1. Deleted User

    Deleted User Newbie

    I think that we all need to give this man a round of applause. Not only for the countless hours it must have taken him to discover and verify all of this, but because of how long it must have taken him to type and format this entire post all for the purpose of infroming us to practice safe injecting, among a lot of other things. Also, you should probably add a TL;DR.
    NoSnake221, Nutez and TurdPooCharger like this.
  2. TurdPooCharger


    Jan 1, 2018
    United States
    I'm on it. Still editing the post as I go.
  3. Deleted User

    Deleted User Newbie

    Damn dude. Just damn. :)
  4. TurdPooCharger


    Jan 1, 2018
    United States
    Re-posted as it'll probably make its way here. I'll pass due to lack of title key expertise.

  5. d0k3

    d0k3 3DS Homebrew Legend

    Dec 3, 2004
    Something else entirely - as a lot of ou may have noticed, GM9 scripting is in some dire need for proper documentation. I think a Wiki may be a good way to solve this, so I set up this GitHub issue to discuss the further course of action. Maybe some of you guys are willing to help me with that. To be honest, you guys do actually know more about the scripting quirks than me :D.
    8BitWonder likes this.
  6. TurdPooCharger


    Jan 1, 2018
    United States
    Homebrew Checker

    Credit goes to:
    • @d0k3 - For fulfilling my very niche command request. And to boot, he did it in a really quick too quick neck breaking pace, workaround time frame creating them. I wanted this, but now the keyboard bacons (yes, food bacon) for moAr GM9 scripts. Argrghgugghh!! :cry:
    • TitleDB.com - For the supplied information
    ... What is it this time? This better be good.
    Presenting a script no one was asking for in the first place and probably almost no one needs or wants either:
    • Homebrew Checker.gm9
    This script was written to test and validate two new gm9 script commands, fget and fset, in the guise of checking your CIA files against a homebrew database.

    If your selected CIA file is a known homebrew title, you get output information about its Name, Description, Author, Title ID, and Product ID. If it's not a known homebrew title, you're either warned what kind of CIA file it is, or that the selected title is unknown if it's a legitimate game/title-type CIA.

    You wrote this just to mess around with two commands? KISS, learn it.
    Sometimes the easy way is great if you're in a pinch. This was created as a means to be creative in testing out those new commands as normal testing procedures, IMO, can be a real chore. I wanted to put them to real practice while cooking up a script that might be useful to some 3DS users.

    And if that wasn't thorough or stringent enough for controlling testing variables, a second test script was eventually written in making sure fget and fset weren't doing anything they weren't suppose to. You can find that other one over at GM9 GitHub here (look for fget_fset_debug.zip), which is better in studying how these new commands work.

    Lastly, the real tertiary reason I wrote this is, you guessed it, for another gm9 script. Details of why this script was created can be read starting at post #992 here.

    Hey! Your script is broken. This doesn't work on GodMode9 v1.6.3.
    Stable v1.6.3 release don't have fget and fset command. You'll need the latest nightly found here. There's a good chance the official debut of these two commands will find their way in the v1.6.4 release.

    Attached Files:

    d0k3 likes this.
  7. matt!

    matt! GBAtemp Advanced Fan

    Nov 20, 2009
  8. matt!

    matt! GBAtemp Advanced Fan

    Nov 20, 2009
    Thanks I used Cthulhu app
  9. twithtots

    twithtots Newbie

    Jul 27, 2018
    United States
    I've scoured this post ... hopefully all of it as best that I can ... and haven't been able to see an answer. Is there a script to dump all installed SD titles at once to CIA's? Or are we stuck having to do them one at a time? I'm very sorry if I missed this in the thread here.

  10. TurdPooCharger


    Jan 1, 2018
    United States
    Oh, you sweet summer child. Lol.

    Hold the L-shoulder button and highlight select everything in yellow to do mass CIA building.
  11. SirBlueVFX

    SirBlueVFX Newbie

    May 6, 2017
    Add this.

    It is to verify the version of SigHax / Boot9Strap.

    Attached Files:

    Last edited by SirBlueVFX, Aug 26, 2018
    NFates, TurdPooCharger and 8BitWonder like this.
  12. 8BitWonder

    OP 8BitWonder Small Homebrew Dev

    Jan 23, 2016
    United States
    Added, thank you for this. :)
    I was hoping someone would make either a tool or script to do this for some time.
    matt! and SirBlueVFX like this.
  13. TurdPooCharger


    Jan 1, 2018
    United States
    Leaving this here since I haven't figured out if GodMode9 already has a built-in feature that does this or if an automated method is feasible in coding.

    For anyone who wants to tackles writing a GM9 script that batch converts RAW Villain3DS downloads into CIA.

    There's a way to convert a single title with an output name as tmd.cia

    I'm not quite sure how to go about outputting multiple titles with unique names.

    Folder with Title ID 0004008c001bc600 outputs in gm9/out as 0004008c001bc600.cia


    I'm sitting out on this one due to a backlog of projects. Have fun with it!

    Edit - This script would be really niche because of the end of CDN downloaders and rarity of raw precursor CIA files. Probably not a long term usage of a gm9 script.
    Last edited by TurdPooCharger, Sep 13, 2018
  14. Important Posts: CTRTransfer (Type D9) Script - TurdPooCharger


    Jan 1, 2018
    United States

    (Type D9) Main Menu [updated].png

    CTRTransfer (Type D9)

    Credit goes to:
    • @d0k3 - The CTRTransfer from both GodMode9 and Decrypt9WIP are the foundations that this script is built upon.
    • @Quantumcat - Helped saved the day solving someone's terribly softbricked o2DS with the power of Decrypt9.
      • This led to learning firsthand what those differences are between the two programs in how they perform it.
      • She also shared the title id for Nintendo 3DS Camera for AUS region.
    • @AnalogMan - His Lazarus3DS and related NAND gm9 scripts are major influences in understanding key aspects about 3DS firmware recovery.
    • @Namesnipe - Shared the neat knowledge that individual tickets can be backed up from the ticket.db.
    • @CodyWGamer - Showcased that the [S:] SYSNAND VIRTUAL isn't something to be trifled with if one does not treat that drive with caution and care.
    • @KleinesSinchen - Demonstrated and verified that the twln.bin and twlp.bin partitions can be super bricked.
      • This interesting knowledge was the final piece of the puzzle in making this script possible by showing that parts of the NAND are manually reflashable (perhaps too easily).
    • @botik (BpyH64) - Found a way to quickly install 3DS titles using dummy CIAs. I borrowed his idea from the .cmd CMACs research.
    • @zoogie - The research data for the Bypass Profile Setup was borrowed from 2DSaver.
    • @aspargas2 - Added DISA/DIFF handling in GM9 v1.9.0, which makes it possible to edit (sys/ext)data files.
    • @Aurora Wright - Luma3DS.
    • @SciresM - Boot9strap and perfect retail NAND NCSD header signature.
    • And many partners in crime busting all sorts of 3DS bricks and issues. While we can't fix them all, we sure as hell do solve a lot of 'em.

    Release Page

    Table of Contents

    What is this?
    Here's a detailed crash course about this subject.
    TL;DR - Basically, CTRTransfer is like a universal SysNAND image used for recovering from softbricks and region changing the firmware.
    If you're familiar with computer operating systems, this is similar to Windows Recovery and Mac Time Machine.


    This is a gm9 script for performing a variation of Decrypt9 CTRTransfer. Homebrew 3DS users are likely to be more familiar with standard or (built-in) GodMode9 CTRTransfer. While both types are used for repairing or region changing the 3DS firmware, there are stark differences in how they go about changing or correcting the CTRNAND.

    Decrypt9 Method
    • A few console unique files such as the movable.sed, configsave.bin, LocalFriendCodeSeed_B, and SecureInfo_A/B are first extracted from the CTRNAND drive. Afterwards, Decrypt9 (the program) flashes the entire raw donor CTRNAND *.bin image file onto the CTRNAND partition. Those backed up files are moved back in the drive to their respective locations and CMAC hash corrections are done throughout such as for the *.db datebase files and user's extdata + sysdata.
    GodMode9 Method
    • GodMode9 (the program) selectively replaces only the title folder and *.db files. This is to surgically fix the broken system apps while keeping the rest of the user's personal and console unique files intact. Once these folders and files are replaced as needed, this is followed by CMAC hash corrections for those *.db files.
    To put this into a comparable life analogy of the two, GM9 CTRTransfer is like replacing worn houseware parts, patching holes for stone walls to a structurally sound but very old house, and renovating its dainty decorations, flooring, and walls. D9 CTRTransfer is like removing your furnishings and personal belongs out of the house, knocking that house down because it's deemed too decrepit, building a replica in its place, and then moving as much of your stuff back in, assuming you haven't forgotten leaving behind anything before the teardown.

    GodMode9 is the safer and less intrusive of the two while fixing most general softbricks. Although Decrypt9 is arguably more effective at dealing with severe softbricks, the older app's implementation fails to back up and restore crucial files such as hardware calibration HWCAL0.dat and HWCAL1.dat, personal legit tickets, and [seed|nag|friend|nnid|etc.]save.bin.

    With those differences in mind, this script was created with the goal of combining the Decrypt9 approach of flashing a clean slate CTRNAND drive while also maintaining as much of the user's original setup like that of GodMode9.

    [Table of Contents]

    Bricks that this can fix.
    1. Files and folders that are partially or fully deleted off the [1:] SYSNAND CTRNAND.
      • For whatever reason, the 3DS or 2DS system you have had its setup accidentally erased. Perhaps you bought/received yours prehacked from a previous owner who was neglectful. As long as something called the essential.exefs is present and has not been tampered with, it's possible to create a fresh firmware setup.
      • Empty CTRNAND.png
    2. The [1:] SYSNAND CTRNAND is missing.
      • Let's imagine you experienced a catastrophic softbrick which required remedying the issue by restoring the SysNAND with a personal image backup. However, luck would have it that the one and only SysNAND *.bin image you kept was trashed by an unknowingly fake SD card. To add further insult to injury, during your restoration of the corrupted image, your system has a very old and untrustworthy battery that dies on you during mid-restore. This incident bricks the CTRNAND partition where GodMode9 doesn't even acknowledge the presence of the drive. Again, this is recoverable so long as the essential.exefs is present and hasn't been tampered with.
      • Missing CTRNAND.png
    3. Strange '?' files that are stubbornly stuck in CTRNAND or cannot be deleted/replaced by conventional means.
      • Despite H2testw checking the SD card for issues, updating the custom firmware & 3DS firmware, and troubleshooting for any and all hardware issues, your system has unexplainable boot issues, poor GUI functionality, or random crashes. You (surprise, surprise!) don't have the benefit of a clean, backed up SysNAND *.bin image to recovery from. Attempts at using standard CTRTransfer are not providing favorable results. You may very well have a broken file allocation table at hand. If those damaged files are limited to replaceable or non-unique items, this script will try maintaining anything that's salvageable.
      • 2DS softlocks or crashes when trying to launch anything from the home menu [post #84]
      • [​IMG]
    4. The system turns on with Blue Screens of Death.
      • The nand header (nand_hdr.bin), TWL partition table (twlmbr.bin), [New 3DS only] secret sector (sector0x96.bin), and/or bootloaders (firm0.bin & firm1.bin) were corrupted from careless firmware modding, A9LH downgrade softbrick, or Gateway3DS malicious brickcode running a firmware newer than 11.2. In order to bypass the bootrom 8046 and launch GodMode9, an ntrboot flashcart would be required such as the R4i Gold 3DS Plus (recommended) or R4iSDHC series (shitty timebomb).
      • :!: This cannot fix hardware based BSoD where the nand chip is fried from a failed hardmod or physically damaged by other means such as spilled water.
      • bootrom_8046.png
    5. [New 3DS only] Franken firmware due to 2.1.0 downgrade from older A9LH guide followed by newer (2xrsa) B9S guide.
    [Table of Contents]

    Safety Features & Process Overview
    This script...
    1. Checks against itself if GodMode9 is a recent enough version that's capable of using these script functions:
      • Code:
    2. Automatically updates the sdmc:/luma/payloads/GodMode9.firm if an older version is found running. Reboots the GM9 session.
    3. Determines if the system in question can be identified as either "retail" vs "devkit" and "Old" or "New" before proceeding.
    4. Exits out much earlier and mentions if CTRNAND images are missing at the specified input directory.
      • Update March-21-2019: Version 1.1 allows you to continue using the script with a reminder instead of a hard exit.
    5. Force fixes the nand_hdr.bin, twlmbr.bin, sector0x96.bin, firm0.bin, and firm1.bin if a bootrom 8046 softbrick is detected.
    6. Asks upfront for write permissions to work in the [1:] SYSNAND CTRNAND and [S:] SYSNAND VIRTUAL/ctrnand_full.bin.
    7. Looks for the accompanying *.sha file that's goes with the CTRNAND *.bin image.
    8. Verifies that the *.sha file is of the correct size and acceptable region code.
    9. Spot checks two offsets to determine whether the CTRNAND image is the correct FULL kind versus FAT/unknown.
    10. Rejects the selected CTRNAND image if it's meant for the other system type (O3DS vs N3DS).
    11. Measures the CTRNAND image size to make sure it's the correct exact size for the system type.
    12. Measures the size of S:/ctrnand_full.bin to see if it's the expected partition size.
    13. Mounts the CTRNAND image to check that it is an intact image.
    14. Writes a 1 GB dummy file onto the SD card and then deletes it so that there's enough free space to work with.
    15. Compares CTRNAND image hash against its *.sha file.
    16. Backs-up the user's entire CTRNAND setup, except for the title folder.
    17. Flashes the CTRNAND image to S:/ctrnand_full.bin without the option to cancel.
    18. Backs-up the system tickets from the donor CTRNAND image.
      • This is done to keep the user's original ticket.db in place with the private legit eShop tickets intact.
      • The console's original system tickets are also dumped on top of the donor system tickets for further preservation.
    19. Deletes the donor's essential files in preparation of cleanly restoring the user's setup.
    20. Restores the user's setup back to the CTRNAND drive, except for certain *.db files.
    21. Image mounts the backup essential.exefs and restores any of these five if missing.
      • LocalFriendCodeSeed_B, HWCAL0.dat, HWCAL1.dat, movable.sed, SecureInfo_A
    22. Examines the SecureInfo_A|B against the *.sha file if region changing is undertaken.
    23. If region changing is intended, defaults _A, creates & edits _B and copies _B to _C.
      • A - original, B - region edited (for Recovery Mode), C - a copy of B (for HOME Menu)
    24. Fixes the entire 1:/ drive's CMACs.
    25. Fixes the S:/twlmbr.bin partition table if required.
    26. Backs-up the DSiWare titles as CIAs and save files. Backs-up TWL system titles into legit CIAs if they're salvageable.
      • CTRTransfer makes TWLN titles forgotten due to changing out the title.db.
    27. Rebuilds the S:/twln.bin partition; reformat the [2:] SYSAND TWLN(AND) drive.
      • Console unique TWL nand files such as inspect.log(~), product.log(~), sysmenu.log, TWLFontTable.dat, opera.ini, and 0000 are retained.
      • If the 2:/shared2/0000 (soundsave.bin) is missing, generate a new copy.
    28. Rebuilds the S:/twlp.bin partition; reformat the [3:] SYSNAND TWLP(HOTO) drive.
      • The photo folder with *.JPG images are retained and restored if present.
      • If the 3:/photo/private/ds/app/484E494A/pit.bin is missing, generate a new copy.
    29. Installs or updates CTRNAND Luma3DS if 1:/boot.firm is missing or older than v9.1.
      • CTRNAND Luma3DS v10, v10.0.1, or newer that is in place will not be downgraded.
    30. Updates CTRNAND GodMode9 if 1:/rw/luma/payloads/GodMode9.firm is older than v1.9.1.
      • CTRNAND GodMode9 will not be installed if it is missing.
    31. New 3DS series only: Fixes the S:/sector0x96.bin if required.
      • Note: This script does not contain copyright material or a raw copy of the secret_sector.bin.
      • To compare and hex review the script, the secret_sector file is found at A9LH to B9S.
    32. Installs or updates boot9strap on both S:/firm0.bin and firm1.bin partitions if older than v1.3.
      • Note: Any other installed bootloaders such as fastboot3DS will be automatically replaced.
    33. Asks to Rosalina menu inject Homebrew Launcher to Nintendo 3DS Camera.
    [Table of Contents]



    If you do not understand English or it is not your main language...

    [ Español | Deutsch | Français | Italiano | Português | Nederlands | Dansk | Svenska | Norsk | 한국어 | 简体中文 | 繁體中文 | 日本語 | Tiếng Việt | ภาษาไทย | Filipino | हिन्दी | اُردُو‎ | اَلْعَرَبِيَّةُ | Türkçe | עִבְרִית | Ελληνικά | Русский | Polski | Magyar | Română | Suomi ]

    ○ [ bold = folder | Courier New = file | sdmc:/ = root of the SD card | underlined = hyperlink ]

    Cam the Cat, from Squishmallows.
    1. Copy everything off your SD card over to a computer.
      • Recommended: If you have another SD card, preferably small sized (minimum 4 GB), use that spare one instead of your main card.
    2. Reformat the card in [ FAT32 format | 32 KB cluster size | Primary partition | MBR disk ] settings with Windows File Explorer, guiformat if bigger than 32 GB, or MiniTool Partition Wizard (free edition).
    3. Test the SD card for hardware problems; full Write + Verify the empty card with H2testw (Windows), F3 (Linux), F3X (Mac), or SD Insight (Android / Chrome OS).
      • :!: A fake or faulty SD card will cause a secondary brick where the user's setup is permanently corrupted when backed up.
      • [​IMG]
    4. [GOOD] If the result comes back clean, delete the *.h2w test files and go to step 5. [BAD] If a problem was reported, replace the card and go back to step 1.
      • [GOOD] - Test finished without errors.
      • [BAD] - The media is likely to be defective.
      • [​IMG]
    5. Either move back your main setup or create a temporary test setup.
      • (1) Your setup must have GodMode9, the 3DSX versions of FBI, faketik, and Cthulhu, Homebrew Launcher, and Luma3DS.
      • (2) Extract files from [ .7z | .rar | .zip ] archives with 7-Zip or WinRAR.
      • (3) Download Links: GodMode9 , FBI , faketik , Cthulhu , new-hbmenu , Luma3DS
        • sdmc:/
          • 3ds/
            • Cthulhu.3dsx
            • faketik.3dsx
            • FBI.3dsx
          • gm9/
            • scripts/
              • GM9Megascript.gm9
              • NANDManager.gm9
          • luma/
            • payloads/
              • GodMode9.firm
          • boot.3dsx
          • boot.firm
      • (4) Here is an optional CFW starter kit for reference and convenience.
      • (5) The script requires a minimum 1 GB of free space.
    6. Put the CTRTransfer files of choice at:
      • sdmc:/gm9/in/11.5.0-38X_ctrtransfer_x3ds.bin
      • sdmc:/gm9/in/11.5.0-38X_ctrtransfer_x3ds.bin.sha
      • [ X = region | x = series ] The images are found at [3ds.hacks.guide] CTRTransfer.
    7. Put the script at:
      • sdmc:/gm9/scripts/CTRTransfer (Type D9).gm9
      • Download here.
    8. Insert the SD card to the 3DS system. Press (POWER) → quickly press and hold (START) → Luma3DS chainloaderGodMode9.
      • Even if the firmware is bricked, backup the SysNAND.
      • This will serve as an extra safety precaution in case firmware recovery is not successful, or the script crashes midrun.
    9. GodMode9 → (HOME) button → Scripts...CTRTransfer (Type D9)CTRTransfer.
      • The rest of the script will be self-explanatory.
    10. During script run, :!: do not press and hold the (B) button when the DSiWare games are being dumped and especially for the system tickets.
      • These are the two sections I could not idiot proof. If you try to cancel building a DSiWare CIA, it'll ask you to try again with the choice to cancel. For the system tickets, the script will fail to completely mount ticket.db.
    11. Exit the script, and press (POWER) → Poweroff system. Turn the system back on, and hold the (SELECT) button to access Luma3DS v#.# configuration. Use these exact settings. Press (START) to save and exit. The system should boot to HOME Menu.
      • [​IMG]
      • Note: In the off chance the 3DS fails to boot HOME Menu with the below (or similar) error, fixing this requires manually finding and deleting the (ext/sys)data subfolder that is causing the hang-up: Debugging "gamecoin"-type brick
      • XX02 = [ JPN: 8202 | USA: 8F02 | EUR: 9802 | CHN: A102 | KOR: A902 | TWN: B102 ]
    12. Open the Nintendo 3DS Camera to access Homebrew Launcher. If region changing the 3DS firmware and there are no system titles shown in HOME Menu, press the { (L)-shoulder + (R)-shoulder } button combo to launch the camera applet → Nintendo 3DS Camera Homebrew Launcher.
      • Inject HBL to Camera (updated).png
      • Note: If you have a [ o3DS | o3DSXL | o2DS ] and it gets stuck with black screens, press the { (L)-shoulder + (DOWN) d-pad + (SELECT) } button combo to open Rosalina menuReboot. This should restart the system and open Homebrew Launcher.
      • Note: If the shoulder buttons and/or cameras are broken, rerun the Inject HBL to Camera with an inserted 3DS game cartridge.
      • [​IMG]
    13. Install the system tickets and DSiWare CIAs with FBI. Restore missing tickets for nonlegit titles with faketik. If you have a lot of games, mass unwrap them all with Cthulhu.
      • homebrew apps.png
      • Install_system_legit_tickets.png Install_DSiWare_CIAs.png
        • The tickets and CIAs folders are named in the following formats found at sdmc:/gm9/out/
          • <date>_<serial>_dsiware_000
          • <date>_<serial>_system tickets_(<region>)_000
        • :!: See the FBI errors 0xD8E08066, 0xD8E0806C, and 0xD8E0806A section found below if the tickets or CIAs fail to install.
      • [​IMG]
      • Unwrap_HOME_Menu_icons.png
    14. Update to the latest firmware version in System SettingsOther SettingsSystem Update.
      • :!: The system legit tickets from step 13 must be installed. Fake or missing system tickets will prevent the firmware from updating.
      • :!: Do not update via Recovery Mode. This can lead to a mismatch between what's installed in the title folder and database files: title.db, import.db, ticket.db.
    15. Go back to the script to restore the DSiWare saves.
      • GodMode9 → (HOME) button → Scripts...CTRTransfer (Type D9)DSiWare CIAs & SavesRestore Saves → choose the 'dsiware' folder.
      • Note: If you don't play or have DSiWare games to begin with, there are no saves to restore. Continue with the next step.
    16. See if the DSiWare games launch with their saves restored. Check if DS(i) mode is broken. You may need to follow up with:
      • [3ds.hacks.guide] DSi / DS functionality is broken after completing the guide
      • For firmware 11.13.0-45, look in FBI → Titles. The TWL_FIRM should be:
        • 0004013800000102
          • Old_3DS TWL_FIRM
          • Version: 10864 (10.39.0)
          • Product Code: CTR-P-CTAP
        • 0004013820000102
          • New_3DS TWL_FIRM
          • Version: 10962 (10.45.2)
          • Product Code: CTR-P-CTAP
      • If the TWL_FIRM was found to be outdated, try again in updating the firmware in System Settings even if it is already on 11.13.
      • Replacement CIAs of the other four (4) TWL system titles can be obtained at https://quantumcat1.github.io/troubleshooting.
        • 00048005484E4441
          • DS Download Play
          • Version: 1024 (1.0.0)
          • Product Code: dlplay
        • 0004800542383841
          • Nintendo DSi™
          • Version: 2048 (2.0.0)
          • Product Code: DS INTERNET
        • 0004800F484E4841
          • Nintendo DS Cart Whitelist
          • Version: 11264 (11.0.0)
          • Product Code: <blank>
        • 0004800F484E4C41
          • TWL Version Data
          • Version: 0 (0.0.0)
          • Product Code: <blank>
      • Note: A log report is created for DSiWare games that fail to get converted into CIAs. Find replacement CIAs based on the TitleID list.
    Conditional: This last step depends if the [2:] SYSNAND TWLN was found to be missing console unique files.

    17. Image mount the twlnand.bin and run a data recovery to retrieve lost or deleted files listed in the twlnand_missing_files.txt.
    • Option (A) OSFMount + Recuva
    • Option (B) IsoBuster
    • sdmc:/gm9/out/<date>_<serial>_dsiware_000/TWL backup/twlnand.bin
    • sdmc:/gm9/out/<date>_<serial>_dsiware_000/TWL backup/twlnand_missing_files.txt
    • twlnand_missing_files.png
    • OSFMount + Recuva -or- IsoBuster.png
    • [​IMG]
    [Table of Contents]

    FBI errors 0xD8E08066, 0xD8E0806C, and 0xD8E0806A
    • 0xD8E08066 - The system tickets may fail to install due to something called the certs.db (certificates). Your setup at one point either corrupted it or erased & regenerated that file with a dummy nonfunctional copy. A replacement copy borrowed from the CTRTransfer image would then be required. The script can replace that file if you come across this issue. Do not use this option if the problem doesn't exist; certs.db is partially involved with transiting 3DS online play.
      • Failed to install ticket.png
    • 0xD8E0806C - The backed up DSiWare titles may fail to install. This is likely to occur if the CTRTransfer was used to region change the firmware. To fix this, install a different DSiWare *.cia file that's not from that backed up set. I have no clue why this hiccup occurs...
    • 0xD8E0806A - The backed up DSiWare legit game titles may fail to install. To fix this, either redownload these previously purchased games from Nintendo eShop or convert the dumped legit CIAs into standard CIAs.
      • Failed to install legit cia.png
      • DSiWare CIAs & SavesConvert CIAs (legit to standard)
      • Install the files in '3. cias (converted)' first followed by '5. tickets (legit)' to retain your private legit dsiware tickets.
    [Table of Contents]

    Additional Features

    Finding and restoring the KeyY.

    If you have the Nintendo 3DS folder backed up from a previous profile that was removed from (1) Format System Memory and (2) NOT involved in a System Transfer, this script can brute force up to 256 iterations finding the lost KeyY in the movable.sed linked to a specific <ID0> subfolder. To read more how this works,
    Assuming the rest of the KeyY string is correct, finding the 0x118 hex counter that matches the target <ID0> can take up to 1.5 hour to complete or as little as 1 minute. This depends on the search order (this script looks backwards, ex: 03 → 02) versus value of the "correct" hex counter relative to the starting search value (ex, "correct" value is 04 but script is looking backwards, which will take a long time to find and calculate).

    Update March-21-2019:
    Version 1.1 includes backing up the user's original sysnand ctrnand data profile if the KeyY is fixed. :!: Changing the KeyY will automatically delete the 1:/data/<ID0> that's in place due to mismatch in encryption upon the next HOME Menu boot. This would force the user to create a new profile. The script provides the option to correct the 1:/data/<ID0> to the new KeyY. However, certain previous items like Friends List will be corrupted; the Friend Code is directly derived from KeyY.

    Update May-21-2019: Version 1.3 does bi-directional searching where it splits the effort in looking both backwards (ex: 03 → 02) and forwards (ex: 03 → 04). There is now the option to quit the search run by pressing and holding the (B) button long enough. A 200 MB free space safety check was implement in case the data folder is backed up.

    [Table of Contents]

    Backing up the DSiWare CIAs and saves only.
    Update March-21-2019: Version 1.1 - You can use this script for the ease of moving or importing nonlegit DSiWare titles and their saves involved in System Transfer or library duping.
    Update April-27-2019: Version 1.2 - The TWL system titles are no longer backed up in order to prevent reinstalling bad copies. This is to prevent bricking the DS mode with fake tickets.
    Update May-21-2019: Version 1.3 - Saves are no longer restored by mass dumping everything so as to not leave behind orphaned files. Saves are individually restored by cross checking for installed titles.

    [Table of Contents]

    Relisting or rebuilding the 3DS database files.
    In the event the title.db and import.db found in 0:/Nintendo 3DS/<ID0>/<ID1>/dbs are corrupted, all games, DLCs, and updates would be forgotten.
    • HOME Menu: <blank>
    • System Settings → Data Management → Nintendo 3DS → [Software|Downloadable Content]
      • Being asked to reset or delete all software and savedata.
      • Saved Software Titles has gray question marks [ ? ].
      • Saved Software Titles is <blank> or has no icons.
      • For missing tickets, this can be fixed with faketik. ← (This is not a database issue.)
    • FBI → Titles: SD titles in green do not appear.
    • GodMode9: They can still be found when doing [A:] SYSNAND SD → Hold (R)-shoulder and press (A) Search for titles...
    • [​IMG] damaged_database.png

    You can rebuild the list with one of these three options.
    • Option (A) - Quick
    • Option (B) - Full
    • Option (C) - Manual
    [Table of Contents]

    :!: General Warnings
    1. (Re-)installing a CIA over a previously installed game will overwrite and delete its save currently in place. The Rebuild 3DS Database options were designed to fix the import.db and title.db without losing the saves and to keep whatever legit tickets you might have acquired from real Nintendo eShop purchases and updates.

    2. During the options' script runs, do not press the (B) button. There is no way to idiot proof the CIA building process. If you press (B) button, you are forced to manually rebuild those titles into CIAs if they were interrupted. Just plug the 3DS system to a AC charger, flip the clam shell closed to let the script do its thing, and leave it alone. Except for Option (C) and if everything goes smoothly without error, the script will turn off the 3DS/2DS to let you know to move onto the next part.

    3. Each option has two parts (1 - starting , 2 - finalizing) with an intermediate step of installing CIAs. Do not mix and match the parts between different options.

    4. Certain games have anti-cheat save protection that will erase itself if tampering or swapping is detected.
    Two well known examples include:
    • Animal Crossing: New Leaf (including Welcome Amiibo edition)
    • Super Smash Bros. for 3DS
    To bypass or reset the secure value, either:
    • (1) Backup & restore the saves with Checkpoint/JKSM.
    • (2) Delete the secure values for games that are known to have this using FBI. Do not try to delete the secure value for games that don't have it.
    • ACNL_secure_value.png
    • Update January 23, 2020: Version 1.4 automatically removes the secure values when restoring the setup/saves in part [ 2a | 2b | 2c ].
    [Table of Contents]

    # ~ # ~ #

    Option (A) - Quick
    The fastest of the three where dummy CIAs are generated, and all installed titles (saves included) are relocated offside to a temporary title_<ID0> folder. Once the dummy CIAs are installed:
    1. The original ticket.db is restored to keep the user's real tickets in place.
    2. To prevent accidental reinstallations of the dummy CIAs, the cias (dummy)_<ID0> folder is deleted.
    3. The titles are moved back to the title folder.
    4. Their individual *.cmd header CMACs are corrected.
    :!: A minimum 256 MB of free space is required when making the dummy CIAs.
    :!: Installing dummy DLCs with lots of contents can make FBI appear to crash or become stuck frozen. However, the progress is rather really slow for these titles. Look at the top row's moving clock for proof; be patient and don't force shut off!
    :!: The sizes and blocks will be reported wrong in FBI and System Settings. There's no away around this annoyance except to use or redo rebuilding the database with one of the other two options.

    :teach: If curiosity got the better of you, where you completed both parts (1a) Generate Dummy CIAs and (2a) Restore Setup, and you want to restore your SD setup just like how it was before having started Option (A), this is entirely reversible with the backed up files found in dbs_cmd_<ID0> folder.


    [Table of Contents]

    # ~ # ~ #

    Option (B) - Full
    This is the slowest option when rebuilding the database. Alongside with Option (C), however, the final reported sizes and blocks in FBI and System Settings will be correct. For each title that is successfully backed up as a CIA, its <TID LOW> subfolder within title/<TID HIGH> folder will be deleted. In case of errors, outside files and titles that aren't made into CIAs are not deleted but moved over to a collection title_<ID0> folder for your later examination. If found, saves are decrypted and extracted to a separate saves_<ID0> folder regardless if their parent games were built into a CIA.

    Once the CIAs are backed up, and the titles are reinstalled:
    1. The original ticket.db is restored to keep the user's real tickets in place.
    2. The saves are individually restored depending if the parent games were found to be reinstalled.
    :!: A minimum 4 GB of free space is required to account for building the largest possible CIAs.
    :!: To avoid misuse or misunderstanding, option (B) requires a certain action outside of the script. Read the option description on what to do before using (1b) Backup CIAs & Saves.
    :arrow: Unlike Option (A), the cias (proper)_<ID0> output folder is left alone. You can keep copies of those backed up CIAs on your computer.
    :arrow: If your SD card has less free space than the total amount of all the CIAs, use:
    • FBI → cias (proper)_<ID0><current directory> → Install and delete all CIAs

    [Table of Contents]

    # ~ # ~ #

    Option (C) - Manual
    In case your SD card does not have 4 GB of free space, or you already have all your games, DLCs, and updates previously backed up as CIAs, this option requires your due diligence supplying a 1-to-1 collection of CIAs for all the titles installed in the Nintendo 3DS folder. A simple installed_titles_list.txt can be cross referenced by TitleIDs against those found at:
    Once the saves are backed up, and the titles are reinstalled:
    1. The original ticket.db is restored to keep the user's real tickets in place.
    2. The saves are individually restored depending if the parent games were found to be reinstalled.
    :!: A minimum 512 MB of free space is required when backing up the saves.
    :arrow: Unlike Option (B), you're not tasked to do anything outside of the script.
    :arrow: The title folder will be left as-is once the saves are copied.
    :arrow: The two (2) DB files do not necessarily have to bad. While not recommended compared to Checkpoint or JKSM, you can use (1c) Backup Saves to extract copies of your (decrypted) saves. On a different 3DS system with a cloned SD setup, you can use the (2c) Restore Saves (with minor naming adjustments to saves_<ID0> folder) if you intend to import over the saves. Just make sure you remove the ticket.db out of saves_<ID0> if the saves are going on a different system!!


    [Table of Contents]

    Remapping the Rosalina menu button combo.
    If your 3DS system has broken buttons where the default { (L)-shoulder + (DOWN) d-pad + (SELECT) } can't be used, the combo can be remapped with one of these choices:
    • (L)-shoulder
    • (R)-shoulder
    • (Y)
    • (X)
    • (START)
    • (SELECT)
    • (UP) d-pad
    • (DOWN) d-pad
    Once you can gain access to Rosalina menu, change the combo preference:
    • Miscellaneous options... → Change the menu combo → <input your new combo> → Save settings
    [Table of Contents]

    Bypassing the new user profile setup.
    3DS systems that have broken 3D slider switch will get stuck at the 3D Screen Check after performing a system reformat.
    • System SettingsOther SettingsFormat System Memory
    • 3D Screen Check.png
    Those who have hacked their o2DS by following outdated 2.1.0 CTRTransfer downgrade guides may also get theirs stuck at that screen, albeit with a distorted appearance.
    • 2.1.0 CTRTransfer o2DS downgrade brick.png
    This pitfall scenario can be skipped with this script. Once HOME Menu is reached, filling out personal information and user agreements is still mandatory for access to online services and system updates.
    • System Settings → Internet Settings → Spotpass →
      • Automatic Software Downloads
      • Sending of System Information
    • System Settings → Other Settings →
      • Profile: User Name, Birthday, Region Settings
      • Date & Time
      • Language
    [Table of Contents]

    Looking up the Parental Controls PIN number.
    Did you forget the four-digit password to the Parental Controls? Did you receive or purchase a 3DS system that the previous owner didn't unlock? No problem!
    • Parental Controls - PIN.png
    [Table of Contents]

    Checking the integrity of the eMMC (NAND chip).

    [Table of Contents]

    Resetting the NVRAM.

    [Table of Contents]

    Some details of this script, what it does, and why. Ending comment.
    • For "best" case brick scenarios where nothing is missing, this script will only replace import.db, title.db, and title folder.
    • In the 1:/ drive, only data, dbs, fastboot3ds, fixdata, private, ro, rw, ticket, title, tmp, __journal.nn_, and boot.firm will be backed up. Everything else will be overwritten/deleted.
    • The user's original ticket.db is kept in place so that personal legit tickets can still be individually dumped if the user chooses to do so later.
      • GodMode9 does not appear to recognize personal legit tickets installed on a different or replacement ticket.db.
    • However, universal legit tickets like system titles can be installed on any ticket.db and still be recognized by GodMode9 .
    • Due to the two bulletin points above, this is the reason why Homebrew Launcher is injected in Nintendo 3DS Camera in order to install those system tickets in a round about way.
      • With that said, this script isn't appropriate for those region changing the firmware with broken shoulder buttons and broken cameras.
    • Anyone examining the script's code might be baffled as to why certain sections may seem very redundant. Let's just say trial and error has made this deliberately overprotective as possible.
    • This script wasn't made with speed in mind. Besides, repairing a firmware softbrick isn't a race. Much of the script has comments with pauses so anyone using the script can know what's going on at a given moment.
    • While I hope this script finds good use to those who may need it, I also wish that no one finds himself or herself of having to do so in the first place. But, shit happens.
    [Table of Contents]
    Last edited by TurdPooCharger, Apr 26, 2021
    E1ite007, lygok, zfreeman and 14 others like this.
  15. Quantumcat

    Quantumcat Dead and alive

    Nov 23, 2014
    Very impressive, nice work!!
  16. KleinesSinchen

    KleinesSinchen GBAtemp's Backup Reminder + Fearless Testing Sina

    Mar 28, 2018
    Don't know what to say to this. Speechless. So I just repeat:
    Will try to read (and maybe understand?) the script later today.
    TurdPooCharger likes this.
  17. CodyWGamer

    CodyWGamer GBAtemp Regular

    Dec 10, 2018
    United States
    glad to be your test monkey XD

    EDIT: So what can i do with this new software now? I managed to install it and now i want to know what else it's capable of... I read your WHOLE thread and want to know what else it can do... can it MCU unbrick my ds mode
    Last edited by CodyWGamer, Mar 13, 2019
  18. TurdPooCharger


    Jan 1, 2018
    United States
    To be clear, the script is technically an add-on to the actual software, GodMode9. Because you already attempted a specialized form of (CTR+TWL)Transfer that's closely related to D9 CTRTransfer, this script won't fix your very strange DS(i) mode brick. As was explained in PM, MCU bricks (if assuming yours is MCU related) is for all intents and purposes, permanent and not fixable.
  19. NFates

    NFates Wants to understand™

    Mar 13, 2016
    Dominican Republic
    Almost two days late, but...
    I tried my best to understand all the technicalities. The fact I think I did so with most shows the write-up (your nightmare) was a success. So,
    Last edited by NFates, Mar 15, 2019 - Reason: Added a comma because I'm picky
    Quantumcat and TurdPooCharger like this.
Draft saved Draft deleted

Hide similar threads Similar threads with keywords - Megathread, [Release], GodMode9