Hacking [GUIDE] Upgrading 8.1.0-0J to 9.2.0-20J

[Oishikatta]

Heya, how did you get an english emunand going? Im on N3ds 9.2 and the info is quite sketchy. I read something about installing the 3dnus CIAs but whenever i do a bunch of them fail and the emunand runs like dog ass until i restore it. Menus etc. are still in Japanese. Any info would be helpful.

Easiest method is to region change sysnand and then create an emunand from it, then if you like just restore your JP sysnand with gateway's launcher.

Guide in first post here: http://gbatemp.net/threads/creating-a-north-american-non-xl-new-3ds.381775/

Stuff about NNID/eshop is all unnecessary since eshop won't work on region changed n3ds.

Basic outline:

1. Obtain SecureInfo_A file from target region. Public files for US/EUR available but not allowed to be shared here.
2. Patch nim to use my URL hosting the 9.2U response by yifan_lu, "update" to 9.2U. Your 3DS will still be JP after.
3. Use yifan_lu's 3DSSwapConsole to install the new SecureInfo_A file. Your 3DS will be changed to US after reboot.
4. Create emunand.
5. Use FBI to delete all -J titles in emunand.
6. Optional: Restore JP sysnand.

All covered in the linked thread, including a .zip file with all required stuff except a SecureInfo_A file.

 

[Taslion]

Yeah basically what oishikatta said. You do the region swap by redirecting your update to his server, run 3dsswapconsole to finalize becoming a different region, then with your new franken-firmware you format your emunand. Then you can format your actual nand with your original nand backup to make it so you boot into your original 3ds region and then can boot into your hacked region emunand.

Also of important note to anyone else who might run into this problem!:

If you fail to update the first time using oishikatta's server and then subsequently keep failing to update you should enter+leave recovery menu to delete the pending update files. I think when you fail once and retry the old files mess up the update process so its best to just clean up and try again

 

[FF777]

I wanted to say that, if people are paranoid about using this, you might look at this thread about how to use OpenDNS to block the nintendo updating websites: https://gbatemp.net/threads/blocking-the-3ds-from-receiving-the-wifi-update-using-opendns.375643

I think that should work any way, since this upgrading method is rewriting where to download the update from (either your local network or Oishikatta's server)..

This might have prevented Death78793 from accidentally updating sysnand to 9.7.. That is a hard feel..


Also, I am about to try this method soon on my 8.1.0J smash-bros N3DS.. I'm using linux though, so need to find one of those pesky windows laptops from some one (all just to run a few commands −＿− Wish the debugger was portable..)

EDIT: I was wrong, you can't block nintendo update servers and still have this update work..

 

[dkabot]

I wanted to say that, if people are paranoid about using this, you might look at this thread about how to use OpenDNS to block the nintendo updating websites: https://gbatemp.net/threads/blocking-the-3ds-from-receiving-the-wifi-update-using-opendns.375643

I think that should work any way, since this upgrading method is rewriting where to download the update from (either your local network or Oishikatta's server)...

Negative. I tried doing it with Nintendo servers blocked, did not work, gave an error.
The server we're redirecting to is not hosting the update, only data about what the update is.
Nintendo has the older versions still on their servers, we just told it that was the latest and off it went.

Also, I am about to try this method soon on my 8.1.0J smash-bros N3DS.. I'm using linux though, so need to find one of those pesky windows laptops from some one (all just to run a few commands −＿− Wish the debugger was portable..)

Try Wine, someone posted that worked. If the debugger connects and lists processes I'd find it hard to imagine write won't work.

 

[FF777]

The server we're redirecting to is not hosting the update, only data about what the update is.
Nintendo has the older versions still on their servers, we just told it that was the latest and off it went.

Oh okay, I didn't know it worked like that.. Thanks for clearing that up for me..
Have to admit though, kind of odd that nintendo still gives access to all the older firmwares, even if you have to craft a custom response and all that stuff to get it..

Try Wine

I was thinking about trying wine, but I'm kind of paranoid when it comes to my 3ds.. Might try it any way in few days when I try this upgrade..

 

[FF777]

So, I tried it finally.. I decided to use an actual windows laptop from a friend for the debugger because I don't like to take any chances with my precious 3DS..

I read all instructions very carefully, and used oishikatta's server thing to do it..

But then, when update started, I thought "Oh crap, I forgot that I have the 3DS set to use openDNS, and I have openDNS set to block all the nintendo update addresses!"........
...but some how, it still continued updating.......So I was wondering where the hell it was connecting to, unless openDNS is lying to me and not really blocking those addresses..
So, that made me a little scared while it was updating.......I was thinking "Oh crap, what if it is using some other weird server, and for some reason updating me to 9.99999999 or whatever stupid version is the newest right now..

>I prayed to the dark lord satan to please give me 9.2.0!
>Update took a while.. Sweating the whole time..
>Finally gets done.. It restarts automatically..
>Tells me about new themes and other crap I don't care about..
>Rush to settings menu.. Firmware 9.2.0J.....mypeniswhen.jpg
>Afterwards realize that I owe satan my soul after I die..

Still have no idea why it worked even though openDNS is allegedly blocking all the update sites, but I want to thank you all for making my life dream of hacking 3DS finally a realization.. Can use things like ninjhacks and stuff to spoof firmware so I am prepared for later things that are released..

 

[FF777]

One more thing I wanted to say to any one doing this: You might want to back-up your sysnand again after successfully updating to 9.2.0 in case you have to restore your sysnand for some reason in the future, but maybe by that time (for some unknown reason) this upgrade-to-9.2.0 trick won't be working any more (maybe for example, nintendo quits hosting old firmwares, who knows).. I am saving both versions from my N3DS; the nand from when it was 8.1.0, and the nand from when I put 9.2.0 on it, just to be safe..

 

[twede86]

Welp, I had something go wrong and I am now updated to 9.7. I am beyond frustrated now, especially after doing so many precautions to prevent this from happening.

I do have a backup of my 8.1 sysnand, though there won't be any way to restore it on for the time being, right? Please tell me I'm wrong.

 

[cearp]

I do have a backup of my 8.1 sysnand, though there won't be any way to restore it on for the time being, right? Please tell me I'm wrong.

well you flash it back via hardware to nand.

 

[Elusivo]

How to get the Raw SOAP reply for 9.2.0-20E O3DS?

 

[FF777]

Welp, I had something go wrong and I am now updated to 9.7.

Well that's super crappy.. I just updated mine a few days ago using this method, and I was praying that these aren't crazy people on here just trying to trick me in to updating to to latest firmware so I can't hack N3DS any more.. But I did every thing correctly I guess (copy/pasted the codes so I didn't typo, and once I entered the system settings, I didn't exit back out or any thing)..

Fortunately for me it successfully updated to 9.2.0 (giant relief for me)..

The sucky thing about this method though, is that there is no way to verify that the 3 write codes actually did the change that they are supposed to.. I know the debugger says it wrote correctly, but I was thinking "How do I know it changed the right places in memory or not?"..

I have no idea why it didn't work for you and Death78793.. But I do know this is a really risky method, basically because if any thing is not done perfectly, it updates to the actual latest version, which of course means you can't hack 3DS any more..

But I am glad you at least backed-up 8.1.0 before trying this, but I think as of yet no one has found a way to hardwarely restore the NAND to N3DS yet..

As far as I can think, you have 4 options at this point, all of them crappy:
1: Wait until some one finally figures out how to hardware-restore the N3DS, then restore your 8.1.0 back-up..

2: Sell N3DS on internet; Buy new jap N3DS and try this method again (especially maybe if you know where some thing went wrong) and pray really hard..

3: Sell N3DS on internet; Buy new jap N3DS and stick with 8.1.0J for now, and just worry about features for 9.0-9.2 later when maybe more hacks have been found to help you update, or maybe ninjhax will be ported to 8.1.0 or some thing.. (Future problems have future solutions)..

4: Sell N3DS on internet; Buy an american N3DS so that you should (maybe) have 9.0-9.2 version, then you don't have to worry about this risky updating method.. Once it is hacked, you can still play all of your good old favorite 日本語 games even though it is an american console.. And if you feel like it, might even try some of those methods where you change the system region (at least I THINK maybe you can do that, but I don't know much about it.. Some thing to do with using things like FBI and deleting titles from NAND and installing new .cia files for the menu of the region you want..)

Any way, I feel sorry for you.. If my update would have gone to 9.7, I would have been very disillusioned as I am sure that you are right now.. I think gbatemp needs an emotional support thread for those who have bricked or otherwise messed up their consoles some how..

EDIT: Just wanted to say holy crap, you registered in 2003 and only 75 posts.. That is impressive..

EDIT 2: I did some more looking around and found out there supposedly is a way to restore sysnand to a N3DS.. I found information about it in this thread: https://gbatemp.net/threads/n3ds-nand-backup-possible-i-hope.381506

 

[cearp]

The sucky thing about this method though, is that there is no way to verify that the 3 write codes actually did the change that they are supposed to.. I know the debugger says it wrote correctly, but I was thinking "How do I know it changed the right places in memory or not?"

you can read the memory of the process to make sure if has changed to what it should be

 

[FF777]

you can read the memory of the process to make sure if has changed to what it should be

Right, but what I meant was that, even if the 3 writes were successful, I was still worrying about the writes patching the correct places they need to patch (like maybe if 3DS used dynamic memory locations or some thing).. For example, maybe when yifan_lu was testing it, his 3DS needed to be patched at 0x15E424 or whatever, but maybe for some reason my 3DS had the URL addresses at some other weird location, so even if I patch 0x15E424 etc, it would have written over some thing else (and not the URL memory address that I want to change)..

I am not saying that the 3DS uses dymanic memory allocation necessarily, but I am saying I don't know how the 3DS works at all really, so when you are sitting there for a long time staring at the update process, all sorts of crazy worries start to go through my tiny brain.. Specifically "I hope those 3 writes really did patch the correct place.....otherwise I am downloading 9.7 update right now)..

EDIT: Actually, now that I think about it.....since you DO have the ability to read addresses (I didn't know you could do that before), I suppose that you could first READ the target address *before* you write to it, just to make sure it is the nintendo URL....and then you could do the 3 writes.....then, when you are in the settings menu, and just before you start the update, check/read the 3 addresses just to make sure that they now point to oishikatta's server..

 

[Oishikatta]

EDIT: Actually, now that I think about it.....since you DO have the ability to read addresses (I didn't know you could do that before), I suppose that you could first READ the target address *before* you write to it, just to make sure it is the nintendo URL....and then you could do the 3 writes.....then, when you are in the settings menu, and just before you start the update, check/read the 3 addresses just to make sure that they now point to oishikatta's server..

Correct, but the debugger does not function inside of system settings, so you will do read/replace/check and then enter system settings.

 

[TheShadowRunner]

If only OoT could be used with NTR, sigh...

 

[cmbeke]

Right, but what I meant was that, even if the 3 writes were successful, I was still worrying about the writes patching the correct places they need to patch.

All you need to do watch your router's traffic and make sure it goes to the update server you chose before it downloads the files from nintedo's servers.

 

[owamugen]

Thank you for the guide and the host, I was able to update my sysnand from 8.1 to 9.2j.

 

[Raugo]

Can this method works without NTR CFW? Using a custom dns server to change the nintendo url?

 

[Wowfunhappy]

Nope. By default (aka, without NTR), Nintendo updates use an encrypted https connection which prevents this sort of thing.

 

[FF777]

I wanted to say that I think I might have been misinformed when I said that I didn't think there was any way to restore sysnand to a N3DS yet..
I'm not sure there is a post in this thread yet saying "Don't worry, you can restore your sysnand via hardware method".. So I want to say that now just to be clear..

I think a lot of people with japanese N3DSs check this thread, so I wanted to say, first back-up your sysnand of course, and then try to update it to 9.2.0 using this thread's method, but if you fail, I wanted to post this link to how you can do a hardware modification on your N3DS: https://gbatemp.net/threads/n3ds-nand-backup-possible-i-hope.381506

Although if you are careful enough, hopefully you won't need to do that..