3DS Flashcart FAQ

This page will list frequently asked questions about the 3DS hacking using flashcarts like Gateway 3DS or R4i Gold 3DS Deluxe.

If you have a question, put it at the end of the page, or ask on GBATemp's forum (will add a thread link here later).

If you have an answer or can help provide better answers and informations than the currently listed one, please edit this page to help other users.

If you found a new question in the forum and know the answer, put it in the corresponding section.

Glossary

NAND

There are two types of NAND: SysNAND and EmuNAND.

• SysNAND is the original NAND on version 4.5 that stores data/system information.
• EmuNAND is a backup/copy/emulated version of your SysNAND that runs off the SD card.

EmuNANDs can be safely updated to the latest system menu, while still having your SysNAND on version 4.5. So you can keep your 4.5 exploit while still having access to online features.

RedNAND is an unreleased nand redirection exploit written by Smealum (w/ help from friends) that has not been released publicly.

SD Card

The "SD Card" is the Big SD card in your 3DS. The one bundled with your console. It's used to store Launcher.dat file, all your save files, and if you want it can also store a copy of your NAND: The EmuNAND partition.

The "Micro SD Card" is the one placed into the flashcart and containing your game's ROMs.

Firmware / System Menu

Users often use "Firmware" to talk about the version of their console or Flashcart, but it's not the correct name.

Like for Wii and WiiU, the 3DS use a System Menu version. If you speak about the 3DS, please use "System version" instead of Firmware in this FAQ.

If you speak about the Flashcart's Launcher.dat, it's not a firmware either. It's a program launched by the DS profile exploit. The firmware would be what's inside the flashcart's chipset. But a lot of users call the Launcher.dat the "Firmware" so I used that word in the FAQ. If it's better to use another word, feel free to replace it.

Exploit

How does it work ?

This hack exploits two different vulnerabilities in the 3DS system menu.

The first one consists in altering the DS profile stored in DS NVRAM (by using a compatible DS flashcart and running a DS homebrew), to exploit the MSET vulnerability in "User mode".

The second one grants access to the 3DS "kernel mode" by launching the DS profile in the 3DS Settings. When the DS profile is launched, it use a vulnerability to gets Kernel access and loads a Launcher.dat file located on the SD card.

Nintendo patched the second vulnerability in System version 5.0.0, and prevented the DS profile to crash in System version 7.0.0. Although the modified NVRAM still crash the system up to version 6.3.0, there's no indication that the MSET exploit wasn't patched in version 5.0.0 too.

Discussion threads : (find the thread with ROP explanation), DS Exploit.

3dbrew....

Console

Is it working in all consoles and regions?

Consoles from all regions are compatible with this exploit, and works on all 3DS consoles (Original and XL/LL). You need a 3DS with a System version from 4.1.0 to 4.5.0 to use this exploit. If your 3DS System version is 5.0.0 or newer, it will not work. The 2DS is manufactured with a System version higher than 4.5.0 so it will not work.

Is it a softmod or hardmod?

This hack is currently based on both. The exploit itself is done in software (It runs by launching programs on the console), but requires a Flashcart to install the DS exploit and another Flashcart to play 3DS ROMs.

You don't need to open your console or solder a modchip to play 3DS Roms, but it's possible to do physical modifications if you want to backup/restore your NAND. See this FAQ's NAND section for more informations.

Flashcarts

How many 3DS Flashcart exist?

• Gateway. Read GBATemp's review.
• R4i Gold 3DS Deluxe. Read GBATemp's review.
• 3DS Link (same product as R4i Gold 3DS Deluxe, just a different name)

All three products are bundled with both a DS mode flashcart and a 3DS mode flashcart.

Why are there two flashcarts?

The DS mode flashcart is used to run a DS Homebrew which will replace the DS profile informations. The modified DS profile is then used to exploit a vulnerability in 3DS mode, access Kernel mode and patch the 3DS system.

The 3DS mode flashcart is used to play 3DS Game ROMs.

Can I use my own DS mode Flashcart?

Yes.

If you already have a DS mode flashcart working with your 3DS, you can use it to run the DS homebrew. Just put the installer.nds file on your MicroSD and launch it from your usual method of booting DS homebrew.

Can I use the DS Mode flashcart bundled with 3DS Flashcart to run DS homebrew/games?

Yes.

The bundled DS Mode flashcart is a regular card working with 3DS firmware 4.5.0 (or newer, depending which product you buy).

• Gateway: This is a r4i gold 3DS clone, using a hacked Wood firmware.
  
• R4i Gold 3DS Deluxe: This is an official R4i Gold 3DS, with the official Wood Firmware.
  
• 3DS Link: This card and R4i Gold 3DS Deluxe are the same product.

Do 3DS Flashcarts work with all consoles?

The 3DS flashcarts are region free and works on all existing 3DS consoles (Original and XL/LL). It doesn't work on 2DS due to bundled system version at manufacturing time.

Do 3DS Flashcarts work on all 3DS System version?

The exploit currently used to get access to the 3DS Kernel works only on System version 4.1.0 to 4.5.0.

My 3DS System version is below 4.5.0, how can I update it?

The current exploit is working with 3DS System Menu version 4.1.0 to 4.5.0.

If you are on System version 4.1.0 to 4.5.0, you don't need to update. If your System version is 1.0.0 to 4.0.0, you will have to update to use this exploit.

There are two different methods to update your System NAND:

1. Using an original game cartridge bundled with the desired System version update (for example Luigi's Mansion 2 has v4.5.0). It works on all System versions, from v1.0.0 to any versions inferior to the game's bundled System version update.
2. Using a game's ROM bundled with System update v4.5.0 and with Gateway v1.0 (which doesn't prevent the required System version checking). It works on System version v4.1.0 to v4.4.0.

You can check this website to find which System version is present in a game's update partition.

Note: The ROM method is not possible with R4i Gold 3DS Deluxe / 3DS Link flashcarts as their initial release (v2.0) prevent the game from checking the required firmware.

My console's firmware is above 4.5.0, what can I do? Is it possible to downgrade?

Downgrading is possible only if you have a backup of your NAND chipset created before updating. You can't restore another console's NAND backup.

If you have a NAND backup of your console and want to restore it, check the NAND section.

If you don't have a NAND backup, you can't use this hack at all. You must buy a new console if you want one with System version 4.5.0 or below.

Can you check the System version before buying a new 3DS?

Copyright 2012 is NOT a guarantee of firmware <= 4.5.0. Having a Nintendo Serial Number <= SW12XXXXXX X is. The lower the serial number the older the unit (which for our purposes is better).

Since firmware 5.0.0 was released March 26, 2013, and we know the release of the various versions of the 3DS and the 3DS XL models/bundles...

In regards to North America:

3DS XL models capable of coming with <= 4.5.0:

Red/Black

Blue/Black

Pink/White

Pikachu bundle

Pink/White 3DS XL in a bundle (with Professor Layton and the Miracle Mask or Style Savvy: Trendsetters)

3DS models capable of coming with <= 4.5.0:

Aqua Blue

Cosmo Black

Flame Red

Pearl Pink (bundled with Nintendogs + Cats)

Midnight Purple

Heroes of Ruin

The Legend of Zelda 25th Anniversary

Kingdom Hearts 3D: Dream Drop Distance

Fire Emblem Awakening

Seems like almost all regular 3DS's are capable while only a limited selection of 3DS XL's are.

The highest reported Nintendo Serial Number that came with 4.5.0:

For the Red/Black 3DS XL: SW1279xxxx x [DemiseScythe]

For the Blue/Black 3DS XL: SW1270xxxx x [moosehunter] (SW1335xxxx x reported > 4.5.0 [tlee22])

For the Pink/White 3DS XL: SW1272xxxx x [Gara]

There are possible contradictions in this data from RickyEarl (says Blue/Black w/ SW1231xxxx x+ had 6.1.0) and tlee22 (says Red/Black w/ SW1275xxxx x had 6.1.0).

The Nintendo Serial Number can be found on the outside of the box on the top (It can also be found on the back of the 3DS itself)

• 

Discussion thread: at the forums

Using the flashcarts

Do I need to run DS exploit every time?

No.

The patched DS profile is reset only if you launch a DS game or a DS mode flashcard. In this case, you will need to run the DS install.nds homebrew again.

You will also need to run the install.nds again if you changed your 3DS System language.

Is the 3DS hack permanent or do I need to run it after every reboot?

You need to run the exploit after each console's reboot/shutdown.

Go to Settings > Other Settings > Nintendo DS Profile to launch the hack again.

I want to remove all exploits on my system!

1. Run a DS game or a DS mode flashcart.
2. Shutdown your 3DS.
3. Delete the Launcher.dat from your SD card
4. Delete the install.nds from your DS flashcard's MicroSD.

Games

Are all games working ?

It depends on the flashcart and its firmware version.

ROMs:

• GW2.0b1, R4i Gold 3DS Deluxe 3.0, 3DS Link 3.0: Only 2 games (Pokemon X/Y and Animal Crossing) are not working when using the ROM form.
• GW1.2, R4i Gold 3DS Deluxe/ 3DS Link 2.0: Games using SDK5+ are not working.

Game Cartridge:

• EmuNAND classic with GW2.0b1: All games (tested up to release 497) are working using EmuNAND classic Firmware 6.3.0

Attention: Since SDK6 (and System version 6.0+) games are using a different save encryption method. While in EmuNAND, the system is still running under 4.5.0 and it's using the old encryption method. If you play your cartridge in System NAND 6.0+ it will not be compatible with EmuNAND 6.0+ and the game will delete/reinitialize the save.

You can check the 3DS flashcarts game compatibility page to see which games are not working, and which version you need.

Are games region free?

Yes.

You can play games from all regions when using ROMs. But if you are using EmuNAND Classic (GW2.0b1), you still need to use a game cartridge from your region.

ROMs:

• GW2.0b1, R4i Gold 3DS Deluxe 2.0, 3DS Link 2.0: Working with games from all regions.
• EmuNAND (GW2.0b1): Working with games from all regions.

Game Cartridge:

• EmuNAND Classic (GW2.0b1) : No region free.

Can I play online?

You can play online only when using EmuNAND Classic mode and a retail cartridge. Read the EmuNAND section for more informations.

Online doesn't work with ROMs.

Can I play games requiring System version past 4.5.0?

Yes.

The flashcarts are spoofing the required System version and prevent the prompt asking to update your console if you play from ROMs. But if you are using EmuNAND Classic (GW2.0b1), you still need to use an updated EmuNAND.

ROMs:

• GW1.2, R4i Gold 3DS Deluxe 2.0, 3DS Link 2.0: Working with all games requiring System version up to 4.5.0 and some games requiring 5.1.0.
• GW2.0b1, R4i Gold 3DS Deluxe 3.0, 3DS Link 3.0: Working with all games requiring System version up to 6.2.0.
• EmuNAND (GW2.0b1): Working with all games requiring System version up to 6.2.0.

Game Cartridge:

• EmuNAND Classic (GW2.0b1) : No System version spoofing. You need to update your EmuNAND System version to 5.1.0 or newer.

Why games using SDK5+ are not working with old flashcart's firmware?

In the SDK5, Nintendo changed the location of the booting logo (the Nintendo logo at the bottom of the booting screen). It's now located outside of the ExeFS, in unencrypted form. Unable to locate this file, the game couldn't boot.

Flashcart's firmwares are patching the location to allow games created with SDK5 to work with System version 4.5.0.

ROMs:

• R4i Gold 3DS Deluxe 2.0, 3DS Link 2.0: Not working with SDK5+ games.
• GW2.0b1, R4i Gold 3DS Deluxe 3.0, 3DS Link 3.0: Working with all SDK5+ games.
• EmuNAND (GW2.0b1): Working with all SDK5+ games.

Game Cartridge:

• EmuNAND Classic (GW2.0b1) : No file path patching. You need to update your EmuNAND System version to 5.1.0 or newer.

Can I store multiple games on my MicroSD?

No.

At least, not for the moment. You need 1 game per MicroSD card.

The Gateway team said they are working on a game selection menu for GW 2.0.

How can I store games bigger than 4GB on FAT32?

It's unknown for the moment how the games will be stored to allow multiple games at the same time.

How do I install a game to my MicroSD card?

The game is written in RAW format, it doesn't use any file system.

You need to use tools to write the ROM image to your device. There are different tools depending on your operating system.

• Windows: Win32DiskImager.

Select the device in the list, Select the .3ds game file and click "Write" button. Attention, be sure to select the correct drive's letter. ALL your card will be deleted and the game will be written.

If the MicroSD contains already a game, the program will not display the device in the list. You need to format the MicroSD first (using Panasonic SD Formater).

• Mac OS: Mac OS 3DS Imaging Tool.

• Linux: use dd command line to write binary file to the device.

sudo dd if=/u01/filename.3ds of=/dev/mmcblk0 bs=1M

• Android: Gateway flash application for rooted android.

Can I trim ROMs to fit in a smaller MicroSD?

Yes.

Some games can be trimmed to remove unused dumped binary data. There are different program you can use to do that.

• ROM_Tool, by 3DSGuy
• 3DS Explorer by Elisherer, and 3DS Explorer mod by 3DSGuy

There are two trimming methods, what are the differences?

The normal trimming method removes unused data at the end of the Game's Data. it can be reverted to get the file back to the original Dump.

The second trimming methods also removes the Update Partition from the game's Data and is irreversible. You can't restore the deleted partition from the modified file.

The first method should be enough to fit all games in your MicroSD card.

Where are the saves? Can I backup them ?

When you play, the save is stored into the flashcart.

If you want to backup your current progress to a file, you need to exit the game by using Home > X > A, it will make a copy of the flashcart's internal save chipset to the root of your big SD card, with the filename based on the GameID.

As long as you play the same game, it will use the flashcart's internal save chipset.

If you play another game, it will import the game's save file from the big SD card to to internal save chipset. It will NOT backup your previous game's save first, you need to properly exit the game if you don't want to lose your save.

You can then keep a backup of your .sav files on your computer if you want.

My saves are being lost after I exit a game, how can I fix this?

There are conflicting reports on the cause of this bug in Gateway's 2.0b firmware and how to prevent it. The symptom is the 3ds freezing/hanging after exiting a game, resulting in the save not properly being transferred to the SD card. The leading theory is that the 3DS hack doesn't always properly initialize, and so it doesn't return after exiting a game.

The only way to ensure that your game will save properly is to run it and then exit the game after it reaches the main menu. If that exit to the home menu works properly (doesn't freeze) then all future exits should work properly during that current run of the 3DS hack, meaning your saves will transfer to the SD card properly (until you re-enter Nintendo DS profile).

How do I change games?

Exit your current game with Home > X > A, and wait few seconds before removing the flashcard, it's doing a backup of the save. change your MicroSD and put the flashcard back in the 3DS.

NAND

How do I backup my NAND?

Yes, There are two methods :

1. You can backup using a hardware flasher. You need to open your console and solder wires in your console. For instruction, check this thread ....
2. You can backup using a software. Currently, only GateWay is providing this option.

- GW2.0b1: Launch the Gateway menu (Press L when selecting the DS profile) and select the "Backup NAND" option. It will save your system NAND to Nand.bin file located at your big SD card's root.

Information: You don't need the Gateway flashcart to backup your NAND to nand.bin file.

What is the correct size of the NAND dump?

There are two different NAND chipsets (different manufacturers), and they are of different sizes.

Toshiba NAND:
1931264 sectors
988.807.168 bytes

Samsung NAND:
1953792 sectors
1.000.341.504 bytes

How do I restore my NAND backup?

It's possible only through hardware method.

If you want to modify your console to do hardware NAND backup and restore, you can check these threads:

NAND Flash Dump (3DS)

nand flash dump (3ds xl)

There are two different models (Normal 3DS and 3DS XL). The 3DS XL is easier to mod.

3DS XL restore process:

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Can I restore another 3DS's NAND backup?

No.

Can I restore a NAND backup made using software tool?

Yes.

But only a NAND backup from your own 3DS.

EmuNAND

What is EmuNAND?

EmuNAND is a copy of your 3DS NAND chipset. It allows you to use this copy located on SD card as if it was your real one located inside the console.

It allows you to do everything without affecting your real NAND, like updating your EmuNAND to access eshop and play online while keeping your realNAND at System version 4.5.0 which lets you run the exploit.

With Gateway 2.0b1, there are two different EmuNAND modes:

• EmuNAND Gateway: Boots the console into EmuNAND, and lets you play 3DS ROMs from the Gateway flashcart.
• EmuNAND Classic: Boots the console into EmuNAND, and lets you play retail game's cartridges.

Do I need EmuNAND?

If you want only to play ROMs, you don't need EmuNAND. You can launch all game's ROMs on your System NAND 4.5.0

EmuNAND with ROMs support is useful only if you don't want to affect your System NAND, or if you want to update the EmuNAND to get Online access.

If you want to download Demos, buy games on eshop, use streetpass without the fear that your console download an update, then you need EmuNAND updated to the latest firmware.

Note: EmuNAND is currently tested only up System version 6.3.0

Do I need a 3DS flashcart to setup and use EmuNAND?

You don't need a 3DS flashcart. You only need a DS compatible flashcart (DStwo, R4i, etc.) to install the DS exploit which is used to boot the launcher.

The 3DS flashcart is needed only to launch 3DS Roms.

Can I use another 3DS EmuNAND?

No.

How do I create the EmuNAND partition?

Using the Launcher.dat from Gateway v2.0b1, press L while selecting the DS profile and it will boot the Gateway menu. Select "Prepare EmuNAND" option.

ATTENTION : It will format your SD card and delete everything. Make a backup of all your SD card's content to your computer before proceeding.

How do I launch EmuNAND?

If the SD card has the EmuNAND partition, it will always boot EmuNAND when you launch the exploit.

If you don't want to use EmuNAND, you need an SD card without it.

There's currently no way to boot into System NAND if there is an EmuNAND partition on the SD Card.

What's the differences between Normal and Classic EmuNAND?

• The EmuNAND Normal lets you play ROMs. You don't need to update EmuNAND to play ROMs requiring a newer System version.
• The EmuNAND Classic lets you play Cartridges and online. You need to update EmuNAND to play a game requiring a newer System version.

Do I need to update my EmuNAND?

You don't need to update EmuNAND if you don't plan to play a retail cartridge requiring a newer System version, access eshop, download Game's updates/patches or play online.

Can I play online with EmuNAND?

You can play online when using EmuNAND Classic mode and a retail cartridge, as long as you have the latest game's update. If Nintendo release a new game patch/update you can't play online anymore unless you can connect to eShop to download it. Do not accept Eshop System update prompt when you are in EmuNAND Classic! It will update your System NAND.

Online doesn't work with ROMs.

How do I update my EmuNAND?

(Link to different tutorials or write one here.)

• You can find the official tutorial on Gateway 3DS website, news from 01/12/2013.
• Another tutorial.

Updating using internet:

ATTENTION:

Do not update your EmuNAND! 3DS System version 7.0.0 (with GW2.0b1 & R4/link3.0) is not fully compatible with EmuNAND, and not needed to play games.

Read following sections to see what stopped working with newer system versions.

If you downloaded System version 6.3 and didn't update yet, you can still install it offline to play latest Retail game cartridges, but you won't have access to eShop. Follow a tutorial to install this update in offline mode to your EmuNAND.

DO NOT USE eShop or the update prompt to download/update your EmuNAND. It will update your System NAND instead. Always go to Settings > verify that the GW3D text is displayed > go to update menu.

Updating using a cartridge:

There is a report that you can update the EmuNAND with a retail game cartridge, but it's only if you want to stay offline and play your retail game with the required System version. This method is not recommended.

You need to be in EmuNAND Classic to get the update prompt. It will update ONLY your System version without eShop features. If you try to access eshop it will prompt you to update to get the latest eShop features, if you accept it will update your System NAND! NO DOT UPDATE USING ESHOP. If you want to update, use the Settings menu and follow a tutorial.

What is the latest working System version for EmuNAND

Latest fully working System version (with GW2.0b1 & R4/link3.0) is v6.3.0

It's the System version which was available when the Launcher.dat (GW2.0b1, R4/Link 3.0) was released.

System version 6.3.0 works with the two EmuNAND Modes:

• EmuNAND Normal: Can play ROMs. Can't access internet based application anymore (Prompt to update to latest System version)
• EmuNAND Classic: Can play retail cartridges, online gaming is working. Can't access internet based application anymore (Prompt to update to latest System version)

What features are working/not working on newer System versions with EmuNAND ?

These System versions are newer than the Launcher.dat (GW2.0b1, R4/Link 3.0) release, therefore the patches are not applied correctly with them and some functions are not working (like Region free, etc.)

System version 7.0.0 (with GW2.0b1 & R4/link3.0):

• EmuNAND Normal Can play ROMs from the same region only. Console freeze if you try to access settings menu or any internet based application (eShop, Miiverse, Mii Plaza, etc.)
• EmuNAND Classic: Can play retail cartridges, online gaming is working. Console freeze if you try to access settings menu or any internet based application (eShop, Miiverse, Mii Plaza, etc.)

Can I backup my EmuNAND partition located on my SD card?

Yes.

Windows

You can currently use Win32DiskImager. It will backup all your SD card (NAND partition and FAT32 partition) as a single binary file.

Linux

you can use dd command to backup your EmuNAND partition only.

Backup emunand from the sd card:

dd if=/dev/sdX of=dummy.bin count=1
dd if=/dev/sdX of=nand.bin count=1 skip=1931264
dd if=/dev/sdX of=nand.bin count=1931263 skip=1 seek=1

Write backup to sd card:

dd if=dummy.bin of=sd_tmp.bin count=1
dd if=nand.bin of=sd_tmp.bin skip=1 seek=1
dd if=nand.bin of=sd_tmp.bin count=1 seek=1931264
dd if=sd_tmp.bin of=/dev/sdX bs=8M
rm sd_tmp.bin

Be sure to change the /dev/sdX to match your SD card. This will make a nand.bin and dummy.bin. The dummy.bin is simply the first sector of the sd card, and nand.bin is your unsplit nand. The byte counts here were based of my nand dumps. I don't know if it's different for other 3DS's. Thanks to moosehunter

Mac OS

-Add Mac OS solution here- You can also use VMWare or Linux live image.

The two different NAND sizes

Toshiba NAND:
1931264 sectors
988.807.168 bytes

Samsung NAND:
1953792 sectors
1.000.341.504 bytes

Can I use my hardware NAND backup with EmuNAND?

Yes.

The EmuNAND partition has its first sector moved after the last NAND sector, and the first sector is replaced by a dummy sector (acting as SD card's MBR). You can't write your NAND backup directly to SD card without modifying the sector positions.

If you are on Linux, you can use dd command to write your NAND.bin to your SD card.

Related GBATemp's post : How to use dd to backup/restore EmuNAND partition. (Values are for Toshiba NAND. Change the values for Samsung NAND).

Is EmuNAND affecting System NAND?

While in EmuNAND, your System NAND (4.5.0) is still running and active. Some action done in EmuNAND will only affect EmuNAND, while others will affect both EmuNAND and System NAND.

Here is a list of known actions affecting the System NAND:

• Modifying a betwork setting in EmuNAND will save all EmuNAND's network setting to System NAND's network setting.
• Updating the System version from Eshop will update the System NAND.

Is System NAND affecting EmuNAND?

Yes. As your console is still running on System NAND 4.5.0, it's using that System version's files and functions.

Here is a list of known actions affecting the EmuNAND:

• The save data encryption method used by new games (SDK6+) is still using the 4.5.0 encryption method, even if you are using EmuNAND 6.1.0+

Specific Game's Questions

How do I play Pokémon X/Y?

ROM: The Pokémon X/Y ROM doesn't work on current flashcarts.

Cartridge: To play the retail Pokémon X/Y, you need EmuNAND Classic 6.2.0 or higher.

Attention: EmuNAND and SysNAND environments are different. You will lose your save progress if you start playing in one environment and launch your game in the other one later. The game will reset your save file and you will have to start a new game. This also apply to all games bundled with System update 6.0.0+

How do I play The Legend of Zelda: A Link Between Worlds?

ROM: Zelda: ALBW works with and without emuNAND using Gateway 2.0b1 or 3DSLink 3.0. If you play on EmuNAND, you don't need to update it.

Cartridge: To play the retail Zelda: ALBW, you need EmuNAND Classic 6.2.0 or higher.

Attention: EmuNAND and SysNAND environments are different. You will lose your save progress if you start playing in one environment and launch your game in the other one later. The game will reset your save file and you will have to start a new game. This also apply to all games bundled with System update 6.0.0+

How do I play Animal Crossing: New Leaf?

ROM: The Animal Crossing: New Leaf ROM doesn't work on current flashcarts.

Cartridge: The original game cartridge doesn't need EmuNAND Classic, the game only requires System version 4.5.0, therefore you can play your game on your SysNAND without updating and loosing Flashcart capability.