So, I went from 9.2 to 4.2 sysnand with 9.8 emunand and CIA installation apps with no hardware at all (Cubic Ninja, Gateway, DS Flashcard). I created a thorough guide for all of the steps I took. I don't want to post them here, because I'm a novice at 3DS modification and may have done a few things out of order (notably, formatting emunand in downgraded os vs original: it may cause issues re-linking original eShop/etc software, though I'm not sure if works the other way, either).
Anyway, if anybody is interested, lob me a PM. I want to see if they work for someone else before posting them broadly.
--------------------- MERGED ---------------------------
Screw it, I'll just post my guide with a...
HUGE DISCLAIMER: This is for original 3DS only, as far as I know. I wasn't able to figure out how to restore eShop content; it may have had something to do with creating EmuNAND after downgrading instead of before! I'd have continued efforts, but stupidly ran rxTools "dump system title tickets" and hard powered off during, bricking my device. Everything aside from the above worked a charm. I wrote this guide from memory after stepping through it twice, and may have missed a step or put something in the wrong order: if you find any of this, please let me know and I'll edit this post ASAP.
Anyway...
Okay, so I just went from 9.2 system version to 4.2.0-U9 SysNAND and 9.8.0-U20 EmuNAND without Cubic Ninja, Gateway, or a DS flashcard. Just an original 3DS XL. I had to figure some shit out along the way and it's a mess to cobble all of it together since info is scattered all over the place, so here's a quick rundown.
First, downgrade instructions (skip if already on 4.X):
1. Pop out the 3DS SD card, pop into a computer, backup the whole thing.
2. Download the Gateway software from
http://www.gateway-3ds.com/downloads/ - get BOTH the most recent Gateway software, AND the downgrade file set that's applicable to your region (both available on that page)
3. Place the downgrade file on the root of your SD card, alongside Launcher.dat from the Gateway software release (found in a folder in the zip named like "GW_Ultra_3.2.2(Public Beta)"
4. Put SD card in 3DS.
5. Launch browser.
6. Go into settings in browser, clearing cookies and history (for some reason this helps the success rate of the exploit)
7. (Optional) For easy bookmarking, turn wifi off (using the switch on the side), and try to navigate to the following URL:
http://go.gateway-3ds.com . It'll fail, because Wifi is off... this is where you can add a bookmark for subsequent launches. Turn wifi back on.
8. Navigate to
http://go.gateway-3ds.com. Gateway software should launch. Backup your System NAND.
9. Copy NAND.bin from your SD card onto your computer, somewhere safe: this is a complete copy of the internal system of your 3DS before molesting it, and you may wish to restore it at some point.
10. Back in Gateway software (relaunching if you have to), select the Downgrade option. Do that.
Outcome: You're now on 4.2.0-U9. Verify by restarting your 3DS and launching the Settings app and checking.
Downgrade is complete, now let's get the CIA installation software on there. You'll do that by installing PBT-CFW and pushing CIA files across the network.
Now: install mset exploit (let's you run things from SD card using 4.X using the "profile" exploit) for running PBT or Pasta
1. Pop SD card in PC again.
2. Format. I used FAT32, since my card is only 32Gb. If yours is larger, may need to find a tutorial somewhere; I didn't have to do that stuff.
3. Grab the spiderprof.zip file from here:
http://s000.tinyupload.com/index.php?file_id=47753777289998764895 - extract that code.bin onto the root of your SD card
4. Pop SD card back in 3DS, and launch the camera "mini-app" by pressing L or R on the home screen. Scan the following QR code:
5. It'll launch the browser, the bottom screen will show some info about running some stuff... once it "flashes", it should be installed. Hard reset your 3DS by holding the power button and turning back on.
Outcome: 4.2.0-U9 with mset exploit installed
Now: Run PBT and install CIA installers
1. Format SD card again from computer
2. Download Palentine from here:
http://jheberg.net/captcha/palantine-cfw-2/
3. Extract the contents of "SD Card" directory inside of that archive to the root of your SD card.
4. Delete Launcher.dat
5. Rename Launcher_GW.dat to Launcher.dat
6. Download PBT from here:
https://gbatemp.net/threads/release-pbt-cfw-import-cias-on-your-sysnand.383242/
7. Copy the boot.bin from the PBT zip to the SD card, overwriting the existing boot.bin
8. Insert SD card into 3DS. Start it up and it should create some stock folders onto your SD card (I believe it gives a message saying so).
9. Eject SD card, back to PC. Explore the card's files. Find the "Nintendo 3DS" folder, and keep drilling into it until you see a folder called "extdata". Create a new folder NEXT TO, not within, called "dbs". In that "dbs" folder, create blank text files called "title.db" and "import.db".
10. Drop the SD card back into the system and turn it on. Go into "System Settings", "Data Management", "Software". Let it "reset" the SD card.
11. Launch system settings. Hit "Other Settings" -> "Profile". Now hold the L button on your 3DS, and tap "Nintendo DS Profile"
12. The top screen should turn blue for a bit. Then it'll re-launch the 3DS home; you shouldn't see any kind of "System Error" here. If the screen freezes on the blue screen (happens often), hard reset and try again until it makes it back to Home
13. Find the 3DS IP. Use your router's admin screen, or this tool:
http://www.nirsoft.net/utils/wireless_network_watcher.html
14. Download whichever CIA's you want to install. I used these: BigBlueMenu -
http://www10.zippyshare.com/v/45736044/file.html and FBI:
https://gbatemp.net/threads/release-fbi-open-source-cia-installer.386433/ (linked that page because it has valuable info and links to a network install app for FBI... for now, just download FBI itself from the github releases link)
15. Copy the CIA files from above into the Palentine directory you extracted earlier. It has batch files like "run.bat", etc.
16. Edit run.bat in the Palentine directory... replace IPTOMODIFY with your 3DS IP address, and the CIA filename with whichever one you want to install.
17. Launch run.bat. If things work, it'll report "Exit code 0" after displaying some debug info. If it can't find your 3DS, ensure the IP is right and that the 3DS is connected to your network and try again.
18. Repeat steps 16 and 17 to install more CIA files.
19. You should be able to verify that these apps installed by resetting your 3DS and relaunching the PBT exploit. They should now show as wrapped software. They'll launch when in PBT mode, but NOT from usual SysNAND.
Outcome: CIA installation utilities now exist. Yay!
Next: Create EmuNAND. This'll be a safe place to update to the latest system version and install new CIA files.
1. Backup your SD card by copying the files on it somewhere on your computer. THIS IS IMPORTANT. If you don't, then the CIAs you just installed will be gone after creating EmuNAND.
2. We need to get back into Gateway. Copy the Gateway Launcher.dat to SD card again.
3. Run the mset exploit again (Settings -> Other Settings -> Profile -> Nintendo DS Profile)
4. Should launch into the Gateway software again. Choose the "Create EmuNAND" option - let it format SD card
5. Restore the backup up files from the first step onto your SD card. Just copy them over.
Outcome: SD card now contains an EmuNAND.
Next: Use rxTools to launch EmuNAND and update system software
1. Find and copy "slot0x25KeyX.bin" to the root of your SD card - Google it. It's copyrighted, while the rest of this software is considered legal.
2. Download a sig patched rxTools.dat file. One option allows more 3DS games to work, another allows DSiWare/GBA games. Read more and retrieve file you want from here:
http://gbatemp.net/threads/rxtools-with-signatures-patched-out.390607/
3. Download rxTools from their website:
http://www.rxtools.net/#!downloads . Extract somewhere.
4. Under "release\tools", run "cdn_firm.exe". It'll fetch a "firmware.bin" file. Copy that to the root of your SD Card
5. Download "webMultiloader.exe" from
https://gbatemp.net/threads/beta-spider-ds-profile-roploader-4-x-only.380725/page-14#post-5434311
6. Run "webMultiloader.exe" and select option 5. It'll create a code.bin file; place that on the root of your SD card.
7. This will re-flash the mset exploit to work directly with rxTools. You want that. Insert SD card in 3DS, launch mini-camera again, scan this QR code:
- Same thing as when first installing mset will happen: screen flashes, then hard reset
8. Reboot 3DS, launch Nintendo DS Profile again. This time rxTools will open. Launch rxMode.
9. Open System Settings. Verify the version string says "RX-E ..."; the "-E" means "EmuNAND". You're now in EmuNAND! Yay!
10. After being absolutely sure you're in EmuNAND, go into "Other Settings" -> "System Update". This will update your EmuNAND to 9.8.
Outcome: You now have SysNAND on 4.2, EmuNAND on 9.8 and with CIA installation utilities!
Whenever you boot your 3DS it'll launch 4.2. To get back to EmuNAND, just launch the profile exploit in System Settings. Now you can install CIA files using whatever preferred method.
Edit 1: Missed a few steps in the PBT installation section (allowing system to reset card, creating "dbs" stuff. Added.
