Hacking Update firmware from 1.1.0

[Ronhero]

1.You can use payload with CubicNinja to get your OTP dump and NAND backup (Decrypted). OTP dumping is only available for 1.0-2.2.
2.If yours is a JPN console, please dump the NAND first. You could contact AHP_Person to have it packed back as downgrade pack.
3.If you could borrow a SKY from your friend. Get it with CubicNinja, and any game of 4.x.
4.Dump the OTP and NAND first. Then use 4.x game to update to 4.x, exploit MSET, use CFW to update to 9.0-9.2, with packs from that iso site.
There could be videos and other things useful for others. So if you just update before dumping it, you are spoiling your own console.

I think we have JPN 1.x now it's just EUR that's needed

 

[drfsupercenter]

What do you actually need from a European console though?

I gave you the promo videos, that's all that was different between 1.0 and 1.1, 2.0 is when all the eShop/browser stuff was added anyway.

And without your console's OTP key it's not like you can just take someone else's decrypted backup and apply it to your own 3DS...

 

[MelonGx]

I tried installing EU & US video into my JP emuNAND 10.5.
They were not executable until I launched them in FBI.
Now they work properly.
For next I will delete emuNAND's 0004001000023000 and install the JP video.

 

[drfsupercenter]

Yeah, last time I tried installing them, I was on 4.5. LOL. The new firmwares might intentionally blacklist them or something.

 

[MelonGx]

Succeeded importing JP video to JP 3DS emuNAND.
1) Delete 0004001000023000 (on JP 3DS emuNAND) with FBI (Devmenu cannot do that).
2) Install JP video CIA.
3) Reboot emuNAND.
Done.

The next is spoofing & injecting Promo Video to SysNAND?

 

[vivien12]

I wouldn't mind dumping it, but I really don't want to hardmod my 3ds, not myself at least. I'm an absolute disaster when it comes to anything hardware related. I don't suppose there is a way to dump it without hardmodding?

 

[MelonGx]

I wouldn't mind dumping it, but I really don't want to hardmod my 3ds, not myself at least. I'm an absolute disaster when it comes to anything hardware related. I don't suppose there is a way to dump it without hardmodding?

It requires Cubic Ninja + 1.1.0 QR.

 

[Syphurith]

Succeeded importing JP video to JP 3DS emuNAND.
The next is spoofing & injecting Promo Video to SysNAND?

Congrats.. Or else, mess up with the decrypted form of the video CIA.
So we could know how it is played, and how to craft one if we can..

I think we have JPN 1.x now it's just EUR that's needed

Last time i checked that iso site, it has 2.2.0E pack. I know AHP has the 1.0U pack (crafted one). Why no 2.2 pack for J/U? Ha.
Also i doubt if you can downgrade one console from other region to 1.0U.. So they can also dump the OTP from KOR/CHN/TWN consoles..

 

[RednaxelaNnamtra]

1.You can use payload with CubicNinja to get your OTP dump and NAND backup (Decrypted). OTP dumping is only available for 1.0-2.2.
2.If yours is a JPN console, please dump the NAND first. You could contact AHP_Person to have it packed back as downgrade pack.
3.If you could borrow a SKY from your friend. Get it with CubicNinja, and any game of 4.x.
4.Dump the OTP and NAND first. Then use 4.x game to update to 4.x, exploit MSET, use CFW to update to 9.0-9.2, with packs from that iso site.
There could be videos and other things useful for others. So if you just update before dumping it, you are spoiling your own console.

Does the nand dump payload also read the otp area? If not where can people get the payload for otp dumping? I searched the last 30-60 min for it and haven't found it(Or maybe i'm to bad at searching for it xD).
I personaly searching for it, to be able to use arm9loaderHax on my o3DS, and later on my new3DS, but if the op want's to do it he needs it too

 

[Aurora Wright]

Sure thing, I don't know if these are technically allowed though because they're firmware files.

All I did, though, was use make_cdn_cia with the right title IDs (which have since been stubbed, I did this like two years ago)

Here's a link.

The CIAs are just the output of make_cdn_cia, and as-is you can install the two that aren't of your region. If you're able to make region-free ones, be my guest! I'd also appreciate a .3ds format since I'd rather just watch the videos from a Gateway than have to install the stupid things...

Check the ISO site soon (awaiting approval )

 

[Syphurith]

Does the nand dump payload also read the otp area? If not where can people get the payload for otp dumping? I searched the last 30-60 min for it and haven't found it(Or maybe i'm to bad at searching for it xD).
I personaly searching for it, to be able to use arm9loaderHax on my o3DS, and later on my new3DS, but if the op want's to do it he needs it too

Oh no, OTP area isn't read in the provided payload. However you can contact AHP_Person for his OTP dumper payload.
Actually you can build any payload companied with that CubicNinja QR, using Ninjhax1.1b repo fully set up. Maybe kind of boring, i admit, and it should worth that.

 

[Ronhero]

Last time i checked that iso site, it has 2.2.0E pack. I know AHP has the 1.0U pack (crafted one). Why no 2.2 pack for J/U? Ha.
Also i doubt if you can downgrade one console from other region to 1.0U.. So they can also dump the OTP from KOR/CHN/TWN consoles..

I confirmed the dev group does have 1.x jpn and yes its not on iso.

Yes I have downgraded a JPN to USA 1.x to get otp working

 

[MelonGx]

Succeeded importing JP video to JP 3DS emuNAND.
1) Delete 0004001000023000 (on JP 3DS emuNAND) with FBI (Devmenu cannot do that).
2) Install JP video CIA.
3) Reboot emuNAND.
Done.

The next is spoofing & injecting Promo Video to SysNAND?

The video CIA needs a version spoof (at least spoofing to v2048) before installing.
Otherwise the emuNAND will ask for a system update after installed.

 

[MelonGx]

Spoofed Video CIA installation succeeded.
Update Nag never comes forever.

Spoofing method:
- Open the Video CIA with Hex editor
- Change offset 0x2F90 0C-0D from 00 00 (v0, USA/EUR) or 00 02 (v2, JPN) to 08 00 (v2048)
- Normally install modified CIA with BBM/FBI in emuNAND

 

[DIXES]

I confirmed the dev group does have 1.x jpn and yes its not on iso.

Yes I have downgraded a JPN to USA 1.x to get otp working

Does it mean TWN region downgrade to USA 1.x for OTP dump is possible?

 

[Asia81]

holly shit
1.1.0 oO ?

 

[Ronhero]

Does it mean TWN region downgrade to USA 1.x for OTP dump is possible?

You can region swap twn to usa to get otp

 

[DIXES]

You can region swap twn to usa to get otp

Does it need a SecureInfo_A file for region swap?

 

[Ronhero]

Does it need a SecureInfo_A file for region swap?

Yes you can do a dirty region swap just to get otp

Install all 9.2u titles using sys updater. Swap the sec a file. Downgrade to 2.x and get otp. Then restore your twn nand

 

[MelonGx]

Spoofed Video CIA installation succeeded.
Update Nag never comes forever.

Spoofing method:
- Open the Video CIA with Hex editor
- Change offset 0x2F90 0C-0D from 00 00 (v0, USA/EUR) or 00 02 (v2, JPN) to 08 00 (v2048)
- Normally install modified CIA with BBM/FBI in emuNAND

Spoofed 1.1.0-1 video CIAs are tested successfully installed into O3DS SysNAND.
The same-region video can be watched without launching CFW.
But it requires PASTA MODE / MINI-PASTA for the installation.

For N3DS, since N3DS SysNAND doesn't have the video title, you have to launch CFW to watch all of them, even installed into SysNAND.