[Tutorial] Update 3DS 8.1 to 9.x

Discussion in '3DS - Tutorials' started by ashinnblunts, Dec 21, 2015.

  1. ashinnblunts
    OP

    ashinnblunts GBAtemp Regular

    Member
    116
    109
    Jun 25, 2012
    United States
    Updating Sysnand 8.1

    Disclaimer: This guide is a WIP. I may have forgotten something. I'm also not responsible for anyone who bricks their 3DS, or anything that happens to it really.

    The 3DS Firmware version 8.1 is the launch version for N3DS. Many people who are on this FW are at 8.1.0-0x, a version with no web browser. The payloads for Ninjhax/Ironhax/Browserhax ect, requires the browser to gain access. Furthermore, most CFW for an exploitable N3DS require one of the aforementioned hacks.

    Originally Nintendo hosted everything needed to update system NAND on their servers, however those files have since been removed. This means in order to update, you need to host these files yourself.

    If you are on 8.1 and do have a browser you can still update via this method. If you are on O3DS I have no idea.

    Preparation

    Before starting you should clear any pending system updates, just in case.

    Install NTR CFW
    Run Cubic Ninja and navigate to the QR code function. Scan the provided QR code in the NTR CFW download to install it to the savegame.

    Web Server
    If you are on Windows and want to setup a local server, download WAMP or something similar. If you are using another OS there are alternatives.

    Once the server is installed, make sure you can access it via local IP (like 192.168.0.x). In order to do this with WAMP, you need to edit httpd.conf. Click the green WAMP icon in the systems tray, navigate to the folder that says "Apache" and click httpd.conf. Find the text "Deny from all" and change it to "Allow from all". Now restart WAMP.

    You should now see info when navigating to your local IP in the web browser (for example: http://192.168.1.100 ).

    Make sure the contents of 3ds-private-update-server.zip are extracted somewhere as well (preferably C:\wamp\www\3dsupdate\).

    1. Unpack Update Files

    Place the .cia files of the system update you chose (should be 9.0, 9.1, or 9.2) inside a sub-folder named "updates" of wherever you extracted 3ds-private-update-server.zip.

    Move node.exe and the file "CdnCiaUnpack.js" to the "updates" folder as well.

    Next, open a command prompt and "cd" to the updates folder and type "node.exe CdnCiaUnpack.js". Alternatively you can drag the CdnCiaUnpack.js file and drop it onto node.exe. If done correctly it should have generated a file called "GetSystemUpdate.partial.xml". This file should not be empty. Move this file outside of the "updates" directory, to the same directory as index.php.

    2. Host Update Files

    Now move the folder containing index.php, all the .xml files, and "updates" directory, to the /www/ of where you installed WAMP (should be C:\wamp\www). I recommend moving it to somewhere like C:\wamp\www\3dsupdate\.

    You should now see some text when viewing that folder in the browser (like http://192.168.1.100/3dsupdate/)

    The first 6 lines of index.php can be configured. If you are having trouble try changing the $ServerPort.

    You should also disable error reporting by editing index.php and typing "error_reporting(0);" on the second line (or anywhere in the <?php tag). If you have PHP 5.x you will most likely have to do this step.

    3. Update SysNAND

    Run Cubic Ninja and launch NTR CFW through it.

    Replace 192.168.1.100 with your local ip / server address. Also make sure you can view the index.php link described in the commands below.

    Run NTR Debugger and type in each command one by one, waiting for each one to say "Finished".

    connect('192.168.1.100', 80)
    listprocess()
    write(0x15E424, tuple(map(ord, "http://192.168.1.100/3dsupdate/index.php\0")), pid=0x25)
    write(0x15E0EC, tuple(map(ord, "http://192.168.1.100/3dsupdate/index.php\0")), pid=0x25)
    write(0x15E463, tuple(map(ord, "http://192.168.1.100/3dsupdate/index.php\0")), pid=0x25)

    Now go to your system settings and update your firmware like normal.

    You can see this process through the video below.



    Once finished, or if something goes wrong, you can view the log file the script generates.

    Credits
    • Syphurith for update server files.
    • Guy who made video (forgot name)
    • cell9 for NTR stuff
     
    Last edited by ashinnblunts, Dec 21, 2015


  2. Angely

    Angely GBAtemp Regular

    Member
    179
    61
    Mar 30, 2015
    Netherlands
    You can also use sysupdater plugin it can be used with the HBL.You need to make a map called updates on the root of your sd & put the update .cia files you want to upgrade in it.This works on all exploitable 2/3ds'es if I'm correct! It's much easier & faster than using the server method. you can use it in combo with minipasta.This method can be also used to upgrade emunand manually to your desired firmware! Hope this also helps. Or you can also try to manually install the browser if you want to stay on 8.1 by installing the mset exploit to launch decrypt9 or rxtools (to install an.cia installer) you have a nds flashcard. There're so many options. xD

    More info on.
    https://gbatemp.net/threads/how-to-...om-4-1-8-1-to-9-2-0-20-with-pasta-cfw.389187/
     
    Last edited by Angely, Dec 21, 2015
  3. Ammako

    Ammako GBAtemp Guru

    Member
    6,400
    3,529
    Dec 22, 2009
    Canada
    None of this can be done on 8.1.0-0J
     
  4. reiyu

    reiyu Canadian, eh?

    Member
    861
    187
    Jan 8, 2008
    Canada
    you can't start pasta without a browser. this will NOT work.
     
  5. Angely

    Angely GBAtemp Regular

    Member
    179
    61
    Mar 30, 2015
    Netherlands
    Sorry i thought you could us it by using ninjahax's HBL plugin:s. I guess you can't use rxtools/ntr/any other cfw/plugins (decrypt9) that can be launched with an mset instead of minipasta?:o It sure suck, i guess upgrading your fw is your only option on N3DS without browser....
     
    Last edited by Angely, Dec 21, 2015
  6. reiyu

    reiyu Canadian, eh?

    Member
    861
    187
    Jan 8, 2008
    Canada
    nobody made an rxTools MSET payload for 8.1. there exists for 9.x.
     
  7. retrofan_k

    retrofan_k GBAtemp Advanced Maniac

    Member
    1,712
    1,029
    May 31, 2013
    Caves
    Can someone explain where I'm going wrong here?

    I have done all the steps in the OP's post except for this:

    Once the server is installed, make sure you can access it via local IP (like 192.168.0.x). In order to do this with WAMP, you need to edit httpd.conf. Click the green WAMP icon in the systems tray, navigate to the folder that says "Apache" and click httpd.conf. Find the text "Deny from all" and change it to "Allow from all". Now restart WAMP.

    That option "Deny from All" does not seem to be in the text when viewed in Notepad using the find option when i try to view it from Wamp.

    I have unpacked the 9.2 update CIA's and made the GetSystemUpdate.partial.xml which is 16kb in size and hosted the files from the looks of things. When I type my local IP of 192.168.1.5 in a browser, I get the following:


    Private Server to update 3ds.
    Folders: Url=http://192.168.1.5:80/, Update=http://192.168.1.5:80/updates
    Accept: GetSystemTitleHash, GetAccountStatus, GetSystemUpdate.
    You can find more details about update it with NTR from yifan_lu blog here.


    I can boot NTR CFW fine (enable the debugger) and then login in to my local server using the NTR Debugger from the PC.

    However, if I try this command after connecting to the server, "write(0x15E424, tuple(map(ord, "http://192.168.1.5/3dsupdate/index.php\0")), pid=0x25)"

    This happens here:

    > connect('192.168.1.5', 80)
    null
    Server connected.
    > write(0x15E424, tuple(map(ord, "http://192.168.1.5/3dsupdate/index.php\0")), pid=0x25)
    null
    packet: cmd = 1684095520, dataLen = 540618292
    broken protocol: magic = 1347703880, seq = 825110831
    Server disconnected.
     
    Last edited by retrofan_k, Dec 27, 2015
  8. ashinnblunts
    OP

    ashinnblunts GBAtemp Regular

    Member
    116
    109
    Jun 25, 2012
    United States
    Your httpd.conf should have something like this in it (take note of the area around "Allow from all")

    Code:
    DocumentRoot "c:/wamp/www"
    <Directory "c:/wamp/www">
        #
        # Possible values for the Options directive are "None", "All",
        # or any combination of:
        #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
        #
        # Note that "MultiViews" must be named *explicitly* --- "Options All"
        # doesn't give it to you.
        #
        # The Options directive is both complicated and important.  Please see
        # http://httpd.apache.org/docs/2.4/mod/core.html#options
        # for more information.
        #
        Options Indexes FollowSymLinks
    
        #
        # AllowOverride controls what directives may be placed in .htaccess files.
        # It can be "All", "None", or any combination of the keywords:
        #   AllowOverride FileInfo AuthConfig Limit
        #
        AllowOverride All
    
        #
        # Controls who can get stuff from this server.
        #
    #    Require all granted
    #   onlineoffline tag - don't remove
         Order Deny,Allow
         Allow from all
         Allow from 127.0.0.1
         Allow from ::1
         Allow from localhost
    </Directory>
    
     
  9. retrofan_k

    retrofan_k GBAtemp Advanced Maniac

    Member
    1,712
    1,029
    May 31, 2013
    Caves
    Hi,

    I have doubled checked this a few times and cannot find this in my conf file. I have attached it and just added a txt extension so it can be viewed easier.

    The version I'm using is:

    Server Configuration
    Apache Version :
    2.4.9 - Documentation
    PHP Version :
    5.5.12 - Documentation
    Server Software:
    Apache/2.4.9 (Win64) PHP/5.5.12
     

    Attached Files:

    Last edited by retrofan_k, Dec 28, 2015
  10. ashinnblunts
    OP

    ashinnblunts GBAtemp Regular

    Member
    116
    109
    Jun 25, 2012
    United States
     

    Attached Files:

  11. retrofan_k

    retrofan_k GBAtemp Advanced Maniac

    Member
    1,712
    1,029
    May 31, 2013
    Caves
    I put the edited httpd.conf in the corresponding WAMP installation directory, yet the same issue is happening when putting in the commands in the debug console. I had to change the port in the index.php to 80 instead of 8080 because the NTR debugger would not connect to 8080.

    connect('192.168.1.5', 80)
    null
    Server connected.
    > write(0x15E424, tuple(map(ord, "http://192.168.1.5/3dsupdate/index.php\0")), pid=0x25)
    null
    packet: cmd = 1684095520, dataLen = 540618292
    broken protocol: magic = 1347703880, seq = 825110831
    Server disconnected.

    I can view this link on my local IP in a browser http://192.168.1.5/3dsupdate/index.php\0"))

    Private Server to update 3ds.
    Folders: Url=http://192.168.1.5:80/3dsupdate/index.php/0")), Update=http://192.168.1.5:80/3dsupdate/index.php/updates
    Accept: GetSystemTitleHash, GetAccountStatus, GetSystemUpdate.
    You can find more details about update it with NTR from yifan_lu blog here.

    stuck:unsure:?????
     
    Last edited by retrofan_k, Dec 28, 2015
  12. retrofan_k

    retrofan_k GBAtemp Advanced Maniac

    Member
    1,712
    1,029
    May 31, 2013
    Caves
    @ashinnblunts

    I have managed to get further with the last step of the commands and successfully wrote the 3 patches with the NTR debugger without errors. I had to put in my 3DS IP and port 8000 (in my case (192.168.1.8, 8000). Port 80 or 8080 would not work but only 8000 for me, yet in the instructions you mention local PC IP i.e connect ('192.168.1.100', 80). Not sure if the port will be a problem for others but the IP needs to be the 3DS one and not the PC.

    However, my next issue is that when I try to update, it throws an error out (I cannot understand Japanese) and I have Nintendo's update URLS blocked in my router for the 3DS and WiiU. I read on another thread here https://gbatemp.net/threads/guide-upgrading-8-1-0-0j-to-9-2-0-20j.384960/page-31 post #611 that update blocks need to be removed.

    I don't want to risk removing these blocks in my router in case I update to 10.3 official:sad:
     
  13. Syphurith

    Syphurith Beginner

    Member
    641
    221
    Mar 8, 2013
    Switzerland
    Xi'an, Shaanxi Province
    You have to dump your SysNAND before any updates to it,
    1.NTR debugger can only connect to 8000 of 3ds, cause NTR itself only opens at that port.
    2.3ds itself would try to connect to http://contest.nintendowifi.net/ once it needs to know if connected to internet.
    Once connected to internet, and not in passby/background mode, it would only access this. So no folding when updating.
    I've only heard of guys that fail the update again and again, but no one would update to a 10.3 with purpose, once that 3ds isn't folded.
    Also the newer version of my PHP file could also handle this request. If you modify this url inside ac, it could be done totally offline.
    3.The real problem is setting up the server, also modify the links. There isn't any other hard points.
    If you're not a total noob, and would like to learn the steps carefully, i don't know why you'd update to latest.
    The chinese tutorial contains needed offsets of nim and ac.
    Just don't be too busy wanting the 9.1, there is guy who used almost 3 days to complete the update.
    And I've also seen one that don't want to wait for instructors (like me) and find another guy to update to latest, orz.
     
    Last edited by Syphurith, Dec 30, 2015 - Reason: Warning.
    MelonGx likes this.
  14. Lucifer666

    Lucifer666 all the world needs is me

    Member
    1,472
    675
    Apr 22, 2011
    The Fourth Dimension
    can you adapt this to WAMP 2.5? "deny from all" isn't there. I've googled for around 3 hours and people are just saying to use the new 'Put Server Online' option, which I did, but I could still only access my server from http://localhost/ and http://127.0.0.1:/ but not from my actual IP address

    I found some other instructions for editing 4 different config files and nothing helped

    hey did you ever get this working? I'm struggling to access my WAMP server via IP address..
     
  15. retrofan_k

    retrofan_k GBAtemp Advanced Maniac

    Member
    1,712
    1,029
    May 31, 2013
    Caves
    Yeah, I had to look for <TitleId>000400102002CA00</TitleId> in GetSystemUpdate_response.xml

    Swap <Version>0</Version> to <Version>1</Version>
     
  16. sj33

    sj33 GBAtemp Addict

    Member
    2,592
    1,591
    Oct 22, 2013
    I'm thinking about doing this so I can upgrade my browserless 8.1J to 9.2 and thus stop having to rely on my Gateway.

    Quick question however - does the 3DS actually have to connect to the internet at all during the update process, or does it just connect straight to the local server. I'm paranoid about accidently updating to the latest official update and would rather just pull the plug on my connection to be safe, but I'm not sure that would still allow me to update.

    I've never set up my own webserver before and while I seem to have set everything up correctly, my paranoia is high. Don't want to end up with a New 3DS on 10.6.
     
  17. retrofan_k

    retrofan_k GBAtemp Advanced Maniac

    Member
    1,712
    1,029
    May 31, 2013
    Caves
    It's fine once the NTR debugger is enabled, as it will only connect to the local server. I was a bit cautious about official fw getting on it. I used this method and it worked, which I later updated to 10.3 then back to 9.1.

    This method will put you on 9.1 and not 9.2, as the japanese 9.2 files are actually 9.1 from that iso site. Makes no difference anyway? as 9.1 does the same as 9.2
     
    Last edited by retrofan_k, Mar 3, 2016
  18. sj33

    sj33 GBAtemp Addict

    Member
    2,592
    1,591
    Oct 22, 2013
    That's good to hear! That being said, I assume if it only connects to the local server then I can indeed remove it from the router? No harm in making sure.

    Those files are actually 9.1? Good to know, although I assume it doesn't actually matter. The purpose of this is to be able to use menuhax, reduce my reliance on Gateway by making CFW possible (not possible on browserless 8.1, I believe) and to be on a firmware where I can potentially install A9LH in the future.

    I hit a couple of errors in the NTR Debugger last night but I'll try again tonight.
     
  19. iCEQB

    iCEQB GBAtemp Advanced Fan

    Member
    638
    413
    Nov 2, 2013
    United States
    I'm confused...the first post says that this tutorial is for 8.1J with browser.
    Did I miss something? Can browserless 8.1J consoles be offline updated now?
     
  20. sj33

    sj33 GBAtemp Addict

    Member
    2,592
    1,591
    Oct 22, 2013
    Are you sure? The first post suggests that the tutorial is for with browserless 8.1j users (i.e. launch Japanese N3DS) but will also work on 8.1 with a browser.