Hacking recovering saves from bricked emunand

[tipilin]

Greetings. as the title implies, some time ago I bricked my emunand whilst doing an update.
however yesterday I decided to "revive" my 3ds installing b9s g9m and latest luma release. however I wonder if it's possible to decrypt the save files from my old roms, In my SD i still have my old "Nintendo 3ds" folder with all the Cias Right there.

also my "dead" emunand it's still lurking in its own partition partition which is fully explorable by gm9. so far i've tried to forcefully inject .tik's in sysnand to ticket.db and injecting emunand's ticket.db and title.db. without any kind of success (and when injecting .tik and title.db it crashes and was forced to restore the nand using a backup).

Thanks in advance


Edit: formatting a little

edit2: I manage how to recover them and will share it with everyone.
special thanks to everyone who guided me in this post and to
https://gbatemp.net/threads/tutorial-manual-system-transfer-for-saves-content.388033/ for providing usefull insight.

here it comes
before you begin: so far I've only tried this using emunand and sysnand from the exactly same console. while moving consoles your mileage may vary

What you need:

a nintendo 3ds with working sys and or emunand (in my case emunand was bricked) or a backup of a working nand of your system

YOUR OLD "NINTENDO 3DS" FOLDER (or at leasts its encrypted saves in a well organized fashion (by title id.)

B9s

Godmode

latest Decrypt9 (it includes a .firm entrypoint which makes it easer to boot while in god mode)

FBI/ freeshop/ original e-shop (if you're banned from it. refer to the first two

optional: something to alter your save file's creation and modification date and time


THE GUIDE

1. boot up into godmode and from emunand ctremunand/private copy the movable.sed into a safe directory in your SD card
note: if you somehow brick your nand or just wanna be safe. refer to steps 3 and 4 but replace "ticket.db" with "movable.sed"

2 open up Decrypt9, enter to "Ticket/Titlekey Options" and peform "ticket dump (your dead nand)"

3. go to your Dead nand options (in my case was emunand). system file dump and dump ticket.db

4. to the working nand options (in my case sysnand) and inject the ticket.db
note: I do recommend injecting the ticket.db with decrypt9 since luma won't boot and crashes when i drag and drop the file using Godmode.

5. boot normaly your 3ds, run FBI freeshop or whatever and install the game (s) again. (I used FBI to install using the Dumped *.tik files to ensure success)

6. play the game until it generates a save data

7.replace your new save data with your old save
note: if the game says the save is corrupted you might need to change your file's creation and modification dates to something latter than the current instalation of your game.

 

[proflayton123]

Try dumping the xorpads

 

[tipilin]

Try dumping the xorpads

then what I do with them. excuse me my ignorance

 

[GothicIII]

Manual system transfer is the only way to go. It is pretty complicated so be prepared. You need to dump xorpads from your 3ds then you dump your bricked emunand and the current emunand partition. On the pc you use xorpads to decrypt both emunand (maybe godmode9 can do this). After this you need to mount the emunand as fat16 formatted image with a tool of your choice. After that you extract the account informations of the broken emunand and inject them into the current one. This makes your savefiles and installed games inside the nintendo 3ds folde readable again. Of course you need to hex tinker with the account files to force the system to reinitialize the informations injected else you brick that emunand. Then you need to encrypt the emunand again and at least write the emunand to sd card again.

Have fun. There are tutorials around but I dont know where. I did these steps over a year back then when a9lh was new. I dont know how much of these steps godmode9 can handle by itself. I did it without 3ds tools except decrypt9.
If There is anything you didnt understand then I suggest to let it be or you end up wasting a day or two. There is no handholding tutorial afaik.

 

[Quantumcat]

Couldn't you also just dump the moveable.sed from the emuNAND and put it in sysNAND, then the SD card data will work?

 

[The Real Jdbye]

Couldn't you also just dump the moveable.sed from the emuNAND and put it in sysNAND, then the SD card data will work?

Tickets are also needed though.

Manual system transfer is the only way to go. It is pretty complicated so be prepared. You need to dump xorpads from your 3ds then you dump your bricked emunand and the current emunand partition. On the pc you use xorpads to decrypt both emunand (maybe godmode9 can do this). After this you need to mount the emunand as fat16 formatted image with a tool of your choice. After that you extract the account informations of the broken emunand and inject them into the current one. This makes your savefiles and installed games inside the nintendo 3ds folde readable again. Of course you need to hex tinker with the account files to force the system to reinitialize the informations injected else you brick that emunand. Then you need to encrypt the emunand again and at least write the emunand to sd card again.

Have fun. There are tutorials around but I dont know where. I did these steps over a year back then when a9lh was new. I dont know how much of these steps godmode9 can handle by itself. I did it without 3ds tools except decrypt9.
If There is anything you didnt understand then I suggest to let it be or you end up wasting a day or two. There is no handholding tutorial afaik.

No need for xorpads or mounting the image on a PC, GodMode9 can be used instead. I've done it that way in the past.

 

[tipilin]

Manual system transfer is the only way to go. It is pretty complicated so be prepared. You need to dump xorpads from your 3ds then you dump your bricked emunand and the current emunand partition. On the pc you use xorpads to decrypt both emunand (maybe godmode9 can do this). After this you need to mount the emunand as fat16 formatted image with a tool of your choice. After that you extract the account informations of the broken emunand and inject them into the current one. This makes your savefiles and installed games inside the nintendo 3ds folde readable again. Of course you need to hex tinker with the account files to force the system to reinitialize the informations injected else you brick that emunand. Then you need to encrypt the emunand again and at least write the emunand to sd card again.

Have fun. There are tutorials around but I dont know where. I did these steps over a year back then when a9lh was new. I dont know how much of these steps godmode9 can handle by itself. I did it without 3ds tools except decrypt9.
If There is anything you didnt understand then I suggest to let it be or you end up wasting a day or two. There is no handholding tutorial afaik.

thank you so much for your insight. i found a tutorial and Godmode can do pretty much every step except for one or two. if everything goes as i see it (read: if i don't have to rollback my sysnand again) i might post a tutorial.

 

[tipilin]

to everyone thank you. I managed to recover my saves

 

[GothicIII]

to everyone thank you. I managed to recover my saves

Happy gaming then

Please post the link to the tutorial you used so future people who stumble onto this thread can find help.

 

[tipilin]

Happy gaming then

Please post the link to the tutorial you used so future people who stumble onto this thread can find help.

sure.
also pretty much every step that involves encrypting or decrypting files can be bypassed using Godmode. therefore I'd write a simple guide of how I did it in OP

 

[tipilin]

Guide added to the op