n3DS / n3DSXL ¦ n3DSLL / n2DSXL ¦ n2DSLL cannot region change the 3DS firmware and use the Nintendo eShop of whatever region it changed to.

@Lirx, can you do several things so we know what we're working with?

1. Take a look on the SD card and see if the *.app, *.tmd, *.cmd, *.sav, etc files are still present in:

• sdmc:/Nintendo 3DS/<ID0>/<ID1>/title/0004000/##XXXX## subfolders.

​

These would be deleted from Format System Memory and are not recoverable, not even with data recovery programs.
However, if those are still present or you made a backup of this exact Nintendo 3DS folder beforehand on computer or another SD card, you games might be recoverable * depending the outcome of 1.

 

I need you to verify those files with those extensions still exist in their subfolders. This lets me know your data is intact with a slim possibility of recovery depending what we find in step 2.

 

Awesome! We have the first part of the picture of whether or not the games are recoverable.

Since you're really new at this, for your safety I want you to follow these steps. Some of these may not make sense, but this is to make sure you don't accidentally softbrick your o3DS.

2. Make a copy of that Nintendo 3DS folder and set it aside on your computer.

3. Take a spare SD card, copy everything off it, and reformat it as FAT32 + 32 KB cluster size with either Windows File Explorer or guiformat.

• A minimum of 4 GB will suffice and is recommended.
• If you do not have any other SD cards, you'll have to use the one you do have and copy everything off it.

4. With it still empty, do a full Write + Verify Test with H2testw. Do not skip this step.

5. If the card passes, delete the *.h2w test files.

• If an error was reported, stop the test. Replace the hardware failed card and go back to step 3.

6. Build a test custom firmware setup with the CFW starter kit found here. Do not use any files from your main setup at this moment.

7. Insert the card into the 3DS. Turn the system on and hold (Start) to access Luma3DS chainloader. Select GodMode9.

8. In GodMode9, press (HOME) button → Scripts... → NANDManager → <X> Backup SysNAND → etc.

• You should find these two files at 0:/gm9/out directory:
  • ######_XX########_sysnand_000.bin
  • ######_XX########_sysnand_000.bin.sha
• This is your NAND *.bin image for recovery purpose.

9. Copy those two (2) files over to your computer.
​

Once you have done this, this will let us know we can safely proceed with the wetwork of modifying files on your CTRNAND drive. I'll explain more about this later.

 

Okay for part 3, I need to explain some very important things so you understand what you'll be doing and why.
Edit - You will not be doing anything from this post except read and learn what is what.

***

The titles [games / DLCs / updates] and saves found within the Nintendo 3DS folder is encrypted by something called the movable.sed. This *.sed file is found on the 3DS internal SYSNAND CTRNAND drive that you will be navigating in with a homebrew app called GodMode9.

Within the movable.sed, there is 0x10 bytes string known as keyY. This is the part that encrypts and decrypts (locks & unlocks) the data in the Nintendo 3DS folder.

Diagram of the movable.sed

There is a mathematical formulaic relationship between the keyY and the <ID0> subfolder.

• sdmc:/Nintendo 3DS/<ID0>/<ID1>/title/...
• <ID0> is 32 characters string.
• From the attached picture found at post #4, your <ID0> is 876061a4fbdc4e312962823a7a2210b3.

***

How the <ID0> is calculated from the keyY

Using the (fake) movable.sed for example, here is how the <ID0> is derived from the keyY.

1. Using HxD hex editor, highlight select and calculate the SHA-256 hash of keyY.

SHA-256 hash of keyY

• keyY = 20 72 EE FA 02 00 00 00 CA E7 1A D2 F8 92 70 E1
• SHA-256 hash = 3DA6C887153C51B388B23370357B606587476DEBC75ED52B57777FC747618717

2. Take the first half of that hash and discard the rest.

• 3DA6C887153C51B388B23370357B606587476DEBC75ED52B57777FC747618717
  
• 3DA6C887153C51B388B23370357B6065

3. Let's clean that up a bit by making those letters into lower cases. Use this website: https://convertcase.net/

• 3DA6C887153C51B388B23370357B6065
  
• 3da6c887153c51b388b23370357b6065

4. Separate into four (4) equal sections and add spaces.

• 3da6c887153c51b388b23370357b6065
  
• [3da6c887][153c51b3][88b23370][357b6065]
• [3d a6 c8 87][15 3c 51 b3][88 b2 33 70][35 7b 60 65]

5. Flip the order within each of the sections.

• [3d a6 c8 87][15 3c 51 b3][88 b2 33 70][35 7b 60 65]
• [87 c8 a6 3d][b3 51 3c 15][70 33 b2 88][65 60 7b 35]

6. Remove the brackets [..] and spaces. This is the <ID0> derived from this keyY.

• [87 c8 a6 3d][b3 51 3c 15][70 33 b2 88][65 60 7b 35]
  
• 87c8a63db3513c157033b28865607b35

***

When you performed a Format System Memory, the movable.sed undergoes slight changes for the keyY and AES-MAC section. This causes the 3DS to ignore the original <ID0> subfolder.

movable.sed with Format System Memory

***

I know this is a lot of take in, but here are some other things you'll need to know.

• You will be using a hex editor whether you like it or not.
• Don't mistaken or confuse real numbers for hexidecimal numbers, even if certain values look similar to each.
• Hex numbers will be denoted with 0x at the front whenever possible.
• You'll be most concern with hex numbers ranging from 00 – FF.

Here's a summary of real (left) vs hex (right) numbers

00 = 0x00
01 = 0x01

.
.
.​

09 = 0x09
10 = 0x0A
11 = 0x0B

.
.
.​

15 = 0x0F
16 = 0x10
17 = 0x11

.
.
.​

255 = 0xFF​

• Use these two weblinks to check yourself and to convert between the two number types:
  • Hex to Decimal converter
  • Decimal to Hex converter

***

Big Warning (Please Read)

@Lirx, I probably should have mentioned this earlier, but there's a component within the *.sed file that contains a copy of another file called the LocalFriendCodeSeed_B. Do not upload your movable.sed and LocalFriendCodeSeed_B files or publicly share pictures of these.

movable & LFCS_B relation

The LFCS_B is something that allows a 3DS system to play online and use Nintendo services. 3DS users who have been permanently banned from online play by either being caught cheating or interacting maliciously with other players, can unban themselves by using another person's (not banned) LFCS_B.

However, because cheaters are assholes with no shame, they will burn your LFCS_B and cause you to get banned if you showed yours out in the open.

You may notice the first half of keyY is a part of the LFCS_B. This (0x08 bytes) half part by itself is not enough to go by in getting you banned if you were to show this. However, if you wish to keep your keyY private (and if you trust me), we can continue discussions in private message (PM)

***

Part 3 was to study all this mumbo jumbo to ready you for part 4, which is recreating your lost movable.sed with the exact keyY. Let me know once you've study what has been written here and feel comfortable enough to do some crazy arse, (newbie) hacker shiet next.

 

I see you're practicing how to highlight select bytes to calculate hash. This is very good to get this out of the way.

Just remember when the moment comes to do this with the movable.sed, you don't post pictures of that file.

After highlighting blue the section you want to find its hash checksum,

• Analysis (top bar menu) → Checksums... → SHA-256 → OK.

Edit 1 - I can initiate PM'ing you.

Edit 2 - There's more to just changing those two (2) values back. You have to fix that AES-MAC, too. Don't worry about that part as this can be done automatically with GodMode9.

 

Part 4 - Retrieving the movable.sed in SYSNAND CTRNAND and examining its keyY with HxD hex editor.

10. Reinsert the SD card used from steps 3–9 back into the 3DS. Turn on the 3DS and hold (Start) to boot GodMode9 again.

11. Go to [1:] SYSNAND CTRNAND/private/movable.sed. Press (A) → Copy to 0:/gm9/out.

12. Turn off the 3DS. Remove the SD card and insert it in your computer.

13. With HxD hex editor, open the copied *.sed file found at:

• sdmc:/gm9/out/movable.sed

​

[WIP - to be continued]
I'll add further steps in this post after more details in PM.

Edit - 12/06/2018, post write-up.

Thanks to @Lirx for sharing her keyY and upper half of the AES-MAC section.

14. Working your way backwards, highlight select between 0x110 – 0x11F and follow the procedure in post #9 in calculating the <ID0>.

• keyY = E6 0C E7 03 00 00 00 00 D5 95 5B AC 87 BD C7 00
  • Calculation #1

    SHA-256 hash of that keyY.
    96A8FB7A4B09463D8886A879E47FD9BD51EC3A9FA96870FC73CB3DFCCF93E353
    
    1st half of that hash.
    96A8FB7A4B09463D8886A879E47FD9BD51EC3A9FA96870FC73CB3DFCCF93E353
    
    Lower case letters of that hash.
    96a8fb7a4b09463d8886a879e47fd9bd
    
    Split into 4 equal parts and add spaces.
    [96a8fb7a][4b09463d][8886a879][e47fd9bd]
    [96 a8 fb 7a][4b 09 46 3d][88 86 a8 79][e4 7f d9 bd]
    
    Flip the orders of the numbers in each section.
    [96 a8 fb 7a][4b 09 46 3d][88 86 a8 79][e4 7f d9 bd]
    [7a fb a8 96][3d 46 09 4b][79 a8 86 88][bd d9 7f e4]
    
    Remove the brackets and spaces.
    7afba8963d46094b79a88688bdd97fe4
  • <ID0> = 7afba8963d46094b79a88688bdd97fe4

Reduce the value of 0x118 by 1 (one) and try again.

• keyY = E6 0C E7 03 00 00 00 00 D4 95 5B AC 87 BD C7 00
  • Calculation #2

    SHA-256 hash of this "supposed" old keyY.
    A4616087314EDCFB3A826229B310227AF5525B2CBE739A5E8AF47B1AEA25DC6A
    
    Take the first half and lower case the letters.
    A4616087314EDCFB3A826229B310227AF5525B2CBE739A5E8AF47B1AEA25DC6A
    a4616087314edcfb3a826229b310227a
    
    Split into 4 equal parts and add spaces.
    [a4 61 60 87][31 4e dc fb][3a 82 62 29][b3 10 22 7a]
    
    Reverse the order in each sections.
    [a4 61 60 87][31 4e dc fb][3a 82 62 29][b3 10 22 7a]
    [87 60 61 a4][fb dc 4e 31][29 62 82 3a][7a 22 10 b3]
    
    Remove the brackets and spaces.
    876061a4fbdc4e312962823a7a2210b3
  • <ID0> = 876061a4fbdc4e312962823a7a2210b3
  • This second calculated <ID0> matches the one previously seen and mentioned in post #4.

​

15. Make sure to hex edit the values at 0x118 and 0x120 by -1 for every Format System Memory. For @Lirx's case, she performed only a single reformat. Save the file, eject the SD card from computer, reinsert into the 3DS, and boot GodMode9.

​

Part 5 - Inject the movable.sed back into CTRNAND.

16. Go to 0:/gm9/out/movable.sed and press (Y) to [CLIPBOARD] select this file.

17. Go to 1:/private directory → press (Y) → Copy path(s) → <A> yes → button combo → Overwrite files(s) → <A> yes.

• This will replace the *.sed file with the version you hex edited.

18. Press (A) on movable.sed → Calculate CMAC → <A> yes (to fix it) → <A> yes → button combo → <A> yes.

• This will automatically make corrections for the AES-MAC hash between 0x130 – 0x13F.

19. Back out with (B) button. Hover over highlighting white [1:] SYSNAND CTRNAND. Hold the R-shoulder button and press (A) → Fix CMACs for drive → etc.

• If you have the backed up Nintendo 3DS folder made prior to Format System Memory, you might need to Fix CMACs for drive for [A:] SYSNAND SD.

​

Part 6 - Check for title recognition in System Settings.

20. After creating a new user profile, go to System Settings → Data Management → Nintendo 3DS → Software. Check to see if the titles are marked with X's like this. This means the games, DLCs, and updates are missing their tickets.

​

21. Continue the data recovery process with the guide found at:

• I made a NAND backup awhile back, now had to recover, missing games.

​