I don't exactly know how it works, I just know that it's able to access both sysNAND and emuNAND, no matter where you launch it from.Thanks! And now an unrelated question: How does D9 access sysNAND from emuNAND?
Whether you boot it from emuNAND, sysNAND, or A9LH. It'll detect everything.