Hacking old 3ds bricked unable to mount ctrnand or ctrnand firm please use a external one

[matthewsmith]

1. Backup your currently bricked SysNAND (for safety).
   • GodMode9 Usage - Creating a NAND Backup
2. Attempt firmware repair with CTRTransfer (Type D9).

will this work considering the sd card is wiped ans missing the essitnal file you have mentioned

 

[matthewsmith]

1. Backup your currently bricked SysNAND (for safety).
   • GodMode9 Usage - Creating a NAND Backup
2. Attempt firmware repair with CTRTransfer (Type D9).

3ds now gives this error after attempting ctrtransfer type d9

 

[TurdPooCharger]

3ds now gives this error after attempting ctrtransfer type d9

Good, this narrows our search.

Here are others whose firmware were still bricked with an ARM9 error after using CTRTransfer (Type D9).

• n00b help from pretty much square one [post #15]
• "prefetch abort (svcbreak) processor ARM9" after CTRTransfer [post #25]
• An exception occurred: Arm 9, Prefetch Abort (SvcBreak) on boot. [post #21]

You will need to examine certain NAND files and find which of those are bad or missing. See the:

• Reference Diagram for NAND files
• Example bad NAND files.
• Warning about publicly posting or sharing images of those files.
• Using the Godmode9 built-in hex editor and HxD on Windows.

***

[0:] SDCARD ()/gm9/out/######_XX#######_sysnand ctrnand_000/

private/

movable.sed​

ro/

sys/

HWCAL0.DAt
HWCAL1.DAt​

rw/

sys/
LocalFriendCodeSeed_B
SecureInfo_A | SecureInfo_B | (There should only be one SecureInfo. Please point out if there are multiple: A, B, C. etc.)​

***

[1:] SYSNAND CTRNAND
(The file structure should mirror the above)

***

[S:] SYSNAND VIRTUAL/essential.exefs → Mount as EXEFS image
[G:] EXEFS GAME IMAGE

frndseed
hwcal0
hwcal1
movable
.
.
.
secinfo
​

 

[matthewsmith]

Good, this narrows our search.

Here are others whose firmware were still bricked with an ARM9 error after using CTRTransfer (Type D9).

• n00b help from pretty much square one [post #15]
• "prefetch abort (svcbreak) processor ARM9" after CTRTransfer [post #25]
• An exception occurred: Arm 9, Prefetch Abort (SvcBreak) on boot. [post #21]

You will need to examine certain NAND files and find which of those are bad or missing. See the:

• Reference Diagram for NAND files
• Example bad NAND files.
• Warning about publicly posting or sharing images of those files.
• Using the Godmode9 built-in hex editor and HxD on Windows.

***

[0:] SDCARD ()/gm9/out/######_XX#######_sysnand ctrnand_000/

private/

movable.sed​

ro/

sys/

HWCAL0.DAt
HWCAL1.DAt​

rw/

sys/
LocalFriendCodeSeed_B
SecureInfo_A | SecureInfo_B | (There should only be one SecureInfo. Please point out if there are multiple: A, B, C. etc.)​

***

[1:] SYSNAND CTRNAND
(The file structure should mirror the above)

***

[S:] SYSNAND VIRTUAL/essential.exefs → Mount as EXEFS image
[G:] EXEFS GAME IMAGE

frndseed
hwcal0
hwcal1
movable
.
.
.
secinfo
​

the error is a data abort thou not a prefetch abort

--------------------- MERGED ---------------------------

Good, this narrows our search.

Here are others whose firmware were still bricked with an ARM9 error after using CTRTransfer (Type D9).

• n00b help from pretty much square one [post #15]
• "prefetch abort (svcbreak) processor ARM9" after CTRTransfer [post #25]
• An exception occurred: Arm 9, Prefetch Abort (SvcBreak) on boot. [post #21]

You will need to examine certain NAND files and find which of those are bad or missing. See the:

• Reference Diagram for NAND files
• Example bad NAND files.
• Warning about publicly posting or sharing images of those files.
• Using the Godmode9 built-in hex editor and HxD on Windows.

***

[0:] SDCARD ()/gm9/out/######_XX#######_sysnand ctrnand_000/

private/

movable.sed​

ro/

sys/

HWCAL0.DAt
HWCAL1.DAt​

rw/

sys/
LocalFriendCodeSeed_B
SecureInfo_A | SecureInfo_B | (There should only be one SecureInfo. Please point out if there are multiple: A, B, C. etc.)​

***

[1:] SYSNAND CTRNAND
(The file structure should mirror the above)

***

[S:] SYSNAND VIRTUAL/essential.exefs → Mount as EXEFS image
[G:] EXEFS GAME IMAGE

frndseed
hwcal0
hwcal1
movable
.
.
.
secinfo
​

my under standing is the data abort and prefetch abort mean diffrent things entirely pardon my lack of knowledge on this im quite noobish in trying to understand

 

[TurdPooCharger]

the error is a data abort thou not a prefetch abort

my under standing is the data abort and prefetch abort mean diffrent things entirely pardon my lack of knowledge on this im quite noobish in trying to understand

The firmware could be fixed but Luma3DS fails to boot to HOME Menu due to uncleared memory in the RAM. See if the battery trick changes anything.

 

[matthewsmith]

The firmware could be fixed but Luma3DS fails to boot to HOME Menu due to uncleared memory in the RAM. See if the battery trick changes anything.

it did not fix the issue

--------------------- MERGED ---------------------------

The firmware could be fixed but Luma3DS fails to boot to HOME Menu due to uncleared memory in the RAM. See if the battery trick changes anything.

would pming u a dump of the error help at all ?

 

[TurdPooCharger]

it did not fix the issue

would pming u a dump of the error help at all ?

I don't know how to interpret ARM disassembly code. I'm familiar with recognizing a handful of Luma error messages and what they might be caused by.

Have you ever used hex editor or viewer?

Edit - Check if you have CTRNAND Luma3DS installed.

1. GodMode9 → [1:] SYSNAND CTRNAND/boot.firm
2. Press (A) on boot.firm → Calculate SHA-256
   • Luma3DS v9.1 = 21A50466C73AA2BF255A167424586AED456E970E3AC69EBB0A930ABD9075B31B
     
   • Luma3DS v10.0.1= 9C5D6C9C299F344B166B3333C94078F900FBE290BC1FCA2992BCC7A16E7E0569

If there is Luma3DS on CTRNAND,

3. Turn off the 3DS, remove the SD card and any game cart/flashcart, and try booting to HOME Menu.​

 

[matthewsmith]

I don't know how to interpret ARM disassembly code. I'm familiar with recognizing a handful of Luma error messages and what they might be caused by.

Have you ever used hex editor or viewer?

no i have not but i checked the nand to make sure everything was there this error only started due to any ctrtransfer failing at ticket.db would taking a ticket.db from another system fix this error

--------------------- MERGED ---------------------------

no i have not but i checked the nand to make sure everything was there this error only started due to any ctrtransfer failing at ticket.db would taking a ticket.db from another system fix this error

well ticket.db and a few others even ur method failed there

 

[matthewsmith]

I don't know how to interpret ARM disassembly code. I'm familiar with recognizing a handful of Luma error messages and what they might be caused by.

Have you ever used hex editor or viewer?

Edit - Check if you have CTRNAND Luma3DS installed.

1. GodMode9 → [1:] SYSNAND CTRNAND/boot.firm
2. Press (A) on boot.firm → Calculate SHA-256
   • Luma3DS v9.1 = 21A50466C73AA2BF255A167424586AED456E970E3AC69EBB0A930ABD9075B31B
     
   • Luma3DS v10.0.1= 9C5D6C9C299F344B166B3333C94078F900FBE290BC1FCA2992BCC7A16E7E0569

If there is Luma3DS on CTRNAND,

3. Turn off the 3DS, remove the SD card and any game cart/flashcart, and try booting to HOME Menu.​

here is the sha for the boot.firm and every time i boot sd card in or not i get the same arm 9 error

 

[TurdPooCharger]

no i have not but i checked the nand to make sure everything was there this error only started due to any ctrtransfer failing at ticket.db would taking a ticket.db from another system fix this error

well ticket.db and a few others even ur method failed there

You can't just check if the files are simply there. They have to be hex examined to find which of your files are corrupt or don't resemble the ones like in the example diagrams.

While ticket.db is important to have in terms of having collection of titles being recognized on HOME Menu, the 3DS firmware is ruggit enough to boot to HOME Menu even when the ticket.db has been deleted (aka, ALL tickets including system ones are missing).

Only a hand of files are needed in order for working NATIVE_FIRM.

• An intact set of title.db & import.db paired to title folder.
  
• SecureInfo_A|B that matches firmware region to the above.
  • A bad copy of this file will not work. A borrowed copy from another, incompatible 2DS/3DS system will also not work.
• If the movable.sed is missing, the 3DS will default on using a backup 0x30 KeyY from the otp.bin.
  • However, having a bad copy inplace with the wrong format (ie, missing SEED header, etc) will not work.
• HWCAL0.DAt and HWCAL1.DAt are not necessarily needed, but missing or having blank copies will throw off screen calibrations.
• LocalFriendCodeSeed_B is not necessarily needed, but missing this or having a false copy will not allow access to Nintendo online play services.

 

[matthewsmith]

You can't just check if the files are simply there. They have to be hex examined to find which of your files are corrupt or don't resemble the ones like in the example diagrams.

While ticket.db is important to have in terms of having collection of titles being recognized on HOME Menu, the 3DS firmware is ruggit enough to boot to HOME Menu even when the ticket.db has been deleted (aka, ALL tickets including system ones are missing).

Only a hand of files are needed in order for working NATIVE_FIRM.

• An intact set of title.db & import.db paired to title folder.
  
• SecureInfo_A|B that matches firmware region to the above.
  • A bad copy of this file will not work. A borrowed copy from another, incompatible 2DS/3DS system will also not work.
• If the movable.sed is missing, the 3DS will default on using a backup 0x30 KeyY from the otp.bin.
  • However, having a bad copy inplace with the wrong format (ie, missing SEED header, etc) will not work.
• HWCAL0.DAt and HWCAL1.DAt are not necessarily needed, but missing or having blank copies will throw off screen calibrations.
• LocalFriendCodeSeed_B is not necessarily needed, but missing this or having a false copy will not allow access to Nintendo online play services.

title.db and import.db were among the errors that the ctr transfer threw up as missing

 

[TurdPooCharger]

here is the sha for the boot.firm and every time i boot sd card in or not i get the same arm 9 error

100477BA2BD88D3F6DD3FF2B5A4730A958C943BDA83A749E4F10BCD1DC4EB26A
is the SHA-256 for Luma3DS v8.1.1

You have outdated custom firmware. At some point, you will need to do both Updating B9S and Finalizing Setup.

• boot9strap v1.3
• Luma3DS v10.0.1 (or v9.1) on both SD card and CTRNAND.
  • Use v9.1 if you experience this bug:
    • Very old 3DS firmware versions and Luma
• GodMode9 v1.8.0 (or 1.7.1) [preferably] on both SD card and CTRAND.
  • Use v1.7.1 if you experience this bug -or- add another FIRM payload to sdmc:/luma/payloads
    • GodMode9 v1.8.0 boot issues with Luma 3DS chainloader

title.db and import.db were among the errors that the ctr transfer threw up as missing

If you used the CTRTransfer (Type D9) with a donor CTRNAND image sourced at [3ds.hacks.guide] CTRTransfer, the script would have replaced the title.db, import.db, and title folder.

***

There is a way to debug your firmware on another like-new/old series 3DS/2DS system. If you're interested in doing something like that, PM me for more details.

 

[matthewsmith]

100477BA2BD88D3F6DD3FF2B5A4730A958C943BDA83A749E4F10BCD1DC4EB26A
is the SHA-256 for Luma3DS v8.1.1

You have outdated custom firmware. At some point, you will need to do both Updating B9S and Finalizing Setup.

• boot9strap v1.3
• Luma3DS v10.0.1 (or v9.1) on both SD card and CTRNAND.
  • Use v9.1 if you experience this bug:
    • Very old 3DS firmware versions and Luma
• GodMode9 v1.8.0 (or 1.7.1) [preferably] on both SD card and CTRAND.
  • Use v1.7.1 if you experience this bug -or- add another FIRM payload to sdmc:/luma/payloads
    • GodMode9 v1.8.0 boot issues with Luma 3DS chainloader

If you used the CTRTransfer (Type D9) with a donor CTRNAND image sourced at [3ds.hacks.guide] CTRTransfer, the script would have replaced the title.db, import.db, and title folder.

like i said this 3ds was inactive for a while how does one update luma without access to the luma 3ds updater

--------------------- MERGED ---------------------------

like i said this 3ds was inactive for a while how does one update luma without access to the luma 3ds updater

and more over since the guide calls for the homebrew menu how am i supposed to update either since i cannot get the 3ds to boot

 

[TurdPooCharger]

like i said this 3ds was inactive for a while how does one update luma without access to the luma 3ds updater

You update Luma3DS on the SD card by simply replacing the sdmc:/boot.firm

There is a GM9Megascript included in recent releases of GodMode9 that handles setting up CTRNAND Luma3DS.

Or, if you want to update CTRNAND Luma3DS manually, see instructions:

• Luma only loads from SysNand [post #2]

To update boot9strap on both FIRM0 and FIRM1, either use the SafeB9SInstaller method, or if you're comfortable enough doing this manually:

1. GodMode9 → press (A) on boot9strap.firm → FIRM image options... → Install FIRM → Install to both
   • You may want to first verify that the FIRM is correct using the Calculate SHA-256.
     
   • [version 1.3 | SHA-256: 79C68585B4BA1D7C4A91B858861553E768C6576B92E303810B33219736B3598B | size: 30 KB]

 

[matthewsmith]

You update Luma3DS on the SD card by simply replacing the sdmc:/boot.firm

There is a GM9Megascript included in recent releases of GodMode9 that handles setting up CTRNAND Luma3DS.

Or, if you want to update CTRNAND Luma3DS manually, see instructions:

• Luma only loads from SysNand [post #2]

will it boot with the older version of b9s

 

[TurdPooCharger]

will it boot with the older version of b9s

I edited my above post about how to update boot9strap.

Now, while it's best to have the custom firmware up-to-date regardless of the state of the 3DS firmware, you will probably still have the ARM9 data boot error after updating B9S, Luma, GM9.

* Keep in mind that the custom firmware is not the 3DS firmware. They're separate entities.

Unless you previously made or have a clean SysNAND *.bin image before the initial brick, hex examining the NAND files in [1:] SYSNAND CTRNAND will be required when CTRTransfer options fail.

 

[TurdPooCharger]

Follow-up post.

After getting in contact with @matthewsmith, he 1-day shipped his o3DSXL over for me to take a look. Upon receiving the package, I was greeted with a very immaculate Persona Q edition. It was so fresh looking, one could have sworn it was brand new. Because I didn't want to risk accidentally denting or scratching his system, I minimized handling it by dumping the ctrnand_full.bin, twln.bin, twlp.bin, and essential.exefs and offload troubleshooting its firmware on my o2DS.

After flashing the three (3) BIN nand images to the o2DS and CMAC correcting the [1:] SYSNAND CTRNAND, I could not understand at first glance why his 3DS firmware was softbricked with an ARM9 (data abort) error.

Hex examining the various CTRNAND files (HWCAL0 / HWCAL1 / DB / movable / SecureInfo / LFCS_B / etc) revealed nothing out of the ordinary. Everything was where and what they should be, yet why did the CTRTransfer (Type D9) fail?


Apparently, the previous owner who last possessed this beauty and sold it to matt, decided to delete everything off the CTRNAND, TWLN, and TWLP drives. What a real asshole thing to do.

This is what the TWLNAND drive should typically include:

[2:] SYSNAND TWLN

• BOLD = folder | Courier New = file | <blank> = empty

import/

<blank>​

progress/

<blank>​

shared1/

<blank>​

shared2/

0000​

sys/

log/

inspect.log
inspect.log~ | Exact copy of inspect.log
product.log
product.log~ | Exact copy of product.log​

TWLFontTable.dat​

ticket/

<blank>​

title/

0003000f/

.
.​

00030004/

.
.​

tmp/

es/

write/

<blank>​

opera.ini​

******

For the TWLPHOTO drive, it should be like this:

• [3:] SYSNAND TWLP/photo/private/ds/app/484E494A/pit.bin

Only found when images are added,

• [3:] SYSNAND TWLP/photo/DCIM/101NIN02/
  • HNI_0001.JPG
  • HNI_0002.JPG

.
.​

******

About the ARM9 (data abort) error

1. When the shared2 folder is missing, the 3DS will refuse to boot to HOME Menu.
2. The 3DS firmware does not regenerate missing folders in the TWLN and TWLP.
   
3. However, if the shared2 folder is present but the 0000 within it is missing, the 3DS will make a replacement 0000.
4. Any file named as 0000 will allow the 3DS to boot... This includes fake, garbage made, and corrupt 0000.
5. [3dbrew.org] Twln/shared2/0000

With those above points kept in mind, CTRTransfer options cannot fix this ARM9 brick because (understandably) they only focus repairing the CTRNAND.

******

Most of the files found in those two TWL partitions are replaceable, except for the console unique LOG files: inspect.log and product.log
Luckily for this o3DSXL, despite everything being deleted, I was able to retrieve these with the image mounting + data recovery program IsoBuster Pro.


Firmware repair went without a hitch:

1. Rebuilt the TWL partitions with the LOG files, TWLFontTable.dat, and reinstalled five (5) TWL system titles: [ TWL_FIRM | Nintendo DS Cart Whitelist | TWL Version Data | DS Download Play | DS Internet ]
   
2. (Offline) updated the 3DS firmware to 11.10.0-43U using SysUpdater + CIAs system titles.
3. Dumped the fixed three (3) BIN nand images, reflashed them back to the o3DSXL with CMAC correction, checked for functionality, deleted the dummy made 1:/data user profile, and shipped back the o3DSXL to matt.

******

About repairing the DS(i) mode.
The next version of CTRTransfer (Type D9) script will include replacing certain folders and files in the TWLN and TWLP drives when they're missing or found to be bad:

• For the TWLN, this include the folders: import, shared1, shared2, and ticket.
  • (Not included) The 3DS creates title when DSiWare games are installed and tmp when the DS Internet is used.
• The file found in shared2: 0000
  • The replacement would be a generic / blank / empty 2.00 MB FAT12 partition image.
• For the TWLP, a (blank) copy of pit.bin
  • This file's purpose is to keep track of all the JPG pictures installed in 101NIN02.

What the script can't replace are the two LOG files (and their ~ copies). It is up to the end user to recovery said files using data recovery software like with the previously mentioned IsoBuster. If you decide to seek a copy of that program on the vast Internet, look for the portable versions.

Even with everything else fixed, there is one other thing to look out for. Certain DSiWare games will refuse to work if the TWLFontTable.dat is missing. When launched without this file, the game gets stuck at white screens.

Spoiler: Missing font table = white screens

Because this is a copyright material, this is also up to the end user to find the file on their own. The TWLFontTable.dat is the same for every 3DS and DSi system with the following size/hash(es).

• Size: 863296 bytes | 843 KB | 0xD2C40 bytes
• CRC32: F1953B32
• SHA256: 2833D4BBA599D5559E482C735F24682CCD44C375BA2940D1206CE85B7A0DD7E4
• MD5: EE83C579E9E69F94CC8317BD66533A36

 

[kanyf]

hello I've the same problem but I can't find the inspect log and product log, maybe some know how can I fix it without .

 

[Deleted User]

Those files are not necessary.