Hacking 3Down - CTRNAND Downgrade

[aut0mat3d]

You can do this by yourselve by inserting your own files before downgrading - look at the first post - i made a little howto on that - its the hidden content, named
Secure Providing a ctrtransfer image:

 

[AshiePoo]

well yes, but FBI's ticket files are universal, yeah? so surely it'd be a good idea to insert them before the end user

 

[chenzw]

Done but only problem when i go to this part:

1. Navigate to SD -> files9
2. Navigate to current directory
3. Hit A
4. Select Install and delete all Tickets and hit A to install

In my FBI i don't get the option Install and delate all Tickets.

Edit: Just in case i was using the wrong version i try to update the FBI bu unfotunaly no new update. So i use the most recent version of the FBI but that option simple is not there.

Edit2: I forgot to say then following your guide i get the file encTitleKeys9.bin (this is the name i choose for my backup).​

You backed up the title keys by mistake... tickets and title keys are two different things.

 

[PedroKeitawa]

You backed up the title keys by mistake... tickets and title keys are two different things.

So i have to re download all the homebrew and games again? Is not a big problem becouse for all my game i make save file backup, plus some games save directly on to SD.

 

[PedroKeitawa]

Also sorry for the double post but i have another problem. I want to use my custom badge but since i backup the wrong file for the tickets now i have to reconnect my ID again, for use the BadgeArceade Center and then use my custom badge. The problem is i cannot use the internet connection with the console becouse i need to update....so there is a way for still use the wifi function with out update?

 

[adrifcastr]

Also sorry for the double post but i have another problem. I want to use my custom badge but since i backup the wrong file for the tickets now i have to reconnect my ID again, for use the BadgeArceade Center and then use my custom badge. The problem is i cannot use the internet connection with the console becouse i need to update....so there is a way for still use the wifi function with out update?

ctrhttpwn

 

[PedroKeitawa]

ctrhttpwn

Thanks. I feel really dumb to backup the wrong file to the title on my 3DS but thanks arceus to save file backup so at the end i not lose anything. Thanks for your help and guide buddy

 

[AshiePoo]

@addi33 i have a "Cleaned" 11.2.0-35U what do you want doing with it?

 

[FrozenPhoenix]

you could include fbi's ticket separately to be installed after the ctrnand transfer, since injecting it into the ctrnand image may not be a option at this point.

 

[AshiePoo]

you could include fbi's ticket separately to be installed after the ctrnand transfer, since injecting it into the ctrnand image may not be a option at this point.

That's actually a valid idea there, i'll look at that

 

[Celto]

Since a lot of people were complaining about 11.4 breaking NTR's streaming feature and wanting to Get Back to 11.3 without SysDowngrader / Having a NAND Backup (whyever), I am presenting you:
3Down
This is NOT violating any Terms in here, since the ctr images are torrent-hosted like in 3ds.guide
ATM I am seeding everything by myself so seeders are needed to even get this to work faster
So there you go this is hopefully helpful.

Spoiler: Secure Providing a ctrtransfer image:

Thx to @Altimit for stating 4 the need of scrubbing!
If you want to share ctrtransfer dumps, you have to clean them to not provide personal data to the Public!
To Clean/Scrub a ctrtransfer dump you should:
Godmode9 Part:

• Mount a public ctrtransfer.bin which matches your 3DS and Region (for Example: 9.2.0-20E_ctrtransfer_n3ds)
• Copy the following Files to a Folder on the SD-Card:

/dbs/ticket.db
/private/movable.sed
/rw/sys/LocalFriendCodeSeed_B
/rw/sys/SecureInfo_A

• Mount your ctrtransfer.bin
• Copy and replace the following Files you extracted one step before in your ctrtransfer.bin:

/dbs/ticket.db
/private/movable.sed
/rw/sys/LocalFriendCodeSeed_B
/rw/sys/SecureInfo_A

• Delete the .sha for your ctrtransfer dump
• Generate a new .sha for your modified dump

PC-Part:
Copy the ctrtransfer.bin and ctrtransfer.sha from SD-Card to your PC
Open the ctrtransfer.sha with a Hexeditor
Append HEX Value 02 (0x02) at the end of the File
Example:

Hash before modification:
E7 B9 5B 8C 3F EC E4 92 FC 2E D1 65 31 9E 54 27 6A 08 5F DC DC F1 AC 5F E2 85 B4 03 F2 6D 17 61
Hash after modification:
E7 B9 5B 8C 3F EC E4 92 FC 2E D1 65 31 9E 54 27 6A 08 5F DC DC F1 AC 5F E2 85 B4 03 F2 6D 17 61 02

It is not clear why safectrtransfer adds 0x02 to the Hash, perhaps it is some sort of Protection or EOF Checking - whatever

Technical Detail:
When flashing the ctrtransfer Image via Decrypt9,
/dbs/ticket.db
/private/movable.sed
/rw/sys/LocalFriendCodeSeed_B
/rw/sys/SecureInfo_A
and additionally configsave.bin
will be saved from your console Flash and restored after ctrtransfer. Unfortuanally Decrypt9 will not do its job when these files are missing, so this is why we have to replace them in the .bin

Update: finally manged to clean the images after 7 hours with help from @aut0mat3d
Update: Quick How2 to make your own ctrtransfer dumps "safe" by @aut0mat3d
Update: 11.2 / 11.3 o3ds EUR are live!
Update: 11.2 USA o3ds is Live! big thanks to @Yuan !
Update: added friendsave.bin dump + inject to prevent eventual loss of friendlists.
Update: added (obvious) Emunand instructions at Section 3 for Emunand users
Update: cleaned it up a bit, should be easier to see everything now.
Update: 11.2 Eur + 11.4 Eur + Tik bkup/restore is added

Can you leave installation instructions please. Thank you

 

[AshiePoo]

Can you leave installation instructions please. Thank you

What? click the link, that's the installation instructions XD 3Down is the site to go to

 

[RocketRobz]

How do i recover my miis from 11.4 if i downgraded?

I don't think you can with 3Down. You're gonna have to use SysDowngrader if you want to downgrade with your Miis kept.
I originally planned on downgrading with 3Down, but then I thought about my Miis.

 

[adrifcastr]

I don't think you can with 3Down. You're gonna have to use SysDowngrader if you want to downgrade with your Miis kept.
I originally planned on downgrading with 3Down, but then I thought about my Miis.

aren't they in the mii makers save/extdata or something? (idk I never really bothered me with mii's and that stuff)

 

[RocketRobz]

aren't they in the mii makers save/extdata or something? (idk I never really bothered me with mii's and that stuff)

They're stored in NAND, now that I checked. I booted my 3DS without an SD card.

 

[adrifcastr]

They're stored in NAND, now that I checked. I booted my 3DS without an SD card.

the question is where in nand...

probably just the save file, I don't think they stored it somewhere difficult to access

 

[Slowbeatle]

I don't think you can with 3Down. You're gonna have to use SysDowngrader if you want to downgrade with your Miis kept.
I originally planned on downgrading with 3Down, but then I thought about my Miis.

I just restored my previous 11.4 nand and backed up the system file where the miis are located and restored. Did the trick. Also, back up the nnid, something that is missing from this guide for some reason.

 

[AshiePoo]

I just restored my previous 11.4 nand and backed up the system file where the miis are located and restored. Did the trick. Also, back up the nnid, something that is missing from this guide for some reason.

i didn't even think of that tbh XD i have no nnid linked to my n3ds atm, it's very much a development console XD

Edit:
@addi33 i have a confirmed working cleaned ctrtransfer for 11.2.0-35U-o3ds did you want it? i'm gonna experiment with extracting only the FBI tickt from a few 3ds systems and just see if injecting the ticket along with or after the ctr transfer will work well, preventing people from having to run through the HBL method, or anything similar

 

[wolf_]

I noticed that when exiting system settings it locks the system any ideas?

 

[FateForWindows]

I noticed that when exiting system settings it locks the system any ideas?

Hold down the power button.