Hacking [GUIDE] The EmuNAND/Save Data Mega Guide GBATemp Doesn't Deserve

[mmn]

The EmuNAND/Save Data Mega Guide GBATemp Doesn't Deserve
mods feel free to edit the title

There are way too many people running around asking the same questions
and getting the same answers, so here we go.

Running the exploit
So, you finally get to use that shiny new Gateway 3DS flashcart sitting
that's been sitting on your shelf for a month. Gateway 3.0 is out!

If you are on firmware 4.5-9.2, here are your options:

1. Bookmark http://go.gateway-3ds.com/ and navigate there using the web browser
whenever you want to run the exploit
2. Use the android app to do the above even if you don't have an internet connection
3. Downgrade to 4.x and use the old DS Profile exploit

BUT WAIT! Don't do any of those things yet! There are other things
you need to know before starting. The next few sections will explain some
info that you should know before you so much as breathe on that gateway card:

1. How 3DS memory works
2. What EmuNAND does
3. Why that might cause problems
4. How to fix those problems
5. Everything about Save data
6. Why you should think hard before downgrading to 4.x

1. How 3DS memory works
I'm going to talk relatively precisely about how things work, because I think
people on this site generally talk very loosely about various things, and it
confuses beginners.

First let's talk about how the 3DS system memory works. It can basically be
divided into two sections: "stuff that gets saved to SD", and "stuff that
gets saved to system memory (NAND)".

Stuff that gets saved to SD: Games, extra save data that games wish
to save to SD

Stuff that gets saved to system memory (NAND): System firmware,
housekeeping info like which titles are installed, system settings, unique info
that differentiates this 3DS system from another

Most people already know this, but data written to SD by a certain 3DS system
(or, a system with certain unique data in its NAND) can only be read and written
by that same 3DS system. Unique data in that 3DS's NAND enables it to
read/write data to a specific folder on SD. If you put the same SD card into
another 3DS, that 3DS will have to make another folder for itself, because
it doesn't have the same unique NAND data as the 3DS that wrote to SD
in the first place.

2. What EmuNAND does
Here's pretty much what happens when you press "Format EmuNAND" in the Gateway launcher:

1. Your SD card's partition table is wiped (data is lost)
2. A small (~1-2GB, maybe?) partition is created
3. A larger partition is created to fill the remaining unallocated space on the SD card
4. An exact copy of your system NAND is made and placed on the SD card's small partition

When you launch Gateway mode or Classic mode, the NAND copy on your SD card
is loaded instead of the 3ds's system NAND. Pretty neat, huh! This allows
you to update the copy of your console's firmware that lives on your SD without
updating your console's actual firmware. It also allows really neat things,
like the ability to install .cia files without worrying about bricking your NAND
firmware. If you install a .cia that bricks your EmuNAND, you can just inject an
EmuNAND backup that i'm sure you made ahead of time, and you're good to go.

3. Why that might cause problems
Mostly this is just why that might cause one relatively big problem. You see, your EmuNAND
really does start off as an exact copy of your system NAND. It has the same unique info,
the same everything. That means that when it wants to write to SD, it can and does write to
the same SD data folder that your system nand uses. This can lead to issues with themes
and cia installations. One of the big issues: If your system NAND and EmuNAND use the same
data folder, going into Data Management while using system NAND will delete ALL
.cias installed to EmuNAND, and ALL of their data. Bad bad bad.

4. How to fix those problems
The main issue is that your system NAND and your EmuNAND have the same unique data, so they
both think that they are the same 3DS and write to the same data folder. You want your
system NAND and EmuNAND to think that they are different systems, so that they will
behave like different systems. Thankfully, performing a System Format on either
system NAND or EmuNAND will achieve this.

But don't do that yet. First you need to create a NAND backup and an EmuNAND backup.
You can make a NAND backup from the Gateway launcher, and you can make an EmuNAND
backup by using EmuNAND Tool.
You're going to want to keep this EmuNAND backup (one of a fresh copy of your NAND),
as well as a backup of a freshly formatted (using System Format, that is) EmuNAND,
as well as a "recent" backup of your EmuNAND.

After you have a backup of your system NAND and your fresh EmuNAND in a safe place,
you can proceed to format one of the two. You're good to go, as long as you don't
have save data from eshop games that you want to be able to use on EmuNAND.

Here are some things to consider when deciding which NAND to format:

1. Your friend code will change on whichever NAND you format
2. You will not be able to access your old Streetpass Mii Plaza data
when you're running on whichever NAND you format
3. You will not be able to access eshop game save data when you're
running on whichever NAND you format
4. You will be able to use the eshop account linked with the console on EmuNAND
regardless of which NAND you format.

However, there is a way to keep your eshop saves. Read on if you'd like to know how.
My recommendation is to format EmuNAND, because there's a much lower chance
that you'll lose things from your system NAND that way.

5. Everything about save data

.3ds saves (all)
These are the ez pz saves. They were made using a Gateway card running a
.3ds rom. There are two types of rom files: Card 1 and Card 2:

Card 1: On a retail cart, the save data would be saved to seperate memory
outside of the game ROM itself, but still on the cart. The way Gateway handles this
is by making a <titleid>.sav file on the SD card. This file can be transferred to
different systems without issue.

Card 2: On a retail cart, the save data gets stored after the ROM, in the same
memory. I'm not 100% sure about this, but I think gateway does it in pretty much
the same way: the save data gets saved to the .3ds file. To back this up, you need
to use savedatafiler. Look for "CTR card"

Just a note, savedatafiler would also work for Card 1 games, but Gateway needs
to fix something for that to work. This means that you can't transfer saves from
Card 1 games to .cia games. Our great savior LioMajor has found a way to
transfer saves from card1 games to .cia! It works on MT Card, though.

One way to fix this is to convert your Card 1 .3ds files to Card 2. It'll only work before
you make your save though. After doing this, you can use savedatafiler to move your
save between the .3ds and .cia. You can use this tool to convert a Card 1 .3ds file into
a Card 2 one. Remember, you have to start a new save if you do this, so do it sooner
rather than later!

.cia files (all) and eshop games (<6.0.0 only, see very last "save data" section)
I'm going to write about eshop games next, because they are the next easiest to
understand. Eshop games, and their saves, are saved to the SD card. They can only
be accessed by the 3DS when it's running on the NAND that they were originally
installed with. Or, more precisely, the NAND that has the same unique info as
the NAND that installed it. This information also holds true for .cia files
(that's almost exactly what eshop games are).

I'm relatively certain, though, that save data is stored encrypted
on the SD card. If you want to back up or transfer a save, you have to use a
program called savedatafiler. It can extract and inject saves to/from the SD card.
It also has the ability to extract and inject saves in card 2 game carts, which I'll
talk about further down.

So, if you have eshop games that you want to back up the save data for,
savedatafiler is the way to do it. Here's the process (as long as the eshop
game and save data haven't been deleted from your SD card):

1. Make you have savedatafiler.3ds (renamed from .csu) on the Gateway red card
2. Backup your EmuNAND using EmuNAND tool
3. Inject your "fresh" EmuNAND backup using EmuNAND tool. This is the one that
has the same NAND data as your sysNAND did when you first started. If you don't
have a backup like this, you can also try injecting your original sysNAND backup.
4. Boot into Gateway mode
5. For each game you want to backup, find the titleid on http://3ds.essh.co/
6. Find the corresponding titleid slot in the first tab of savedatafiler and follow
the directions on the top screen to backup your save (don't choose the "secure" way)
7. The third tab of savedatafiler should show all of the data you've backed up
8. Reinject the backup you made at step 2
9. Install the eshop games again, either from eshop or .cia
10. Open savedatafiler, go to the 3rd tab, and import all of the save data

Your saves should be imported and usable! You can use a similar process for
transferring .cia or eshop saves to a different 3DS.

Note: If, after reading this section, you still have questions about how to use
savedatafiler, see this awesome guide by lemanuel.

Retail carts (<6.0.0 only, see very last "save data" section)

If you're trying to extract a Pokemon X/Y/OR/AS save, look here.
Otherwise, read on...

So this issue is, uh, complicated.

First thing's first, here's how things are supposed to work:

1. You dump your retail cart rom (or maybe obtain it another way?)
2. You dump your retail cart save
3. You rename your .3ds dump to .3dz and put it on your Gateway red card
4. You rename your .sav dump to <titleid>.sav and put it on your SD card
5. Load up the .3ds dump

Now I'm going to tell you that this will work with like 15% of games. Sorry
This will only work if that game's save is 512kb in size. If it isn't then it'll
read as corrupt. That's not the only issue though...

All retail games released after 6.0.0
In firmware 6.0.0-11, nintendo introduced a new way of encrypting save data.
Games that include a 6.0.0-11 or higher firmware on the retail cart use this encryption.
This is where things get dicey. One of the keys used for the encryption is loaded on
console boot. It doesn't get reloaded when you boot into EmuNAND. This used to be
an issue for 4.x users wanting to play retail carts with this kind of encryption.

Gateway basically overcame this issue by making those games playable in Classic mode
using the 4.x key loaded at boot. This meant that the games would save fine, but you couldn't
open that save on a 9.x sysnand console, and the reverse was true as well.

Well, now those 9.x sysnand saves will work in Classic mode, as long as your console is on
sysnand 9.x. Gateway properly uses the 9.x key that was loaded at boot... but if you dump
the same saves with the Gateway launcher, they won't work. I'm pretty sure this is a bug,
and I've sent an email to Gateway about it. You can read about that here.

There are two bottom lines here. The first is that dumped saves won't work under the
following conditions:

1. The game's save is not 512kb in size
2. The game uses >6.0 encryption for saving

The second bottom line is that you will lose the ability to play retail saves that use
>6.0 encryption on your 3ds if you downgrade to system NAND 4.x.
Additionally, if you have >6.0 eshop games that you started playing on a >6.0 system,
and you weren't in gateway mode, you won't be able to keep those saves either*. This is because of
the aforementioned mismatch in the keys used to encrypt and decrypt saves. Basically, if
you want to continue to be able to play retail games with >6.0 save encryption, you need to
stay on the system NAND version you are currently on. You'll need to stay at that system NAND
version until gateway fixes all of these save compatability issues.

THE ISSUES IN THIS SECTION ONLY APPLY TO RETAIL CARTS! See "Eshop games and .cia files" for backing up eshop/cia saves!


* This statement seems to be contested. I can't test it myself because I don't have any eshop
games that fit the criteria, but we have two conflicting stories about this.


6. Why you should think hard before downgrading to 4.x
See the last two paragraphs in the previous section.

 

[NNV]

We're not worthy.

This post needs to be stickied.

 

[Thomas12345]

Quick question.... After I press "Format Emunand", GW creates an exact copy of my sysnand right? So at that point, if I immediately go into my emunand, I can play my eshop games (bought and last played on sysnand) and still have all my saves? I mean emunand and sysnand would have the same unique info right?

 

[mmn]

Quick question.... After I press "Format Emunand", GW creates an exact copy of my sysnand right? So at that point, if I immediately go into my emunand, I can play my eshop games (bought and last played on sysnand) and still have all my saves? I mean emunand and sysnand would have the same unique info right?

Yes, that should be possible.

 

[Thomas12345]

Yes, that should be possible.

Thanks, how long did it take you to write this thing

Also, if I boot into classic mode with 9.2 sysnand, can I make GW remember the 9.2 encryption key? Then downgrade and have GW still use the 9.2 encrytion key?

Also after I extract my Emunand using emunand tool, can I flash it to my sysnand using Downgrade + hold up arrow? If this is possible, then maybe I can get savedatafiler to run on my sysnand and dump the save of my Pokemon Y cartridge

 

[JimMack]

Great guide, condenses a lot of things that are being addressed into one topic. Do you think you could add in how playing DS games is affected by all of this stuff? I have an Acekard 2i right now, though I imagine I wouldn't need that anymore.

 

[Thomas12345]

Great guide, condenses a lot of things that are being addressed into one topic. Do you think you could add in how playing DS games is affected by all of this stuff? I have an Acekard 2i right now, though I imagine I wouldn't need that anymore.

You can only play DS games in sysnand. You cannot play DS games in Gateway mode or in Classic mode.

Also, if you play a DS game, you have to re-install the blue card exploit. But it shouldn't be too much of a hassle, since you'll already have the flashcart in your 3DS. Just re-install the exploit when you're done playing your DS game

 

[MelonGx]

I'll say:

If you want to dump your 3DSwares, please STAY EVERYTHING "BAD BAD BAD" IN No.3.
Otherwise you cannot use most of the dump tools because they only support emuNAND-ID=SysNAND-ID.

 

[pu1se80]

Thanks! Definitely going to need this once N3DS support becomes available.

 

[ubergeek77]

I'm going to assume retail -> cia (even for games that don't use 6.x encryption) isn't going to happen any time soon, right?

I'm still trying with CFW, hopefully it works at the end of it.

 

[Ralph1611]

Thanks.... I wanted to downgrade to 4.x but still want my >6.0 games

 

[mmn]

I'll say:

If you want to dump your 3DSwares, please STAY EVERYTHING "BAD BAD BAD" IN No.3.
Otherwise you cannot use most of the dump tools because they only support emuNAND-ID=SysNAND-ID.

Well, all you need to do to circumvent that is to restore a previous NAND backup where the ID's are the same. Backups sure are great.

I'm going to assume retail -> cia (even for games that don't use 6.x encryption) isn't going to happen any time soon, right?

I'm still trying with CFW, hopefully it works at the end of it.

Retail -> cia works for pre-6.0.0 card 2 games. If you have an MT Card, retail -> cia works for all pre-6.0.0 games.

 

[masenko]

I'm planning on getting a new 3ds xl when it comes out, could i update my 3dsxl regular from 9.2 sysnand to 9.4 emunand and then use system transfer to new 3dsxl? then i could keep 3dsxl for gate and new3dsxl for real carts

 

[Zidapi]

If you are on firmware 5.x-9.x, up to 9.2, here are your options:

Less than ten lines in and I've already found your first error.

The system versions that can exploited with Gateway 3.x range "from 4.5 and all the way up to 9.2" according to their announcement blog post.

To further support this I'm currently running Gateway 3.0 on my 4.5 system, and am able to load emuNAND both by the DS Profile exploit and the Go web exploit.

 

[cearp]

The EmuNAND/Save Data Mega Guide GBATemp Doesn't Deserve
There are way too many people running around asking the same questions and getting the same answers from me, so here we go.

'from me' - that makes it sound a bit like you are the only one helping people here, but still, thanks for the guide for people. but no need to say that people don't deserve it. it is cool to help but not cool to say things like that.
do you want people to bow down and say things like 'thank you oh so much for giving this guide to us even when we don't deserve it'... jeez

 

[Zidapi]

'from me' - that makes it sound a bit like you are the only one helping people here, but still, thanks for the guide for people

I concur, it reads as pretty arrogant to me. There are plenty of really helpful people here.

That aside, I'd definitely support your guide being stickied.

 

[RikuCrafter]

I got a reply telling me I'd be able to play my retail Persona Q and Smash etc. with EmuNAND on 9.2, with my 4.5 SysNAND. This guide says that's not possible. Could I get some clarification please as to which one is right?

 

[gudenau]

This needs a sticky!

 

[Jiro2]

Three questions:

1) I am still trying to figure out how to dump the save game of Streetpass Mii Plaza (to transfer it from one machine to another). Is it possible to do this?

2) I had a Pokemon ORAS demo on the Gateway as a .3ds. I downloaded one off the eshop and transferred the save using SaveDataFiler. This worked. My machine is SysNAND 4.1 and Em,uNAND 9.4. From what you are saying, the one on the Gateway runs using old encryption. ORAS demo uses 7.0.0 which means that the one from the eshop would use new encryption. So how did this work?

3) Would it be possible to modify this guide to also explain the situation with NNIDS, which is almost as confusing? (I guess if you did this you'd have to rename the title)

 

[mmn]

Less than ten lines in and I've already found your first error.

The system versions that can exploited with Gateway 3.x range "from 4.5 and all the way up to 9.2" according to their announcement blog post.

To further support this I'm currently running Gateway 3.0 on my 4.5 system, and am able to load emuNAND both by the DS Profile exploit and the Go web exploit.

Alright, I fixed that, thanks.

'from me' - that makes it sound a bit like you are the only one helping people here, but still, thanks for the guide for people. but no need to say that people don't deserve it. it is cool to help but not cool to say things like that.
do you want people to bow down and say things like 'thank you oh so much for giving this guide to us even when we don't deserve it'... jeez

I concur, it reads as pretty arrogant to me. There are plenty of really helpful people here.

That aside, I'd definitely support your guide being stickied.

Oh my god I just reread that and I can't believe I actually published that.

Needless to say, I've removed it.