This is a tutorial that shows you how to use ninfs (formerly fuse-3ds) to extract the contents of games, NAND backups, and SD card contents. This tutorial is a work in progress; please post a reply if something is confusing or needs a correction.

This supports Windows, macOS, and Linux. This tutorial mostly focuses on the GUI on Windows. For macOS/Linux steps plus CLI/installable-module usage, see the README and latest release at the repository.

What sets ninfs apart from others like ctrtool is that it doesn't need to decrypt separately first. Instead, files are decrypted as needed. For example, if you mount a CIA, you can see all of the files in it, and you only need to copy out what you need. This makes it much faster and more efficient, especially for larger games where it can take a while (and several gigabytes of space) to decrypt!

Want to see a video demonstration? Here is one with Pokémon Ultra Moon, using fuse-3ds v1.0.

Spoiler: Demonstration

In this short video, I show that the CIA is encrypted, then I use ninfs to mount it and browse its contents in Windows/File Explorer. I can also use the decrypted.cxi file to immediately start playing it in Citra.
(Note that slowness is due to the virtual machine, speed would be faster on a normal computer!)

Getting started

Windows users simply need two things:

• Install the latest release of WinFsp
• Download the latest release of ninfs at GitHub or the GBAtemp Download Center
  • You should download the win64 version if you're using 64-bit Windows.

Please see the latest release notes for macOS and Linux (+ alternative steps for Windows).

You also need the ARM9 bootROM. You can use boot9strap to dump it by holding START+SELECT+X at boot, and finding it at /boot9strap/boot9.bin on the SD card. You can find boot9strap setup at 3DS Hacks Guide.

For newer digital games (2015+), you also need a SeedDB. Check out the SeedDB list.

Setting up boot9/SeedDB

You will need boot9.bin or boot9_prot.bin, and seeddb.bin. This will be placed at %APPDATA%\3ds on Windows, and `~/.3ds` on macOS/Linux.

If one of the files could not be found, an error will be displayed.

Spoiler: Copy boot9 or SeedDB

Both boot9 and SeedDB use similar steps for setup. This part shows boot9 steps, but it is the same for SeedDB.

If you click "Fix boot9", you will see a dialog allowing you to choose the boot9 file, and the searched paths.

Click "Select boot9 to copy..." then find the boot9.bin or boot9_prot.bin file. If it is valid, it will be copied.

Using the GUI

Run ninfs (either the exe, or the module if you installed it). A console window will appear, then a GUI a few seconds later.

First, choose the type that you want at the top:

• CTR Cart Image (".3ds", ".cci")
• CDN contents (directory with "cetk", "tmd", and contents)
• CTR Importable Archive (".cia")
• Executable Filesystem (".exefs", "exefs.bin")
• Nintendo 3DS NAND backup ("nand.bin")
  • Using a directory instead of drive letter is highly recommended for this!
  • You need the OTP for this if the NAND backup does not have essential.exefs embedded by GodMode9. If you have essential.exefs as a separate file, you can extract it from that. If the Counter can't be automatically generated, you also need the CID.
  • You can write to the NAND. In the GUI, you need to enable this option. Otherwise, the mount will be read-only.
• NCCH (".cxi", ".cfa", ".ncch", ".app")
• Read-only Filesystem (".romfs", "romfs.bin")
• SD Card Contents ("Nintendo 3DS" from an SD card)
  • You need movable.sed from the system whose SD card contents you want to browse. You can get it from essential.exefs, or by copying it from CTRNAND -> private -> movable.sed.
  • You can write to the SD contents. In the GUI, you need to enable this option. Otherwise, the mount will be read-only.
• 3DSX Homebrew (".3dsx")
• Titles directory ("title" from NAND or SD)
  • To browse SD card titles, the contents must be decrypted first. You can use the SD Card Contents mount first to do that, then use this one.
• Nintendo DSi NAND backup ("nand_dsi.bin")
• Nintendo DS ROM image (".nds", ".srl")
• Nintendo Switch NAND backup ("rawnand.bin")

Once you choose the type, you need to choose the file (or directory) that you want to mount. This would be the game, NAND, or "Nintendo 3DS" SD card folder that you want.

Finally, click "Mount". If there are no errors, Windows Explorer/File Explorer will automatically open at the mount. Some example contents are shown below.

Spoiler: Root of a CIA mounted at F:

Spoiler: Root of an NCCH mounted at A:

Spoiler: Root of a NAND backup mounted at E:\NAND

Now you can copy out the files you want.

• If you mounted CCI, CDN, CIA, NCCH, or Titledir, you can see "decrypted.cxi" (or "decrypted.cfa" for non-executable contents) which acts like a decrypted version of the game. You can use it in applications that require decrypted contents like Citra.
• For NAND, you can use a tool like OSFMount to mount partitions like CTRNAND, TWLN, and TWLP. Make sure you used directory mount, not drive letter.
  If you enabled writing, you can also write back to the partitions. They will be re-encrypted as you write.
• For SD, you can browse the decrypted contents, and use something like the titledir mount to browse the installed games. You can also write to it, and the files you write will be re-encrypted.
  You can extract game saves and extdata with a tool like 3ds-save-tool.

Once you are done, click "Unmount". The mount will be removed.

Add to context/right-click menu

You can add "Mount with ninfs" to the context menu when you right-click on files. It will try to automatically detect the file type and show it in the GUI, so you can just click Mount.

Spoiler: Context Menu Demonstration

Open ninfs, click "Help & Extras", then click "Add to menu". Read the dialog, then click "Add entry" or "Remove entry" to add or remove the context menu entry.

If you move or rename the EXE, you will need to re-add it.

Troubleshooting

• I am using Windows 7, 8, or 8.1 and am getting "The procedure entry point ucrtbase.terminate could not be located in the dynamic link library api-ms-win-crt-runtime-l1-1-0.dll.".
  • You are missing "Update for Universal C Runtime in Windows". This was distributed via Windows Update. If you don't have it, you can install the update: https://support.microsoft.com/en-us/help/2999226/update-for-universal-c-runtime-in-windows
• I am on Windows 7 and am getting an error saying the driver is not signed when trying to install WinFsp.
  I am on Windows 7 and am getting "Cannot create WinFsp-FUSE file system: unspecified error."
  • It is likely you are missing SHA-2 code signing support. This was distrbuted via Windows Update. If you don't have it, you can install this security advisory: https://technet.microsoft.com/en-us/library/security/3033929.aspx

 

[T0biasCZe]

ETA: I should emphasize: movable.bin / movable.sed changes whenever a 3DS undergoes a System Format. So if you backed up your SD card, formatted your system, and then backed up your movable.bin / movable.sed (or the other way around) then this definitely won't work.

no the the sd card and the mobable.bin/movable.sed is from after i formatted the 3DS

 

[T0biasCZe]

Try this:

python disa-extract.py something.sav SomeOutputName -sd -id 0004000012345678

I tried "python disa-extract.py 00000001.sav lostworld -sd -id 00040000000cb400"
it again said
No enough secrets provided. Will skip CMAC verification.
Error: Not a DISA format

 

[KleinesSinchen]

I tried "python disa-extract.py 00000001.sav lostworld -sd -id 00040000000cb400"
it again said
No enough secrets provided. Will skip CMAC verification.
Error: Not a DISA format

Have to leave the house for now. Will look into this later today.
Please provide the following information (I didn't thoroughly read everything):

• Is the 00000001.sav already decrypted (with ninfs or GodMode9)? If it is still encrypted it needs a -decrypt or something like this in addition
• Did your provide the keys in the secrets.py? → I have to verify if and what is needed for extracting a save later.

Edit:
So… finished. I have now verified the procedure with "The Legend of Zelda – Links Awakening (Germany, GBC Virtual Console)"

The commands
disa-extract.py 00000001.sav_dec output -sd -id 0004000000042600 ----- for the decrypted save file
and
disa-extract.py 00000001.sav_enc output -sd -decrypt -id 0004000000042600 ----- for the encrypted file
both produced an output without error messages.

For the decrypted file not having a secrets.py at all produced the exact same files (with the warning that CMAC verification will be skipped). For decryption to work all of those in the secrets.py must have the correct values:
self.keyConst
self.key0x30X
self.key0x34X
self.keyMovable

The message

No enough secrets provided. Will skip CMAC verification.
Error: Not a DISA format

appears when trying to extract an encrypted file without the -decrypt option. Especially: You will need KeyY from the movable.sed from the console that created the save.

 

[Kwyjor]

For decryption to work all of those in the secrets.py must have the correct values:

I suspected that was needed. Does that mean you figured out how to get them? Last time this came up it was still a mystery.

 

[KleinesSinchen]

I suspected that was needed. Does that mean you figured out how to get them? Last time this came up it was still a mystery.

And I feared that question.
The two KeyX are inside of boot9.bin (dumped easily with B9S or Fastboot3DS), 16 bytes each:

self.key0x30X (From 0xD9E0 to and including 0xD9EF)
self.key0x34X (From 0XD9F0 to and including 0xD9FF)

The self.keyMovable is KeyY from movable.sed (like explained in the secrets template file)

I have no idea where the KeyScrambler constant is stored or how to obtain it from a console. The half-gods having accomplished everything in 3DS hacking haven't provided easy to understand, complete documentation making idiots like me comprehend and reconstruct their steps (or I'm way too dumb to find it).

To make it short: The scrambler constant just happened to be pasted somewhere between other things in a text file with the description "keys.conf for rom-properties"
==========


At this point I'm a 100% angry that possible copyright issues are a hurdle for backing up saves from what is considered to be an outdated console – which is out of production.
3DS CFW, homebrew (and piracy!) on the 3DS are noob-friendly beyond any description – without any knowledge of the inner workings. It just works. The software is so advanced and easy to use that one has to actively think of ways to screw up. But encountering problems with personal data like saves, it becomes a hassle.
===================

Most important: @T0biasCZe you can only decrypt that file with the correct KeyY from movable.sed which is unique. All others keys can be found either in the console and/or online.

I've still not read everything in this thread about your problem and I am at the end of my concentration for today. It was exhausting for my brain (have been looking up a lot).

 

[T0biasCZe]

Is the 00000001.sav already decrypted (with ninfs or GodMode9)? If it is still encrypted it needs a -decrypt or something like this in addition

its decrypted with Ninfs (tho idk if correctly since it doesnt have the "DISA" when opened in text/hex editor

 

[Kwyjor]

You have some sort of working 3DS right now, don't you? Perhaps it would be worthwhile to see if you can successfully decrypt a save file from your functional unit before continuing with this any further.

 

[KleinesSinchen]

its decrypted with Ninfs (tho idk if correctly since it doesnt have the "DISA" when opened in text/hex editor

Your file is either corrupted or still encrypted. It should contain "DISA" Maybe a visualization of the entropy can give us a hint if it is still encrypted.

My example looks like this: (It is the png picture output of "binwalk -E 00000001.sav* --save"


Encrypted:

Decrypted:

I'm a little surprised that the encrypted file doesn't have an overall entropy next to 1.0 (parts show deviation but still pretty high entropy).
The decrypted file – as expected – has parts with very low entropy.

 

[T0biasCZe]

You have some sort of working 3DS right now, don't you? Perhaps it would be worthwhile to see if you can successfully decrypt a save file from your functional unit before continuing with this any further.

I have New 3DS and New 2DS Xl.
Are you talking about the decrypt options in Godmode9?

 

[Kwyjor]

Are you talking about the decrypt options in Godmode9?

No, I mean, do exactly what you're trying to do right now with ninfs, but with a save file (and a movable.sed) from one of your working units.

 

[Kibble]

Hey, would it be possible to extract 3DS save data stored on the SD card of a broken system to a new, modded one? My broken 2DS had several hundred hours of Fantasy Life save data on it, and this method seems like it may be able to help me transfer those contents to my New 3DS.

 

[ihaveahax]

Hey, would it be possible to extract 3DS save data stored on the SD card of a broken system to a new, modded one? My broken 2DS had several hundred hours of Fantasy Life save data on it, and this method seems like it may be able to help me transfer those contents to my New 3DS.

Fantasy Life saves everything to Extra Data (aka extdata). You could use this to copy its extdata archive to a second 3DS. But you first need movable.sed for your broken console, and if you don't have this you may not be able to get it. (If you had anyone added as a friend on the 3DS they may be able to help you out with getting the key.)

 

[Kibble]

Fantasy Life saves everything to Extra Data (aka extdata). You could use this to copy its extdata archive to a second 3DS. But you first need movable.sed for your broken console, and if you don't have this you may not be able to get it. (If you had anyone added as a friend on the 3DS they may be able to help you out with getting the key.)

Interesting, I think I may know someone who could have access to my old friend code. Thanks a lot for getting back to me so quickly!

 

[Kwyjor]

Interesting, I think I may know someone who could have access to my old friend code.

The friend code alone will not help. You will need to run homebrew on a 3DS that has your Mii in its Friend list. Alternatively, if you have a saved QR code of one of your Miis on your SD card, you might be able to do something with that.

 

[ibrokemyds]

Hey everyone, I used ninfs to extract the data from my Nintendo 3ds folder of a broken 3ds. Is there a way for me to transfer that data to my current system or is it not possible?

 

[Kwyjor]

Hey everyone, I used ninfs to extract the data from my Nintendo 3ds folder of a broken 3ds. Is there a way for me to transfer that data to my current system or is it not possible?

Have you bothered to read any of the rest of the thread so far, sir..?

If you are concerned primarily about your save data, then you will need to unpack the relevant files with 3ds-save-tool before you can restore them with Checkpoint (or JKSM). Alternatively, you can use ninfs to re-encrypt the relevant files and then use Godmode9 to fix the CMAC.

If you want to transfer more than just save data, then that's probably going to cause more problems than it solves and it will probably be much easier just to re-install your apps and games.

 

[ibrokemyds]

Have you bothered to read any of the rest of the thread so far, sir..?

If you are concerned primarily about your save data, then you will need to unpack the relevant files with 3ds-save-tool before you can restore them with Checkpoint (or JKSM). Alternatively, you can use ninfs to re-encrypt the relevant files and then use Godmode9 to fix the CMAC.

If you want to transfer more than just save data, then that's probably going to cause more problems than it solves and it will probably be much easier just to re-install your apps and games.

My bad for the reading-the-thread part... I'm pretty new to this, when I got linked here it just shot me to the bottom of the thread I guess.
At the moment I really only care about the save data, replacing the games won't be difficult for me to do. Thanks so much!

 

[Rude_Boy_EEEE]

Have you bothered to read any of the rest of the thread so far, sir..?

If you are concerned primarily about your save data, then you will need to unpack the relevant files with 3ds-save-tool before you can restore them with Checkpoint (or JKSM). Alternatively, you can use ninfs to re-encrypt the relevant files and then use Godmode9 to fix the CMAC.

If you want to transfer more than just save data, then that's probably going to cause more problems than it solves and it will probably be much easier just to re-install your apps and games.

If you don't mind, I, too, am having Save data troubles, and I can't figure out how to use 3ds-save-tool... I installed the latest Python and tried installing Cryptodome like it says to, but I have very little knowledge of coding and the like. Can you maybe lend me a hand again?

 

[Kwyjor]

If you don't mind, I, too, am having Save data troubles, and I can't figure out how to use 3ds-save-tool...

You were already asking questions about threeSD; is there some reason you think this will do something that threeSD did not?

I installed the latest Python and tried installing Cryptodome like it says to, but I have very little knowledge of coding and the like.

If you are trying to use 3ds-save-tool with save data you already decrypted using ninfs, then you are reading the instructions incorrectly.

 

[Rude_Boy_EEEE]

You were already asking questions about threeSD; is there some reason you think this will do something that threeSD did not?

If you are trying to use 3ds-save-tool with save data you already decrypted using ninfs, then you are reading the instructions incorrectly.

I apologize, I just thought that the threeSD program decrypted the .sav, then 3ds-save-tool extracted the proper files from the .sav. Then I thought I would use something like JKSM to put those files into my 3DS game. Plus, when I use ninfs to "Mount SD Card Content," I use my movable.sed and everything, but it gives me the files from a second id0 in my old Nintendo 3DS directory. I can't figure how it only scans that part, which doesn't have the data I'm trying to reach.