O3DS XL Bricked During Plailect's Guide

Discussion in '3DS - Homebrew Development and Emulators' started by JoshuaDoes, Sep 4, 2016.

  1. JoshuaDoes
    OP

    JoshuaDoes Member

    Newcomer
    37
    76
    Sep 4, 2016
    United States
    Port Huron, MI, USA
    I have an old 3DS XL that is now currently bricked. I followed Plailect's guide to install arm9loaderhax, as I use for every other 3DS and 3DS XL I've softmodded.

    I got as far as doing the ctrtransfer for 2.1.0 successfully, and then I unmounted and ejected my SD card like usual. However, upon reboot, the 3DS sat there for about half an hour without doing anything. I attempted reboots with the SD card in, out, a game cartridge in, out, etc. and nothing worked.

    I then attempted to use recovery mode (safe mode as some call it) about 7 times to update the 3DS XL to 11.0 (as I was going to use the DSiWare transfer exploit), but every time I attempted it it would reach ~60% (judged by progress bar location). I joined #3dshacks on Rizon and tried getting help, but to no avail. I then accessed my network settings via recovery mode and set the proxy settings to a proxy server I had running on my laptop (Charles Proxy) with SSL proxying disabled (I don't have the Nintendo cert for that anyways), and I found that the system updater would automatically failsafe each file download attempt to HTTP if SSL failed, and this let me pinpoint the last file downloaded to the 3DS before it would hang the updater.

    I found the culprit to be http://nus.cdn.c.shop.nintendowifi.net/ccs/download/0004013800000102/00000016
    When scanning yls8's title ID list for system updates, this turned out to be TWL_FIRM v8817. I'm not sure if the file is corrupted (I even attempted to download it and redirect the update file to the local download) or if TWL_FIRM is impossible to write over, or if it's corrupted from the bricked 2.1.0 downgrade.

    I hope I've managed to explain as best as possible my current situation. I have a NAND backup, but I do not have access to my hardmodding tools and I have no money to ship the 3DS XL to a hardmodder.

    Any help will be greatly appreciated!
     
  2. Temarile

    Temarile (ノ◕ヮ◕)ノ*:・゚✧ A9LH ✧゚・: *ヽ(◕ヮ◕ヽ)

    Member
    1,132
    422
    Jan 7, 2016
    Netherlands
    Sorry, I can't help you. But I do want to give you credits for being informed and giving enough information for someone more knowledgeable to help you, instead of "hurr durr bricked now what".
     
  3. JoshuaDoes
    OP

    JoshuaDoes Member

    Newcomer
    37
    76
    Sep 4, 2016
    United States
    Port Huron, MI, USA
    I do my best to provide as much information as possible. Thank you for the credits!

    I hope someone can help me here...
     
    jsa likes this.
  4. cravas

    cravas GBAtemp Advanced Fan

    Member
    864
    229
    Jul 30, 2016
    Oeiras
    As you said it, you've tried everything you can remember to restore it and a hardmod is out of the question.

    And since you already found what is wrong with the update (TWL_Firm) I can only think is that the console was touched before with something else (maybe Gateway).

    I quote this from the old guide:

    On the OLD Guide we had warnings about this type of situations but on the NEW Guide there are none.

    Maybe you can try to do a CART Update if you have one.


    Hope you solve it.
     
    JoshuaDoes and jsa like this.
  5. JoshuaDoes
    OP

    JoshuaDoes Member

    Newcomer
    37
    76
    Sep 4, 2016
    United States
    Port Huron, MI, USA
    Thank you very much for the info! I've looked into possibly auto-booting a cartridge, but it requires the inserted cartridge to have an autoboot flag set to 1. I also couldn't get the button sequence to boot into the normal System Settings app either, which is supposed to happen with the same button sequence if no autoboot cartridge is detected.

    As far as I know, this console has never touched anything not officially published by Nintendo or licensed developers until I got ahold of it and attempted this process.
     
  6. cravas

    cravas GBAtemp Advanced Fan

    Member
    864
    229
    Jul 30, 2016
    Oeiras
    This is all the key combinations I'm aware of.

    SOURCE:
    http://www.gamefaqs.com/boards/997614-nintendo-3ds/71168246


    Maybe try some and see if it helps in anyway.
    I'm out of ideas, sorry.

    Good luck, ;)
     
    JoshuaDoes likes this.
  7. JoshuaDoes
    OP

    JoshuaDoes Member

    Newcomer
    37
    76
    Sep 4, 2016
    United States
    Port Huron, MI, USA
    87799888
    It would appear that the system was technically already setup, and as far as I can tell there's no possibility of triggering a factory reset via software or onboard methods, therefore preventing me from autobooting a cartridge that would contain a system update. The "System Update" boot shortcut is also known as the recovery mode or safe mode that I'm using to attempt to force update the system. "Circle Pad Calibration" and "Touch Screen Calibration" do not boot, just like attempting a normal boot into the home menu.

    Thank you for the help anyways! I hope others can come across that may be enlightened in this situation, and I appreciate the feedback you've provided.
     
  8. neim81094

    neim81094 GBAtemp Regular

    Member
    149
    37
    Jun 15, 2013
    United States
    You can always hardmod flash a fresh system on your 3DS. It could be that your hardware itself is causing the issue.
    Because if Software fixes (EG Recovery Mode ) doesn't work, hardmod would be the next step. Though I wouldn't be surprised if you are also getting issues with that do to hardware failure.

    Also, if you are able to redirect the 3DS to see your local network as the place to restore it, why don't you try to 'restore' it to 2.1.0?
     
    Last edited by neim81094, Sep 4, 2016
    JoshuaDoes likes this.
  9. JoshuaDoes
    OP

    JoshuaDoes Member

    Newcomer
    37
    76
    Sep 4, 2016
    United States
    Port Huron, MI, USA
    The 3DS was 100% functional on 10.3 according to the person I was doing this task for. He had no idea what homebrew really was or how it worked, so I doubt he even had access to anything that could mess with the 3DS. As for hardware failure, I don't really know as I can still boot into recovery mode and can fully use the touch screen, the 3D slider, WiFi, sound, and buttons.

    At the moment, I have no way of doing any hardmods so I can't flash a fresh system, and I also tried doing a SHA verification of my SysNAND backup and it would appear that it's corrupted as well... Is there a way to flash a completely fresh NAND on the 3DS without the OTP?
     
  10. gamesquest1

    gamesquest1 Nabnut

    Member
    14,134
    9,477
    Sep 23, 2013
    is the SD card you are using legit? if its a dodgy fake SD card that would explain having a bad sysnand dump i guess, but afaik all the downgrade tools verify themselves and the downgrade files before performing any mission critical steps

    and no, without a valid nand backup then you are pretty much screwed, check if the SD had emunand setup as a last ditch attempt
     
    JoshuaDoes and vb_encryption_vb like this.
  11. Quantumcat

    Quantumcat Dead and alive

    Member
    11,006
    5,901
    Nov 23, 2014
    Australia
    Canberra, Australia
    I'd also like to extend my congratulations on being so well researched and thorough with your efforts. I clicked on this thread rolling my eyes thinking, "another one who used the wrong downgrade files" but then I read it and I was like "WOW!"
     
    JoshuaDoes and Swiftloke like this.
  12. JoshuaDoes
    OP

    JoshuaDoes Member

    Newcomer
    37
    76
    Sep 4, 2016
    United States
    Port Huron, MI, USA
    The SD card is legit, and is in fact the one that came with the O3DS XL. I also decided to run a file recovery on the SD card to see if maybe I could recover a correct SysNAND backup, but to no avail.

    Thank you very much! I do my best to explain everything in as much detail as I possibly can, and hopefully I can help out in the community very well because of this. I've already helped some people on #3dshacks on the Rizon IRC network too!
     
  13. JoshuaDoes
    OP

    JoshuaDoes Member

    Newcomer
    37
    76
    Sep 4, 2016
    United States
    Port Huron, MI, USA
    My friend suggested a theory to me:

    Use the hardmods to obviously access my NAND, and when booted with a Linux Mint on my computer I can use the DD program in my terminal to do a raw dump of the NAND (whether it's bricked or not). In theory, I should be able to extract the OTP region from
    Code:
    0x10012000
    (
    Code:
    0x100
    ==
    Code:
    256
    bytes long). However, I have to dump the NAND first and extract its
    Code:
    NCSD
    header, which as far as we know is in plaintext.

    He's going to ask around on the #3dshacks IRC channel on Rizon and see if the theory makes sense to others as well. This may be my last ditch attempt, and if it fails then I'm SOL.
     
  14. ezk0

    ezk0 Newbie

    Newcomer
    1
    1
    Sep 7, 2016
    Gambia, The
    My O3DS XL also did not boot after downgrading to 2.1.0. I started with 8.1.0. It just had a blackscreen and the blue light was flashing.
    this solved it for me

    Step 7 of this is also helpful.
    But i assume that you've already been through all the Troubleshoot Sites. Sorry if i am no help at all
     
    JoshuaDoes likes this.
  15. JoshuaDoes
    OP

    JoshuaDoes Member

    Newcomer
    37
    76
    Sep 4, 2016
    United States
    Port Huron, MI, USA
    Thanks anyways! However, I have not even been able to extract the OTP region quite yet because I was not able to boot my 2.1.0 downgrade, therefore arm9loaderhax has not been installed and I cannot boot any payloads. Otherwise I'm sure this thread wouldn't exist. :P
     
    Duckling likes this.