Tutorial  Updated

Restore N3DS from FW 2.1 without NAND Backups

Hi guys, I forgot to do a nand backup and downgrade my n3ds sysnand to 2.1. After getting otp I update my sysnand through system settings resulting in a hardbrick. I know this is user error. I have done many a9lh but this is the first time I forgot. Damned.

Anyway I have thought of a possible way to unbrick which I do not know if it will work.

1) Extract out unbricked 2.1 emunand in pc.
2) Hardmod and flash the unbricked 2.1 emunand to sysnand.
3) ???

Lets say the above method works is there anyway to update my sysnand back to 9.2 or 10.7? I am guessing recovery wont work. What about games with update in it?

Many thanks in advance!

UPDATE!!! (N3DS is unbricked!!!) *Stuck on 2.1 without any NAND Backups*

My situation:
I downgraded to 2.1 on a N3DS without any sysNAND or emuNAND backups totally. So I tried updating though system settings to 10.7 which causes a brick. (I did not know at that point of time).

So I extracted out the 2.1 from my microSD using 3DS Multi EmuNAND Creator and flashed it back to sysNAND with a hardmod.

After getting help from @d0k3 & @al3x_10m and many hours of trial and error I managed to update my N3DS from 2.1 without any nand backup.

So the steps are below, I have splitted it up into 4 sections.

Links to files needed
N3DS 10.7 firm0 and firm1 files
N3DS NCSD Header
Modded Decrypt9
OTPHelper-20160502-081624

1) Setting Up emuNAND
1) Use OTPHelper to dump your otp.bin and otp0x108.bin
2) Use OTPHelper to make a backup for 2.1 sysNAND and rename it to sysNAND 2.1 or something. (Incase the gamecart update fails, you still can use a hardmod to unbrick)
!!!IMPORTANT!!! - I bricked my N3DS a few times during updating to 4.5 using game cart. Steps 3 and 4 is like an insurance, no harm taking extra precaution
3) Turn off internet settings, format your N3DS, if it is in the format loop just wait around 2 mins or so and off it.
4) Boot into recovery by holding L + R + Up + A on boot, after that exit
5) Repeat steps 3 and 4 again
6) Update the N3DS to 4.5 using a gamecart
7) Create emuNAND FW 4.5 using gateway by use gateway entrypoint (go.gateway-3ds.com)
8) Use the modded Decrypt9, it is named as Launcher.dat *Start it using gateway entrypoint (go.gateway-3ds.com) (Slot0x05KeyY.bin needs to be in the root to use the modded Decrypt9)
9) Dump hs.app for emuNAND 4.5
10) Use Universal Inject Generator to create sysupdater.app(profi200's one,safesys and plaisys doesn't work)
11) Unmount SD and put 10.7 N3DS update pack in 'updates' folder, 10.7 firm0.bin and firm 1.bin and NCSD_header_n3ds.bin on root of SD Card
12) If you have a gateway card, replace the modded Decrypt9 launcher with gateway launcher
13) Put back your SD and inject sysupdater into h&s then reboot

2) Updating emuNAND to 10.7
*Make sure these 3 files are at the root of your SD Card*
10.7 firm0.bin
10.7 firm 1.bin
NCSD_header_n3ds.bin

1) I used gateway to enter emuNAND for 4.5 since I got a gateway card. If you have no gateway you can try other CFW? If anyone tested it can let me know, I will add it to this guide and put your name in credits :D
2) Open sysupdater in emuNAND 4.5 and press (A) to update emuNAND to 10.7
3) After updating it will auto reboot, take out the SD card and replace the Launcher.dat with the one from OTPHelper-20160502-081624
4) Launch OTPHelper in sysNAND 4.5 *Start it using gateway entrypoint (go.gateway-3ds.com)
5) Inject the 10.7 firm0.bin and firm1.bin into emuNAND 10.7
6) Use the Unbrick FW 9.x EmuNAND function (This will take quite some time)
7) After it is done go to NAND Backup & Restore and select Clone EmuNAND to SysNAND
8) Make a NAND backup of your 10.7 sysNAND and rename it sysNAND 10.7 or something (This is needed for A9LH installation)
9) Reboot and your N3DS is now UNBRICKED!!!

3) Downgrade sysNAND to 9.2
*Remember to delete the 10.7 updates folder from root of your SD Card*

1st we need to downgrade to 9.2, you can use Plailect's downgrading guide to downgrade
I used cubic ninja as the entry point for 10.7 to boot into homebrew launcher

When you boot into 9.2 it will show "An error has occured." message, don't worry this is normal.
For some reason it will crash around 3-4 seconds when you boot your N3DS because of the homemenu being loaded I think?

4) Installing A9LH (LumA Version)
We need to install menuhax so just grab the files from here, you should know how to use it by now.

1) Do the Preparatory Work from Plailect's Guide
2) Now we got a 3-4 seconds window before the N3DS will crash when we boot it
3) After you on the N3DS quickly tap the top left corner of your touchscreen to go into HOME Menu Settings
4) Tap Change Theme (This is needed to install menuhax)
5) After exiting it will crash again don't worry
6) After you on your N3DS again, quickly tap on the internet browser icon
7) Go to http://yls8.mtheall.com/3dsbrowserhax_auto.php to launch homebrew launcher
8) Install menuhax, configure it to type 2 (Auto Boot)
9) Exit menuhax manager and launch miniPasta, it will auto reboot into homebrew launcher again
10) Launch Safe A9LH Installer and press Select *Redo steps 9-10 if it hangs*
11) Power on your N3DS, it will auto reboot into homebrew launcher again, now uninstall menuhax
12) A9LH is installed in your N3DS but the error will still show up when it is on 9.2 so now we gonna update it to 10.7 while keeping the A9LH
13) If you have followed the Preparatory Work from Plailect Guide, you will be able to launch Decrypt 9 by holding Start button on boot
14) Launch Decrypt9, go to SysNAND Options > SysNAND Backup/Restore... > NAND Restore (keep a9lh) > Select the sysNAND 10.7 backup you made earlier on
15) After restoring you will have a A9LH 10.7 sysNAND
16) Use Decrypt 9 to inject fbi to the h&s
17) Now make a NAND dump of the 10.7 A9LH sysNAND


Pros:
N3DS is unbricked!

Cons:
You can't use any app or stuffs related to DSIware
BigBlueMenu is not working, but there are other .cia installers to replace that.
I can't format my N3DS too but hey its unbricked, who cares

Credits:
@d0k3 For helping me throughout the whole journey and providing the OTPHelper-20160502-081624 test build
@al3x_10m For helping me throughout the whole journey and providing the N3DS NCSD Header & Modded Decrypt9 files
yellows8 for menuhax and browserhax
@Plailect for the A9LH guide
@smealum for ninjhax
@DarkMatterCore for 3DS Multi EmuNAND Creator
 
Last edited by slslasher,

4gionz

Well-Known Member
Member
Joined
Aug 16, 2014
Messages
793
Trophies
0
Age
33
XP
488
Country
Canada
How did you end up on 2.1 without a 9.2 NAND backup? Damn even if you flash the 2.1 emunand with a hardmod (which would actually work I think) you'll still be left on 2.1 with no way to get back to 9.2...hopefully someone here has a way out
 

slslasher

Well-Known Member
OP
Member
Joined
Mar 17, 2015
Messages
165
Trophies
0
Age
33
XP
739
Country
Singapore
How did you end up on 2.1 without a 9.2 NAND backup? Damn even if you flash the 2.1 emunand with a hardmod (which would actually work I think) you'll still be left on 2.1 with no way to get back to 9.2...hopefully someone here has a way out
U wont need a 9.2 backup to downgrade to 2.1. Coz I memorized the a9lh steps so I did nt read the guide now. So I missed out the backup part.

Works on old3ds but bricked on new 3ds
 

4gionz

Well-Known Member
Member
Joined
Aug 16, 2014
Messages
793
Trophies
0
Age
33
XP
488
Country
Canada
U wont need a 9.2 backup to downgrade to 2.1. Coz I memorized the a9lh steps so I did nt read the guide now. So I missed out the backup part.

Works on old3ds but bricked on new 3ds
No I know you don't need a 9.2 backup to downgrade but you absolutely need one to get back to your original firmware..it's a crucial part of the guide and literally step one once on 9.2 even when NOT trying to install a9lh. I'm sorry but I really think it's permabricked...wish I could be more help.

pm me if you can't do anything with it and want to sell it tho. If it's decent condition I may take it if the price is cheap just for the parts (although I doubt it since just the shipping from you to me would cost an arm and a leg)
 

slslasher

Well-Known Member
OP
Member
Joined
Mar 17, 2015
Messages
165
Trophies
0
Age
33
XP
739
Country
Singapore
No I know you don't need a 9.2 backup to downgrade but you absolutely need one to get back to your original firmware..it's a crucial part of the guide and literally step one once on 9.2 even when NOT trying to install a9lh. I'm sorry but I really think it's permabricked...wish I could be more help.

pm me if you can't do anything with it and want to sell it tho. If it's decent condition I may take it if the price is cheap just for the parts (although I doubt it since just the shipping from you to me would cost an arm and a leg)
I am actually selling quite cheap. 125sgd. Its in really good condition n I have 2 of it. Maybe I will try to recover my partition using some software to get it to 10.7 pre-downgraded emunand n extract it out which I doubt it will work. I will try it tonight. I am very good at soldering, used to do psp mods but might not help in this case.
 

mathieulh

Well-Known Member
Member
Joined
Feb 28, 2008
Messages
378
Trophies
0
Website
keybase.io
XP
897
Country
France
The keyslot used to decrypt/encrypt CTRNAND changed from 0x04 on o3ds to 0x05 on n3ds, when you downgraded to 2.1.0 which uses an o3ds firm, you re-encrypted your CTRNAND using the 0x04 keyslot, but using a card or system settings to update your console will write a n3ds FIRM (after all, your console is a n3ds) which needs CTRNAND to be encrypted with keyslot 0x05, because it's not encrypted with the right key, it will fail to boot.
 
  • Like
Reactions: Quantumcat

Bedel

The key of the blade
Member
Joined
Oct 28, 2015
Messages
1,384
Trophies
0
XP
2,815
Country
United States
I am actually selling quite cheap. 125sgd. Its in really good condition n I have 2 of it. Maybe I will try to recover my partition using some software to get it to 10.7 pre-downgraded emunand n extract it out which I doubt it will work. I will try it tonight. I am very good at soldering, used to do psp mods but might not help in this case.
If you have emunand backup and not sysnand, I think you can use that to recover the N3DS. It will be on 10.7 and need a downgrade again, but since it's the same console, it should be possible to recover from the hardbrick that way.
 

jerrmy12

Well-Known Member
Member
Joined
Apr 8, 2016
Messages
240
Trophies
0
XP
108
Country
United States
Hi guys, I forgot to do a nand backup and downgrade my n3ds sysnand to 2.1. After getting otp I update my sysnand through system settings resulting in a hardbrick. I know this is user error. I have done many a9lh but this is the first time I forgot. Damned.

Anyway I have thought of a possible way to unbrick which I do not know if it will work.

1) Extract out unbricked 2.1 emunand in pc.
2) Hardmod and flash the unbricked 2.1 emunand to sysnand.
3) ???

Lets say the above method works is there anyway to update my sysnand back to 9.2 or 10.7? I am guessing recovery wont work. What about games with update in it?

Many thanks in advance!
kek, this is what you get for skipping steps
 

slslasher

Well-Known Member
OP
Member
Joined
Mar 17, 2015
Messages
165
Trophies
0
Age
33
XP
739
Country
Singapore
Last edited by slslasher,

driverdis

I am Justice
Member
Joined
Sep 21, 2011
Messages
2,867
Trophies
2
Age
31
Location
1.048596β
XP
2,838
Country
United States
I would talk to @d0k3 and see if he has any ideas on making something sysupdater like that installs New 3DS cias (9.2) then undoes the changes to the NAND to allow 9.2 to boot on New 3DS.

Other than that, You are stuck.
 

slslasher

Well-Known Member
OP
Member
Joined
Mar 17, 2015
Messages
165
Trophies
0
Age
33
XP
739
Country
Singapore
I would talk to @d0k3 and see if he has any ideas on making something sysupdater like that installs New 3DS cias (9.2) then undoes the changes to the NAND to allow 9.2 to boot on New 3DS.

Other than that, You are stuck.
is it possible to just undo the changes to NAND then I use recovery to update to 10.7?
 

driverdis

I am Justice
Member
Joined
Sep 21, 2011
Messages
2,867
Trophies
2
Age
31
Location
1.048596β
XP
2,838
Country
United States
is it possible to just undo the changes to NAND then I use recovery to update to 10.7?

I do not think so as recovery probably would not boot once the NAND changes were reverted. If New 3DS CIAs and firm (from firmware 9.2) could be installed from inside 2.1, undoing the changes to the NAND would probably allow boot on 9.2.

--------------------- MERGED ---------------------------

Well, great. Stupid phone's cellular connection made me post multiple times :/
 

slslasher

Well-Known Member
OP
Member
Joined
Mar 17, 2015
Messages
165
Trophies
0
Age
33
XP
739
Country
Singapore
I do not think so as recovery probably would not boot once the NAND changes were reverted. If New 3DS CIAs and firm (from firmware 9.2) could be installed from inside 2.1, undoing the changes to the NAND would probably allow boot on 9.2.

--------------------- MERGED ---------------------------

Well, great. Stupid phone's cellular connection made me post multiple times :/
I saw from youtube there is a way to install .cia through cmd in windows. What abt reverting the nand changes?
 

d0k3

3DS Homebrew Legend
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
Oh well... There is no known way out of this problem. With a hardmod, you can try this (I'm only giving you pointers into the right direction here, you need to do the legwork yourself):
  • [Preparations] USe OTPHelper to generate the CTRNAND slot 0x05 and slot 0x04 XORpads, keep them in a safe place
  • Upgrade to v4.5 using a cartridge (everything should be fine, N3DS still working)
  • Using SysUpdater and a N3DS update pack, update your N3DS to an acceptable version >= 9.0
  • The last step will have your SysNAND bricked
  • To unbrick, dump your NAND, then dump your CTRNAND from that with my 3DSFAT16 tool (in my GitHub...) using the slot 0x04 XORpad
  • Inject the CTRNAND back into the NAND dump using the slot 0x05 XORpad
  • Replace the first 512 byte of your NAND dump with the first 512 byte from another (working, >= 9.0) N3DS NAND dump (need help from another user for this).
  • Write your NAND dump back
If you are really lucky, this will do the job. If it does not, it will be much harder. You'd basically need to install A9LH from 2.1 (there is a possibility, but you will need to hunt it down, also maybe @dark_samus3 knows), then get a N3DS vX.Y CTRNAND from someone else and replace certain files (I can't help you to decide which) with files from your CTRNAND.

Anyways, I fully expect you let us know how this goes for you. Good luck!


EDIT: Just added a step that I forgot, recheck the instructions.
 
Last edited by d0k3,

slslasher

Well-Known Member
OP
Member
Joined
Mar 17, 2015
Messages
165
Trophies
0
Age
33
XP
739
Country
Singapore
Oh well... There is no known way out of this problem. With a hardmod, you can try this (I'm only giving you pointers into the right direction here, you need to do the legwork yourself):
  • [Preparations] USe OTPHelper to generate the CTRNAND slot 0x05 and slot 0x04 XORpads, keep them in a safe place
  • Upgrade to v4.5 using a cartridge (everything should be fine, N3DS still working)
  • Using SysUpdater and a N3DS update pack, update your N3DS to an acceptable version >= 9.0
  • The last step will have your SysNAND bricked
  • To unbrick, dump your NAND, then dump your CTRNAND from that with my 3DSFAT16 tool (in my GitHub...) using the slot 0x04 XORpad
  • Inject the CTRNAND back into the NAND dump using the slot 0x05 XORpad
  • Replace the first 512 byte of your NAND dump with the first 512 byte from another (working, >= 9.0) N3DS NAND dump (need help from another user for this).
  • Write your NAND dump back
If you are really lucky, this will do the job. If it does not, it will be much harder. You'd basically need to install A9LH from 2.1 (there is a possibility, but you will need to hunt it down, also maybe @dark_samus3 knows), then get a N3DS vX.Y CTRNAND from someone else and replace certain files (I can't help you to decide which) with files from your CTRNAND.

Anyways, I fully expect you let us know how this goes for you. Good luck!


EDIT: Just added a step that I forgot, recheck the instructions.
Hi, thanks for the steps. I will try it later. I have got and extra small N3DS for extracting the NAND dump but I don't really get the 2nd last step about the 512 byte.
 

d0k3

3DS Homebrew Legend
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
Hi, thanks for the steps. I will try it later. I have got and extra small N3DS for extracting the NAND dump but I don't really get the 2nd last step about the 512 byte.
Dump the NAND from the second N3DS as well, get the first 512 byte from that and write to a file. When doing the steps, you need to replace the first 512 bytes of the first N3DS NAND dump with the first 512 byte from the second N3DS NAND dump. Second N3DS needs to be >= 9.0.

Also, you're the first person to do this, and if it works, or if it fails - please let the others on here know how it turns out for you.
 

slslasher

Well-Known Member
OP
Member
Joined
Mar 17, 2015
Messages
165
Trophies
0
Age
33
XP
739
Country
Singapore
Dump the NAND from the second N3DS as well, get the first 512 byte from that and write to a file. When doing the steps, you need to replace the first 512 bytes of the first N3DS NAND dump with the first 512 byte from the second N3DS NAND dump. Second N3DS needs to be >= 9.0.

Also, you're the first person to do this, and if it works, or if it fails - please let the others on here know how it turns out for you.
Sure I will let you guys know the results. The 512 bytes do u mean using a hexeditor and copy the values 0x200 (512) bytes. Length in hex editor is 200.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • LeoTCK @ LeoTCK:
    SUPPORT LOCAL PRODUCTS, MAKE REVOLUTION
  • LeoTCK @ LeoTCK:
    THEY KEEP REMOVING LOCAL SHIt AND REPLACING WItH INFERIOR CHINESE CRAP
  • LeoTCK @ LeoTCK:
    THATS WHY MY PARTNER CANT GET A GOOTWEAR HIS SIZE ANYMORE
  • LeoTCK @ LeoTCK:
    HE HAS BIG FOOT AND BIG DUCK
  • LeoTCK @ LeoTCK:
    d*ck i mean*
  • LeoTCK @ LeoTCK:
    lol
  • Veho @ Veho:
    Mkay.
  • Veho @ Veho:
    I just ordered another package from China just to spite you.
  • SylverReZ @ SylverReZ:
    Communism lol
  • SylverReZ @ SylverReZ:
    OUR products
  • The Real Jdbye @ The Real Jdbye:
    @LeoTCK actually good quality products are dying out because they can't compete with dropshipped chinese crap
    +2
  • BakerMan @ BakerMan:
    @LeoTCK is your partner the sascrotch or smth?
  • Xdqwerty @ Xdqwerty:
    Good morning
  • Xdqwerty @ Xdqwerty:
    Out of nowhere I got several scars on my forearm and part of my arm and it really itches.
  • AdRoz78 @ AdRoz78:
    Hey, I bought a modchip today and it says "New 2040plus" in the top left corner. Is this a legit chip or was I scammed?
  • Veho @ Veho:
    @AdRoz78 start a thread and post a photo of the chip.
    +2
  • Xdqwerty @ Xdqwerty:
    Yawn
  • S @ salazarcosplay:
    and good morning everyone
    +1
  • K3Nv2 @ K3Nv2:
    @BakerMan, his partner is Luke
  • Sicklyboy @ Sicklyboy:
    Sup nerds
    +1
  • Flame @ Flame:
    oh hi, Sickly
  • K3Nv2 @ K3Nv2:
    Oh hi flame
    K3Nv2 @ K3Nv2: Oh hi flame