Hacking [GUIDE] Upgrading 8.1.0-0J to 9.2.0-20J

[Syphurith]

One quick question:
Does 9.1.0-20J come with a browser?

3DS version explanation:
9 - Major, 2 - Minor. 0 - Always zero, maybe debug ones different. 20 - browser version. J - Japan region.
So it has a browser.

 

[Ronhero]

Yes it has a browser ans all exploits work.

 

[reiyu]

nvm delete this pls.

 

[srwgin]

Well, no one seems to have posted a working set up here since Nintendo took down the files, so here they are for anyone still in need. Be sure to change my local address in all the files (192.168.1.66) to your computer's address

Tested these myself. Thanks to @pegasus21 for the help, and @yifan_lu for the original hard work.

I compare your GetSystemUpdate_response.xml and GetSystemUpdate_response.xml.920
found most files fssize different why？
GetSystemUpdate_response.xml.920 is the same as GetSystemUpdate_response.xml.yifan
GetSystemUpdate_response.xml.pegasus21 only 2 files different

GetSystemUpdate_response.xml.920 Yifan
<TitleId>0004003000008202</TitleId>
<Version>15360</Version> //can not find on http://yls8.mtheall.com/ninupdates/reports.php
<FsSize>3375104</FsSize>
<TitleId>000400DB00017202</TitleId>
<Version>9248</Version> //can not find on http://yls8.mtheall.com/ninupdates/reports.php
<FsSize>147456</FsSize>

GetSystemUpdate_response.xml.pegasus21
<TitleId>0004003000008202</TitleId>
<Version>14336</Version> //9.1
<FsSize>3256320</FsSize>
<TitleId>000400DB00017202</TitleId>
<Version>9232</Version> //9.1
<FsSize>20480</FsSize>

 

[Tokiopop]

I compare your GetSystemUpdate_response.xml and GetSystemUpdate_response.xml.920
found most files fssize different why？
GetSystemUpdate_response.xml.920 is the same as GetSystemUpdate_response.xml.yifan
GetSystemUpdate_response.xml.pegasus21 only 2 files different

GetSystemUpdate_response.xml.920 Yifan
<TitleId>0004003000008202</TitleId>
<Version>15360</Version> //can not find on http://yls8.mtheall.com/ninupdates/reports.php
<FsSize>3375104</FsSize>
<TitleId>000400DB00017202</TitleId>
<Version>9248</Version> //can not find on http://yls8.mtheall.com/ninupdates/reports.php
<FsSize>147456</FsSize>

GetSystemUpdate_response.xml.pegasus21
<TitleId>0004003000008202</TitleId>
<Version>14336</Version> //9.1
<FsSize>3256320</FsSize>
<TitleId>000400DB00017202</TitleId>
<Version>9232</Version> //9.1
<FsSize>20480</FsSize>

Mine is for files converted from .cias that are available on that one ISO website, hence different filesizes.

If you have the original update files then use the others

 

[srwgin]

Mine is for files converted from .cias that are available on that one ISO website, hence different filesizes.

If you have the original update files then use the others

I only have 9.2J CIA
if I use node.js converted
it must use your?

 

[Tokiopop]

I only have 9.2J CIA
if I use node.js converted
it must use your?

Well mine are actually for 9.1, but I converted what I thought was 9.2. I'm not sure if 3DNUS bugged out (it saved the files as 9.2.0-20) or if my system settings is just displaying the wrong version somehow.

I think the best way to tell which to use is to go into one of the folders, 0004001000020000 for example, and compare the filesize of all files with an 8-digit name to the filesize in the .xml. If you use an incorrect GetSystemUpdate_response.xml nothing bad will happen, the download of the firmware will just fail and you'll get an error on your 3DS.

 

[srwgin]

Well mine are actually for 9.1, but I converted what I thought was 9.2. I'm not sure if 3DNUS bugged out (it saved the files as 9.2.0-20) or if my system settings is just displaying the wrong version somehow.

I think the best way to tell which to use is to go into one of the folders, 0004001000020000 for example, and compare the filesize of all files with an 8-digit name to the filesize in the .xml.

thank you for help
I will check and test later

 

[MelonGx]

For the -20, if anyone put the 9.1.0 CVer and the -20 NVer only on the server, it also gives you 9.1.0-20.
But I think no one will do that nonsense thing.

 

[Syphurith]

@srwgin The official FsSize can not be easily calculated - i find no clues of how to do so, but, that is in fact not checked by the console.
Yes, as @Tokiopop said if the response is invalid it would just fail. But those different ones isn't checked actually - the FsSize, and TitleHash.
If you mind this really, you can download the official SOAP response from yellows8 server, and modify it to a similar file without "TITLELIST_HERE".

And, if you've modified the link correctly it would update super fast, cause it transfers data in local network.
So if you modified the wrong position, and find it update quite slow - just off the wifi. But it should easily fail before downloads.
You can check if it is accessing the server, by UniServerZ: "Apache->Apache Log->View Apache Access Log" and look at the file end.
You can always dump the 0x00100000 of the nim process and search for the link position yourself.
If you modified the correct position but wrong IP or port, it would just fail.

 

[enarky]

Trying to update my JPN 8.1.0-0 N3DS to 9.2.0-20 with @Syphurith's script and the CIAs from that ISO site, but I'm hitting a roadblock somewhere. Everything seems to run peachy, until my N3DS downloads 000400102002CA00/tmd.1. I then get the message that an error has occured and that my N3DS is powering off. I tried it countless times (with two different 9.2.0-20J filesets and also with 9.0.0), but it's always the same. Anyone has an idea what might've happened there?

 

[Syphurith]

Trying to update my JPN 8.1.0-0 N3DS to 9.2.0-20 with @Syphurith's script and the CIAs from that ISO site, but I'm hitting a roadblock somewhere. Everything seems to run peachy, until my N3DS downloads 000400102002CA00/tmd.1. I then get the message that an error has occured and that my N3DS is powering off. I tried it countless times (with two different 9.2.0-20J filesets and also with 9.0.0), but it's always the same. Anyone has an idea what might've happened there?

It seems this title would block the update, and i don't know what check is implemented for this.
You can just remove cia of this title and redo all the steps. Even the name of the title NCCH is "newslist".
Or if you know xml, you can remove the small xml segment for this title in the GetSystemUpdate.partial.xml.
BTW, i've seen someone succeeded to update his N3DS to 9.1-20J after removed this specified title.
EDIT: Hope you would success soon. Also you can write tutorials for how to use this if you like and no names of mine is required.

 

[enarky]

It seems this title would block the update, and i don't know what check is implemented for this.
You can just remove cia of this title and redo all the steps. Even the name of the title NCCH is "newslist".
Or if you know xml, you can remove the small xml segment for this title in the GetSystemUpdate.partial.xml.
BTW, i've seen someone succeeded to update his N3DS to 9.1-20J after removed this specified title.
EDIT: Hope you would success soon. Also you can write tutorials for how to use this if you like and no names of mine is required.

Thanks, I've removed that title from the .partial.xml and the update process went through. Looks like whatever that file does it's not important for the update and instead of updating to 9.2.0-20 it updates to 9.1.0-20 without it. Whew.

As for tutorial, I'm not sure if I'm the right person to do that. I did most of that on OSX with the debugger running in a Windows VM and my webserver running on my Debian server, I don't think a lot of people have that setup. But I'll help anyone with questions, of course.

At least I can say your scripts work and made the update possible. So, thanks a lot, cheers!

 

[Bug_Checker_]

The official FsSize can not be easily calculated - i find no clues of how to do so, but, that is in fact not checked by the console.

What did you use to parse the cia(s) (assuming your original source was a cia)?

 

[Syphurith]

What did you use to parse the cia(s) (assuming your original source was a cia)?

A nodejs script, hand written. Those all details are in source code in the package i posted before.
There should be a install.txt to guide you setup the server yourself.
But, mind you please tell me why you ask this question? I might not have get your words well.

 

[evilweevil]

I just successfully updated to 9.1.0-20J using Tokiopop's setup and Syphurith's .cia unpacking script with the supposed 9.2.0-20J update files from the-site-that-must-not-be-named, and the process went quite smoothly. Honestly, the READMEs + having already read Yifan Lu's original post before made it quite clear what needed to be done. Having said that, it did take two tries though, since I forgot to add the inbound rules for port 80 in Windows Firewall so the first attempt ended up hanging for a bit before failing since the update server couldn't be reached.

Now I just need to look into what CFW solution for emuNAND works best and figure out region changing.

 

[Tokiopop]

I just successfully updated to 9.1.0-20J using Tokiopop's setup and Syphurith's .cia unpacking script with the supposed 9.2.0-20J update files from the-site-that-must-not-be-named, and the process went quite smoothly. Honestly, the READMEs + having already read Yifan Lu's original post before made it quite clear what needed to be done. Having said that, it did take two tries though, since I forgot to add the inbound rules for port 80 in Windows Firewall so the first attempt ended up hanging for a bit before failing since the update server couldn't be reached.

Now I just need to look into what CFW solution for emuNAND works best and figure out region changing.

I looked into region changing and it honestly doesn't seem worth the trouble. Just use RXtools + NTR and use the language emulation plugin for the games that are in Japanese despite being EU/US

 

[andalù 69]

Hi..there
But at now it's possible again change from 8.1.0-0J to 9.2.0-20J
But is not possible to have a Youtube video guide for watching how to change FW 8.1.0-0J to 9.2.0-20J???
I don't have understand some point of guide!!!
For example what i have need???
Link download please!!

 

[Syphurith]

Hi..there
But at now it's possible again change from 8.1.0-0J to 9.2.0-20J
But is not possible to have a Youtube video guide for watching how to change FW 8.1.0-0J to 9.2.0-20J???
I don't have understand some point of guide!!!
For example what i have need???
Link download please!!

1.If you admit you're too noob for the guide you can contact @Ronhero.
2.If not you could ask others about the certain problem please, and please remember to ask the guy that released the content.
You might need to report what the IP of 3ds and PC are in the WIFI local network, and the corresponding log files that generated.
3.If what you're using is mine, i'm sorry i'm in China so no videos or whatever that much easy for you could be provided.
Also to notice it has been proven successful for now around 6/7 guys that have theirs updated.

 

[BurningDesire]

I put the files I used on a server, hopefully this makes it simpler.

It is still recommended of course to make a backup of your 8.1 sysnand first with gateway's launcher, and to enter and exit recovery mode to clear any pending updates.

connect("your 3ds ip", 8000)
write(0x15E424, tuple(map(ord, "http://jp81to92update.tk/\0")), pid=0x25)
write(0x15E0EC, tuple(map(ord, "http://jp81to92update.tk/\0")), pid=0x25)
write(0x15E463, tuple(map(ord, "http://jp81to92update.tk/\0")), pid=0x25)

Is the server still up? Does this method currently still work?