Rough guide;
Get your hands on the .nds for sudokuhax, fieldrunners, guitar hero or one of the other dsiware games with exploits. The .cia won't do; however, if you install the .cia then you can navigate to its install directory and get the .app there, which is the same thing.
Get the appropriate. sav exploit.
Go to TWLN:/title/00030005/42383841/content and overwrite the .app file there with your dsiware rom. It needs to have the exact same name, 00000002.app.
Write the save exploit to TWLN:/title/00030005/42383841/data as public.sav
The DS connections option in system settings should now be replaced with the game, and be able to boot the exploit.
Btw a N3DS updated without properly uninstalling a9lh will be a brick. So don't count on this method protecting you from that.