Hacking Can I remove the CFW of 3DS after did the Region Change?

[Danielneia]

Hi, Today I change the region of my European 3DS to US region using CTRTransfer, but my question is: Can I remove the CFW after did the region change? or I aways have to keep the CFW to have the region change? If I did this, I'll Brick my 3ds?

 

[Shadow#1]

Hi, Today I change the region of my European 3DS to US region using CTRTransfer, but my question is: Can I remove the CFW after did the region change? or I aways have to keep the CFW to have the region change? If I did this, I'll Brick my 3ds?

Why remove CFW?

 

[PabloMK7]

Hi, Today I change the region of my European 3DS to US region using CTRTransfer, but my question is: Can I remove the CFW after did the region change? or I aways have to keep the CFW to have the region change? If I did this, I'll Brick my 3ds?

To be honest, I have no idea if the tickets and signatures are still valid and the CFW is patching the checks. If they are valid, then there won't be any problem. If they aren't valid, you will brick.

 

[TurdPooCharger]

Hi, Today I change the region of my European 3DS to US region using CTRTransfer, but my question is: Can I remove the CFW after did the region change? or I aways have to keep the CFW to have the region change? If I did this, I'll Brick my 3ds?

To be honest, I have no idea if the tickets and signatures are still valid and the CFW is patching the checks. If they are valid, then there won't be any problem. If they aren't valid, you will brick.

For science, I backed up my SysNAND and ntrboot flashed my R4i 3DS Gold RTS flashcart on standby.

CTRTransfer my USA n3DSXL with 11.8.0-41 firmware using 11.5.0-38J_ctrtransfer_n3ds.bin. I made sure to delete my SecureInfo_C and edit my actual SecureInfo_B at offset 0x100 from 01 to 00, aka USA → JPN.

Then, I went to HOME Menu to check that my 3DS is in Japanese.

Lastly, I Uninstall CFW.

I took out my flashcart, removed the SD card, and removed + reinserted the battery for good measures.

Spoiler: The result!

My shit bricked black.

lol. Well, I do hope to recover with ntrboot. If not, get ready to press F.

Edit - Yay! Lucky me, NTRboot saved the day. My baby is up and running again. So there you have it folks: you can't region change, uninstall the CFW, and NOT* expect it to keep working. XD

 

[KleinesSinchen]

For science, I backed up my SysNAND and ntrboot flashed my R4i 3DS Gold RTS flashcart on standby.

CTRTransfer my USA n3DSXL with 11.8.0-41 firmware using 11.5.0-38J_ctrtransfer_n3ds.bin. I made sure to delete my SecureInfo_C and edit my actual SecureInfo_B at offset 0x100 from 01 to 00, aka USA → JPN.

Then, I went to HOME Menu to check that my 3DS is in Japanese.

Lastly, I Uninstall CFW.

I took out my flashcart, removed the SD card, and removed + reinserted the battery for good measures.

Spoiler: The result!

My shit bricked black.

lol. Well, I do hope to recover with ntrboot. If not, get ready to press F.

Edit - Yay! Lucky me, NTRboot saved the day. My baby is up and running again. So there you have it folks: you can't region change, uninstall the CFW, and expect it to keep working. XD

Thanks for trying that. I would not have dared to do this. Another thing learned… Hopefully your test machine was not a very valuable one – for the case NTRboot would not have done the trick. It is not really good to lose a working device just out of curiosity.

 

[BORTZ]

Good to know. I have region changed my pearl white japanese console to a US region. Not that I ever have any intention of removing CFW, what kinda mad-man would do that?

 

[TurdPooCharger]

Thanks for trying that. I would not have dared to do this. Another thing learned… Hopefully your test machine was not a very valuable one – for the case NTRboot would not have done the trick. It is not really good to lose a working device just out of curiosity.

We've been through so much. I think I spent more time on it in GodMode9 and doing stupid stuff than playing video games. Oh well... To learn what happens, see the edited spoilers.'

Edit - If it were any different, I was ready to do a hardmod.

 

[Danielneia]

Yay! Lucky me, NTRboot saved the day. My baby is up and running again. So there you have it folks: you can't region change, uninstall the CFW, and NOT* expect it to keep working. XD

Yeah! Thanks to try that, man! I was wondering if it was possible, you are my hero now hahaha

 

[Ryccardo]

All depends: where did you get your SecureInfo_A of different region?

If you made it, it's unsigned... if it came from a console of the desired region, it's signed

(And of course you would need signed system titles, but I hope you got them from 3DNUS anyway)

 

[TurdPooCharger]

All depends: where did you get your SecureInfo_A of different region?

If you made it, it's unsigned... if it came from a console of the desired region, it's signed

(And of course you would need signed system titles, but I hope you got them from 3DNUS anyway)

My n3DSXL has SecureInfo_B. I did CTRTransfer using the JPN n3DS image found on 3ds.hacks.guide here. The system produced a SecureInfo_C, which I deleted. I checked to make sure the *_B was from my own 3DS (serial number: XX########) and hex edited that 0x100 as per these guides' instructions and previous attempt at making a theoretical n3DS TWN or CHN CTRTranger image:

• https://github.com/Plailect/Guide_RedNAND/wiki/Region-Changing
• https://3dbrew.org/wiki/Nandrw/sys/SecureInfo_A
• [PoC] 3DS Region Changing + proof
• Region change to Chinese [post #6] ← My experiment with JPN (success!) and TWN/CHN (failed!)

***

For shits and giggles, I'll repeat this region change + uninstall CFW experiment again using sysUpdater and the JPN n3DS Firmware package found at that darth site:

• 11.8.0-41J, MD5 hash: 19bdfea3125906e7cd8174c43de55f93

I'm fairly certain those *.cia files are signed and complete as a collection set. My prior experience downloading from 3DNUS apps has always led to missing some system titles.

Round 2!

 

[Ryccardo]

For shits and giggles, I'll repeat this region change + uninstall CFW experiment again using sysUpdater and the JPN n3DS Firmware package found at that darth site:

You will need a SecureInfo_...B from a real Japanese console, of course
(Actually, try both A and B... I don't think the logic for having one or the other is documented)

previous attempt at making a theoretical n3DS TWN or CHN CTRTranger image:

Oh, and as you already were partially explained in that topic, it's because there are no Chinese or Taiwanese N3DSes (not that smart people bought the O3DSes when importing Japanese ones resulted in generally better product*) - the NS driver has hardcoded region-to-titleID mappings for Home and friends, and I have absolutely no idea of what it ends up doing on "nonexisting" regions (and of course, whatever you may manage to force it to run may not support C/T anyway; maybe you can jerry rig something with TestMenu and DevMenu... on CFW only of course!)

* worse, in Taiwan they actually realized this and started officially selling J and T consoles/games on the same shelves!

 

[TurdPooCharger]

Okay, so here are my results.

Edit - I made the mistake earlier of calling 3DNUS as "CDNUS", due to not remembering acronyms. Post corrections have been made.

I did a crosscheck with [3dbrew.org] Title list and found out the JPN n3DS 11.8 package from that darth site was missing several titles. Some of the titles aren't required or not part of the new 3DS series. Many still are cross shared between regions. For thoroughness, I ended up mixing and matching titles between two (2) packages from the 11.8 JPN n3DS set (from that darth site) and 11.7 JPN o3DS set (previously obtained through 3DNUS). Aka, fraken firmware.

The reason why I had to resort to the 11.7 JPN o3DS 3DNUS package and not the 11.8 JPN n3DS set was due to many missing system titles. I had to make the assumption that system titles with the exact Title IDs do not have regional and old/new differences, except for slight version updates.

These were the 11.7 ones from 3DNUS that got mixed in to complete the set.

00040010 - System Applications

• 0004001000020800 - StreetPass Mii Plaza
• 0004001000020B00 - Nintendo Zone
• 0004001000020E00 - AR Games
• 0004001000020F00 - SAFE_MODE System Updater (mset)
• 0004001000023000 - Promotional video

0004001B - System Data Archives

• 0004001B00010002 - CICertA

0004009B - Shared Data Archives

• 0004009B00010202 - Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
• 0004009B00011902 - "JA_small/32" dictionary.
• 0004009B00013202 - Mounted as "eula:"
• 0004009B00014002 - JPN/EUR/USA System Font ("font:")
• 0004009B00014102 - CHN System Font ("font:")
• 0004009B00014202 - KOR System Font ("font:")
• 0004009B00014302 - TWN System Font ("font:")
• 0004009B00015202 - Mounted as "rate:"

00040130 - System Modules

• 0004013000002002 - MIC (Microphone)
• 0004013000002102 - PDN
• 0004013000002A02 - MP

0004800F - System Data Archives

• 0004800F484E4C41 - Version Data

Those highlighted green are from the 3DNUS set.

Spoiler: Total Set of JPN system titles

000400DB

• 000400DB00010302
• 000400DB00010502
• 000400DB00017202
• 000400DB20016202

0004001B

• 0004001B00010002
• 0004001B00010702
• 0004001B00010802
• 0004001B00018002
• 0004001B00018102
• 0004001B00018202

0004009B

• 0004009B00010202
• 0004009B00010402
• 0004009B00010602
• 0004009B00011902
• 0004009B00012202
• 0004009B00013202
• 0004009B00014002
• 0004009B00014102
• 0004009B00014202
• 0004009B00014302
• 0004009B00015202

0004800F

• 0004800F484E4C41
• 0004800F484E4841

00040010

• 000400100002BF00
• 000400102002C800
• 000400102002C900
• 000400102002CA00
• 000400102002CB00
• 0004001000020A00
• 0004001000020B00
• 0004001000020E00
• 0004001000020F00
• 0004001020020D00
• 0004001000020000
• 0004001000020100
• 0004001000020200
• 0004001000020400
• 0004001000020500
• 0004001000020700
• 0004001000020800
• 0004001000020900
• 0004001000023000
• 0004001020020300
• 0004001020023100

00040030

• 000400300000BC02
• 000400300000C002
• 000400300000C102
• 000400300000C302
• 000400300000C402
• 000400300000C502
• 000400300000C602
• 000400300000CD02
• 000400300000F602
• 000400302000C003
• 000400302000C503
• 0004003000008A02
• 0004003000008D02
• 0004003000008E02
• 0004003020008A03
• 0004003000008202
• 0004003000008302
• 0004003000008402
• 0004003000008602
• 0004003000008702
• 0004003000009502
• 0004003020008802

00040130

• 0004013000001A02
• 0004013000001B02
• 0004013000001D02
• 0004013000002A02
• 0004013000002B02
• 0004013000002C02
• 0004013000002D02
• 0004013000002E02
• 0004013000002F02
• 0004013020001A03
• 0004013020001B03
• 0004013020001C02
• 0004013020001C03
• 0004013020001D03
• 0004013020001E02
• 0004013020001E03
• 0004013020001F02
• 0004013020001F03
• 0004013020002C03
• 0004013020002D03
• 0004013020002E03
• 0004013020002F03
• 0004013000001502
• 0004013000001702
• 0004013000001802
• 0004013000002002
• 0004013000002102
• 0004013000002402
• 0004013000002602
• 0004013000002702
• 0004013000002802
• 0004013000002902
• 0004013000003102
• 0004013000003202
• 0004013000003302
• 0004013000003402
• 0004013000003502
• 0004013000003702
• 0004013000003802
• 0004013000008002
• 0004013020001503
• 0004013020001602
• 0004013020001703
• 0004013020001803
• 0004013020002103
• 0004013020002202
• 0004013020002203
• 0004013020002302
• 0004013020002303
• 0004013020002403
• 0004013020002703
• 0004013020002903
• 0004013020003103
• 0004013020003203
• 0004013020003303
• 0004013020004002
• 0004013020004102
• 0004013020004202
• 0004013020008003

00040138

• 0004013820000002
• 0004013820000003
• 0004013820000102
• 0004013820000202

00048005

• 00048005484E4441
• 0004800542383841

Attempt 2

1. I ran sysUpdater to mass install the CIAs.
2. I kept my original SecureInfo_B and made the edit at 0x100 from 01 → 00.
3. All USA region only system titles had their titles and tickets deleted in FBI.
4. I do a System Memory Format and make a new dummy user profile.
5. Finally, the CFW is uninstalled. Battery, flashcart, and SD card are removed. Battery reinserted.

Result: FAILED


Attempt 3

1. CFW is restored with NTRboot. my edited SecureInfo_B is kept in place.
   
2. Updating the 3DS firmware is attempted in Recovery Mode: my Internet connection hangs.
   
3. I swap in the SecureInfo_A from the 11.5.0 CTRTransfer n3DS JPN image at 3ds.hacks.guide.
4. My SecureInfo_B is deleted. Only the SecureInfo_A is kept in place at 1:/rw/sys directory.
   
5. Another System Memory Format is performed, and a new dummy profile is made again.
6. CFW is uninstalled again. Blah, blah with the battery, flashcart, and SD card.

Result: FAILED


Attempt 4

1. Another round of CFW restore with NTRboot.
2. I tried updating the firmware to 11.9 again with Recovery Mode. Internet still hangs. Firmware still at fraken 11.8J.
3. The SecureInfo_A is renamed to SecureInfo_B.
4. On the [1:] SYSNAND CTRNAND, I do a Fix CMACs for drive.
5. Format System Memory and dummy profile yet again.
6. Uninstall CFW. Battery, flashcart, and SD card procedure.

Result: FAILED


At this point, I was having some doubts if region changing could work in conjunction with custom firmware removal. Hell, I was starting to question if there was a problem with removing the CFW part.


Attempt 5

1. NTRboot → Restore CFW.
2. (Safe) restored the SysNAND with my actual 11.8 USA n3DSXL image. No more JPN shenanigans.
   
3. Uninstall the CFW.

Result: FAILED, what the ever living fuu....


So apparently, all the tinkering done on my SysNAND has caused some sort of unsigned tickets or modifications that would not work when the custom firmware is removed. The prime suspects that caused my n3DSXL to softbrick with black screens when CFW is removed are:

• Mismatches in FIRM 0 or 1 from multiple boot9strap and fastboot3ds installations??
• Lingering Arcade Badges acquired through the GYTB app.
• Reinstalled system titles with unsigned tickets from previous NAND experiments.

To test if the uninstall CFW gm9 megascript works or not...


Attempt 6

1. Restore CFW.
2. Still on my actual USA 11.8 profile → Format System Memory & make a dummy profile.
3. Update to 11.9U firmware through Recovery Mode.
4. Remove CFW.

Result: FAILED, n3DSXL still bricked. Oh crap... >_<


Here is when I feared my n3DSXL will forever require custom firmware to sustain itself in working condition... Not that this is necessarily a bad thing. I then remember still having something very important when I first hacked my 3DS system a long time ago.


Attempt 7

1. Restore CFW.
2. SysNAND restore with my first ever backed up SysNAND image. The n3DSXL is downgraded to a pristine 11.5 firmware.
3. Uninstall CFW.

Result: SUCCESS,* in removing CFW. n3DSXL boots to HOME Menu.


OKAY. We can work with that. Let's see what else we can uncover.


Attempt 8

1. Restore CFW.
2. Install JPN *.cia files firmware package with sysUpdater.
3. Hex edit my SecureInfo_B. System boots to JPN firmware.
   
4. Uninstall all the USA region only system titles in FBI.
5. Make a SysNAND backup for this current setup; it's very tedious to manually check and carefully delete USA titles.
6. Format System Memory & dummy profile.
7. Boot to Recovery Mode. Put my n3DSXL next to my home router. Updating to 11.9J goes through this time!
8. Boot to HOME Menu and check in System Settings if it is indeed 11.9J.
9. Uninstall CFW.

Result: FAILED, ARgrahgagh!!!!!


So much trouble in uninstalling my CFW, softbricking the 3DS, and then NTRboot restoring back the CFW. Some of those attempts gave some scares when the SafeB9SInstaller wouldn't appear. I eventually found the exact sweet spot the magnet triggers sleep mode and the number of seconds of holding those button combos, that softbricking and NTRboot haxing became a chore. Still... I press forward.


Attempt 9

1. Restore the CFW.
2. SysNAND restore using the image made in attempt #8.
3. Inject the SecureInfo_A from 11.5.0 n3DS JPN CTRTransfer image. Delete my SecureInfo_B.
4. Format System Memory & dummy profile.
5. Update to 11.9J firmware in Recovery Mode.
6. Check HOME Menu and System Settings for the 11.9.0-42J firmware tag.
7. Uninstall CFW.

Result: SUCCESS, WHAT THE EVER LIVING SHIT!!!


***

In conclusion,

1 - @Ryccardo's theory assessment about needing to use a real native region SecureInfo_A or SecureInfo_B is correct. You can't edit and use your own original region SecureInfo_A/B.​

2 - Whether renaming the SecureInfo_A to SecureInfo_B works or not, I don't care to find out.

• Attempt 10: Before restoring my original SysNAND setup, renaming *_A → *_B and removing CFW does work.
• Attempt 11: What happens if you have both SecureInfo_A and SecureInfo_B? Using my real SecureInfo_B and the JPN SecureInfo_A, swapping the A/B letters, the 3DS will default to loading *_B first if it's there. If *_B is present and has bad signature, the 3DS (without CFW) will boot with black screens.

3 - Using those legit system title *.cia files from that darth site and 3DNUS isn't enough because of fraken firmware. Corrections in properly signed tickets and total clean setup has to be made by updating the 3DS firmware through the Nintendo CDN.​

4 - Are Format System Memory and making dummy profiles really necessary? ¯\_(ツ)_/¯​

5 - So yes, it is possible to region change the 3DS firmware and uninstall the custom firmware.

6 - The question you should ask is, should you do this?

Answer: NO. Don't attempt this if you don't want to risk soft-bricking the 3DS system because it's being a stickler with legit tickets and whatnot.

Solution: If you want stock-like OFW experience, use Rei-Six instead of Luma3DS. Read this post.​

 

[ryujin889]

What IF I restore a nand Backup I made before Region changing after, would that be vaild to uninstall cfw

 

[mrgone]

kudos for actually checking and having a the restore plan beforehand
i never changed the region just installed the one japanese cart (and my other carts)

 

[cearp]

Sorry I didn't notice this earlier, all the testing you guys did etc...
Like you found, it works fine if the secureinfo file hasn't been edited - that's how I did the first PoC region change years ago, didn't have coldboot cfw then
(Region changed to all 5 other regions at the time, worked fine)

 

[ryujin889]

So if I backup my secure info_A (in my case) then restore it after I flash the ctrtransfer image to my 3ds I should be able to Uninstall cfw?

 

[lone_wolf323]

So if I backup my secure info_A (in my case) then restore it after I flash the ctrtransfer image to my 3ds I should be able to Uninstall cfw?

There is the safety test of running the native firm from the uninstall 3s guide. If that test fails to boot to homemenu in any way it means you will not be uninstalling cfw unless you want a 3ds that wont work until ntrboot is used woth a flashcart to install cfw again.

 

[ryujin889]

Thank you for helping, I will try this later and see what happens.

 

[ryujin889]

It did not work It bricked NTR Boot saved the day though.