Hacking Am I screwed?

[kirbymaster101]

Well, is there any chance to recover my saves if i still have the 3ds folder D:

 

[Lucifer666]

Are your emuNANDS linked? if so you're in luck

OR if you have an emuNAND backup then don't worry because you won't lose anything when you restore your emuNAND

 

[anon1234]

so, just to be clear - did it ask you once or twice? You know, the update prompt? Was there any confirmation needed or did it update right away?

 

[kirbymaster101]

So, I have a OG3ds lying around and discovered rxtools, can I use it for anything ?

 

[Oishikatta]

So, I have a OG3ds lying around and discovered rxtools, can I use it for anything ?

Not much just eshop without updating sysnand mainly. What you need is xorpads for your n3ds.

Also what is your sig pic from?

 

[kirbymaster101]

Not much just eshop without updating sysnand mainly. What you need is xorpads for your n3ds.

Also what is your sig pic from?

myanimelist? Couldn't figure out how to make the signature dynamically change to my current anime list , that ones like a year old.
Edit: (Well, guess MAL got it working now)

 

[Apache Thunder]

rxTools wont' help you here as it won't decrypt a emunand from a different console. However you can use Decrypt9 to decrypt your currently broken emunand and extract the data, dbs, and private folders. These will be the folders you will import into your new 9.5 emunand once you make it. (rxTools does not have n3DS support, so unfortunately you'll be stuck using xorpads until Karl3DS comes out. I would assume they would have some kind of decryption menu where they can directly decrypt the nand to a file like rxTools does, but I could be wrong on that. They might only do xorpads. But we'll see once they release I guess)

Hopefully you didn't actually format emunand yet. Even though it no longer boots, you can still use Decrypt9 on it and extract some of the files you need to restore 9.5. But it won't be an easy process.

If you linked the console to an NNID, you are SOL until you can restore the files from your currently broken emunand. Because you won't be able to relink your NNID to a new emunand unless you unlink it first. If you don't have a backup that was linked to NNID where you can format it to unlink, you'll probably have to call Nintendo to manually transfer your NNID to a different console. That process will take 1-2 days FYI.

You'll have to tell them the console stopped working and they'll ask you some security questions like what your recent purchases are. Of coarse don't mention the Gateway/emunand or how it actually stopped working. But that should be common sense.

I would recommend only doing that as a last resort.

Find Fat16Tool (requires Python. Make sure you have 64 bit version of Python installed or this script won't extract your fat16 file from the main nand.bin file correctly). Then use padxorer to decrypt it using the xorpad. Edit it with something like WinImage (or mount it directly if you are on a Mac by changing file extension to .img) then find the files I mentioned above to backup. Then create a new emunand. Manually update it to 9.5 using 3DNUS (make sure you have the n3DS option checked or it won't download all the CIAs you need as n3DS has some n3DS specific titles that need to be installed as well). 3DNUS will build the CIAs that you can update emunand with using DevMenu/BigBlueMenu (don't use BigRedMenu however, it doesn't currently install system titles correctly last I checked). There's also a new CIA installer called FBI that can apparently install system update CIAs as well.

It also calls the AM:InstallFirm service to properly update NATIVE_FIRM partitions had you wanted to use CIAs to update sysnand. However last I checked the authors did not code it to work for Gateway users (due to them using a newer command) so you will still get a brick if you wanted to use that to update sysnand. I don't understand why they didn't account for Gateway users as that will be the vast majority of who will be using it. But I guess they were aiming it towards upcoming Karl3DS users. Kinda dissappointed with that.

But for emunand you won't have to worry about that as Gateway patches out checks that a bad NATIVE_FIRM would usually cause a brick on anyway. Just note you'll never be able to use an emunand updated via CIAs or game roms on sysnand until the NATIVE_FIRM partition is fixed. So once you manually update to 9.5 using CIAs, you can't use it on sysnand. (but why would you? 9.5 isn't exploitable anyway. )


There's also the method of patching NIM and pointing it to a custom server so you can update via system settings. But that's probably too complicated for most users. I don't really see that as a viable update path for inexperienced users. That and I don't think there's any public patch out for that right now. Just something that Karl3DS might implement in an upcoming CFW.

Once you have the files imported into your new working 9.5 emunand fat16 file. You then need to reencrypt it. Basically "reverse" the padxorer commands so that the xorpad file is the first file you list in the command followed by the fat16 partition image. That will encrypt it to a new ".out" file. This is the file you will reinject into the NAND.BIN file. Then flash that to emunand using emunand tool. Assuming you do everything right that should get 9.5 back to where it was before you bricked it and your existing SD content will work again including your game saves and what not.

But all of this is dependent on you not erasing your emunand that had been bricked. Becuase while it doesn't boot, it still had data you can recover for when you go to rebuild a new emunand. Just search around GBATemp to fill in any blanks if you need further details on how to decrypt/encrypt emunand partition and what files you need to copy to your new emunand.

Basically the entire contends of the "data" folder, the ticket.db file in the dbs folder and the movable.sed file in the private folder. note that you can't use the private.sed file from your old 3DS as there is a KeyY string stored in the file that needs to be rehashed correctly for the new console. This is something system transfer normally does and currently there is no way of injecting movable.sed files from other consoles.

v2.3 release of rxTools supposedly added support for this, but injection features were borked currently because the dev forgot to disable debug code. lolz.

 

[kirbymaster101]

rxTools wont' help you here as it won't decrypt a emunand from a different console. However you can use Decrypt9 to decrypt your currently broken emunand and extract the data, dbs, and private folders. These will be the folders you will import into your new 9.5 emunand once you make it. (rxTools does not have n3DS support, so unfortunately you'll be stuck using xorpads until Karl3DS comes out. I would assume they would have some kind of decryption menu where they can directly decrypt the nand to a file like rxTools does, but I could be wrong on that. They might only do xorpads. But we'll see once they release I guess)

Hopefully you didn't actually format emunand yet. Even though it no longer boots, you can still use Decrypt9 on it and extract some of the files you need to restore 9.5. But it won't be an easy process.

If you linked the console to an NNID, you are SOL until you can restore the files from your currently broken emunand. Because you won't be able to relink your NNID to a new emunand unless you unlink it first. If you don't have a backup that was linked to NNID where you can format it to unlink, you'll probably have to call Nintendo to manually transfer your NNID to a different console. That process will take 1-2 days FYI.

You'll have to tell them the console stopped working and they'll ask you some security questions like what your recent purchases are. Of coarse don't mention the Gateway/emunand or how it actually stopped working. But that should be common sense.

I would recommend only doing that as a last resort.

Find Fat16Tool (requires Python. Make sure you have 64 bit version of Python installed or this script won't extract your fat16 file from the main nand.bin file correctly). Then use padxorer to decrypt it using the xorpad. Edit it with something like WinImage (or mount it directly if you are on a Mac by changing file extension to .img) then find the files I mentioned above to backup. Then create a new emunand. Manually update it to 9.5 using 3DNUS (make sure you have the n3DS option checked or it won't download all the CIAs you need as n3DS has some n3DS specific titles that need to be installed as well). 3DNUS will build the CIAs that you can update emunand with using DevMenu/BigBlueMenu (don't use BigRedMenu however, it doesn't currently install system titles correctly last I checked). There's also a new CIA installer called FBI that can apparently install system update CIAs as well.

It also calls the AM:InstallFirm service to properly update NATIVE_FIRM partitions had you wanted to use CIAs to update sysnand. However last I checked the authors did not code it to work for Gateway users (due to them using a newer command) so you will still get a brick if you wanted to use that to update sysnand. I don't understand why they didn't account for Gateway users as that will be the vast majority of who will be using it. But I guess they were aiming it towards upcoming Karl3DS users. Kinda dissappointed with that.

But for emunand you won't have to worry about that as Gateway patches out checks that a bad NATIVE_FIRM would usually cause a brick on anyway. Just note you'll never be able to use an emunand updated via CIAs or game roms on sysnand until the NATIVE_FIRM partition is fixed. So once you manually update to 9.5 using CIAs, you can't use it on sysnand. (but why would you? 9.5 isn't exploitable anyway. )


There's also the method of patching NIM and pointing it to a custom server so you can update via system settings. But that's probably too complicated for most users. I don't really see that as a viable update path for inexperienced users. That and I don't think there's any public patch out for that right now. Just something that Karl3DS might implement in an upcoming CFW.

Once you have the files imported into your new working 9.5 emunand fat16 file. You then need to reencrypt it. Basically "reverse" the padxorer commands so that the xorpad file is the first file you list in the command followed by the fat16 partition image. That will encrypt it to a new ".out" file. This is the file you will reinject into the NAND.BIN file. Then flash that to emunand using emunand tool. Assuming you do everything right that should get 9.5 back to where it was before you bricked it and your existing SD content will work again including your game saves and what not.

But all of this is dependent on you not erasing your emunand that had been bricked. Becuase while it doesn't boot, it still had data you can recover for when you go to rebuild a new emunand. Just search around GBATemp to fill in any blanks if you need further details on how to decrypt/encrypt emunand partition and what files you need to copy to your new emunand.

Basically the entire contends of the "data" folder, the ticket.db file in the dbs folder and the movable.sed file in the private folder. note that you can't use the private.sed file from your old 3DS as there is a KeyY string stored in the file that needs to be rehashed correctly for the new console. This is something system transfer normally does and currently there is no way of injecting movable.sed files from other consoles.

v2.3 release of rxTools supposedly added support for this, but injection features were borked currently because the dev forgot to disable debug code. lolz.

What about if I formatted emunand but backuped the emunand partition and 3ds folders before hand ?

 

[Apache Thunder]

yeah that would work. Just generate xorpads and you can decrypt the backup you made before formatting emunand. Then you can extract and inject the files I mentioned into your new emunand. Though I'd recommend updating the new emunand to 9.5 before injecting files to ensure the ticket.db file is compatible. I have not tried to use ticket.db file from a newer FW version in an older one yet. Since the emunand you updated to partially got bricked, the ticket.db is probably still on 9.5 or on 9.6. One revision up probably isn't a big enough difference to cause issues. Using a 9.5/9.6 ticket.db on 9.2 however might cause issues. But I don't know as I have not tried this.

 

[kirbymaster101]

yeah that would work. Just generate xorpads and you can decrypt the backup you made before formatting emunand. Then you can extract and inject the files I mentioned into your new emunand. Though I'd recommend updating the new emunand to 9.5 before injecting files to ensure the ticket.db file is compatible. I have not tried to use ticket.db file from a newer FW version in an older one yet. Since the emunand you updated to partially got bricked, the ticket.db is probably still on 9.5 or on 9.6. One revision up probably isn't a big enough difference to cause issues. Using a 9.5/9.6 ticket.db on 9.2 however might cause issues. But I don't know as I have not tried this.

is there a tutorial for xorpads? Im so confused but willing to do this to recover saves. Tried manually moving a 000000001.sav and obviosuly that didnt work
can i skip the NNID step if i dont care about it?

Edit: nvm found a tutorial, just making sure but all of this xorpad generating is on my og3ds doesnt work on n3ds right?
OK i just reread my first post and never realized that I said it was on a N3ds xl, now Im pretty much SOL right?

 

[Apache Thunder]

If you restore the files that I mentioned, NNID will be fixed as well. The files you need to restore are not visible on your SD card. They are in the emunand/nand.bin file you extracted from emunand partition and they'll have to be extracted and injected into your new emunand partition.

Unfortunately it won't be a simple process. I don't have time right now to fully explain it. But I'll list off the things you will need:

1. A backup of your broken emunand as well as a dump of your new working 9.5 emunand.
2. Decrypt9 (specifically the n3DS build of it) for generating the xorpad for nand. You don't need a new xorpad for each backup. one xorpad will work for encrypting/decrypting future emunand/nand dumps from your console. Each xorpad is unique to that console. So like with normal nand images. You can't use a xorpad from a different console on your n3DS.
3. Fat16tool.py python script for extracting fat16 file from nand.bin.
4. Must have Python 2.7 64bit version installed to use above mentioned python script.
5. Padxorer for decrypting the fat16.bin files.
6. A program to modify the decrypted fat16 file. I personally use WinImage. Though that program isn't free however. Unfortunately I'm not familier with the "free" alternatives that may be out there for Windows users. Mac users can just change the file extension and mount it as a drive image.
7. Emunand tool to extract/inject emunand to SD card. Sounds like you already have this one.

That's all I recall being needed.

Once you have your fat16 image decrypted and mounted, the layout will look something like this. Remember it's the data, dbs, and private folders that contain the files you need to transfer over.

While data, and private folder should have their entire contents transferred over, I think only the ticket.db file in the dbs folder needs to be transferred over. (though someone can correct me if I'm wrong on that or not)

The folder inside the data folder will have a long string of letters/numbers. This is random/unique to the movable.sed your console is currently using and won't match what is shown in the image above. Just copy the entire folder found inside the data folder to the new emunand at the same location. If your new emunand already has a sub-folder inside the data folder (It most likely will if you allow it to go through the initial setup process which is what you need to do before you can start using DevMenu to update it to 9.5 with) then just delete the old folder before/after you copy the new one from your bricked emunand image. I suppose you can just leave the old one there if you want. The system will most likely delete it on it's own since it's not valid for the current movable.sed anyways.

Assuming you do the above, you do NOT need to touch your saves/SD card content. (the part of the SD card you can normally see in Windows Explorer). Just leave them be as they was when emunand first bricked. Once you get the new emunand rebuilt with the needed files restored, the existing SD card content like installed games and game saves will work and your NNID should still work as well assuming you didn't manually unlink it by calling Nintendo.

 

[kirbymaster101]

As far as I know Decrpypt9 only works on og3ds. Can i use that xorpad for my n3ds or do I just have to wait it out?