Hacking Can you install a legit cia and keep the game? + Question about 3ds modding

[Davine_Lu_Linvega]

(For context i have 3 3dses: 1 O3ds hacked; 2 N3ds unhacked, one double ips, one ips-tn. my main system is the double ips)

The spotpass preservation project made me realize that you don't need a hacked 3ds to boot up firms and this got me tinkering with NTRBoot and gm9 to boot up firms on my unhacked N3ds ips-tn, i tried to install a global legit cia game with gm9 and to my surprise it works, it just can't be re-downloaded, i guess because this system doesn't have a nintendo account linked to it. If i were to do this to my main system, and then open the eshop, would the game then be linked to my account?

Just a thought but it's weird that there little to none information about "softmodding" the 3ds, even now with nimdsphax, i know NTRBoot is not something everybody has access to but nimdsphax and super-skaterhax makes it some what accessible to everybody to boot firms like luma and open-agb, only caveat being that you have to run the exploit every time, the dsi guide makes the installation of unlauch optional, i just found it weird that the 3ds guide never mentions boot9strap being optional (yes i know it's for convenience and since i've done 90% of the work just install b9s but it's fun to keep the system stock and still run homebrew)

 

[lone_wolf323]

(For context i have 3 3dses: 1 O3ds hacked; 2 N3ds unhacked, one double ips, one ips-tn. my main system is the double ips)

The spotpass preservation project made me realize that you don't need a hacked 3ds to boot up firms and this got me tinkering with NTRBoot and gm9 to boot up firms on my unhacked N3ds ips-tn, i tried to install a global legit cia game with gm9 and to my surprise it works, it just can't be re-downloaded, i guess because this system doesn't have a nintendo account linked to it. If i were to do this to my main system, and then open the eshop, would the game then be linked to my account?

Just a thought but it's weird that there little to none information about "softmodding" the 3ds, even now with nimdsphax, i know NTRBoot is not something everybody has access to but nimdsphax and super-skaterhax makes it some what accessible to everybody to boot firms like luma and open-agb, only caveat being that you have to run the exploit every time, the dsi guide makes the installation of unlauch optional, i just found it weird that the 3ds guide never mentions boot9strap being optional (yes i know it's for convenience and since i've done 90% of the work just install b9s but it's fun to keep the system stock and still run homebrew)

no. your games require legit signed tickets which only nintendo has. You cannot gain games in which you havent paid for that way.

 

[KleinesSinchen]

boot9strap being optional

It should not be optional in my opinion. Depending on what people do the console will stop booting. B9S survives practically any nonsense but deliberate uninstallation → Always access to GodMode9.

and then open the eshop, would the game then be linked to my account?

That will not happen. If you don't have purchased things the server will not deliver a personalized ticket for download. As far as I know it replaced the universal legit signature on the very first possibility when having a console which came with a preinstalled title, but the server knows which consoles legitimately have a title.
Best you can achieve is running titles with universal signature without having to load Luma3DS.

 

[RAHelllord]

I've actually been through something similar where I tried to to buy a title properly after enjoying a free play test sponsored by the high seas.
The e-shop simply throws an error because the fake ticket exists on the system which leads to some expectedly unexpected behavior.

If the fake ticket exists and the game is installed it correctly says it's already downloaded.
If the fake ticket exists but the game is not installed the e-shop the claims it can be downloaded again, but refuses to do so and just throws a generic error.
When you remove the fake ticket via FBI and uninstall the game via software manager you can then normally buy and download the game from the e-shop, or at least you were able to while the store still existed.

 

[The Real Jdbye]

(For context i have 3 3dses: 1 O3ds hacked; 2 N3ds unhacked, one double ips, one ips-tn. my main system is the double ips)

The spotpass preservation project made me realize that you don't need a hacked 3ds to boot up firms and this got me tinkering with NTRBoot and gm9 to boot up firms on my unhacked N3ds ips-tn, i tried to install a global legit cia game with gm9 and to my surprise it works, it just can't be re-downloaded, i guess because this system doesn't have a nintendo account linked to it. If i were to do this to my main system, and then open the eshop, would the game then be linked to my account?

Just a thought but it's weird that there little to none information about "softmodding" the 3ds, even now with nimdsphax, i know NTRBoot is not something everybody has access to but nimdsphax and super-skaterhax makes it some what accessible to everybody to boot firms like luma and open-agb, only caveat being that you have to run the exploit every time, the dsi guide makes the installation of unlauch optional, i just found it weird that the 3ds guide never mentions boot9strap being optional (yes i know it's for convenience and since i've done 90% of the work just install b9s but it's fun to keep the system stock and still run homebrew)

Legit CIAs can be redownloaded. In fact, before Nintendo patched the exploit that allowed us to generate valid tickets from title keys, any CIA or ticket installed using a tool like freeShop, FunkyCIA or TIKDevil could also be downloaded/redownloaded from the eShop app.
What you can't do however is transfer legit CIAs with system transfer. eShop sees the valid tickets on your console and allows you to redownload them (since all that is needed to download a title is a valid ticket), but system transfer doesn't actually transfer tickets, it just redownloads them again from the eShop servers and the legit CIA's ticket is never linked to your eShop account/NNID unless you actually got it preinstalled so it won't be redownloaded.
There isn't really much point to doing this, since by the point you are installing CIAs you may as well just install CFW.

 

[Davine_Lu_Linvega]

It should not be optional in my opinion

In hindsight yea, maybe "softmodding" could be a section hidden in the hamburger menu of the guide (like uninstalling CFW), with a BIG warning that you should only do this if you have access to NTRBoot.

B9S survives practically any nonsense but deliberate uninstallation

Is the script the only way to remove it? does a NAND backup made before installing b9s also remove it?

the server knows which consoles legitimately have a title.

Figured that nintendo would have a final check for cases like this, just didn't expect it due to how the eshop worked back then (when freeshop was a thing), so the ticket works on every console but the server only allows that console (3ds with factory pre-installed title) to redownload it

 

[KleinesSinchen]

Is the script the only way to remove it? does a NAND backup made before installing b9s also remove it?

Safe NAND restore leaves the FIRM partitions as they are and won't remove B9S. Full or forced NAND restore of an image without B9S will remove it.
Official updater tries to "repair" the FIRM partitions to stock (which Luma3DS prevents). Running an update having native FIRM only will remove B9S.

 

[Davine_Lu_Linvega]

Best you can achieve is running titles with universal signature without having to load Luma3DS.

I've made a discovery, it's a bit of a long process but you can re-download games from the eshop after installing them as .cias, just not from the re-download list, all without having CFW installed.

• 1) Boot into gm9, either via NTRBoot or nimdsphax, and install your legit cia (remember that region lock is a thing and since we are not using luma games out of your region won't work)
• 2) Boot into native FIRM and open the game
• 3) Exit the game and open the eshop, search for your game page, scroll down and tap repair software, it won't find any problems but still offer to repair it anyway, tap yes and wait for the download to be done
• 4) That's it, you can now uninstall the game and you can reinstall it from the eshop, you can only reinstall it from the game page and not the re-download page

As long as you don't remove the ticket from the system (with like FBI) you can always re-download the game, here's a list of global legit games, the second comment in the thread is what made me try this (archive because op deleted the list)
I've tried to use a burner NNID to see if the games would get linked to it but no luck, it's just the ticket in the console, so no the games can't be transferred, but still a cool thing none the less!

 

[Osakasan]

Ok, i have to ask.

Doesn't this community have rules agaisnt piracy?

Isn't what OP is asking basically piracy?

And save me the euphemisms, there is no scenario where you use a legit CIA that isn't linked to piracy.

 

[KleinesSinchen]

Ok, i have to ask.

Doesn't this community have rules agaisnt piracy?

Isn't what OP is asking basically piracy?

And save me the euphemisms, there is no scenario where you use a legit CIA that isn't linked to piracy.

No linking to copyrighted material is the rule.
Disucssion is allowed. And @Davine_Lu_Linvega's findings are interesting. I wouldn't have guessed the server could be tricked into letting you download things. Well. Technically you are presenting a valid download ticket with the method. I would avoid trying this though.

Many members openly confess to pirate as much as they can. Not that I would like that part of this otherwise awesome community. If the rules were that scrict here no discussion about CFW would be possible at all. You would have to be blind to not see that CFW is more often than not abused for running illegal copies rather than homebrew and backups.

I'm also against euphemisms such the infamous "backups" in quotes meaning illegal copies rather than legitmate backups without the quotes.

Technically there is no difference between real backups and pirated content.
The same can be said for universal legit signatures. One could hunt down any legit CIA by obtaining consoles with preinstalled games.
Most likely people will just download the games illegally using that "not a shop" application, which gets mentioned here way too often. They don't even care if they have a valid signature or not.

I have seen that niche (signed pirated 3DS games) used for financial profit by criminals. They ntrboot into Luma3DS or GodMode9, install all available universal legit CIAs and sell the "not modded" consoles with a lot of first party titles for inflated prices.

 

[Hayato213]

and then open the eshop, would the game then be linked to my account?

Why would it be linked to your account when you never purchased it.

 

[Davine_Lu_Linvega]

Isn't what OP is asking basically piracy?

I won't lie that I'm not implying piracy, but i have tried this exploit with only software that i own (yes I don't own a preloaded mario 3d, but still, nintendo got my money in 2011 so...)

I posted the steps on how to do this so other people know how it's done and don't get fooled by people on the used market

Why would it be linked to your account when you never purchased it.

Because Nintendo internet infrastructure sucks, this experiment was more of a "you don't know unless you try" type of thing

I have seen that niche (signed pirated 3DS games) used for financial profit by criminals. They ntrboot into Luma3DS or GodMode9, install all available universal legit CIAs and sell the "not modded" consoles with a lot of first party titles for inflated prices.

This is something I didn't foresee when doing this, this opens the door for scummy people to install global legit CIAs and then resell the system as unhacked like you said, the only way to verify the legitimacy of these systems would be to ask the seller to open the eshop and check the downloaded software list, if it's empty you know the seller is a scumbag; the second way to know is if the system has more than 1 preloaded game (i don't think there ever was a 3ds with majora's mask, 3d land, animal crossing and mario bros 2 all preloaded in one system, so if you see this you know the seller is a scumbag)

I would avoid trying this though

Yes. in the end i would suggest you to not try this, this question was asked to see if anybody else did this before, and it evolved in me trying it myself, you are fooling nintendo by doing this and nintendo knows this since the way you have to redownload the software, this might result in your console getting banned, if nintendo still cares and looks at their 3ds servers and notices something fishy (which they might still care about since they updated the 3ds after the eshop closure)

 

[Hayato213]

Because Nintendo internet infrastructure sucks, this experiment was more of a "you don't know unless you try" type of thing

Obviously you have no idea what you are talking about.

 

[Davine_Lu_Linvega]

Obviously you have no idea what you are talking about.

Well, yea? That's why i asked the question in the first place. The only other person to do what i did was a random dude in an archived reddit thread. In the end what i found answers half of my question, you can keep the game and redownload it, but it's only a per system thing and as long you have the ticket, and no it's not account linked

 

[SSBM_Spectator]

The spotpass preservation project made me realize that you don't need a hacked 3ds to boot up firms and this got me tinkering with NTRBoot and gm9 to boot up firms on my unhacked N3ds ips-tn, i tried to install a global legit cia game with gm9 and to my surprise it works,

I don't know anything about 3ds modding and just lurk because the conversations are interesting. Are you saying that you can install cias without editing/modding the console in any other way? How does that work?

 

[Kwyjor]

Gosh, I completely missed this the first time around.

I don't know anything about 3ds modding and just lurk because the conversations are interesting. Are you saying that you can install cias without editing/modding the console in any other way? How does that work?

So, normally when you mod a 3DS, you use an exploit to run the boot9strap installer – a .firm payload – which writes boot9strap to the internal 3DS memory (the NAND). This lets you launch .firm payloads at bootup – usually Luma, godmode9, or open_agb_firm. One of these exploits is nimdsphax, which is what you run from the Homebrew Launcher after using super-skaterhax.

Instead of using boot9strap, you can also launch .firm payloads using an ntrboot cartridge, i.e. with a magnet. And – this is news to me – you can apparently launch .firm payloads other than the boot9strap installler with nimdsphax. This is of course completely nonstandard and people don't usually do things this way.

Now, when you install software with FBI, FBI generates a fake "ticket". One of the main purposes of Luma is to let you run software that does not have a valid ticket. Normally Nintendo generates a valid ticket when you download software from the eShop. You can actually back up your own valid tickets and re-install your software without connecting to the eShop, and then run it on native firmware – but you'd still need an exploit to run FBI or Godmode9 to actually install it first.

Some 3DS units were sold with software pre-installed, and this software could be run without ever connecting to the eShop. These titles – and only these specific titles – have special tickets, and if they're backed up to a .cia, they can be installed to another unit with no CFW and run on native firmware – provided you use an exploit to install them first. This is all explained in https://gbatemp.net/threads/what-is-a-legit-cia-and-other-noob-cia-questions-answered.386705/ .

 

[SSBM_Spectator]

Gosh, I completely missed this the first time around.

So, normally when you mod a 3DS, you use an exploit to run the boot9strap installer – a .firm payload – which writes boot9strap to the internal 3DS memory (the NAND). This lets you launch .firm payloads at bootup – usually Luma, godmode9, or open_agb_firm. One of these exploits is nimdsphax, which is what you run from the Homebrew Launcher after using super-skaterhax.

Instead of using boot9strap, you can also launch .firm payloads using an ntrboot cartridge, i.e. with a magnet. And – this is news to me – you can apparently launch .firm payloads other than the boot9strap installler with nimdsphax. This is of course completely nonstandard and people don't usually do things this way.

Insanely helpful reply, thanks!

Post automatically merged: Mar 26, 2025

Some 3DS units were sold with software pre-installed, and this software could be run without ever connecting to the eShop. These titles – and only these specific titles – have special tickets, and if they're backed up to a .cia, they can be installed to another unit with no CFW and run on native firmware – provided you use an exploit to install them first.

The post you linked mentioned something about Funkycia and how it can apparently make a cia personally "legit" (i.e., able to be ran without cfw), but I was under the impression that ONLY games with special tickets could be played without cfw and ONLY nintendo could create tickets?

 

[Kwyjor]

The post you linked mentioned something about Funkycia and how it can apparently make a cia personally "legit" (i.e., able to be ran without cfw)

I believe that only applied in the distant past – prior to firmware 11.8, at least.

 

[4d1xlaan]

Now, when you install software with FBI, FBI generates a fake "ticket".

correction: fbi doesnt generate fake tickets, the ticket is made when the cia is created. the cia has the ticket, tmd, and the contents, and fbi just installs those as-is

if there is a problem with the cia (invalid or corrupted content for example) then fbi will abort and it doesn't get installed, but otherwise what you give it is what it installs. so if your cia has a legit signed ticket, that's what gets installed

godmode does generate fake tickets on the fly if you choose to install a .3ds rom though, and when converting 3ds to cia. I've never used gm9 to install cia so i dont know if it keeps the ticket in the cia or if it generates a new one, I would assume it uses the one in the cia but someone would need to confirm

 

[SSBM_Spectator]

I believe that only applied in the distant past – prior to firmware 11.8, at least.

There goes my dreams of playing Flipnote Studio 3D on an "unhacked" 3ds...