Hacking 3DS unbricking progress

[gamesquest1]

No. I read somewhere that only the RPi has low level sd card access.

bkifft would likely know more on the matter than most XD, but yeah its theoretically possible you could use a PC with specific SD card readers, but again the likelihood of people having a compatible card reader is fairly unlikely as bkifft said pretty much all build in SD readers are using a USB interface which wouldn't work for issuing low level commands, i hope the bricking crap is behind us now and as i have said before i don't really think it warrants anyone spending time creating new methods when there really isn't much excuse for it, pretty much everyone who got bricked "should" be unbricked at this point.

there will always be 1 or 2 stragglers expecting a file that you put on a SD card which magically unbricks the 3DS.......this is the reason the clones existed in the first place, people don't like spending money

 

[kactusss]

hello!
First of all thanks to bkifft and krisztian1997 for those great tools.

I have a problem with my bricked 3DS .

I bought a launcher.dat bricked 3DS XL and the seller gave me the NAND save. It was really cheap and I wanted to try the nand mod. This was a great deal for me


The 3DS had a blue screen with error code :

BOOTROM 8046
ERRCODE: 00F800FE
00000000 00000000
00000200 00000000

(classic launcher.dat bricked 3DS's error code i suppose)

I have done the soldering job with the SD card and set up the bkifft's Raspberry Pi unbricker. The eMMC controller was locked, so I unlocked it, everything went well.

Next step, I have checked the integrity of the NAND save with rom_tool. The save seems ok :

The NAND.bin size is 1 000 341 504 octets.

Then I have connected the modded SD card to my SD card reader, then started the 3DS, the error code was :

BOOTROM 8046
ERRCODE: 00F800FE
00000000 00000000
00000400 00000000

Windows detected it, win32diskimager detected it. Great! So I have wrote the NAND.bin save. Everything went well.
win32diskimager gave me a success message.

I have turned off my 3DS and disconnected it.
But when I started it, I still had a blue screen with the same error :

BOOTROM 8046
ERRCODE: 00F800FE
00000000 00000000
00000200 00000000

I tried to write the NAND.bin several times but I am still unable to boot the 3DS...,
Moreover I am also able to dump the actual nand...

Can somebody know what can be the problem ? I think I did everything right... Do you think the NAND dump may not be the right one ? What would happen if I write another 3DS NAND dump on my console ? (maybe the seller gave me the wrong NAND dump?)

Sorry for the english and the long post. Thanks in advance for your help/idea


TL: DR : Had a launcher.dat bricked 3DS, unlocked the eMMC, flashed the NAND.bin save and still have the blue screen

 

[gamesquest1]

Could be a short on your NAND dump wires somewhere

Also you didn't actually have to restore the NAND dump you where given, just running the unlock command will unbrick now

 

[kactusss]

Thank for your answer.

Could be a short on your NAND dump wires somewhere

I don't think so, I have checked every wire with a multimeter and I am able to read/write the nand without problems...

Also you didn't actually have to restore the NAND dump you where given, just running the unlock command will unbrick now

Are you sure about that ? I pretty sure you have to restore the old nand... All these guide said so :
http://www.moddingstudio.com/content.php?1697-Guida-al-recupero-dei-3DS-brickati-(Gateway-brick)
http://www.psxtools.de/thread.php?threadid=61918
http://www.elotrolado.net/hilo_tutorial-reparar-bricks-con-raspberry-pi-y-backup-de-la-nand_1979374

 

[gamesquest1]

Yeah the program was updated pretty soon after release so just running the unlock command is enough to make it 100% unbricked......I didn't update my video guid I just put captions over it to alert people to this fact

You don't even need a NAND dump at this point (always good to have one, but it's not nessisary)

For future reference just run 3dsunbrick, and press U
Then reboot the 3ds and it done.....so much simpler and quicker than the old method

 

[kactusss]

Really ? we are talking about bkifft's unbricker right ?
I have downloaded bkifft's unbricker 3 days ago on github and my raspberry pi was connected on ethernet... And just after having unlocked the emmc, the 3ds still won't boot :/

gamesquest1 I saw you had a 3DS with a 200 error code.. What does this error mean ? Bad wire ? Why was I able to unlock the emmc if there was a short ?

 

[gamesquest1]

tbh the error code "can" fluctuate between 200/400 and still perform as expected.......i believe a 400 shows a "better" connection than 200, but idk tbh i have also had successful dumps from 000007 code,i think the codes just represent what stage it got to before the SD reader interrupted access with the 3ds (or something along those lines) as one SD reader i have gave mainly 200 but another is virtually always 400

if you can try removing the wires completely and seeing if it will boot


oh and make sure you have no solder splashes or little bits of wire left in the console as a BSOD can also signify other generic hardware faults (possibly cased by something bridging elsewhere)

 

[pizzatime]

I'm back.
...with a 3DS XL that I'm not able to unbrick.

I use the RPI method, I've 3x RPI boards but no luck on them all...
This is the program output when I try to unlock the EMMC:

EMMC: resetting controller
CMD0: idle
CMD1(0) : init and querry OCR
CMD1(0x03FE040F) : repeat untill ready
SD_send_int: [B]error occured whilst waiting for command complete interrupt[/B]
INTERRUPT:--------------------------------------
ACMD_ERR:      0
DEND_ERR:      0
DCRC_ERR:      0
DTO_ERR:        0
CBAD_ERR:      0
CEND_ERR:      0
CCRC_ERR:      0
CTO_ERR:        1
ERR:            1
ENDBOOT:        0
BOOTACK:        0
RETUNE:        0
CARD:          0
READ_RDY:      0
WRITE_RDY:      0
BLOCK_GATE:    0
DATA_DONE:      0
CMD_DONE:      0
RESPONSE:-----------------------------------
RESP3: 0x00000000
RESP2: 0x00000000
RESP1: 0x00000000
RESP0: 0x03FE040F
SD_init: [B]no CMD1 (0) response[/B]

Seems that the RPI is not able to use the CMD line.
Only one time I'm been able to obtain "EMMC is locked", than nothing.
I'm starting to think that this 3DS have an hardware issue occurred after the gateway brick. (or caused by me, maybe, but I'm really sure that soldering and connections are correct and working).

 

[kactusss]

tbh the error code "can" fluctuate between 200/400 and still perform as expected.......i believe a 400 shows a "better" connection than 200, but idk tbh i have also had successful dumps from 000007 code,i think the codes just represent what stage it got to before the SD reader interrupted access with the 3ds (or something along those lines) as one SD reader i have gave mainly 200 but another is virtually always 400

if you can try removing the wires completely and seeing if it will boot


oh and make sure you have no solder splashes or little bits of wire left in the console as a BSOD can also signify other generic hardware faults (possibly cased by something bridging elsewhere)

Thanks for your help. I have desoldered everything. Still the same error

 

[gamesquest1]

Thanks for your help. I have desoldered everything. Still the same error

hmmm strange, did the user have emunand set up? you can extract the emunand partition and write it to the console(it will only restore to the firmware that emunand was set up to though i.e 6.x or 7.x etc), if it works it looks like they have either supplied a random firmware to you to restore(which isn't good) or the firmware was corrupted......either way i assume it would just freeze on a black screen not go to the blue screen...but im not 100% sure on that

also try look at the nanddump in a hex editor and look if it has the correct header

 

[bkifft]

Thanks for your help. I have desoldered everything. Still the same error

The bluescreen can sometimes also happen just from having wires soldered to the 3DS, and you might very well have flashed a bad NAND dump now.

As long as you didn't get any errors on the unlock ('u') the lock as well as the writeprotect have been removed for sure (you can check the rpu_log.txt on the usb fat to check again if you want to).

I'm afraid I'm out of ideas how to revive your (now unwired/unsoldered) 3DS.

I'm back.
...with a 3DS XL that I'm not able to unbrick.

I use the RPI method, I've 3x RPI boards but no luck on them all...
This is the program output when I try to unlock the EMMC:

[snip]
CMD1(0x03FE040F) : repeat untill ready
[snip]
RESP0: 0x03FE040F

Seems that the RPI is not able to use the CMD line.
Only one time I'm been able to obtain "EMMC is locked", than nothing.
I'm starting to think that this 3DS have an hardware issue occurred after the gateway brick. (or caused by me, maybe, but I'm really sure that soldering and connections are correct and working).

wowser. haven't had that return code yet, should be that hardcoded 4040 FF something. and as its a timeout error and not a crc error (for those interested: CTO_ERR instead of CCRC_ERR), the communication seems to be stable and working.... in other words a mind scratcher. first impulse would be broken eMMC chip (controller to be precise) but I'll have to think about this a bit more.

Edit: if someone wants to chime in: the retval of the first CMD1 should be the OpperationConditionRegister (in other words: the electrical specs the eMMC can work under) which is then blindly replied back to it untill it reports "k, I'm ready now".
0x03FE040F just doesn't make any sense, but is the checksum protected and verified reply the eMMc gives.

As I've put away the whole RPU stuff it'll take me some time to get back up to speed.

 

[pizzatime]

Great. I'm so lucky that I'm sure that the 0x03FE040F madness is a broken eMMC chip.
It's noticeable that sometimes is not appearing the blue screen on last power on sequence. Not even the LCD backlight, anyway.
Uhm...

 

[kactusss]

The bluescreen can sometimes also happen just from having wires soldered to the 3DS, and you might very well have flashed a bad NAND dump now.

As long as you didn't get any errors on the unlock ('u') the lock as well as the writeprotect have been removed for sure (you can check the rpu_log.txt on the usb fat to check again if you want to).

I'm afraid I'm out of ideas how to revive your (now unwired/unsoldered) 3DS.

Oh thanks for your answers. I guess I am going to change the mobo...
Thanks for your tool bkifft.

 

[gamesquest1]

Oh thanks for your answers. I guess I am going to change the mobo...
Thanks for your tool bkifft.

did they not have emunand set up....so you could atleast revive it to 7.x if it was a bad dump?

could even be the case they set up emunand and stayed on 4.x

 

[kactusss]

Nop, no emunand :/
I don't think it was a bad dump because I already had this error just before having wrote the dump (just after unlocking the emmc with bkifft's tool)

 

[gamesquest1]

try giving the board a good brush down in case there is anything stuck in there shorting something. also try just looking around the area you soldered and make sure there isn't any stray solder splashes.....and final thing you can try is querying the nand again on the raspberry pi and getting the CSD value, just to see if there is anything reported incorrectly there....if you wouldnt mind soldering it up again that is

 

[kactusss]

Just before desoldering, I checked the emmc statue with my raspberry just to be sure

I don't think anything is wrong here...

 

[gamesquest1]

Just before desoldering, I checked the emmc statue with my raspberry just to be sure

I don't think anything is wrong here...

yeah thats all correct

there must be something wrong with the board then, have you had a look if there is anything a miss near the solder points? also give it a good brush down to try get any stray strands of wire removed

 

[kactusss]

Yeah I will try that.. Maybe I fucked up a resistor next to solder points.. I can't see anything bad but those are so small...
Anyway I will try and I will keep you informed. Thanks for your help gamesquest1

 

[gamesquest1]

ok good luck