How to UNBRICK your N3dsXL with NO SysNAND Backup File With B9S (Sighax) and Hardmod

Discussion in '3DS - Tutorials' started by joker_77, May 26, 2017.

  1. joker_77
    OP

    joker_77 Newbie

    Newcomer
    7
    9
    May 25, 2017
    Mexico
    Hi Everyone
    In this post I will try to explain you what I´ve done to unbrick my new 3ds XL without having a backup of your SysNAND... In my scenario my new3dsXL was bricked by updating the firmware from v2.1 when I was trying to install arm9lh (but i think this could unbrick any bricked console no mater how was bricked -talking about software bricks ofcourse-)
    I think this could help to unbrick any bricked 3ds console using the corresponding files
    I would like to share the files that I´ve used to unbrick my 3ds but I dont know if I can because Iam new on this site
    Well lets get started

    1- Extract your SysNAND using Win32DiskImager via hardmod and take it to a safe place in your PC (doesn´t even matter if this SysNAND is fuc..ked up it could be used as a "checkpoint" in the future)

    2- Follow this guide to Install B9S (sighax) in the copy of your SysNAND via hardmod (in my case I use the 11.4 native firm as current.firm -2nd Step of the Guide- because when I updated my 3ds the v11.4 was the last firm launched by Nintendo If you dont remember which firm was the last when you updated your 3ds just try one by one)
    https://3ds.guide/installing-boot9strap-(hardmod)

    3-Flash back to your 3ds the copy of your SysNAND that was renamed to NAND-patched.bin as the guide says with Win32DiskImager (at this point your SysNAND already has the sighax installed and now you can launch luma chainloader)

    4-Download and copy to your SDCard the latest Luma Files for Boot9Strap (sighax) and the latest Decrypt9Wip for Boot9Strap (this should be at luma/payloads and in .firm Format) and make sure the file "aeskeydb.bin" is at the "files9" folder on the root of your SDCard

    5-Download the 9.2 CTRTransfer file corresponding to your console from this guide (this file has to be at the "files9" folder with his .sha file)
    https://3ds.guide/9.2.0-ctrtransfer.html

    6-Conect the SdCard back to your 3ds and power on the 3ds holding "start" botom to launch the luma´s chainloader and launch Decrypt9Wip and then go to "Sysnand Options>CTRNAND transfer...>Auto CTRNAND transfer" complete the combo keys and choose the CTRtransfer File and wait until finish

    7-After rebooting the console it has to boot Normaly then you just have to update your firm to 11.4 and install FBI and that stuff

    Iam sorry for my Bad english but i tryed to do it with out the google translate
    I hope you could Unbrick your console with this info
    Take care and Good luck
    Pease
     
    iAqua, Lacius, Kubas_inko and 5 others like this.


  2. pepepotamo

    pepepotamo Member

    Newcomer
    32
    6
    Dec 16, 2010
    Cote d'Ivoire
    gonna try this when I get soldering tools, if it works I'll give you my heart, lol
     
    joker_77 likes this.
  3. gamesquest1

    gamesquest1 Nabnut

    Member
    14,011
    9,337
    Sep 23, 2013
    Can also confirm this will work, I unbricked someones system that was bricked exactly the same way, except the system would Blue screen of death with the outputted patched nand, I had to manually inject just firm0 at 0xB130000 which allowed the system to boot properly

    Apparently the system had crashed during the update so it was a weird Franken firm, he had updated to latest which was 11.3 at the time but the firm0 ended up being 2.1 native firm so if how far the update had ran before crashing
     
    Last edited by gamesquest1, May 26, 2017
    pepepotamo and joker_77 like this.
  4. joker_77
    OP

    joker_77 Newbie

    Newcomer
    7
    9
    May 25, 2017
    Mexico
    And how did you patch just the firm0 ... I mean wich app or homebrew did you used to patch just the firm0? And I think your method just work on old3ds systems or not ?
     
  5. Myria

    Myria GBAtemp Fan

    Member
    421
    391
    Jul 24, 2014
    United States
    I think I'll wait until there are DS flash cart methods of recovery, which won't require soldering.
     
    Quantumcat likes this.
  6. addi33

    addi33 GBAtemp Advanced Maniac

    Member
    1,571
    670
    Sep 12, 2016
    Gambia, The
    I am pretty sure he hexedited it, since he posted an offset
     
  7. Oleboy555

    Oleboy555 Wie dit leest is een zemmel

    Member
    343
    108
    Feb 8, 2017
    Netherlands
    Amsterdam
    how would that work?
     
  8. gamesquest1

    gamesquest1 Nabnut

    Member
    14,011
    9,337
    Sep 23, 2013
    Yeah keep your original bricked dump, generate a patched one, then copy from 0x0xB130000->0xB530000 and past it into the original bricked nand backup at the same offset

    This shouldn't be necessary in most cases though and just the steps in the OP should be enough
     
    joker_77 likes this.
  9. Myria

    Myria GBAtemp Fan

    Member
    421
    391
    Jul 24, 2014
    United States
    Oleboy555 and joker_77 like this.
  10. joker_77
    OP

    joker_77 Newbie

    Newcomer
    7
    9
    May 25, 2017
    Mexico
    I think all that is what bootstrap can do if it is installed on your system... but how would that work if you dont have B9S installed.. i dont think that you just insert a cartridge and it will boot magicly.. but that would be awesome ... lets wait then .. anyway it is better to wait than soldering your mother board if you dont know how to use an iron soldering
     
  11. Quantumcat

    Quantumcat Dead and alive

    Member
    8,780
    4,472
    Nov 23, 2014
    Canberra, Australia
    Has anyone successfully gotten the console to boot to a DS game? I tried to send my console to sleep using a fridge magnet but it didn't work - maybe not powerful enough? I also tried pressing the buttons using various implements with the lid closed but it never worked.
     
  12. Oleboy555

    Oleboy555 Wie dit leest is een zemmel

    Member
    343
    108
    Feb 8, 2017
    Netherlands
    Amsterdam
    Magnets XDD

    — Posts automatically merged - Please don't double post! —

    how would I go about doing that? I can send my 3ds to sleep with a magnet with the lid open
     
  13. Ryccardo

    Ryccardo WiiUaboo

    Member
    2,501
    1,102
    Feb 13, 2015
    Italy
    Imola
    Or wrong polarity, try all sides and corners before calling it a dud :)

    The sensor, depending on the model, is right in the middle of the letter-buttons or between B and Start

    Wait for an implementation to be developed and released (or of course try to invent it yourself... but with no documentation available and no known usable experimentation hardware, it won't be fun)
     
  14. daxtsu

    daxtsu GBAtemp Guru

    Member
    5,462
    3,824
    Jun 9, 2007
    As I understand it, it won't respond to the button combo unless the cartridge is the special kind that's mentioned in the "bonus fail" (or a valid one from Nintendo of course). Regular games just end up booting to the regular home menu, or at least they did when I attempted it out of curiosity.

    As for telling if the magnet is strong enough, boot the console to the home menu and place the magnet on the console; if the screens go black and it enters sleep mode, yes, it's powerful enough, assuming you've found the right spot. On the N3DS XL, the sweet spot is just right of Select & Start.
     
    Last edited by daxtsu, May 27, 2017
    Ryccardo likes this.
  15. Quantumcat

    Quantumcat Dead and alive

    Member
    8,780
    4,472
    Nov 23, 2014
    Canberra, Australia
    SUCCESS!! Thanks for telling me where! Most of my problem was not knowing where to put the magnets.
    image.jpg

    — Posts automatically merged - Please don't double post! —

    I tried with a DSTwo and Start-Select-X but it just booted into Luma config (a9lh).

    Just tried it on a stock system too - boots into home menu in sleep mode, when I remove the magnet it's just the home menu.

    In @SciresM's presentation it says that you can at least play DS games with a bricked system because of being able to do this - but it doesn't work. Maybe it would require an original DS cartridge, of which I have none.
     
    Last edited by Quantumcat, May 27, 2017
    daxtsu likes this.
  16. daxtsu

    daxtsu GBAtemp Guru

    Member
    5,462
    3,824
    Jun 9, 2007
    Oh right, I forgot Luma puts its menu button on Select or whatever. I don't use Luma. :P
     
  17. Quantumcat

    Quantumcat Dead and alive

    Member
    8,780
    4,472
    Nov 23, 2014
    Canberra, Australia
    No good on stock system either. I hope this DS cart boot thing isn't just an unfounded rumour and we'll never have DSBoothax :sad:
     
  18. daxtsu

    daxtsu GBAtemp Guru

    Member
    5,462
    3,824
    Jun 9, 2007
    I don't see why SciresM and others would go to such lengths. Plus it would make sense for such a mechanism to exist in their repair centres, it'd be much cheaper to flash a stock image on the eMMC/NAND than it would be to trash a motherboard and provide the user with an entirely 'new' console, assuming no other physical damage was present.
     
  19. Quantumcat

    Quantumcat Dead and alive

    Member
    8,780
    4,472
    Nov 23, 2014
    Canberra, Australia
    I was thinking maybe this button combination was found in reverse engineered code, and it was just assumed rather than tested. I couldn't find any video showing it working.
     
  20. mikey420

    mikey420 GBAtemp Fan

    Member
    378
    101
    Dec 11, 2015
    United States
    Will this unbrick an n3ds that was bricked by the 11.3+ update and gateway cfw?
     
    joker_77 likes this.