42. In [root], highlight white the [4:] EMUNAND CTRNAND. Hold the R-shoulder button and press (A) → Fix CMACs for drive → <A> yes → button combo. This will automatically calculate and correct the mismatching hashes between the donor NAND and target system.

Fix CMACs for drive

Section VII - Enable EmuNAND

43. Boot Luma3DS v9.1 configuration and select these two options:

• (x) Autoboot EmuNAND
• (x) Show NAND or user string in System Settings

​

44. Boot HOME Menu. If you notice the wireless LED indicator turning on, quickly access Rosalina Menu to turn off the WiFi.​

45. Go to System Settings. Look for the Emu 11.8.0-41E. Verify the o2DS is indeed using EmuNAND with the NAND borrowed from the o3DS.

○ Congratulations. You've now mastered the homebrew dark art of performing an unauthorized System Transfer. With this knowledge, use wisely.
​

****

Outcome ∅ - The o2DS is stable in EmuNAND when using the donor NAND.
After exploring HOME Menu, using Homebrew Launcher, and playing your game of choice, you discover the o2DS functions correctly. However, this is too soon to celebrate. You have some followup testing to do:

46. Go back to GodMode9 and copy the EmuNAND over to the SysNAND.

• I really hope you backed up that SysNAND image in step 37. Last call.
• (HOME) → Scripts... → NANDManager → <LEFT> Transfer Emu to Sys, etc.

47. Boot Luma3DS v9.1 configuration and deselect ( ) Autoboot EmuNAND.

○ System Settings: look for the Sys 11.8.0-41E​

​

Outcome A - The o2DS is stable in SysNAND when using the donor NAND.
The o2DS continues to function correctly when testing everything (minus the Internet).

Conclusion
The o2DS original NAND image is somehow corrupt, despite previous attempts of CTRTransfer and updates through Recovery Mode. You will need to attempt repairing its firmware by making a CTRTransfer image and flashing it on top of its original NAND.

48A. On the o2DS, GodMode9 → [S:] SYSNAND VIRTUAL → ctrnand_full.bin → Copy to 0:/gm9/out.

○ This will produce the CTRTransfer image derived from the donor NAND.​

49A. (HOME) button → Scripts... → NANDManager → <R> Restore SysNAND (Safe) → ######_XX########_sysnand_000.bin (from step 37).

○ Restore the o2DS original NAND backup to its SysNAND CTRNAND.​

50A. Go to 0:/gm9/out/ctrnand_full.bin → CTRNAND options... → Transfer image to CTRNAND → Transfer to SysNAND, etc.

○ Finally, this will reinstall system titles from the donor NAND and (should) fix the underlying bug.
​

51A. Give it another go in HOME Menu. *crosses fingers*​

You might be asking, what's the difference between CTRTransfer and SysNAND images? Why does one need to restore the o2DS original broken NAND image before using CTRTransfer?

While SysNAND and CTRTransfer images are related, there are key differences between the two.

• SysNAND is encrypted and usable only for the 2DS or 3DS system it was made from.
• CTRTransfer, depending [old|new] series, can be thought as a universal SysNAND usable by any hacked 3DS/2DS.
• SysNAND contains your personal files such as LocalFriendSeedCode_B, movable.sed, SecureInfo_B, etc.
• CTRTransfer does not reflash or overwrite those personal info. Your 3DS or 2DS retains its unique identity.
  • This is not to say a privately created CTRTransfer does not contain those files! You have to manually remove them yourself.
  • Publically shared CTRTransfer found at 3ds.hacks.guide has those stripped out. No being sneaky.

Outcome B - The o2DS crashes in SysNAND with the donor NAND, despite being stable in EmuNAND.
This would be a very strange turn of events...

48B. Follow steps 48A–51A but substitute the SysNAND with EmuNAND.​

Conclusion
Despite the rarity and near zilch (if any reported natural wear & tear occurance), the o2DS physical NAND chip on the motherboard that houses your SysNAND CTRNAND has started to fail. While flash memory can and do expire from usage, silicon manufacturing for eMMC at 1-2 GB size have long ago matured to the point that there should be a near zero defective yield rate. The rest of that o2DS should be falling apart long before its onboard NAND is supposed to go bad. However, we don't live in a perfect world, and faulty chips do slip through in production because batches are checked in sample sizes.


Outcome C - The o2DS crashes in EmuNAND with the donor NAND.
Sigh...

48C. Disassemble the o2DS and remove its motherboard. Go to an electronic repair specialist who has an oven or workstation heat gun. Although there's a slim chance of success, reflowing the solders may fix the unknown component if the issue is broken solder joints.

DO NOT USE YOUR KITCHEN OVEN AS THIS WILL CONTAMINATE YOUR FUTURE BAKED FOODS!!! ​

If you have your own heat gun, and there are no locally available electronic repair shops, you may try reflowing the motherboard yourself.​

Conclusion
It can be anyone's guess in what is physically wrong with that o2DS.

• CPU, GPU, RAM, front camera, missing or failed SMD, lifted/broken traces, etc.

***

Once the EmuNAND and illigitimate System Transfer testing has concluded, you should remove all traces of the donor NAND from the SD card and SysNAND.

• SysNAND Restore (Safe) the image (from step 37) if CTRTransfer recovery was not followed in outcomes A or B.
• Use MiniTool Partition Wizard to delete and merge partitions back together for the SD card using step 3.

 

Go in these subfolders and individually delete the files and subfolders. Report back what won't get deleted in EmuNAND CTRNAND.

 

Your 2DS is beating us up.

***

I need you to be truthful with me because I have two ideas you can try before I call the cavalry.

***

Question Statement
You, @Extrasklep, from Poland and fan of Animal Crossing's Rover the Train Cat, followed through with Section I - Prepare the SD card with a 4 GB or bigger SD card, formatting that card with MiniTool Partition Wizard (free edition) AND more importantly, checking its health status with H2testw, as per stated instructions and with clean test results?

Is the above statement correct to the best of your honest knowledge?

 

As long as your laptop successfully reformatted that card and H2testw didn't find anything wrong with it (starting empty of course), then your SD card is okay. That answers the crucial question in the off chance the problem is the SD card itself.

***

Oh dear. I'm going to be frank with you. I have never heard of or seen a 2DS or 3DS experiencing CTRNAND problems where the files can't be deleted. This is extremely bizarre considering this happened on an EmuNAND. If you're seeing the same question marks and impossible GB file sizes in the [1:] SYSNAND CTRNAND... Let me explain this in terms of what I do know.

I have seen this sort of behavior for SD cards that locked themselves in read-only mode when they softly die. This is an end stage behavior that a softhardbricked SD card does to try to protect data. Although you might have caught on from observation or already knew about this, the physical NAND chip on the 3DS is basically the same as those found on SD cards and flash drives. Sometimes, the SD card die in worse fashion where files have strange names and odd sizes like what you're seeing.

If SD card failure is anything to go by and related to 3DS NAND, your o2DS may have experienced outcome B. The problem with making that claim is that a working EmuNAND haven't been made to prove the o2DS other software and hardware aspects are not at fault. Your EmuNAND was suppose to be a control variable to test this theory along with bad firmware or some other hardware problem.

***

Here's what you can try to find out this isn't a fluke.

Idea 1 - Was there something wrong with the SD card? Try a different card to find out.

1. Take a different SD card that's not the one you were using and follow Section I for it.
2. Create an EmuNAND on this second card. Try again to delete the files in [4:] EMUNAND CTRNAND.
3. If you can delete all the files, you'll know your first SD card has oddly derped big time.
   • However, if the same "unable to delete" incident happens again, move onto idea 2.

Idea 2 - Try deleting the files in [1:] SYSNAND CTRNAND.

4. Do this if you have its backed up NAND, and it's still on the first SD card. This is the only way you'll know the NAND is indeed dying or semi-bricked.​

 

In this case since you're not the one who hacked the console originally, and it's doing VERY odd things in terms of software with no errors to your SD card.... I'm still going to say it's a software compatibility issue. This is the only time I would suggest uninstalling B9S and returning to stock OFW, updating the system and then using Frogminer or NTRBootHax to re-do the installation as per the guide to the T.

Sounds like whoever hacked it used a video guide and some .rar with the essential files needed for hacking. No telling if those files were the right versions, bloat, etc. Hell there was a dude a while back that put one of those "Hack.rar" on his vids and left his personal OTP inside bricking tons of people......

I'd revert to OFW. (It's a one step operation using a Godemode9 Script).... If that doesn't fix your problems it's not really a loss since you can't use it in it's current state, hacked or not. At least then you can eradicate the potential that it was hacked incorrectly.

— Posts automatically merged - Please don't double post! —

Also, Frogminer is 100% free. The only issue is you need someone to create the necessary file for you unless you have a high end GPU.

 

It's simple.... Not really necessary to write a guide D9/GM9 initiate the CTRNAND transfer different ways. It's been common knowledge for sometime GM9 doesn't always work well with CTRNAND transfers...

1. Make sure your CTRTransfer image is in /files9/
2. Navigate to SysNAND Options
3. Navigate to CTRNAND transfer... and Auto CTRNAND Transfer

 

You can make an EmuNAND from a computer with 3DS Multi EmuNAND Creator.

The problem is the 3DS can't access EmuNAND made with a NAND *.bin image from a different 3DS because of encryption. Remember, only the SysNAND *.bin image is usable from the 3DS that made it. That bad System Transfer guide got around this restriction by pulling those files out the SysNAND drives, placing them in the three (3) folders, and then transferring the files over to the emptied EmuNAND drives.

Because the o2DS NAND *.bin images you have right now aren't clean, using 3DS Multi EmuNAND Creator won't fix or avoid the "unable to delete" files bug.

***

Try Quantumcat and Majickhat55's approach of CTRTransfer in Decrypt9WIP, but first restore any deleted personal info files.

1. Download Decrypt9WIP. Copy Decrypt9WIP.firm and place it in smdc:/luma/payloads folder.

2. Copy the 11.5.0 CTRTransfer files and put them in:

• smdc:/files9/11.5.0-38E_ctrtransfer_o3ds.bin
• smdc:/files9/11.5.0-38E_ctrtransfer_o3ds.bin.sha

3. GodMode9 → (HOME) → Scripts... → NANDManager → <R> Restore SysNAND (Safe) → etc.

4. Decrypt9WIP → SysNAND Options → CTRTransfer... → Auto CTRNAND Transfer → button combo → 11.5.0-38E_ctrtransfer_o3ds.bin → etc.​

 

Just to be sure, can I safely go online with both my 2DS and 3DS now?

 

Big thanks to everyone who helped me with this!