From WikiTemp, the GBAtemp wiki
(Does the Gateway Laucher.dat works on the r4I Deluxe ?)
(What should I use?)
 
(40 intermediate revisions by 10 users not shown)
Line 1: Line 1:
 +
{{3DSNav}}{{Update}}
  
 
This page will list frequently asked questions about 3DS hacking using flashcarts like Gateway 3DS or R4i Gold 3DS Deluxe.
 
This page will list frequently asked questions about 3DS hacking using flashcarts like Gateway 3DS or R4i Gold 3DS Deluxe.
Line 12: Line 13:
 
There are two types of NAND: SysNAND and EmuNAND.
 
There are two types of NAND: SysNAND and EmuNAND.
  
*SysNAND is the original NAND on version 4.5 that stores data/system information.
+
*SysNAND refers to the original data/system information on a NAND chip embedded in the 3DS.
*EmuNAND is a backup/copy/emulated version of your SysNAND that runs off the SD card.   
+
*EmuNAND refers to a backup/copy/emulated version of your SysNAND that runs off the SD card.   
  
EmuNANDs can be safely updated to the latest system menu, while still having your SysNAND on version 4.5. So you can keep your 4.5 exploit while still having access to online features.
+
SysNAND should be kept on an exploitable system version, such as 4.5 or 9.2. Over time, 9.2 has gotten more software support, so there are no (or little) reason to stay on 4.5.
  
RedNAND is another name for EmuNAND, it stands for Redirected NAND
+
EmuNANDs can be safely updated to the latest system version, provided that the custom firmware being used supports that firmware version. So you can keep your 4.5 exploit while still having access to online features.
 +
 
 +
RedNAND is another name for EmuNAND, it stands for Redirected NAND.
  
 
=== SD Card ===
 
=== SD Card ===
The "SD Card" is the Big SD card in your 3DS. The one bundled with your console. It's used to store Launcher.dat file, all your save files, and if you want it can also store a copy of your NAND: The EmuNAND partition.
+
Every 3DS comes with an SD card bundled with the console. O3DS models, including the 2DS, use the larger SD card, while the N3DS models use the smaller micro SDs. We can use this to store homebrew, custom themes, save files, eShop and .cia home menu channels, and, if you want, an EmuNAND partition. The SD card will not be read by the 3DS if it is not formatted as FAT32. This can be done on a Windows computer. The person typing this recommends using MiniTool Partition Wizard to flash the SD card as FAT32, Cluster Size: 32kb, then formatting EmuNAND with the homebrew program EmuNAND9. Some have reported 64kb cluster size can result in faster data load times, but this author cannot confirm the claim.
  
The "Micro SD Card" is the one placed into the flashcart and containing your game's ROMs.
+
Like the N3DS, the Gateway and Sky 3DS flashcards require a "Micro SD Card" is the one placed into the flashcart containing 3DS software as .3ds or .3dz rom images.
  
=== Flashcart's names ===
+
=== Firmware / System Menu ===
In the FAQ and the forum, you will encounter different terms which could designate the same product. You can see here what they are referring to.
+
Users often use "Firmware" to talk about the version of their console or Flashcart, but it's not the correct name.
 +
 
 +
Like for Wii and WiiU, the 3DS use a System Menu version.
 +
If you speak about the 3DS, please use "System version" instead of Firmware in this FAQ.
 +
 
 +
If you speak about the Flashcart's Launcher.dat (also known as CFW or Custom Firmware when used on a 3DS without a flash cartridge), it's not a firmware either. It's a program launched by the DS profile exploit that patches the System Menu in memory, and then "jumps" back to it.
 +
 
 +
=== CFW Options ===
 +
In the FAQ and the forum, you will encounter different terms which could designate the same product/software. Most or all of the CFW refers to the "Hacked mode" which patch the console's software signature checking to allow ROM, Region free, Firmware spoofing, etc.
  
 
'''Software''':
 
'''Software''':
* '''Gateway''': Refers to the "Hacked mode" (entering into the ''Gateway Mode'', usually without EmuNAND) which patch the console to allow ROM, Region free, Firmware spoofing, etc.
+
* '''RxTools''':  
 +
* '''PalentineCFW''': One of the oldest CFWs
 +
* '''PastaCFW''': Modification of Palentine CFW
 +
* '''ReiNAND''':
 +
* '''Luma3DS (AuReiNAND)''':
 +
* '''CakesFW''':
 +
* '''RxTools''':
 +
* '''NTR CFW''':
 +
* '''Gateway''':
 
The three available modes being: Gateway, EmuNAND Normal and EmuNAND Classic.
 
The three available modes being: Gateway, EmuNAND Normal and EmuNAND Classic.
  
Line 34: Line 53:
  
 
'''Hardware''':
 
'''Hardware''':
* '''Gateway 3DS''': It's the name of the Gateway 3DS team's flashcart.
+
* '''Sky 3DS''': Flashcart relying on external means to emulate a physical game card without the 3DS knowing the difference. There are 3 versions of the card: One with a blue button, orange button, or neither. The button serves as a method to switch between rom images. The blue card is limited to storing up to 10 games, while the orange button eliminates this limitation using hardware modification which can be done on the blue button models. (Source: Some thread on Maxconsole??? It's been so long.)
 +
* '''Gateway 3DS''': Flashcart relying on both external and internal means to boot into Gateway's own Custom Firmware.
 
* '''Gateway''': Same as above, it's often just referred to as Gateway only.
 
* '''Gateway''': Same as above, it's often just referred to as Gateway only.
 
* '''GW''': It's the abbreviation for Gateway card.
 
* '''GW''': It's the abbreviation for Gateway card.
 
* '''GW2.0b1''': Launcher.dat version 2.0b1 from the Gateway 3DS team.
 
* '''GW2.0b1''': Launcher.dat version 2.0b1 from the Gateway 3DS team.
 
+
* '''DSTWO+''': SuperCard's implementation of the Gateway flashcard. Has had some reports of deliberate software bricking from Gateway's 3rd-party prevention code. (citation needed)
 
* '''R4i 3DS Gold Deluxe''': It's the name of the R4ids.cn team's flashcart.
 
* '''R4i 3DS Gold Deluxe''': It's the name of the R4ids.cn team's flashcart.
 
* '''3DS Link''': It's the name of the 3DS Link team's flashcart.
 
* '''3DS Link''': It's the name of the 3DS Link team's flashcart.
Line 45: Line 65:
 
* '''R4i/Link3.0''': Launcher.dat version 3.0 from both R4ids.cn and 3DS Link teams.
 
* '''R4i/Link3.0''': Launcher.dat version 3.0 from both R4ids.cn and 3DS Link teams.
  
=== Firmware / System Menu ===
+
== What should I use? ==
Users often use "Firmware" to talk about the version of their console or Flashcart, but it's not the correct name.
+
Free Custom Firmware, Sky 3DS, and Gateway are all the current recommended choices to use, but it all depends on what you want to do with your console.
  
Like for Wii and WiiU, the 3DS use a System Menu version.
+
Free Custom Firmware, which includes everything but Gateway in the Software list above, is the cheapest solution, but is also the most tedious to set up. It can be confusing to use if the user isn't very tech-savvy. The best way to avoid bricks is to use EmuNAND as much as possible for most everything done on the console. Some CFWs (most notably Luma3ds) support CFW on SysNAND, but is dangerous to use without a method of re-flashing NAND back to SysNAND.  Fortunately, Arm9loaderhax, the current method of running CFWs allows reflashing sysnand once installed, since it loads BEFORE the main firmware.  Properly made custom firmware, loaded with arm9loaderhax (such as Luma3ds), will prevent the firmware from wiping it out (11.3 and all later versions attempt to do this). Also there is a regularly updated guide on the web explaining how to install it on various firmware versions.
If you speak about the 3DS, please use "System version" instead of Firmware in this FAQ.
+
 
 +
Gateway 3DS can do what most of the free CFW can do, but it has one advantage: It has its own cheat support with on-3DS RAM searching. Gateway is not free; However, Gateway is probably one of the easiest to set up. On N3DS, Gateway requires either a copy of Cubic Ninja or Ocarina of Time 3D respective to the region of the console as well as a DS flashcart to prepare the MSET exploit. While Gateway has its own cheat support, NTR CFW allows free-CFW users to use cheats as well. However, not only are these cheats incompatible with Gateway's, but they also require recompiling the source .plg and do not have on-console RAM searching.  It also requires that Sysnand not be updated past the vulnerable versions.  Gateway does NOT protect the firmware, so if gateway is accidentally booted into sysnand mode, if sysnand is 11.3, arm9loaderhax is wiped.
 +
 
 +
Sky3DS has proven to work as a last resort if the system is not currently exploitable, and is typically recommended for people who cannot exploit their console with a more recent SysNAND system version. It can emulate physical game cards including Cubic Ninja, which allows a user to use Ninjhax to launch the Homebrew Launcher.  If the user only wishes homebrew, then Soundhax works on current firmware to load the homebrew launcher, so Sky3ds is not currently needed for homebrew ona ny console, though it may be required in the future..
 +
 
 +
EmuNAND can be formatted with Gateway, but EmuNAND9 is currently the best option to achieve this due to its nature of open-source software and optimization. One can install .cia files by [https://gbatemp.net/threads/release-inject-any-app-into-health-safety-o3ds-n3ds-cfw-only.402236/ injecting a CIA installer like FBI or Dev Menu to the Health & Safety App]. Dev Menu is copyrighted software, is closed-source, but is also the most compatible due to its official support. (People have issues installing SSB4 DLC until they use Dev Menu) Meanwhile, FBI is open-source, free to use, and easily modifiable to fix issues that arise. It's best to inject FBI, then install Dev Menu using the injected FBI.
 +
 
 +
*'''CTRBootManager''': It is possible to have more than one option for a CFW. ...
 +
*'''MultiEmuNAND Creator''': It's also possible to have more than one Emunand. ...
 +
 
 +
= Exploits/Entrypoints =
  
If you speak about the Flashcart's Launcher.dat, it's not a firmware either. It's a program launched by the DS profile exploit. The firmware would be what's inside the flashcart's chipset. But a lot of users call the Launcher.dat the "Firmware" so I used that word in the FAQ. If it's better to use another word, feel free to replace it.
+
==MSET (System Settings)==
 +
something something installs ROP
  
== Exploit ==
 
 
=== How does it work ? ===
 
=== How does it work ? ===
 
This hack exploits two different vulnerabilities in the 3DS system menu.
 
This hack exploits two different vulnerabilities in the 3DS system menu.
Line 67: Line 97:
 
* rsa_verify exploit [http://gbatemp.net/threads/so-how-long-do-you-think-gateway-will-last.359699/page-3#post-4873326 1][http://gbatemp.net/threads/merry-christmas-have-some-ram-dumping.359697/page-12#post-4878576 2]
 
* rsa_verify exploit [http://gbatemp.net/threads/so-how-long-do-you-think-gateway-will-last.359699/page-3#post-4873326 1][http://gbatemp.net/threads/merry-christmas-have-some-ram-dumping.359697/page-12#post-4878576 2]
  
== Console ==
 
 
=== Is it working in all consoles and regions? ===
 
=== Is it working in all consoles and regions? ===
 
Consoles from all regions are compatible with this exploit, and works on all 3DS consoles (Original and XL/LL).
 
Consoles from all regions are compatible with this exploit, and works on all 3DS consoles (Original and XL/LL).
Line 79: Line 108:
 
You don't need to open your console or solder a modchip to play 3DS Roms, but it's possible to do physical modifications if you want to backup/restore your NAND. See this FAQ's NAND section for more information.
 
You don't need to open your console or solder a modchip to play 3DS Roms, but it's possible to do physical modifications if you want to backup/restore your NAND. See this FAQ's NAND section for more information.
  
 +
==Spider (Web Browser)==
 +
 +
===Browserhax===
 +
 +
==Ninjhax==
 +
Cubic Ninja
 +
 +
===OoThax===
 +
Ocarina of Time
 +
 +
===Tubehax===
 +
Youtube App
 +
 +
===Smashhax===
 +
Linux.
 +
 +
==Home Menu Hax==
 +
===shufflehax===
 +
===themehax===
 +
 +
==Memchunkhax==
 +
 +
==SNShax==
 +
 +
=Downgrading=
 +
==Arm9LoaderHax (A9LH)==
 +
Early kernel access. The exploit runs from the N3DS's added security: Arm9Loader. Hence the name: Arm9LoaderHax. Although this exploits from the added security of the N3DS, this can be installed on any 3DS as well.
 +
 +
==Memchunkhax2==
 +
 +
== Console ==
 
=== Can you check the System version before buying a new 3DS? ===
 
=== Can you check the System version before buying a new 3DS? ===
 
Copyright 2012 is NOT a guarantee of firmware <= 4.5.0. Having a Nintendo Serial Number <= SW12xxxxxx x in North America, SEx1153xxxx x or SUx1035xxxx x in Europe, or SJF1265xxxx x in Japan for a 3DS XL (or <= CW7235xxxx x for a regular 3DS in North America) is. The lower the serial number the older the unit (which for our purposes is better).
 
Copyright 2012 is NOT a guarantee of firmware <= 4.5.0. Having a Nintendo Serial Number <= SW12xxxxxx x in North America, SEx1153xxxx x or SUx1035xxxx x in Europe, or SJF1265xxxx x in Japan for a 3DS XL (or <= CW7235xxxx x for a regular 3DS in North America) is. The lower the serial number the older the unit (which for our purposes is better).
Line 164: Line 224:
 
* [[Orange 3DS]] (same product as R4i Gold 3DS Deluxe, just a different name).
 
* [[Orange 3DS]] (same product as R4i Gold 3DS Deluxe, just a different name).
 
* [[MT-Card]] A clone of Gateway 3DS that was edited to add features.
 
* [[MT-Card]] A clone of Gateway 3DS that was edited to add features.
 +
* [[DSTWO+]]. Read GBATemp's [https://gbatemp.net/review/dstwo.412/ review].
  
 
All these products are bundled with both a DS mode flashcart and a 3DS mode flashcart.
 
All these products are bundled with both a DS mode flashcart and a 3DS mode flashcart.
Line 171: Line 232:
 
*[[K3DS]] A rebrand of sky3ds.
 
*[[K3DS]] A rebrand of sky3ds.
 
*[[R5]] A rebrand of sky3ds.
 
*[[R5]] A rebrand of sky3ds.
 +
 +
Also now Amiibo emulators like
 +
 +
* [[Amiiqo]]  - [http://www.amiiqo.com/ (Official Website)]
 +
<!-- Website should be removed when Amiiqo wiki page is created maybe? -->
  
 
=== Why are there two flashcarts? ===
 
=== Why are there two flashcarts? ===
Line 500: Line 566:
 
There are two methods:
 
There are two methods:
  
# You can backup your NAND with a hardware method. You need to open your console and solder wires in your console. For instructions, check these threads for [http://gbatemp.net/threads/nand-flash-dump-3ds.353263/  3DS] and [http://gbatemp.net/threads/nand-flash-dump-3ds-xl.350668/ 3DS XL].
+
# You can backup your NAND with a hardware method. You need to open your console and solder wires in your console. For instructions, check these threads for [http://gbatemp.net/threads/nand-flash-dump-3ds.353263/  3DS] and [http://gbatemp.net/threads/nand-flash-dump-3ds-xl.350668/ 3DS XL]. Another Tutorial that covers all the 3DS models is here:    [https://gbatemp.net/threads/tutorial-noob-friendly-nand-dumping-2ds-3ds-3ds-xl-n3ds-n3ds-xl.414498/]
 
# You can backup your NAND with a software method, using the Launcher.dat.
 
# You can backup your NAND with a software method, using the Launcher.dat.
  
Line 752: Line 818:
 
=== How do I play Pokémon X/Y? ===
 
=== How do I play Pokémon X/Y? ===
 
'''ROM''':  
 
'''ROM''':  
Pokemon X/Y is only playable using Gateway 3DS, it does not work on any other flashcarts.
+
Pokemon X/Y is playable with many 3ds flashcarts such as, Sky3ds/Sky3ds+, Gateway 3ds, Supercard Dstwo+, and the QQ3ds/QQ3ds+.
  
'''Cartridge''': To play the retail Pokémon X/Y, you need EmuNAND Classic 6.2.0 or higher.
+
'''Cartridge''': To play the retail Pokémon X/Y, you need EmuNAND of the firmware 6.2.0 or higher.
  
 
=== How do I play The Legend of Zelda: A Link Between Worlds? ===
 
=== How do I play The Legend of Zelda: A Link Between Worlds? ===
'''ROM''': Zelda: ALBW works with and without emuNAND using Gateway 2.0b1 or Gold/Link 3.0 (or higher). If you play on EmuNAND, you don't need to update it.
+
'''ROM''': Zelda: ALBW works with and without emuNAND using Sky3ds, Gateway, and QQ3ds. If you play on EmuNAND, you don't need to update it.
  
 
'''Cartridge''': To play the retail Zelda: ALBW, you need EmuNAND Classic 6.2.0 or higher.
 
'''Cartridge''': To play the retail Zelda: ALBW, you need EmuNAND Classic 6.2.0 or higher.
Line 765: Line 831:
 
=== How do I play Animal Crossing: New Leaf? ===
 
=== How do I play Animal Crossing: New Leaf? ===
 
'''ROM''':  
 
'''ROM''':  
Animal Crossing is only playable using Gateway 3DS, it does not work on any other flashcarts.
+
Animal Crossing is playable using the Gateway 3ds, Sky3ds, and QQ3ds.
  
 
'''Cartridge''': The original game cartridge doesn't need EmuNAND Classic, the game only requires System version 4.5.0, therefore you can play your game on your SysNAND without updating and loosing Flashcart capability.
 
'''Cartridge''': The original game cartridge doesn't need EmuNAND Classic, the game only requires System version 4.5.0, therefore you can play your game on your SysNAND without updating and loosing Flashcart capability.

Latest revision as of 23:12, 12 March 2017

Update.png  This page may need to be updated with the newest available information. 
 Please edit the page with new information and remove this Template when finished! 

This page will list frequently asked questions about 3DS hacking using flashcarts like Gateway 3DS or R4i Gold 3DS Deluxe.

If you have a question, put it at the end of the page, or ask on GBATemp's forum here.

If you have an answer or can help provide better answers and information than is currently listed, please edit this page to help other users.

If you found a new question in the forum and know the answer, put it in the corresponding section.

Contents

Glossary

NAND

There are two types of NAND: SysNAND and EmuNAND.

  • SysNAND refers to the original data/system information on a NAND chip embedded in the 3DS.
  • EmuNAND refers to a backup/copy/emulated version of your SysNAND that runs off the SD card.

SysNAND should be kept on an exploitable system version, such as 4.5 or 9.2. Over time, 9.2 has gotten more software support, so there are no (or little) reason to stay on 4.5.

EmuNANDs can be safely updated to the latest system version, provided that the custom firmware being used supports that firmware version. So you can keep your 4.5 exploit while still having access to online features.

RedNAND is another name for EmuNAND, it stands for Redirected NAND.

SD Card

Every 3DS comes with an SD card bundled with the console. O3DS models, including the 2DS, use the larger SD card, while the N3DS models use the smaller micro SDs. We can use this to store homebrew, custom themes, save files, eShop and .cia home menu channels, and, if you want, an EmuNAND partition. The SD card will not be read by the 3DS if it is not formatted as FAT32. This can be done on a Windows computer. The person typing this recommends using MiniTool Partition Wizard to flash the SD card as FAT32, Cluster Size: 32kb, then formatting EmuNAND with the homebrew program EmuNAND9. Some have reported 64kb cluster size can result in faster data load times, but this author cannot confirm the claim.

Like the N3DS, the Gateway and Sky 3DS flashcards require a "Micro SD Card" is the one placed into the flashcart containing 3DS software as .3ds or .3dz rom images.

Firmware / System Menu

Users often use "Firmware" to talk about the version of their console or Flashcart, but it's not the correct name.

Like for Wii and WiiU, the 3DS use a System Menu version. If you speak about the 3DS, please use "System version" instead of Firmware in this FAQ.

If you speak about the Flashcart's Launcher.dat (also known as CFW or Custom Firmware when used on a 3DS without a flash cartridge), it's not a firmware either. It's a program launched by the DS profile exploit that patches the System Menu in memory, and then "jumps" back to it.

CFW Options

In the FAQ and the forum, you will encounter different terms which could designate the same product/software. Most or all of the CFW refers to the "Hacked mode" which patch the console's software signature checking to allow ROM, Region free, Firmware spoofing, etc.

Software:

  • RxTools:
  • PalentineCFW: One of the oldest CFWs
  • PastaCFW: Modification of Palentine CFW
  • ReiNAND:
  • Luma3DS (AuReiNAND):
  • CakesFW:
  • RxTools:
  • NTR CFW:
  • Gateway:

The three available modes being: Gateway, EmuNAND Normal and EmuNAND Classic.

It can sometimes be used by users even if it's not a Gateway 3DS flashcart.

Hardware:

  • Sky 3DS: Flashcart relying on external means to emulate a physical game card without the 3DS knowing the difference. There are 3 versions of the card: One with a blue button, orange button, or neither. The button serves as a method to switch between rom images. The blue card is limited to storing up to 10 games, while the orange button eliminates this limitation using hardware modification which can be done on the blue button models. (Source: Some thread on Maxconsole??? It's been so long.)
  • Gateway 3DS: Flashcart relying on both external and internal means to boot into Gateway's own Custom Firmware.
  • Gateway: Same as above, it's often just referred to as Gateway only.
  • GW: It's the abbreviation for Gateway card.
  • GW2.0b1: Launcher.dat version 2.0b1 from the Gateway 3DS team.
  • DSTWO+: SuperCard's implementation of the Gateway flashcard. Has had some reports of deliberate software bricking from Gateway's 3rd-party prevention code. (citation needed)
  • R4i 3DS Gold Deluxe: It's the name of the R4ids.cn team's flashcart.
  • 3DS Link: It's the name of the 3DS Link team's flashcart.
  • R4i/Link: As both R4i 3DS Gold Deluxe and 3DS Link cards are from the same manufacturer and use the same firmware, they are often mentioned together when needing to provide a firmware version. For example R4i/Link v3.0 refers to both R4i 3DS Gold Deluxe v3.0 and 3DS Link v3.0.
  • Gold/Link: Same as above, but using the "Gold" part of the name to talk about the R4i 3DS Gold Deluxe product.
  • R4i/Link3.0: Launcher.dat version 3.0 from both R4ids.cn and 3DS Link teams.

What should I use?

Free Custom Firmware, Sky 3DS, and Gateway are all the current recommended choices to use, but it all depends on what you want to do with your console.

Free Custom Firmware, which includes everything but Gateway in the Software list above, is the cheapest solution, but is also the most tedious to set up. It can be confusing to use if the user isn't very tech-savvy. The best way to avoid bricks is to use EmuNAND as much as possible for most everything done on the console. Some CFWs (most notably Luma3ds) support CFW on SysNAND, but is dangerous to use without a method of re-flashing NAND back to SysNAND. Fortunately, Arm9loaderhax, the current method of running CFWs allows reflashing sysnand once installed, since it loads BEFORE the main firmware. Properly made custom firmware, loaded with arm9loaderhax (such as Luma3ds), will prevent the firmware from wiping it out (11.3 and all later versions attempt to do this). Also there is a regularly updated guide on the web explaining how to install it on various firmware versions.

Gateway 3DS can do what most of the free CFW can do, but it has one advantage: It has its own cheat support with on-3DS RAM searching. Gateway is not free; However, Gateway is probably one of the easiest to set up. On N3DS, Gateway requires either a copy of Cubic Ninja or Ocarina of Time 3D respective to the region of the console as well as a DS flashcart to prepare the MSET exploit. While Gateway has its own cheat support, NTR CFW allows free-CFW users to use cheats as well. However, not only are these cheats incompatible with Gateway's, but they also require recompiling the source .plg and do not have on-console RAM searching. It also requires that Sysnand not be updated past the vulnerable versions. Gateway does NOT protect the firmware, so if gateway is accidentally booted into sysnand mode, if sysnand is 11.3, arm9loaderhax is wiped.

Sky3DS has proven to work as a last resort if the system is not currently exploitable, and is typically recommended for people who cannot exploit their console with a more recent SysNAND system version. It can emulate physical game cards including Cubic Ninja, which allows a user to use Ninjhax to launch the Homebrew Launcher. If the user only wishes homebrew, then Soundhax works on current firmware to load the homebrew launcher, so Sky3ds is not currently needed for homebrew ona ny console, though it may be required in the future..

EmuNAND can be formatted with Gateway, but EmuNAND9 is currently the best option to achieve this due to its nature of open-source software and optimization. One can install .cia files by injecting a CIA installer like FBI or Dev Menu to the Health & Safety App. Dev Menu is copyrighted software, is closed-source, but is also the most compatible due to its official support. (People have issues installing SSB4 DLC until they use Dev Menu) Meanwhile, FBI is open-source, free to use, and easily modifiable to fix issues that arise. It's best to inject FBI, then install Dev Menu using the injected FBI.

  • CTRBootManager: It is possible to have more than one option for a CFW. ...
  • MultiEmuNAND Creator: It's also possible to have more than one Emunand. ...

Exploits/Entrypoints

MSET (System Settings)

something something installs ROP

How does it work ?

This hack exploits two different vulnerabilities in the 3DS system menu.

The first one consists in altering the DS profile stored in DS NVRAM (by using a compatible DS flashcart and running a DS homebrew), to exploit the MSET vulnerability in "User mode".

The second one grants access to the 3DS "kernel mode" by launching the DS profile in the 3DS Settings. When the DS profile is launched, it uses a vulnerability in rsa_verify request (for which the length isn't checked) to copy the payload in memory and launch it with Kernel access to load a file located on the SD card (ys:/Launcher.dat).

Nintendo patched the second vulnerability in System version 5.0.0, and prevented the DS profile to crash in System version 7.0.0. Although the modified NVRAM still crash the system up to version 6.3.0, there's no indication that the MSET exploit wasn't patched in version 5.0.0 too.

Discussion threads :

  • DS Exploit 12
  • rsa_verify exploit 12

Is it working in all consoles and regions?

Consoles from all regions are compatible with this exploit, and works on all 3DS consoles (Original and XL/LL). You need a 3DS with a System version from 4.1.0 to 4.5.0 to use this exploit. If your 3DS System version is 5.0.0 or newer, it will not work. The 2DS is manufactured with a System version higher than 4.5.0 so it will not work.

Is it a softmod or hardmod?

This hack is currently based on both. The exploit itself is done in software (It runs by launching programs on the console), but requires a Flashcart to install the DS exploit and another Flashcart to play 3DS ROMs.

You don't need to open your console or solder a modchip to play 3DS Roms, but it's possible to do physical modifications if you want to backup/restore your NAND. See this FAQ's NAND section for more information.

Spider (Web Browser)

Browserhax

Ninjhax

Cubic Ninja

OoThax

Ocarina of Time

Tubehax

Youtube App

Smashhax

Linux.

Home Menu Hax

shufflehax

themehax

Memchunkhax

SNShax

Downgrading

Arm9LoaderHax (A9LH)

Early kernel access. The exploit runs from the N3DS's added security: Arm9Loader. Hence the name: Arm9LoaderHax. Although this exploits from the added security of the N3DS, this can be installed on any 3DS as well.

Memchunkhax2

Console

Can you check the System version before buying a new 3DS?

Copyright 2012 is NOT a guarantee of firmware <= 4.5.0. Having a Nintendo Serial Number <= SW12xxxxxx x in North America, SEx1153xxxx x or SUx1035xxxx x in Europe, or SJF1265xxxx x in Japan for a 3DS XL (or <= CW7235xxxx x for a regular 3DS in North America) is. The lower the serial number the older the unit (which for our purposes is better).

The Nintendo Serial Number can be found on the outside of the box on the top (It can also be found on the back of the 3DS itself)

Since firmware 5.0.0 was released March 26, 2013, and we know the release of the various versions of the 3DS and the 3DS XL models/bundles...

For North America:

3DS XL models capable of coming with <= 4.5.0:

Red/Black

Blue/Black

Pink/White

Pikachu bundle

Pink/White 3DS XL in a bundle (with Professor Layton and the Miracle Mask or Style Savvy: Trendsetters)

3DS models capable of coming with <= 4.5.0:

Aqua Blue

Cosmo Black

Flame Red

Pearl Pink (bundled with Nintendogs + Cats)

Midnight Purple

Heroes of Ruin

The Legend of Zelda 25th Anniversary

Kingdom Hearts 3D: Dream Drop Distance

Fire Emblem Awakening

Seems like almost all regular 3DS's are capable while only a limited selection of 3DS XL's are.

The highest reported Nintendo Serial Number that came with 4.5.0:

Red/Black 3DS XL: SW1279xxxx x [DemiseScythe]

Blue/Black 3DS XL: SW1278xxxx x [drfsupercenter] (SW1335xxxx x reported > 4.5.0 [tlee22])

Pink/White 3DS XL: SW1286xxxx x [liquidsolidyetboth]

Midnight Purple 3DS: CW7235xxxx x [andremario81] (came with 4.4.0)

There are possible contradictions in this data from RickyEarl (says Blue/Black w/ SW1231xxxx x had 6.1.0) and tlee22 (says Red/Black w/ SW1275xxxx x had 6.1.0).

For Europe:

There is a spreadsheet for European 3DS's here that indicates any <= SEx1153xxxx x or SUx1035xxxx x Nintendo Serial Number should come with <= 4.5.0.

The lowest reported serial numbers that came with >4.5.0 are SEx11623xxx x and SUx104xxxxx x.

For Japan:

The highest reported Nintendo Serial Number that came with 4.5.0:

Super Robot Taisen UX 3DS LL: SJF1265xxxx x [Cjuub]

For Brazil:

Brazil uses the USA (U) firmware, but has a different style of Nintendo Serial Number (CB).

3DS Cosmo Black: CB7001xxxx x (4.2.0)

Discussion thread: at the forums

Flashcarts

How many 3DS Flashcarts exist?

All these products are bundled with both a DS mode flashcart and a 3DS mode flashcart.

Also now Amiibo emulators like

Why are there two flashcarts?

The DS mode flashcart is used to run a DS Homebrew which will replace the DS profile informations. The modified DS profile is then used to exploit a vulnerability in 3DS mode, access Kernel mode and patch the 3DS system.

The 3DS mode flashcart is used to play 3DS Game ROMs.

Can I use my own DS mode Flashcart?

Yes.

If you already have a DS mode flashcart working with your 3DS, you can use it to run the DS homebrew. Just put the installer.nds file on your MicroSD and launch it from your usual method of booting DS homebrew.

Can I use the DS Mode flashcart bundled with 3DS Flashcart to run DS homebrew/games?

Yes.

The bundled DS Mode flashcart is a regular card working with 3DS firmware 4.5.0 (or newer, depending which product you buy).

  • Gateway: This is a r4i gold 3DS clone, using a hacked Wood firmware.
  • R4i Gold 3DS Deluxe: This is an official R4i Gold 3DS, with the official Wood Firmware.
  • 3DS Link: This card and R4i Gold 3DS Deluxe are the same product.
  • MT Card: This card does allow you to play DS ROMs on the DS Mode flashcart that comes in the package, but homebrew may not currently be supported.

Do 3DS Flashcarts work with all consoles?

The 3DS flashcarts are region free and work on all 3DS consoles (original 3DS, 3DS XL/LL, 2DS and New 3DS).

Do 3DS Flashcarts work on all 3DS System versions?

There are currently 2 exploits out for the Gateway 3DS, one that works on 4.1.0 - 4.5.0 and another that works up to 9.2.0. Flashcarts that rely on these exploits like the Gateway will only work on those system menu versions. The Sky3DS currently works up to the latest version (9.4.0) due to not needing an exploit.

My 3DS System version is below 4.5.0, how can I update it?

Update.png  This page may need to be updated with the newest available information. 
 Please edit the page with new information and remove this Template when finished! 

The current exploit is working with 3DS System Menu version 4.1.0 to 4.5.0.

If you are on System version 4.1.0 to 4.5.0, you don't need to update. If your System version is 1.0.0 to 4.0.0, you will have to update to use this exploit.

There are two different methods to update your System NAND:

  1. Using an original game cartridge bundled with the desired System version update (for example Luigi's Mansion 2 has v4.5.0). It works on all System versions, from v1.0.0 to any versions inferior to the game's bundled System version update.
  2. Using a game's ROM bundled with System update v4.5.0 and with Gateway v1.0 (which doesn't prevent the required System version checking). It works on System version v4.1.0 to v4.4.0.

You can check this website to find which System version is present in a game's update partition.

Note: The ROM method is not possible with R4i Gold 3DS Deluxe / 3DS Link flashcarts as their initial release (v2.0) prevent the game from checking the required firmware.

My console's firmware is above 4.5.0, what can I do? Is it possible to downgrade?

If you're running version 9.2 or earlier, you can use the new Gateway browser exploit in order to downgrade to 4.5.0. You can find guides on how to do this in the forums.

If you're running a version higher than 9.2, downgrading is possible only if you have a backup of your NAND chipset created before updating. You can't restore another console's NAND backup.

If you have a NAND backup of your console and want to restore it, check the NAND section.

If you don't have a NAND backup, there isn't currently a work-around. You must buy a new console if you want one with System version 4.5.0 or below, or wait for another downgrade exploit.

Using the flashcarts

How do I update my Flashcart's software version?

Replace the Launcher.dat on your SD card with the new Launcher.dat file.

Do I need to run DS exploit every time?

No.

The patched DS profile is reset only if you launch a DS game or a DS mode flashcard. In this case, you will need to run the DS install.nds homebrew again.

You will also need to run the install.nds again if you changed your 3DS System language.

Is the 3DS hack permanent or do I need to run it after every reboot?

You need to run the exploit after each console's reboot/shutdown.

Go to Settings > Other Settings > Nintendo DS Profile to launch the hack again.

I want to remove all exploits on my system!

  1. Run a DS game or a DS mode flashcart.
  2. Shutdown your 3DS.
  3. Delete the Launcher.dat from your SD card
  4. Delete the install.nds from your DS flashcard's MicroSD.

If you do this and used EmuNAND the EmuNAND partition will still be on your system's SD card.

Does the Gateway Launcher.dat works on the r4I Deluxe ?

No.

You can't use a Launcher.dat to boot ROMs using a different flashcart than the one it's created for. Though, you can use any Launcher.dat without flashcart to enter in EmuNAND/EmuNAND Classic and access eShop or launch retail games.

Games

Are all games working ?

It depends on the flashcart and its firmware version.

ROMs:

  • GW Omega 2.3b: 100% ROM Compatibility with 7.x support (this includes booting into 8.x EmuNAND)
  • GW Omega 2.0/2.1: Animal Crossing, Pokemon X/Y, and eShop games (for 3DS only) are working, but no 7.x encryption titles (Tomodachi Life, SSB4, etc.)
  • GW2.0b1, R4i Gold 3DS Deluxe 3.0, 3DS Link 3.0: Only 2 games (Pokemon X/Y and Animal Crossing) are not working when using the ROM form.
  • GW1.2, R4i Gold 3DS Deluxe/ 3DS Link 2.0: Games using SDK5+ are not working.
  • MT Card v2.0: Only 7.x Titles not supported

Game Cartridge:

  • EmuNAND classic with GW2.3b: All games are working using EmuNAND classic Firmware 8.1.0 w/ a Gateway card

-Note: If you're using Gateway's Launcher.dat for a free EmuNAND classic service, It will not boot 7.x titles or 8.x EmuNAND without a Gateway Card.

To be more specific, only Gateway can currently run 7.x encryption at the moment.

Attention: Since SDK6 (and System version 6.0+) games are using a different save encryption method. While in EmuNAND, the system is still running under 4.5.0 and it's using the old encryption method. If you play your cartridge in System NAND 6.0+ it will not be compatible with EmuNAND 6.0+ and the game will delete/reinitialize the save.

You can check the 3DS flashcarts game compatibility page to see which games are not working, and which version you need.

Are games region free?

No, but there are methods to load games from other regions.

The first method is to use regionFOUR, which works up to system version 9.9 and requires cubic ninja (or a Sky3DS playing cubic ninja).

The second way is to use EmuNAND, which loads ROMs from any region. Note however that, if you are using EmuNAND Classic, you still need to use a game cartridge from your region.

ROM

  • System NAND

Gateway 3DS v1 : Not region free
Gateway 3DS v1.2 - R4i Gold 3DS Deluxe v2.0 - 3DS Link v2.0 : Region free
Gateway 3DS v2.0b1 - R4i Gold 3DS Deluxe v3.0 - 3DS Link v3.0 : Region free, except on 4.1.0

  • EmuNAND

Gateway 3DS v2.0b1 - R4i Gold 3DS Deluxe v3.0 - 3DS Link v3.0 : Region free, except on 4.1.0

Note: Region free and System version spoofing with Gateway 3DS v2.0b1 and R4i Gold 3DS Deluxe/3DS Link v3.0 doesn't work if your System version is 4.1.0. R4i source1R4i source2 GW Source1.

To fix this issue update your EmuNAND or, if you don't use EmuNAND, update your System NAND to 4.5.0 using a retail game cartridge.

Game Cartridge

  • EmuNAND Classic

Gateway 3DS v2.0b1 - R4i Gold 3DS Deluxe v3.0 - 3DS Link v3.0 : No region free.

Can I play online?

There are several ways you can play online, one using Gateway's ROM dumper, which will get you a 3DS ROM with an online ID, using a public header is not recommended, as it is speculated that Nintendo has started to ban those who have used them. (make sure to swap .3ds with .3dz)

Retail Games on EmuNAND classic or SysNAND can go online

Can I play games requiring System version past 4.5.0?

Yes.

The flashcarts are spoofing the required System version and prevent the prompt asking to update your console if you play from ROMs. But if you are using EmuNAND Classic (GW2.0b1), you still need to use an updated EmuNAND. EmuNAND classic on the latest Gateway (GW2.3b) can run retail cartridges while System Version Spoofing.

ROMs:

  • GW1.2, R4i Gold 3DS Deluxe 2.0, 3DS Link 2.0: Working with all games requiring System version up to 4.5.0 and some games requiring 5.1.0.
  • GW2.0b1, R4i Gold 3DS Deluxe 3.0, 3DS Link 3.0: Working with all games requiring System version up to 6.2.0.
  • EmuNAND (GW2.3b): Working with all games requiring System version up to 7.1.0.

Game Cartridge:

  • EmuNAND Classic (GW2.3b) : Will System Version Spoof, but games that require 7.x require you to buy a Gateway card.

Why are games using SDK5+ not working with old flashcarts' firmware?

In SDK5, Nintendo changed the location of the booting logo (the Nintendo logo at the bottom of the booting screen). It's now located outside of the ExeFS, in unencrypted form. Since the game is unable to locate this file, the game can't boot.

Flashcarts' firmwares are patching the location to allow games created with SDK5 to work with System version 4.5.0.

ROMs:

  • R4i Gold 3DS Deluxe 2.0, 3DS Link 2.0: Not working with SDK5+ games.
  • GW2.0b1, R4i Gold 3DS Deluxe 3.0, 3DS Link 3.0: Working with all SDK5+ games.
  • EmuNAND (GW2.0b1): Working with all SDK5+ games.

Game Cartridge:

  • EmuNAND Classic (GW2.0b1) : No file path patching. You need to update your EmuNAND System version to 5.1.0 or newer.

What about games using SDK7+?

These games use the 7.x encryption, the only way to boot ROMs or Retail cartridges with this SDK on a 4.0-4.5 requires you to own a Gateway card.

Can I store multiple games on my MicroSD?

It depends on the flashcard used.

For Gateway and MT, you can store multiple ROMs on a single MicroSD card using drag-and-drop.

Older versions of the Sky3DS will only support one game per MicroSD card, but the blue button versions will allow multiple games to be written to the card using their Diskwriter program for Windows.

For all other cards, you need 1 game per MicroSD card.

How can I store games bigger than 4GB on FAT32?

The maximum supported 3DS cartridge size is 8GB but there's currently no developer or publisher using this size. If your ROM is exactly 4GB, you can trim it to fit as a single file on a FAT32 partition, as the game's data is probably not using the full chipset available size and can always be trimmed by few MB.


For files bigger than 4GB or if you can't trim a game, you have two other choices :

Most flashcart's maker provide tools to split the ROM in two files.

Some of the flashcarts are also compatible with the ExFAT partition format which allows you to store files bigger than 4GB.


If you are on Windows XP SP2/SP3 and didn't update it to add ExFAT support, you can do it manually by installing this update.

How do I install a game to my MicroSD card?

The game is written in RAW format, it doesn't use any file system.

You need to use tools to write the ROM image to your device. There are different tools depending on your operating system.

Select the device in the list, Select the .3ds game file and click "Write" button. Attention, be sure to select the correct drive's letter. ALL your card will be deleted and the game will be written.

If the MicroSD contains already a game, the program will not display the device in the list. You need to format the MicroSD first (using Panasonic SD Formater).

  • Linux: use dd command line to write binary file to the device.
sudo dd if=/u01/filename.3ds of=/dev/mmcblk0 bs=1M

The location of the file and device may vary depending on your Linux machine. Beware that writing to the wrong device could trash your hard drive.

-Note: As of GW2.1 you no longer need to flash games to an SD card, there is MultiROM support. You can drag and drop ROMs onto your SD Card

  • Sky3DS: Use the provided software (DiskWriterv106b) to write the data to the SD card for you.

Which MicroSD should I choose?

The faster, the better. You should also watch for fake Micro SD cards which fake their size and overwrite data.

Which MicroSD size should I choose?

Typically, it depends on the amount of games you want. Most people generally get 32gb Micro SD cards.

Can I trim ROMs to fit in a smaller MicroSD?

Yes.

Some games can be trimmed to remove unused dumped binary data. There are different program you can use to do that.

There are two trimming methods, what are the differences?

The normal trimming method removes unused data at the end of the Game's Data. it can be reverted to get the file back to the original Dump.

The second trimming methods also removes the Update Partition from the game's Data and is irreversible. You can't restore the deleted partition from the modified file.

The first method should be enough to fit all games in your MicroSD card.

How do I change games?

[GW2.0b1] Exit your current game with Home > X > A, and wait few seconds before removing the flashcard, it's doing a backup of the save. change your MicroSD and put the flashcard back in the 3DS.

[GW2.1+] This Version has MultiROM, so on the System Home Menu press select to see all the games on the SD Card

[Sky3DS] Simply return to the HOME MENU, close all suspended software, and press the button on top of cartridge to change titles.

Saves

Where are the saves stored?

When you play, the save data is stored into the flashcart's internal save chipset.

The flashcart can only store one game's save at a time. You need to backup the save data to your SD card before playing another game or you will lose your progress.

As of GW2.1 saves are stored on the SD Card.

Can I save my current progress to SD card?

If you want to backup your current progress to a file, you need to exit the game properly by using Home > Exit (X) > Confirm (A).

It will create a copy of the flashcart's internal save chipset to the root of your big SD card, with the filename based on the GameID. For example The Legend of Zelda: A Link Between Worlds (EU): SD:\00040000000EC400.sav

If there is already a backup file for that game, it will be overwritten. The internal save on the chipset is then wiped after the file is backed up on the SD.

When you launch a different game, it will check if there is already a backup for that game on your SD card. If found, it will be transfered to the flashcart's internal save chipset and will replace the previous game's data.

If I don't exit the game properly, will I lose my progress?

If you do not exit properly (e.g. battery runs out) the flash card should still have the save file in the internal save chipset, although on some occasions this will not be the case. As a result it is recommended to exit properly at all times.

Attention: If you play another game, it will NOT backup your previous game's progress to SD automatically, you need to properly exit the game manually if you don't want to lose your save before playing another game.

Attention 2: If you delete the .sav file on your SD card, the flashcart's current data will be reset when you launch the game, even if it's the latest played game! If you decide to format the SD card (for example to prepare EmuNAND) always keep a backup of your files and restore them to your card before launching the game again.

Can I backup the saves to my computer?

Yes.

You can keep a backup of your .sav files on your computer if you want.

Can I share save files with another user?

Yes.

The .sav files can be shared with other flaschart's users as long as they are playing the same ROM dump/region/version of the game.

How do I restore a save from someone else?

  1. Play a different game than the one which you want to import the save. (It you play the same game, it will use the internal save chipset instead of the .sav file, so ensure that you are playing a different one).
  2. Shutdown 3DS (users reported that it didn't work without shutting down, especially if you are using EmuNAND)
  3. Put the .sav file on the root of your SD card. It should be named based on the game's TitleID, for example The Legend of Zelda: A Link Between Worlds (EU): SD:\00040000000EC400.sav
  4. Put the game for which you want to import the save into the Flashcart.
  5. Launch the game.

Is a save from Gateway 3DS compatible with R4i 3DS Gold Deluxe/3DS Link?

Yes.

The saves are compatible and can be shared between all current flashcart's manufacturers.

Is a save from EmuNAND compatible with SysNAND?

If played from ROM: Yes

If played from Cartridge: It depends on the game and SysNAND.

The reason:

  • Since System Menu version 6.0.0, there is a new save encryption method (using a different KeyY).
  • We call the new encryption method "KeyY 6.0 method".
  • The KeyY 6.0 method causes all incompatibilities.

For games don't request KeyY 6.0 method:

  • It's compatible with EmuNAND Classic mode regardless of SysNAND version.

For games request KeyY 6.0 method:

  • If started the game cartridge on EmuNAND Classic mode with SysNAND 4.1.0-5.1.0, then the cartridge is ONLY compatible with EmuNAND Classic mode with SysNAND 4.1.0-5.1.0.
    • Playing this cartridge on SysNAND 6.0.0 or above will CORRUPT YOUR SAVE DATA!
  • If started the game cartridge on SysNAND 6.0.0 or above, then the cartridge is ONLY compatible with EmuNAND Classic mode with SysNAND 6.0.0-9.2.0.
    • Playing this cartridge on EmuNAND Classic mode with SysNAND 4.1.0-5.1.0 will CORRUPT YOUR SAVE DATA!

For dumped save from games requesting KeyY 6.0 method:

  • It's incompatible with EmuNAND ROM mode regardless of SysNAND, because EmuNAND ROM mode doesn't support KeyY 6.0 method.

Games using the KeyY 6.0 method

Nearly all games since late 2013 are using the KeyY 6.0 method. Such as:

  • Pokémon X/Y/OR/AS
  • Monster Hunter 4G
  • Zelda ALBW
  • Bravely Default
  • Disney Magical World
  • Majoras Mask 3d
  • (Add more games here)

Is a save created under one EmuNAND version compatible with another EmuNAND version?

Yes.

For the moment, the EmuNAND is using the KeyY save encryption method from the SysNAND (4.1.0-4.5.0). Playing a game in any EmuNAND version will still use the same save encryption method.

We don't know if the flashcart's teams will "fix" the encryption method to use the EmuNAND one and prevent losing save data between EmuNAND and SysNAND. If they do, your save data started on EmuNAND with the current Launcher.dat version will not work with future Launcher.dat releases.

NAND

How do I backup my NAND?

There are two methods:

  1. You can backup your NAND with a hardware method. You need to open your console and solder wires in your console. For instructions, check these threads for 3DS and 3DS XL. Another Tutorial that covers all the 3DS models is here: [1]
  2. You can backup your NAND with a software method, using the Launcher.dat.

- GW2.0b1, Gold/Link 3.0: Launch the Gateway menu (press L when selecting the DS profile) and select the "Backup NAND" option. It will save your system NAND to Nand.bin file at the root of your SD card.

Information: You don't need the 3DS flashcart to backup your NAND to nand.bin file. You need only a working DS flashcart to install the modified DS profile on your console and the Launcher.dat file on your SD card.

What is the correct size of the NAND dump?

There are two different NAND chipsets (different manufacturers), and they are of different sizes.

3DS and 3DSXL/LL

Toshiba NAND:
1931264 sectors
988.807.168 bytes = 943 MB
Samsung NAND:
1953792 sectors
1.000.341.504 bytes = 954 MB

2DS

Appears (on one unit) to be the same as the "Toshiba NAND" above.
Some 2DSes (my 2DS/ pre-installed Pokemon Y) have Samsung NAND, the one that is the same as New 3DS XL which is 1.300.234.240 bytes (1.21GB) in size of NAND backup.

N3DS and N3DS XL/LL

??? NAND:

1.979.711.488 bytes = 1.84GB
Samsung NAND:

1.300.234.240 bytes = 1.21GB

How do I restore my NAND backup?

It's possible only through hardware method.

If you want to modify your console to do hardware NAND backup and restore, you can check these threads:

NAND Flash Dump (3DS)

nand flash dump (3ds xl)

There are two different models (Normal 3DS and 3DS XL). The 3DS XL is easier to mod.

3DS XL restore process:

Can I restore another 3DS's NAND backup?

No.

A method for downgrading System Menu Versions is being developed, but there is likely to be no actual successful downgrade without a previous NAND dump from the system.

Can I restore a NAND backup made using software tool?

Yes.

But only a NAND backup from your own 3DS.

EmuNAND

What is EmuNAND?

EmuNAND is a copy of your 3DS NAND chipset. It allows you to use this copy located on SD card as if it was your real one located inside the console.

It allows you to do everything without affecting your real NAND, like updating your EmuNAND to access eshop and play online while keeping your realNAND at System version 4.5.0 which lets you run the exploit.

With Gateway 2.0b1, there are two different EmuNAND modes:

  • EmuNAND Gateway: Boots the console into EmuNAND, and lets you play 3DS ROMs from the Gateway flashcart.
  • EmuNAND Classic: Boots the console into EmuNAND, and lets you play retail game's cartridges.

Do I need EmuNAND?

If you want only to play ROMs, you don't need EmuNAND. You can launch all game's ROMs on your System NAND 4.5.0

EmuNAND with ROMs support is useful only if you don't want to affect your System NAND, or if you want to update the EmuNAND to get Online access.

If you want to download Demos, buy games on eshop, use streetpass without the fear that your console download an update, then you need EmuNAND updated to the latest firmware.

Note: EmuNAND probably won't work correctly, if at all, on new System version released after the latest available Launcher.dat version. A Launcher.dat update should be able to fix the compatibility for newer System version/NATIV_FIRM firmware.

Do I need a 3DS flashcart to setup and use EmuNAND?

You don't need a 3DS flashcart. You only need a DS compatible flashcart (DStwo, R4i, etc.) to install the DS exploit which is used to boot the launcher.

The 3DS flashcart is needed only to launch 3DS Roms.

Can I use an EmuNAND from another 3DS?

No.

How do I create the EmuNAND partition?

Using the Launcher.dat from Gateway v2.0b1, press L while selecting the DS profile and it will boot the Gateway menu. Select "Prepare EmuNAND" option.

ATTENTION : It will format your SD card and delete everything. Make a backup of all your SD card's content to your computer before proceeding.

How do I launch EmuNAND?

If the SD card has the EmuNAND partition, it will always boot EmuNAND when you launch the exploit.

If you don't want to use EmuNAND, you need an SD card without it.

There's currently no way to boot into System NAND if there is an EmuNAND partition on the SD Card.

What's the differences between Normal and Classic EmuNAND?

  • The EmuNAND Normal lets you play ROMs. You don't need to update EmuNAND to play ROMs requiring a newer System version.
  • The EmuNAND Classic lets you play Cartridges and online. You need to update EmuNAND to play a game requiring a newer System version.

Do I need to update my EmuNAND?

You don't need to update EmuNAND if you don't plan to play a retail cartridge requiring a newer system version, play online, or access the eshop to download games or game updates.

Can I play online with EmuNAND?

You can play online when using EmuNAND Classic mode and a retail cartridge, as long as you have the latest game's update. If Nintendo release a new game patch/update you can't play online anymore unless you can connect to eShop to download it. Do not accept Eshop System update prompt when you are in EmuNAND Classic! It will update your System NAND.

Online doesn't work with ROMs.

Local Multiplayer works fine with ROMs.

How do I update my EmuNAND?

ATTENTION: Do not update your EmuNAND if your current Launcher.dat version doesn't support the target System version!

Read the next question to see the maximum System version compatible with your Launcher.dat version.

DO NOT USE eShop or the update prompt to download/update your EmuNAND. It will update your System NAND instead. Always go to Settings > verify that the GW3D text is displayed > go to update menu.

Updating using internet:

Updating offline:

If you downloaded a new System update while in sleep mode and have a prompt to update when you are in EmuNAND, you can install it offline. Follow the previous method "Updating using internet" to install your already downloaded update.

Updating using a cartridge:

There is a report that you can update the EmuNAND with a retail game cartridge, but it's only if you want to stay offline and play your retail game with the required System version. This method is not recommended. There are also reports of this overwriting your system's NAND, so DO NOT DO THIS.

You need to be in EmuNAND Classic to get the update prompt. It will update ONLY your System version without eShop features. If you try to access eshop it will prompt you to update to get the latest eShop features, if you accept it will update your System NAND! NO DOT UPDATE USING ESHOP. If you want to update, use the Settings menu and follow a tutorial.

What is the latest working System version for EmuNAND?

Working system versions depend on your current Launcher.dat version. If a new System version is released after the latest Launcher.dat version, chances are the new System menu will not work anymore, or only launch in degraded mode.

Legend:

  • Fully working: You can play ROMs and retail cartridges, region free for ROMs, System menu version spoofing for ROMs, Applications launching. eShop access is also working if you are using the latest available System version.
  • Compatible: This system version can be launched with EmuNAND but is not compatible with all features. It should lets you launch ROMs and retail cartridge. No region free or System menu version spoofing. The console can freeze if you try to access settings menu or any applications (eShop, Mii, etc.)

Gateway 2.0b1, R4i Gold 3DS Deluxe/Link 3DS 3.0:

  • Latest fully working System version: 6.3.0
  • Compatible System version(s): 7.0.0, 7.1.0

Gateway 2.0b2, R4i Gold 3DS Deluxe/Link 3DS 3.1:

  • Latest fully working System version: 7.1.0

Can I backup my EmuNAND partition located on my SD card?

Yes.

Windows

You can currently use Win32DiskImager. It will backup all your SD card (NAND partition and FAT32 partition) as a single binary file.

To backup only the EmuNAND partition, you can use "emuNAND Tool".

Linux

you can use dd command to backup your EmuNAND partition only.

Commands for Toshiba NAND:

Backup emuNAND from the sd card:

dd if=/dev/sdX of=dummy.bin count=1
dd if=/dev/sdX of=nand.bin count=1 skip=1931264
dd if=/dev/sdX of=nand.bin count=1931263 skip=1 seek=1

Write backup to sd card:

dd if=dummy.bin of=sd_tmp.bin count=1
dd if=nand.bin of=sd_tmp.bin skip=1 seek=1
dd if=nand.bin of=sd_tmp.bin count=1 seek=1931264
dd if=sd_tmp.bin of=/dev/sdX bs=8M
rm sd_tmp.bin

Commands for Samsung NAND:

Backup emuNAND from the sd card:

dd if=/dev/sdX of=dummy.bin count=1
dd if=/dev/sdX of=nand.bin count=1 skip=1953792
dd if=/dev/sdX of=nand.bin count=1953791 skip=1 seek=1

Write backup to sd card:

dd if=dummy.bin of=sd_tmp.bin count=1
dd if=nand.bin of=sd_tmp.bin skip=1 seek=1
dd if=nand.bin of=sd_tmp.bin count=1 seek=1953792
dd if=sd_tmp.bin of=/dev/sdX bs=8M
rm sd_tmp.bin

Be sure to change the /dev/sdX to match your SD card. This will make a nand.bin and dummy.bin. The dummy.bin is simply the first sector of the sd card, and nand.bin is your unsplit nand. Thanks to moosehunter

Mac OS

Backing up EmuNAND on OSX in a Terminal works analog to Linux, you only use /dev/diskX instead of /dev/sdX and the bs parameter in the last entry needs a lowercase m. Find the correct /dev/ tree entry with 'diskutil list'.

Before you can write to the SD Card under OSX Terminal, you must unmount all partition on the SD card with the command "'diskutil unmount /dev/diskX" or you get an error like "dd: bs: illegal numeric value"

The two different NAND sizes

Toshiba NAND:
1931264 sectors
988.807.168 bytes = 943 MB
Samsung NAND:
1953792 sectors
1.000.341.504 bytes = 954 MB

Can I use my hardware NAND backup with EmuNAND?

Yes.

The EmuNAND partition has its first sector moved after the last NAND sector, and the first sector is replaced by a dummy sector (acting as SD card's MBR). You can't write your NAND backup directly to SD card without modifying the sector positions.

On Windows, you can use the "emuNAND Tool" to write your NAND backup to your SD card.

If you are on Linux, you can use dd command to write your NAND.bin to your SD card.

Related GBATemp's post : How to use dd to backup/restore EmuNAND partition. (Values are for Toshiba NAND. Change the values for Samsung NAND).

Is EmuNAND affecting System NAND?

While in EmuNAND, your System NAND (4.5.0) is still running and active. Some action done in EmuNAND will only affect EmuNAND, while others will affect both EmuNAND and System NAND.

Here is a list of known actions affecting the System NAND:

Confirmed

  • Updating the System version from Eshop will update the System NAND.

Conflicting reports

  • Modifying a network setting in EmuNAND will save all EmuNAND's network setting to SysNAND's network setting.
  • Moving game's icon position on the System Menu also change their position on SysNAND.

Note: If these issues are only present in a specific Launcher.dat version, move them to the "Known Bug List" section.

Is System NAND affecting EmuNAND?

Yes. As your console is still running on System NAND 4.5.0, it's using that System version's files and functions.

Here is a list of known actions affecting the EmuNAND:

  • The save data encryption method used by new games (SDK6+) is still using the 4.5.0 encryption method, even if you are using EmuNAND 6.1.0+

Specific Game's Questions

How do I play Pokémon X/Y?

ROM: Pokemon X/Y is playable with many 3ds flashcarts such as, Sky3ds/Sky3ds+, Gateway 3ds, Supercard Dstwo+, and the QQ3ds/QQ3ds+.

Cartridge: To play the retail Pokémon X/Y, you need EmuNAND of the firmware 6.2.0 or higher.

How do I play The Legend of Zelda: A Link Between Worlds?

ROM: Zelda: ALBW works with and without emuNAND using Sky3ds, Gateway, and QQ3ds. If you play on EmuNAND, you don't need to update it.

Cartridge: To play the retail Zelda: ALBW, you need EmuNAND Classic 6.2.0 or higher.

Attention: EmuNAND and SysNAND environments are different. You will lose your save progress if you start playing in one environment and launch your game in the other one later. The game will reset your save file and you will have to start a new game. This also apply to all games bundled with System update 6.0.0+

How do I play Animal Crossing: New Leaf?

ROM: Animal Crossing is playable using the Gateway 3ds, Sky3ds, and QQ3ds.

Cartridge: The original game cartridge doesn't need EmuNAND Classic, the game only requires System version 4.5.0, therefore you can play your game on your SysNAND without updating and loosing Flashcart capability.

Known bugs

Gateway 3DS v2.0b1, R4i Gold 3DS Deluxe/3DSLink v3.0

  • Region free and System version spoofing doesn't work on System menu 4.1.0 or EmuNAND 4.1.0. To work around this problem, either update your SysNAND to 4.5.0 with a game card, or use EmuNAND and update it, or use the previous Launcher.dat version if your game doesn't need a new System version.
  • Console freeze when entering in Gateway mode. No reliable method to prevent this issue has been found. You can remove the Flashcard from the 3DS to have less freezes when booting in Gateway mode.
  • Console freeze when exiting a game, preventing the save to be backed up correctly to the SD Card, resulting in savegame loss. See the Troubleshooting section for a way to mitigate this bug.
  • All changes done in EmuNAND Wifi Settings are also applied to SysNAND.
  • Following issues are not bugs, but results of currently unpatched System version/NATIV_FIRM version.
    • EmuNAND v7.x.x doesn't have region free and System version spoofing.
    • EmuNAND v7.x.x can't launch new updated applications (eshop, System settings, etc.)
    • EmuNAND v7.x.x uses mixed language settings in games (Japanese, Spanish, German, French, etc.) even if the game doesn't allow using one of these languages in your region.

All bugs listed above are fixed in Gateway 3DS v2.0b2 and R4i Gold 3DS Deluxe/3DSLink v3.1.

Gateway 3DS v2.0b2, R4i Gold 3DS Deluxe/3DSLink v3.1

  • Updated Youtube channel doesn't work. The original (not updated) channel works fine. The update is currently available only on USA eShop.
  • Randomly brick 3DS console. This was meant as an anti-clone feature by Gateway, and affects clones often, but occasionally bricks consoles even using a real Gateway. What triggers this on a real Gateway is not fully known; one report connects it to diagnostics, but there are probably other factors as well. This thread explains how to fix the brick (requiring soldering and hardware) and some users may be willing to fix other people's bricks.

R4i Gold 3DS Deluxe/3DSLink v3.1

  • Save issue (savegame loss) since 2014. Set the Console's date back to 2013 or use Launcher.dat v3.0 report thread. Issue fixed in R4i Gold 3DS Deluxe/3DSLink v3.2.
  • Randomly brick 3DS console (as above)

These are anti-clone functions from Gateway's team.

R4i Gold 3DS Deluxe/3DSLink v3.2

  • Randomly brick 3DS console (as above)

R4i Gold 3DS Deluxe/3DSLink v3.3

  • Doesn't boot games from different regions
  • Freezes after entering to System Settings in EmuNAND 7.1
  • Probably contains all bugs from R4i Gold 3DS Deluxe/3DSLink v3.0 (see above), as it seems it's a reverted version to prevent bricking issue.

R4i Gold 3DS Deluxe/3DSLink v3.3b

  • None. (this version is actually R4i Gold 3DS Deluxe/3DSLink v2.0, based on Gateway v1.2)

Troubleshooting

Region free and System version spoofing are not working

The Gateway v2.0b1 and Gold/Link v3.0 have compatibility problem if your System NAND is 4.1.0 or your EmuNAND is either 4.1.0 or 7.0.0+

  • Solution: You need to update your System NAND to 4.2.0-4.5.0, or use the previous or the newer Launcher.dat version. This bug is fixed in Gateway v2.0b2, R4i 3DS Gold Deluxe/3DSLink v3.1.
  • Recommended: Update Launcher.dat to Gateway v2.0b2, or revert back to Gateway v1.2 or R4i 3DS Gold Deluxe/3DSLink v2.0 if your game works with the old version, or update your System menu to 4.2.0-4.5.0.

My EmuNAND created with Gateway Launcher.dat doesn't work with R4i 3DS Gold Deluxe / 3DS Link

It's probably caused by sector 0 of the SD card.

Nobody reported how to fix this issue yet. A User with R4i EmuNAND need to provide a copy of his sector 0.

My saves are being lost after I exit a game

There are conflicting reports on the cause of this bug in Gateway's 2.0b1 firmware and how to prevent it. The symptom is the 3ds freezing/hanging after exiting a game, resulting in the save not properly being transferred to the SD card. The leading theory is that the 3DS hack doesn't always properly initialize, and so it doesn't return after exiting a game.

The only way to ensure that your game will save properly is to run it and then exit the game after it reaches the main menu. If that exit to the home menu works properly (doesn't freeze) then all future exits should work properly during that current run of the 3DS hack, meaning your saves will transfer to the SD card properly (until you re-enter Nintendo DS profile and thus re-initialize the 3DS hack).

  • Solution: If your system froze when exiting a game, do not launch the game again! Your progress is not lost yet, the save is still on the flashcart. Restart the system and enter Gateway mode. Remove the SD card (the system should warn you at that point about removing SD cards when the power is on; you can usually just ignore that), and then boot the game. After confirming that your save wasn't lost, insert the SD back in and exit the game by pressing the Home button and then Close. At this point the game should close, and the save should have been safely copied to the SD card. If it freezes again you can repeat the process.

This solution may not work with EmuNAND, as removing the SD card may cause complications.

Attention: If you launch a game after the freeze, the savegame will be lost, either replaced by the save of the new game, or deleted if the new game has no save.

My retail game says my Savegame is corrupted

You are probably trying to play a retail game cartridge in EmuNAND after starting the game on SysNAND, or playing on SysNAND after starting it on EmuNAND.

Newer games use a different save format and are not compatible between EmuNAND <-> SysNAND.

EmuNAND 6.0+ Saves will work with any EmuNAND FW6.0+ 3DS.

SysNAND 6.0+ Saves will work any SysNAND FW6.0+ 3DS.

The save won't get corrupted as long as you are using the same FW environment (SysNAND or EmuNAND).

For more information, read the "Save" section of this FAQ.

My friends are always offline when I use EmuNAND / I have two different friend codes

This is due to the 3DS generating a friend code on the EmuNAND first, then on the SysNAND later.

If your system never generated a friend code on the SysNAND, it will generate one on the EmuNAND once you give the 3DS a internet connection in EmuNAND mode. Later on if you decide to have a internet connection on the SysNAND as well, it'll generate another one for SysNAND. Thus the friend code on SysNAND will never get transferred to the EmuNAND and you'll have two different friend codes for the same system. One for SysNAND and another one for EmuNAND.

  • Solution: You can either make sure to have a friend code generated on SysNAND first before creating the EmuNAND, or delete the EmuNAND and create a new EmuNAND after making sure a friend code is generated on the SysNAND, or you can simply live with it and use two different friend codes.

My game displays in incorrect language

This is probably because you are using an EmuNAND version incompatible with your current Launcher.dat version.

System version 7.1.x has been released after the release of Gateway 3DS v2.0b1, therefore this version of Gateway 3DS doesn't know how to patch the EmuNAND 7.x correctly and results in many bugs (incorrect language, no region free, no Settings access, etc.). Check the Known bugs section on his FAQ for a full 2.0b1 bug list.

To resume:

ALL Games work fine with

  • GW 2.0b1 + NO emuNAND.
  • GW 2.0b2 + NO emuNAND.
  • GW 2.0b1 + EmuNAND 4.x - 6.x
  • GW 2.0b2 + EmuNAND 4.x - 7.x
  • MT 1.1 + EmuNAND 4.x - 7.x

Games display in Incorrect language with

  • GW 2.0b1 + EmuNAND 7.x

To fix the language issue

  • Don't use EmuNAND.
  • Downgrade your EmuNAND to 4.x - 6.x version using EmuNAND Tool to write one of your old EmuNAND backup to your SD Card.
  • Create a new EmuNAND based on your 4.x SysNAND.
  • Use GW 2.0b2.

Attention, GW 2.0b2 is NOT recommended as it will brick your 3DS.

Legend

GW 1.2 = Gateway 3DS 1.2, R4i Gold 3DS Deluxe 2.0 and 3.3b

GW 2.0b1 = Gateway 3DS 2.0b1, R4i Gold 3DS Deluxe 3.0 and 3.3

GW 2.0b2 = Gateway 3DS 2.0b2, R4i Gold 3DS Deluxe 3.1 and 3.2

MT 1.1 = MT-Card 1.1