Homebrew O3DS XL Bricked During Plailect's Guide

[JoshuaDoes]

I have an old 3DS XL that is now currently bricked. I followed Plailect's guide to install arm9loaderhax, as I use for every other 3DS and 3DS XL I've softmodded.

I got as far as doing the ctrtransfer for 2.1.0 successfully, and then I unmounted and ejected my SD card like usual. However, upon reboot, the 3DS sat there for about half an hour without doing anything. I attempted reboots with the SD card in, out, a game cartridge in, out, etc. and nothing worked.

I then attempted to use recovery mode (safe mode as some call it) about 7 times to update the 3DS XL to 11.0 (as I was going to use the DSiWare transfer exploit), but every time I attempted it it would reach ~60% (judged by progress bar location). I joined #3dshacks on Rizon and tried getting help, but to no avail. I then accessed my network settings via recovery mode and set the proxy settings to a proxy server I had running on my laptop (Charles Proxy) with SSL proxying disabled (I don't have the Nintendo cert for that anyways), and I found that the system updater would automatically failsafe each file download attempt to HTTP if SSL failed, and this let me pinpoint the last file downloaded to the 3DS before it would hang the updater.

I found the culprit to be http://nus.cdn.c.shop.nintendowifi.net/ccs/download/0004013800000102/00000016
When scanning yls8's title ID list for system updates, this turned out to be TWL_FIRM v8817. I'm not sure if the file is corrupted (I even attempted to download it and redirect the update file to the local download) or if TWL_FIRM is impossible to write over, or if it's corrupted from the bricked 2.1.0 downgrade.

I hope I've managed to explain as best as possible my current situation. I have a NAND backup, but I do not have access to my hardmodding tools and I have no money to ship the 3DS XL to a hardmodder.

Any help will be greatly appreciated!

 

[Temarile]

Sorry, I can't help you. But I do want to give you credits for being informed and giving enough information for someone more knowledgeable to help you, instead of "hurr durr bricked now what".

 

[JoshuaDoes]

Sorry, I can't help you. But I do want to give you credits for being informed and giving enough information for someone more knowledgeable to help you, instead of "hurr durr bricked now what".

I do my best to provide as much information as possible. Thank you for the credits!

I hope someone can help me here...

 

[cravas]

As you said it, you've tried everything you can remember to restore it and a hardmod is out of the question.

And since you already found what is wrong with the update (TWL_Firm) I can only think is that the console was touched before with something else (maybe Gateway).

I quote this from the old guide:

Remove any TWL_FIRM modifications done to the device or PlaiSysUpdater will throw an error
(if you have no idea what this is, don't worry about it; most users will not need to do this)

• To do this, use 3DNUS to download the stock TWL_FIRM as a CIA, then install it
• New 3DS TWL_FIRM Title ID: 0004013820000102
• Old 3DS / 2DS TWL_FIRM Title ID: 0004013800000102

On the OLD Guide we had warnings about this type of situations but on the NEW Guide there are none.

Maybe you can try to do a CART Update if you have one.


Hope you solve it.

 

[JoshuaDoes]

As you said it, you've tried everything you can remember to restore it and a hardmod is out of the question.

And since you already found what is wrong with the update (TWL_Firm) I can only think is that the console was touched before with something else (maybe Gateway).

I quote this from the old guide:



On the OLD Guide we had warnings about this type of situations but on the NEW Guide there are none.

Maybe you can try to do a CART Update if you have one.


Hope you solve it.

Thank you very much for the info! I've looked into possibly auto-booting a cartridge, but it requires the inserted cartridge to have an autoboot flag set to 1. I also couldn't get the button sequence to boot into the normal System Settings app either, which is supposed to happen with the same button sequence if no autoboot cartridge is detected.

As far as I know, this console has never touched anything not officially published by Nintendo or licensed developers until I got ahold of it and attempted this process.

 

[cravas]

This is all the key combinations I'm aware of.

Nintendo 3DS system button combinations/shortcuts:

Boot*:
System Update: L+R+UP**+A
Circle Pad Calibration: L+R+Y
Touch Screen Calibration: L+R+X

HOME-menu:
Motion Sensor Calibration: Y+B (hold)

Virtual Console/DS(iWare) games:
While playing DS/DSiWare/GBA*** games:
HOME (opens up HOME-prompt)+Start+UP -> brightness up
+Start+DOWN -> brightness down
+Start+LEFT -> Power-Saving Mode off
+Start+RIGHT -> Power-Saving Mode on
(HOME/B to close HOME-prompt; A to go to HOME-menu)

While booting up DS/DSiWare/GB/GBC/GBA games:
Start -> original resolution (1:1 resolution) (GB and GBC games will have the original system as border)

While playing NES games:
L+R+Y -> switch between player (controller) 1 and player (controller) 2

While playing GB games:
L+R+Y -> switch between grey tint and green tint (the latter being reminiscent of the original Game Boy)

Other:
While booting up a 3DS system that is not set up, with a 3DS Game Card in it: A+B+X+Y+R -> force the game to boot, regardless of setting up the system

* pressing cancel in said part of System Settings turns off the system
** the directions are buttons on the D-pad
*** at the time of writing, Game Boy Advance titles are only available to Nintendo 3DS owners, that took part in the 2011 Nintendo 3DS Ambassador Program

SOURCE:
http://www.gamefaqs.com/boards/997614-nintendo-3ds/71168246


Maybe try some and see if it helps in anyway.
I'm out of ideas, sorry.

Good luck,

 

[JoshuaDoes]

87799888

This is all the key combinations I'm aware of.



SOURCE:
http://www.gamefaqs.com/boards/997614-nintendo-3ds/71168246


Maybe try some and see if it helps in anyway.
I'm out of ideas, sorry.

Good luck,

It would appear that the system was technically already setup, and as far as I can tell there's no possibility of triggering a factory reset via software or onboard methods, therefore preventing me from autobooting a cartridge that would contain a system update. The "System Update" boot shortcut is also known as the recovery mode or safe mode that I'm using to attempt to force update the system. "Circle Pad Calibration" and "Touch Screen Calibration" do not boot, just like attempting a normal boot into the home menu.

Thank you for the help anyways! I hope others can come across that may be enlightened in this situation, and I appreciate the feedback you've provided.

 

[TheNintendoEnthusiast]

You can always hardmod flash a fresh system on your 3DS. It could be that your hardware itself is causing the issue.
Because if Software fixes (EG Recovery Mode ) doesn't work, hardmod would be the next step. Though I wouldn't be surprised if you are also getting issues with that do to hardware failure.

Also, if you are able to redirect the 3DS to see your local network as the place to restore it, why don't you try to 'restore' it to 2.1.0?

 

[JoshuaDoes]

You can always hardmod flash a fresh system on your 3DS. It could be that your hardware itself is causing the issue.
Because if Software fixes (EG Recovery Mode ) doesn't work, hardmod would be the next step. Though I wouldn't be surprised if you are also getting issues with that do to hardware failure.

The 3DS was 100% functional on 10.3 according to the person I was doing this task for. He had no idea what homebrew really was or how it worked, so I doubt he even had access to anything that could mess with the 3DS. As for hardware failure, I don't really know as I can still boot into recovery mode and can fully use the touch screen, the 3D slider, WiFi, sound, and buttons.

At the moment, I have no way of doing any hardmods so I can't flash a fresh system, and I also tried doing a SHA verification of my SysNAND backup and it would appear that it's corrupted as well... Is there a way to flash a completely fresh NAND on the 3DS without the OTP?

 

[gamesquest1]

is the SD card you are using legit? if its a dodgy fake SD card that would explain having a bad sysnand dump i guess, but afaik all the downgrade tools verify themselves and the downgrade files before performing any mission critical steps

and no, without a valid nand backup then you are pretty much screwed, check if the SD had emunand setup as a last ditch attempt

 

[Quantumcat]

I'd also like to extend my congratulations on being so well researched and thorough with your efforts. I clicked on this thread rolling my eyes thinking, "another one who used the wrong downgrade files" but then I read it and I was like "WOW!"

 

[JoshuaDoes]

is the SD card you are using legit? if its a dodgy fake SD card that would explain having a bad sysnand dump i guess, but afaik all the downgrade tools verify themselves and the downgrade files before performing any mission critical steps

and no, without a valid nand backup then you are pretty much screwed, check if the SD had emunand setup as a last ditch attempt

The SD card is legit, and is in fact the one that came with the O3DS XL. I also decided to run a file recovery on the SD card to see if maybe I could recover a correct SysNAND backup, but to no avail.

I'd also like to extend my congratulations on being so well researched and thorough with your efforts. I clicked on this thread rolling my eyes thinking, "another one who used the wrong downgrade files" but then I read it and I was like "WOW!"

Thank you very much! I do my best to explain everything in as much detail as I possibly can, and hopefully I can help out in the community very well because of this. I've already helped some people on #3dshacks on the Rizon IRC network too!

 

[JoshuaDoes]

My friend suggested a theory to me:

Use the hardmods to obviously access my NAND, and when booted with a Linux Mint on my computer I can use the DD program in my terminal to do a raw dump of the NAND (whether it's bricked or not). In theory, I should be able to extract the OTP region from

0x10012000

(

0x100

==

256

bytes long). However, I have to dump the NAND first and extract its

NCSD

header, which as far as we know is in plaintext.

He's going to ask around on the #3dshacks IRC channel on Rizon and see if the theory makes sense to others as well. This may be my last ditch attempt, and if it fails then I'm SOL.

 

[ezk0]

My O3DS XL also did not boot after downgrading to 2.1.0. I started with 8.1.0. It just had a blackscreen and the blue light was flashing.
this solved it for me

Step 7 of this is also helpful.
But i assume that you've already been through all the Troubleshoot Sites. Sorry if i am no help at all

 

[JoshuaDoes]

My O3DS XL also did not boot after downgrading to 2.1.0. I started with 8.1.0. It just had a blackscreen and the blue light was flashing.
this solved it for me

Step 7 of this is also helpful.
But i assume that you've already been through all the Troubleshoot Sites. Sorry if i am no help at all

Thanks anyways! However, I have not even been able to extract the OTP region quite yet because I was not able to boot my 2.1.0 downgrade, therefore arm9loaderhax has not been installed and I cannot boot any payloads. Otherwise I'm sure this thread wouldn't exist.