Did anyone find out why... (Downgrade softbrick)

Discussion in '3DS - Homebrew Development and Emulators' started by pofer, Feb 8, 2016.

  1. pofer
    OP

    pofer GBAtemp Fan

    Member
    326
    104
    Jan 4, 2016
    Spain
    Somewhere around the corner
    Did anyone find out why some people always softbricked their consoles while downgrading without formatting first ?


    As some of us experienced it , while downgrading everything seemed to install just fine using sysupdate but you always ended up with a softbrick no matter what you tried

    In my case I had 5 softbricks (using 3 different entry points) before I finally was able to downgrade it

    And it all was fixed by formatting the console ! I had mine downgrade on the first try after doing it

    So did anyone find out why some people were experiencing that ? I know it's not too common but it's worth the try to know why it happened
     


  2. A_Random_Guy

    A_Random_Guy Officially That Dev

    Member
    862
    459
    May 22, 2015
    Malaysia
    Smea's closet
    Some people reported including me that when you already installed a Legit CIA using memchunkhax2 FBI, after downgrading you will be meet with a softbrick. After formatting, it fixes the softbrick. Some people suggest that FBI corrupts enough the ticket so that you will be able to install Legit CIA making the system softbrick
     
  3. pofer
    OP

    pofer GBAtemp Fan

    Member
    326
    104
    Jan 4, 2016
    Spain
    Somewhere around the corner
    Oh but I never installed any legit cia games on my 3ds , how odd
     
  4. yacepi15

    yacepi15 GBAtemp Advanced Fan

    Member
    868
    167
    Aug 15, 2015
    I downgraded two consoles,both with legit CIA installed and no softbrick. (O3DSes XL,10.3,one with the first sysUpdater with a N3DS brick probability over 9000,and the another with SafeSysUpdater)
     
  5. Noelemahc

    Noelemahc GBAtemp Regular

    Member
    133
    25
    Jan 28, 2016
    Serbia, Republic of
    Downgraded two O3DSs which had legal CIAs on them, but all installs were through NASA. No softbricks.
     
  6. mashers

    mashers Stubborn ape

    Member
    3,837
    5,153
    Jun 10, 2015
    Kongo Jungle
    It's a good question, but I think if we really understood why it happens then we would have a downgrade method which was safer by now.
     
    Games&Stuff and wormdood like this.
  7. ihaveamac

    ihaveamac GBAtemp Guru

    Member
    5,339
    5,751
    Apr 20, 2015
    United States
    Tigard, OR
    this might not mean anything, but after accidentally bricking a console messing with movable.sed, I found out this file in NAND also deals with encryption with some files in the NAND (not just SD files). this gets changed when you format or transfer, which could be connected to why formatting fixes soft-bricks if a console has been getting them.

    https://3dbrew.org/wiki/Nand/private/movable.sed
     
    Last edited by ihaveamac, Feb 8, 2016
  8. mashers

    mashers Stubborn ape

    Member
    3,837
    5,153
    Jun 10, 2015
    Kongo Jungle
    Interesting. Do you know what actually happens to the file when you format the NAND? This is an interesting quote from that 3dbrew page:

    I wonder whether it's the use of the fall-back key which allows the downgrade to succeed, and if deleting Movable.sed is sufficient to cause this to happen. If so, could sysupdater have an option to remove Movable.sed?
     
  9. ihaveamac

    ihaveamac GBAtemp Guru

    Member
    5,339
    5,751
    Apr 20, 2015
    United States
    Tigard, OR
    not really...all I know is that it's changed at format/transfer.
    what we did was try moving movable.sed from one console to another. neither of us did our research, and so this caused a hard brick that can only be fixed by restoring a NAND dump (which we have, thankfully). the backlight wouldn't even turn on.

    I suppose you could try making an emunand backup, then delete it somehow (dump emunand and use xorpads? or dump pre-decrypted?) and see what happens.
     
  10. mashers

    mashers Stubborn ape

    Member
    3,837
    5,153
    Jun 10, 2015
    Kongo Jungle
    Is it possible to delete files from sysnand? I've got a hard mod now so I can try this safely... though I don't know how to test the effects even if the 3DS boots, since I've got a clean 9.2 sysnand so would presumably be able to downgrade from 10.3 cleanly even if I updated.
     
  11. ihaveamac

    ihaveamac GBAtemp Guru

    Member
    5,339
    5,751
    Apr 20, 2015
    United States
    Tigard, OR
    if you have a NAND dump, you can generate an xorpad using Decrypt9 (XORpad Generator Options -> CTRNAND Padgen). then use this xorpad with 3DSFAT16tool.

    Decrypt9 can also dump NAND partitions already decrypted (SysNAND/EmuNAND Options -> Partition Dump... -> Dump CTRNAND Partition), though I haven't tested it myself. you'll probably need to add ".iso" to the end or something to easily mount it on OSX.

    (oh and don't be silly like me and overwrite your NAND dump trying to use a xorpad)
     
  12. mashers

    mashers Stubborn ape

    Member
    3,837
    5,153
    Jun 10, 2015
    Kongo Jungle
    Can you do it on the device directly? Modifying and rewriting a NAND dump is clearly not going to be an option for potential downgraders, but I'm wondering whether there's a way of doing it in software the way sysupdater or NASA do it. In other words, use one of these tools to remove or overwrite movable.sed before initiating the downgrade. Again, this is all predicated on the assumption that it will even make a difference, let alone that removing the file won't brick the console...
     
  13. ihaveamac

    ihaveamac GBAtemp Guru

    Member
    5,339
    5,751
    Apr 20, 2015
    United States
    Tigard, OR
    overwriting movable.sed is probably a bad idea since it deals with SD encryption, so most people don't want to lose their digital saves and stuff. also this could be totally wrong but I think you would need direct NAND access to arbitrarily delete any file in it (like movable.sed), and that requires an ARM9 kexploit.
     
    Last edited by ihaveamac, Feb 8, 2016
  14. mashers

    mashers Stubborn ape

    Member
    3,837
    5,153
    Jun 10, 2015
    Kongo Jungle
    Ahh, catch 22 then. Ahh well, it was a nice idea. TBH I think anyone who wants kernel access that badly would be better off getting a hardmod installed. It's not expensive to get someone else to do it, and it means your NAND is safe forever ;)
     
  15. ihaveamac

    ihaveamac GBAtemp Guru

    Member
    5,339
    5,751
    Apr 20, 2015
    United States
    Tigard, OR
    kind of expensive for us to get a hard mod in the US, and I don't think we trust our soldering skills to do it ourselves. but we're doing it anyway since we have to.

    I'm interested in seeing what Gateway is going to bring in terms of downgrading. in my experience, if the console came with 9.6+, or was formatted/transferred to some time after being updated to 9.6, then it won't soft-brick when downgrading.
     
  16. mashers

    mashers Stubborn ape

    Member
    3,837
    5,153
    Jun 10, 2015
    Kongo Jungle
    Really? Why's that?

    Would that require a Gateway card though?
     
  17. ihaveamac

    ihaveamac GBAtemp Guru

    Member
    5,339
    5,751
    Apr 20, 2015
    United States
    Tigard, OR
    sorry but I don't know if I can/should answer this at the moment. we are using hundshamer's service though soon.
    Gateway's downgrader to 4.x doesn't require a card, so probably not.
     
  18. mashers

    mashers Stubborn ape

    Member
    3,837
    5,153
    Jun 10, 2015
    Kongo Jungle
    Intriguing.

    Also intriguing ;)
     
  19. Uziskull

    Uziskull Picture may not be real

    Member
    265
    178
    Nov 15, 2015
    Somewhere, probably
    When I downgraded my 9.5 O3DS, I'd installed a legit CIA beforehand and it downgraded at first try, so I believe legit CIAs aren't an issue. I used that very unstable first build of FBI to downgrade.
     
  20. dotarice

    dotarice Advanced Member

    Newcomer
    90
    10
    Nov 10, 2015
    Bahrain