Does some one know about CTRnand\transfer?

Discussion in '3DS - Flashcards & Custom Firmwares' started by gkoelho, Aug 25, 2016.

  1. gkoelho
    OP

    gkoelho GBAtemp Advanced Fan

    Member
    547
    133
    Apr 16, 2015
    Brazil
    Just curious about, I did a little of research but couldn't find much.

    I understand using this process instead has extra protections involving the partitions, but what else it has different from the old method? Can some one with the knowlede explain this in more details:

    For people like me that always likes to learn something new :teach::teach:
     


  2. Rak

    Rak Advanced Member

    Newcomer
    76
    5
    Jun 19, 2015
    I too want to know this. It seems like something interesting to read.
     
  3. shadow910512

    shadow910512 Member

    Newcomer
    46
    12
    Aug 24, 2016
    Malaysia
    Meowland
    me three
    feels like its a premade 2.1.0 image that can be installed in any 3ds right now, but how??
     
  4. Clydefrosch

    Clydefrosch GBAtemp Psycho!

    Member
    4,127
    1,181
    Jan 2, 2009
    Gambia, The
    besides apparently saving us a bunch of emunand installs, dumps and reflashes, this new method actually doesn't downgrade the system like we would have to going from say 10.7 to 9.2 using sysupdater. sysupdater has always been a little finicky, requiring sometimes hundreds of reloads just to get it running even then it sometimes messed up installing a title for some reasons, ending downgrades in partial frankenfirmwares.


    this new method basically just applies a universally usable nand backup to the system making it load a 2.1.0 firmware thats good enough to install a9lh and get your otp file.
    its as save and quick as applying any other nand backup you made using emunand9 or decrypt9. no countless titles, no real chance for it to stop halfway through (other than batteries giving out on you or you dropping the system or removing the sd card, or having a corrupted 2.1.0 file)

    as to how they managed to present us with a nand backup that works on every console (when usually, nand backups are kinda specific to your console) i have no idea. but they did. and thats nice.

    the guide itself is, apart from the part 1 table (which is irrelevant for everyone who already is on 9.2 sysnand), much more easy to follow and unless you have like 60 gb of installed cias to backup, you can make it to a working a9hl/luma setup within an hour (+however long it takes for you to download all the files)
     
    Last edited by Clydefrosch, Aug 25, 2016
    gkoelho likes this.
  5. Urbanshadow

    Urbanshadow GBAtemp Maniac

    Member
    1,296
    474
    Oct 16, 2015
    Until someone (@d0k3 , @Plailect ?) lands here and explains it deeper (if possible!): CTRNAND is just a partition of the nand, the bigger one, responsible of containing system titles. The direct difference between a CTRNAND backup and a full NAND backup is you don't touch FIRM0/FIRM1 or TWL,AGB or key storage partitions. So what you are really doing is a backup of the system titles.

    They might found a way to trick N3DS in properly booting a 3DS CTRNAND since 2.1 system software version is only available to 3DS, perhpahs with a dedicated franken-ctrnand modified enough to grab the otp but not agressively changed to provide universal support. From my point of view we are not directly changing FIRM partitions by the CTRNAND restore, but then again the process is called CTRNAND transfer for a reason so modification of FIRM0 might be done manually afterwards because afaik the "bug" responsible for the OTP register to be left open is located in the 2.1.0 FIRM.

    It really gets me the point of being "universal". That might mean nand backup sharing between hacked systems.

    EDIT: From d0k3's release notes:
    • CTRNAND Transfer...: This menu contains various options to enable transfer of CTRNAND partitions between consoles.
      • Auto CTRNAND Transfer: Automatically transfer a transferable CTRNAND image to this consoles NAND. Without A9LH installed, this will overwrite the FIRM0, FIRM1, CTRNAND. With A9LH installed, this will only overwrite CTRNAND. O3DS images can be transferred into N3DS consoles, but the NCSD header of the NAND may be overwritten.
      • Dump transferable CTRNAND: Dump a CTRNAND image for later use in the feature above. Transferables images can be shared between consoles.
      • Autofix CTRNAND: Use this to automatically fixes the CMACs for movable.sed, *.db and system saves inside the CTRNAND. It will also fix the inside the data folder. This is useful f.e. when a CTRNAND from another console was previously injected the regular way.SO
    So this means we might not need to downgrade anymore. Just make a 9.2 CTRNAND transfer (even o3ds to n3ds). I wonder if this might bypass the N's 11.0 hardcoded min system title version list as I don't think the transfer is using the direct installing/removal of titles into the system. Then again, running d9 requires arm9 and I highly doubt the CTRNAND transfer functionality uses arm11k services only so I think it doesn't make any changes to the 11.0 people.
     
    Last edited by Urbanshadow, Aug 25, 2016
    d0k3, gkoelho and DrkBeam like this.
  6. Quantumcat

    Quantumcat Dead and alive

    Member
    11,113
    5,952
    Nov 23, 2014
    Australia
    Canberra, Australia
    I wonder if we can flash a lower CTRNand to an 11.0 backup obtained with a hardmod or DSiWareHax, to save time compared to modifying NATIVE_FIRM and downgrading with sysupdater?
     
    Starzcream likes this.
  7. DarkKaine

    DarkKaine GBAtemp Regular

    Member
    272
    294
    Dec 1, 2014
    Netherlands
    Pretty sure after 9.2 a backdoor was used to simply downgrade titles while not actually having permission to other services. As such, I don't think a full CTRNAND transfer is possible without having the proper access.
    This will not work either, as the dump is encrypted and can only be decrypted by utilizing functions in 3DS mode (with the proper access level).

    In short, CTRNAND is extremely convenient and safe, as you're not dealing with different 3DS configurations and flashing a universal image with your 3DS console information.
     
    Last edited by DarkKaine, Aug 25, 2016
    Quantumcat likes this.
  8. Urbanshadow

    Urbanshadow GBAtemp Maniac

    Member
    1,296
    474
    Oct 16, 2015
    As I said, most likely there's no possibility of a proper access. This means, even with full access to services you can't do it.
    Most probably needs direct physical address space access and that can only be achieved by arm9.
     
  9. trinhno

    trinhno GBAtemp Regular

    Member
    128
    38
    Aug 5, 2015
    Senegal
    Last edited by trinhno, Aug 25, 2016
    gkoelho and Urbanshadow like this.
  10. gkoelho
    OP

    gkoelho GBAtemp Advanced Fan

    Member
    547
    133
    Apr 16, 2015
    Brazil
    Very useful information here. I hope there will be a deep technical explanation about this as a9lh has got, its so interesting.
     
  11. d0k3

    d0k3 3DS Homebrew Legend

    Member
    2,629
    2,651
    Dec 3, 2004
    Gambia, The
    I suggest everyone check @Plailect's new guide. :)
     
    vb_encryption_vb likes this.
  12. LinkSoraZelda

    LinkSoraZelda GBAtemp Advanced Maniac

    Member
    1,980
    625
    Aug 12, 2015
    United States
    Land of the Rising Orange
    I swear I will start fucking crying if you can transfer consoles without having to swap motherboards or do a system transfer.

    And even make a stock system into an a9lh one? Whew.


    Oh my gosh this will be amazing in the future.
     
  13. d0k3

    d0k3 3DS Homebrew Legend

    Member
    2,629
    2,651
    Dec 3, 2004
    Gambia, The
    You can transfer consoles, but with the current auto method, system data from the receiving system is kept, and you might want a full transfer from System A -> System B. To do this, dump CTRNAND (that's in a different submenu) from System A, inject to System B. Then Autofix CTRNAND on System B, done. I may make this more comfortable later, but it is already just two steps on System B anyways.

    As I said, also take a look at Plailect's new guide.

    Edit: This goes without saying, but if you do this, don't be a Jackass, have a hardmod. There are no bricks with Plailect's new guide so far, but you could still mess up.
     
    Last edited by d0k3, Aug 25, 2016
  14. Urbanshadow

    Urbanshadow GBAtemp Maniac

    Member
    1,296
    474
    Oct 16, 2015
    Not to send the hobbits down a hole, but this looks way more safe than before. Is just false confidence?
     
  15. d0k3

    d0k3 3DS Homebrew Legend

    Member
    2,629
    2,651
    Dec 3, 2004
    Gambia, The
    It is way more safe than before. There is also much less user messup potential now. :)
     
  16. Urbanshadow

    Urbanshadow GBAtemp Maniac

    Member
    1,296
    474
    Oct 16, 2015
    Really good news. Good job! :)
     
  17. DavidRO99

    DavidRO99 Average Ryzen user.

    Member
    980
    285
    Jun 11, 2016
    Korea, North
    your back-door
    Wait... we can now install A9LH with just a CTRNAND img? So if somebody has A9LH and they backup the CTRNAND someone else on 9.2 can install that CTRNAND and copy arm9loaderhax.bin to their SD and it will work?
     
  18. Urbanshadow

    Urbanshadow GBAtemp Maniac

    Member
    1,296
    474
    Oct 16, 2015
    Nope. CTRNAND backups of a9lh systems are just CTRNAND partition backups. Forcing it to do that will brick the target system (and only hardmod recoverable!), because the otp of both systems are different.

    In practice, decrypt9 protects itself from that brick and only recover CTRNAND partition, with potentially unexpected results if FIRM0/FIRM1 are in different versions than CTRNAND but not a brick.
     
    Last edited by Urbanshadow, Aug 26, 2016
  19. d0k3

    d0k3 3DS Homebrew Legend

    Member
    2,629
    2,651
    Dec 3, 2004
    Gambia, The
    FIRMs are taken care of in that method, too, meaning either the A9LH FIRMs will be kept (if A9LH installed) or the correct ones will be installed.
     
    LinkSoraZelda likes this.
  20. Urbanshadow

    Urbanshadow GBAtemp Maniac

    Member
    1,296
    474
    Oct 16, 2015
    Extracted from CTRNAND? That's clever.
    (inb4 People transferring CTRNAND with a9lh 11.0 sysnand to another system and expecting to get a9lh but get fully updated to 11.0)