Arm9loaderhax coupled with AuReiNand gives us lucky 3DS users the amazing option of running Custom Firmware on sysnand. The advantages of this are as follows:

• Much faster and more reliable CFW cold booting compared to menuhax + emunand
• Slightly faster CFW cold booting compared to arm9loaderhax + emunand
• Using 2GB of SD card space for emunand is no longer needed (but still recommended to keep a 9.2 emunand around)
• GBA ROMs only need to be installed once, since they run from sysnand now!

Most CFW users will already have a 9.2 sysnand which is usually kept as vanilla as possible, and then an emunand running a higher FW version (i.e. 10.5) booted through CFW. With arm9loaderhax and AuReiNand, we can now swap the firmware versions over so 10.5 runs directly on SysNand, and EmuNand is used only when 9.2 is really needed (e.g. for running decrypt9). This tutorial will walk you through the process of swapping your sysnand and emunand, and changing your arm9loaderhax to use AuReiNand in order to cold boot directly to a patched 10.5 sysnand.

This tutorial assumes the following:

• You have a 9.2 or below sysnand and CFW running an emunand of a higher firmware version
• You know how to verify a SysNAND backup using md5
• You know how to back up your sysnand, emunand and SD card
• You know how to access hax to get to the Homebrew Launcher
• You know how to install homebrew apps on your 3DS
• You know how to install CIAs
• You have already captured your OTP and built an arm9loaderhax installer
• You have FBI installed on your sysnand

I won’t explain how to do all of these as this guide is intended to be an overview of the process I used to swap my sysnand and emunand.


If you follow this guide and do not have a valid sysnand backup, you risk bricking your console and this may not be recoverable without a hardmod.

This guide involves updating your sysnand to 10.5. If you don’t have a reliable way of downgrading to 9.2 if you need to, don’t follow this guide. This means you need to be able to use arm9loaderhax to boot CFW, or have a hardmod and a NAND backup, if you want to undo this.

Do not attempt this procedure without a working arm9loaderhax installer. A hardmod is not required but is recommended.


You will need:

• Homebrew hax already set up and running on your sysnand
• CFW already installed with a working emunand
• Decrypt9
• EmuNAND9
• MiniPasta
  
• AuReiNand mod (do not install this yet)

If you already have arm9loaderhax set up to boot your emunand, you will need to remove it. This is because one of the needed tools, decrypt9, can only run from sysnand. Arm9loaderhax will prevent you from entering sysnand at all, so will need to be removed. I did this by restoring a vanilla 9.2 sysnand backup which I took from the console prior to installing arm9loaderhax.


Stage 0: Make a backup of your SysNand, EmuNand and 3DS SD card

Seriously, you’ll be glad you did if something goes wrong. This process involves a lot of messing around with both sysnand and emunand.


Stage 1: Dump EmuNAND partitions

1. Boot your 3DS to sysnand
2. Launch hax and run MiniPasta
3. When back at sysnand, launch hax and run Decrypt9
4. Go to “EmuNAND Options” and then “Partition Dump”
5. Dump each of the partitions with the exception of FIRM0 and FIRM1, pressing B after each one to return to the menu and dump the next partition
6. Press START to quit Decrypt9, and reboot back to sysnand

Stage 2: Downgrade EmuNand to 9.2

1. From sysnand, launch hax and run MiniPasta
2. When back at sysnand, launch hax and run EmuNAND9
3. Choose “EmuNAND Manager Options” and then choose “Clone SysNAND to EmuNAND”
4. Once this is complete, press START to reboot
5. From sysnand, launch hax and run TinyFormat to format SysNand and unlink NANDs
6. Once the system reboots, complete the initial setup without linking NNID
7. Once you are at the home menu, set your sysnand theme to red
8. Launch hax and run CFW to get into emunand
9. Once in emunand, set the theme to blue
10. Power off the 3DS

At this point, your sysnand and emunand should both be on 9.2, and you should have dumps of your original emunand. The purpose of setting the NAND colours to red and blue is to ensure you can tell which NAND you are in, since they are both at this stage running the same FW version and will look identical.


Stage 3: Update SysNand to AuReiNand CFW 10.5

1. Take out your 3DS SD card and put it in your computer
2. Replace the rei folder, arm9loaderhax.bin and ReiNand.dat in the root of your SD card with the ones from AuReiNand.
3. In the new rei folder on your SD card, place the firmware.bin and firmware90.bin from the FIRMs archive linked from the AuReiNand GitHib page
4. Create an empty file on the SD card in the /rei folder called updatedsysnand
5. Put your SD card back in your 3DS and boot it up to sysnand
6. Launch hax and run arm9loaderhax.3dsx to install the loader
7. If you get stuck on a message saying “Exploiting arm9…”, you can safely reboot your 3DS
8. The 3DS will reboot once this process is complete
9. You should now be in sysnand but running ReiNand. Verify that arm9loaderhax has been installed by powering off your 3DS, removing the SD card and powering on again. Your system should hang on a black screen because the arm9payload is not available. If your 3DS boots to sysnand without the SD card inserted, this means that arm9loaderhax has not been installed properly and you MUST NOT proceed
10. Once you have verified that arm9loaderhax is working, replace the SD card and power on your 3DS to boot to sysnand
11. Open System Settings set up your Internet connection
12. Update to 10.5 (seriously, don’t do it unless you’re certain the CFW is running by doing the SD card removal test in step 9. If you update to 10.5 without CFW up and running, you risk not being able to run any unsigned code, meaning you could end up stuck on 10.5 with no CFW)
13. Once the update is complete and the system has rebooted, enter System Settings to verify that you are now on 10.5

Step 4: Reinject emunand partitions to sysnand

This stage will make your new 10.5 sysnand how your emunand used to be

1. Power off the 3DS
2. While holding L, power the 3DS back on. This will boot into the 9.2 emunand
3. Launch hax, and run Decrypt9
4. Choose “SysNAND Options” and then “Partition Inject”
5. Inject each of the partitions in turn, with the exception of FIRM0 and FIRM1, pressing B after each one to return to the menu and inject the next partition
6. Press START to quit Decrypt9 and reboot back to SysNand.

If everything went according to plan, you should be looking at your sysnand but with all your CIAs showing. In my case, they were all back in presents and out of their folders which was a mild inconvenience. I also lost my custom theme, so that had to be reinstalled.


Final checks

1. Launch a CIA from sysnand to verify that it works. Successful launching of a CIA will indicate that the sysnand CFW is working
2. Enter System Settings from sysnand to confirm that you are on 10.5
3. Power off your 3DS, and power it back on while holding L. You should then be booted to your emunand, which will resemble your sysnand before the swap over
4. Enter System Settings from emunand to confirm that it is on 9.2
5. Now, do another sysnand, emunand and SD backup!

 

[ketal]

Can I inject the CTRNAND partition alone? I happen to have that one dumped from my old emunand but not the other partitions.

 

[Svaethier]

Can I inject the CTRNAND partition alone? I happen to have that one dumped from my old emunand but not the other partitions.

you can I'm sure of

 

[HighMans]

After following this procedure, I can no longer get in to emunand. I'm on a new 3ds using the correct firmware provided in the firms archive. Using the flag, and holding down L bootes me to a black screen and nothing else.

 

[DrakeLyon]

After following this procedure, I can no longer get in to emunand. I'm on a new 3ds using the correct firmware provided in the firms archive. Using the flag, and holding down L bootes me to a black screen and nothing else.

Same thing for me, except on O3DS. Everything went perfectly except for the end of the tutorial. I boot into AuReiNAND SysNAND on 10.6 when I power on my 3DS, which is perfect for me. However, upon injecting the EmuNAND partition I dumped previously into SysNAND, SysNAND remained completely unchanged and EmuNAND won't boot... Actually, in the Homebrew Menu, neither Cakes nor rxTools will open at all. :/

 

[mashers]

After following this procedure, I can no longer get in to emunand. I'm on a new 3ds using the correct firmware provided in the firms archive. Using the flag, and holding down L bootes me to a black screen and nothing else.

Can you boot the 10.6 sysnand?
Do you have firmware90.bin in /rei?
Are you using the latest AuReiNand including its arm9loqderhax.bin? (Older versions had the L and R buttons messed up I believe)

 

[ketal]

I'm writing a tool that extracts all the partitions from a nand backup, might be handy for some people here

 

[mashers]

upon injecting the EmuNAND partition I dumped previously into SysNAND, SysNAND remained completely unchanged and EmuNAND won't boot...

Looks like something went wrong when injecting the partition, or your booting the wrong NAND so it looks like something hasn't changed when it really has.

--------------------- MERGED ---------------------------

I'm writing a tool that extracts all the partitions from a nand backup, might be handy for some people here

That would be very helpful. Are you also intending to add partition inject functions?

 

[ketal]

That would be very helpful. Are you also intending to add partition inject functions?

Will look into it. I started making it because I have my Emunand 10.5 backup on pc and there's no way Decrypt9 can extract them, since my Sysnand is already 10.6

 

[mashers]

Will look into it. I started making it because I have my Emunand 10.5 backup on pc and there's no way Decrypt9 can extract them, since my Sysnand is already 10.6

It would be a really helpful tool for sure. What platform(s) are you developing for?

 

[ketal]

It would be a really helpful tool for sure. What platform(s) are you developing for?

Have been working on web stuff for a while. I got into C recently with 3ds homebrew

 

[mashers]

Have been working on web stuff for a while. I got into C recently with 3ds homebrew

If want a tester, I've got a hardmod so can test partition injection safely.

 

[ketal]

If want a tester, I've got a hardmod so can test partition injection safely.

Alright, will contact you when l'll have all the partitions extraction working

 

[HighMans]

Can you boot the 10.6 sysnand?
Do you have firmware90.bin in /rei?
Are you using the latest AuReiNand including its arm9loqderhax.bin? (Older versions had the L and R buttons messed up I believe)

Yes to all of those questions.

 

[mashers]

Yes to all of those questions.

Could you by any chance have menuhax running in your emunand? Perhaps try renaming your Nintendo 3DS folder and try booting emunand again.

 

[dkabot]

Have been working on web stuff for a while. I got into C recently with 3ds homebrew

Mashers' hardmod testing might be faster, but if you want "safer" tests, someone with an exploitable console can run Decrypt9 to make a full system and (decrypted) partition dump, try your tool to extract, and compare.

 

[ketal]

Mashers' hardmod testing might be faster, but if you want "safer" tests, someone with an exploitable console can run Decrypt9 to make a full system and (decrypted) partition dump, try your tool to extract, and compare.

I've been extracting lots of partitions from both o3ds and n3ds successfully; haven't tested AGBSAVE partition yet but it should work just like the others (get xorpad size, if matches with agbfirm proceed to dump. You can test whatever dump with winimage)

 

[DrakeLyon]

I fixed the problem with my SysNAND not having my EmuNAND files after the injection by injecting the backup of EmuNAND I made during this tutorial into my SD. My CIAs showed up gift wrapped and ready-to-use. However, EmuNAND still doesn't boot for me, even though I'm fairly certain it contains my SysNAND on 9.2. I think maybe it won't boot because the copy injected was before I installed A9LH.

Anyway, since SysNAND works perfectly with AuReiNAND on 10.6 with all of my EmuNAND files, I only really need EmuNAND now for Decrypt9 and EmuNAND9. Can anyone tell me how I can format my EmuNAND now or get it up and running again?

 

[CHTxc]

As somebody who has already set up A9LH with screen init on 9.2 sysNAND with 10.6 emuNAND would it be possible to do the following:

1 dump all emuNAND partitions except for FIRM0 and FIRM1 (via D9 on sysNAND)
2. inject a 9.2 backup prior A9LH into emuNAND
3. format sysNAND with TinyFormat
4. create updatedsysnand file
5. inject the dumped partitions into sysNAND through emuNAND booted with firmware90.bin

Edit: Did it as written above and it worked. Not booting into sig check patched 10.6 sysNAND.

 

[HighMans]

Could you by any chance have menuhax running in your emunand? Perhaps try renaming your Nintendo 3DS folder and try booting emunand again.

That was the issue, thank you!

 

[PixelBurst]

Just to clarify, when it says 'create an empty file' that does mean create a folder there with that name right?