This method no longer works as-is because Nintendo removed the update files from their servers. You now need to host the files on your own server and modify the GetAccountStatus request to point to it. See here for the cached 9.1J/9.2U update files.
I posted this http://yifan.lu/2015/03/23/nintendo-3ds-system-updater/ but I thought some people here may be interested. Please note this should only be attempted by those who understand what they're doing (aka, this is not noob friendly). Hopefully someone may make a more noob friendly solution based on this information (like a NTR plugin with a hosted SOAP server). Also, this procedure can be used to upgrade any version to any other version (maybe even downgrade provided you are already <= 9.2) in any other region but that's an exercise left to the reader.
(Oh yeah, for those who have to ask. The reason for this is because ninjhax isn't supported on 8.1.0-0J)
Prerequisites
EDIT 2: Oishikatta was kind enough to host the files, so you don't need to have a web server http://gbatemp.net/threads/guide-upgrading-8-1-0-0j-to-9-2-0-20j.384960/page-6#post-5420331 be warned that when you do this, you're sending your account id, serial number, and device token to someone else! (They can for example use this information to transfer your eshop account to their 3DS.)
I posted this http://yifan.lu/2015/03/23/nintendo-3ds-system-updater/ but I thought some people here may be interested. Please note this should only be attempted by those who understand what they're doing (aka, this is not noob friendly). Hopefully someone may make a more noob friendly solution based on this information (like a NTR plugin with a hosted SOAP server). Also, this procedure can be used to upgrade any version to any other version (maybe even downgrade provided you are already <= 9.2) in any other region but that's an exercise left to the reader.
(Oh yeah, for those who have to ask. The reason for this is because ninjhax isn't supported on 8.1.0-0J)
Prerequisites
- Cubic Ninja
- NTR CFW 2.0 and NTR Debugger
- A web server with support for some kind of scripting language (PHP for example)
- Clear any pending update by entering recovery mode and exiting (I don’t think this is needed but better safe than sorry)
- Host the SOAP response for the version you want to update to on your web server. You can find all the raw SOAP responses from yellows8’s update report site. For example, here is the one for 9.1.0-20J. According to yellows8, there was a bug and his bot did not capture 9.2.0-20J. However, since there was only two titles changed in that update, I just manually crafted a 9.2.0-20J response.
- Host the SOAP response for the update title hash. Here is the template. You need to change the value of the TitleHash to match the TitleHash at the end of your update response from step 1.
- Create a script that responds with one of the two SOAP responses above depending if the request header is for “urn:nus.wsapi.broadon.com/GetSystemUpdate” or “SOAPAction: urn:nus.wsapi.broadon.com/GetSystemTitleHash”. I made a two lined PHP script called “update.php” that does this.
- Host the SOAP response for getting the server URLs. The template for this is here. You only need to change the value of NusURL to point to your NUS responder script created in step 3. (In my case, it would be http://myhost.com/update.php)
- Boot your 3DS into NTR CFW 2.0 and connect the debugger
- Use listprocess() to get the PID for “nim”. On 8.1.0-0J, it should be 0x25.
- Patch NIM to use your server for NetUpdateSOAP (this offset is for 8.1.0-0J): write(0x15E424, tuple(map(ord, “http://myhost.com/update.php\0″)), pid=0x25)
- Patch NIM to use your server for ECommerceSOAP. Since you’re only responding to GetAccountStatus, it is okay to hard code this: write(0x15E0EC, tuple(map(ord, “http://myhost.com/GetAccountStatus_response.xml\0″)), pid=0x25)
- Do the same for another reference to ECommerceSOAP: write(0x15E463, tuple(map(ord, “http://myhost.com/GetAccountStatus_response.xml\0″)), pid=0x25)
- Go into system settings, and perform an update (do NOT exit system settings as you will lose your patches and will have to perform them again after restarting).
- Once the update is done, you will be prompted to restart, however because you are in NTR mode, the screen will just go black. You need to hold the power button and manually restart.
EDIT 2: Oishikatta was kind enough to host the files, so you don't need to have a web server http://gbatemp.net/threads/guide-upgrading-8-1-0-0j-to-9-2-0-20j.384960/page-6#post-5420331 be warned that when you do this, you're sending your account id, serial number, and device token to someone else! (They can for example use this information to transfer your eshop account to their 3DS.)
Last edited by yifan_lu,