Hello Rei,
I've been experimenting with your source since you released it. Great work. Fascinating to say the least; I'm learning a lot from it.
One of my biggest issues with my jpn n3ds (turned european) was the non working eshop.
yifan_lu suggested the issue was the ctcert not matching the serial; so I dumped the ram from my old 3ds, and from my new 3ds, replacing the ctcert occurences using your injected arm9 thread.
This are the offset I found (for 9.5 firm):
memcpy((void*)0x01FFB804, patchctcert, 0x7c); // ctcert "ITCM" version
memcpy((void*)0x8095b34, patchctcert, 0x4); // u32 device id
memcpy((void*)0x80ef200, patchctcert, 0x4); // same as above
memcpy((void*)0x80df7c5, patchctcert, 0x4); // same as above
memcpy((void*)0x8095ba0, patchctcert2, 0x180); // ctcert "full" version
memcpy((void*)0x2f06a764, spr, 0x3); // product code (in my case, KTR)
Those however, are not enough. The error code changed, but the eshop is still not loading :/
Would love a clue from you, if you had any to share.
Thanks