Your shiny brand new 3DS console just arrived, it is on a good FW version, and maybe it's even your first 3DS console ever. Now, one of the biggest fears of new users is accidentialy updating the SysNAND, rendering their 3DS incapable of running exploits needed for homebrew, CFWs or flashcarts. That fear is not completely irrational, judging from the sheer number of "Am I screwed?" threads here. But, don't worry, I'm here to help. I'll explain how FW updates find their ways to your system and how you can be as safe as possible, even if you let someone else access you N3DS console. By now, I assume you know why SysNAND updates are bad and what the difference between SysNAND and EmuNAND is. Let me add to this that updating your FW also hurts its resale value and shouldn't ever be done without consideration., no matter what flashcart you're using now.

This FAQ is for FW version 9.0...9.2, but it should also be applicable to earlier versions and most probably even to later ones. Thanks go to GBAtemp members who provided most of the information in my earlier thread found here.


First of all, calm down!

As a matter of fact, Nintendo will never update the FW of your 3DS console without first asking you (or the current user) for confirmation. No, that thing won't update itself from turning it on, looking at it or accidentially pushing a button on the backside. You are specifically asked, and usually it requires multiple button presses to confirm. Even if somehow you already have the dreaded update nag at system startup, there's a way to get rid of that.

​

So, how can it 'accidentially' be updated then?

Now, Big N does ask for confirmation before updating your precious console, but they absolutely make sure that they do so at every opportunity they get. These are the ways you'll may get asked to update your 3DS:

• Automatic Download: if you leave your 3DS connected to a WiFi hotspot and put it in standby, the update will be downloaded, but not installed. This will lead to the dreaded update nag at startup.
• Internet enabled system apps: before using the eShop you are asked to do a system update. You're not even able to use it unless you are on the most recent update. Before you da a system transfer (from old to new 3DS), you are also asked to do an update on both consoles. This applies to other system apps as well, especially those that require internet.
• Retail cartridges: Each and every retail cartridge comes with their own system update on the cart. If you're below the update provided on the cart, you're asked to update.
• Manual updating: of course you can also update manually from the configuration menu.

Given these possibilities to update your 3DS FW, the most common ways 3DS consoles are 'accidentially' updated are the following:

1. Others (children, f.e.) using your 3DS and being impatient / updating deliberately / fiddling around with stuff they don't know about.
2. You not paying attention and confirming something you shouldn't have confirmed.
3. You being uninformed and doing it deliberately / without knowing what you're doing.

The following paragraphs will show you how to minimize the risk from 1. and 2. As for 3., you're already reading this, so you're also working on reducing the risk from that. 2. very often comes from users actually wanting to update their EmuNAND, but I'll have you covered on this as well.


Enough of that, tell me how to prevent updates!

The basic strategy of preventing unwanted SysNAND updates is not to be asked to do an update in the first place. To achieve that, there are several strategies, some of which might seem to be overkill to you. You don't need to follow all of these strategies and, depending on how you want to use your 3DS, you may also not want to follow all of them. In fact, some of these strategies may even borderline on paranoia. So, just pick the strategies you want to use. Anyways, without further ado, here's the list, sorted roughly by protection factor:

• Don't ever confirm anything update related - That should go without saying, but don't ever confirm anything that wants to update your system. No, that update is not only for the eShop. No, that update doesn't only apply to the game you're just playing. In summary, actually read the stuff your 3DS shows you and react accordingly.
• Don't confirm the Nintendo Network license agreement - this has to be confirmed once and, until confirmed, turns up everytime you try something internet related. Simply put, don't confirm it, and you should be perfectly safe. This will mean you will be excluded from most internet / wireless related stuff. It will also keep you from access to the Cubic Ninja exploit, so it may be not for you.
• Leave the wireless setting off at all times - this is found in the upper left at the home screen. Turn it off once and leave it that way, and you're completely safe from internet updates.
• Don't use standby - turn it completely off at all times. If WiFi is enabled, your console will try to download a local update and nag you to update every time you turn it on. Take note that this and the above will also disable Streetpass functionality.
• ... or alternative to the above, use EmuNAND. Just make sure you don't get back to SysNAND without noticing. Also know that standby, especially in conjunction with WiFi will drain your battery.
• If you have the update nag, get rid of it as fast as possible - it is easy to do.
• Use the TubeHax DNS on all your Wifi connections. This will block updates, but also leave the Youtube app defunct, Instructions, directly from @smealum: "On your 3DS, open the System Settings app, then go to Internet Settings and Connection Settings. From there, select your favorite Connection, tap the Change Settings button, and on the second page head over to the DNS section. Once there, select "No" for "Auto-obtain DNS", and under Detailed Setup, enter the following address : 107.211.140.065."
• Leave the three WiFi slots empty or fill them with fake data - Be aware that the 3DS will connect to some Nintendo partners hotspots without asking, even if you did fill all slots with fake data. So, this on itself is not enough protection. Such hotspots are, for example, found in McDonald's Restaurants. Filling with fake data (vs. leaving empty) is recommended if you use an EmuNAND alongside your SysNAND.
• Remove system updates from game backups - you may use romtool to do so. This can also do regular trimming and by removing the update you'll get even smaller files. More safety plus space for free, yay! Actually, scratch that. The Sky3DS won't load these roms anymore and the Gateway has protection inbuilt anyways. If you want to save space and own a Gateway, go ahead of course.
• (Instead of the above) be extra careful when running recent retail cartridges and / or game backups - they may contain unwanted update data, and you will be asked every time you start them up.
• Organize your start menu - move the stuff that may ask you for a license agreement or a system update such as the eShop, system settings or Miiverse out of sight and into a folder. Name this folder something boring, so your kids / friends won't take extra interest in it.
• Block access to Nintendo updates via Firewall / personal DNS server / Router - that is for experienced users wanting to play online. It will only help you in your own Wifi network and it might be a bit difficult to set up. I made a tutorial for setting up such a hotspot using stuff almost everyone owns. There are also other tutorials, using various other hardware on this site.
• Use parental control to limit access to stuff - No, this won't actually block system updates, but you can limit access to internet enabled stuff, which will in fact reduce the risk, especially if you let others play. You should especially block access to internet settings. Note that this is a thin layer of protection at best.
• Disable Spotpass - the setting is found in internet settings. Turn it off and leave it that way. It's not completely sure that this will do anything to prevent the automatic update download, though.
  
• Create a backup of your SysNAND if you have the possibility - you'll need a Gateway card for that, and this backup is really your last resort solution, as restoring it will require a NAND hardmod to your 3DS console (will additionally void your warranty).

In short, you shouldn't ever use your SysNAND to access the internet. Take a pass on wireless functionality (yes, that includes Streetpass) or get a Gateway and do everything wireless related on EmuNAND. If you must use internet and don't have access to EmuNAND, at least don't use standby, and enable WiFi only when needed.


So, how to safely update my EmuNAND?

As I wrote earlier, people sometimes accidentially update their SysNAND when they actually wanted to update their EmuNAND. About how to actually set up and unlink your GW / EmuNAND you'll need to find out somewhere, but on the update process I'll have you covered.

• Update the EmuNAND from system settings only - yes, by now the GW has some very good security measures of it's own in place, and updates of the EmuNAND may work from anywhere, but I suggest you still heed my advice. Only update from Other Settings -> System Updates. Before doing so, make sure it says 'GW3D' in front of the version number, which is found at the bottom left of the top screen in settings. Don't exit settings after checking the version number. Only exit after updating.
• Make sure EmuNAND ist still compatible with the new FW version beforehand. If the new FW version is pretty new, chances are it is not. The friendly folks at GBAtemp will keep you updated and you may also check the Gateway site.
• Not required, but helpful: Use different themes for EmuNAND and SysNAND. That way you'll always have a visual reminder of which system you are currently in.
• An additional hint from @Wekker: Set different times / dates for EmuNAND and SysNAND. This way you have another way of telling you're on the right /wrong system when updating.

There's also a good guide on MaxConsole. Some of it may be outdated by now, though.


But I need / want to access the internet...

In that case, you of course don't have any other choice but to actually accept the Nintendo Network license agreement. There are still ways to be safe, though. Use a FW update blocking connection such as the one I described here. Use parental controls to make sure no one accesses hotspots other than the ones you defined. Try to avoid standby and disable wireless connections if you are not using them.


But, I actually want to update my SysNAND (and I know what I'm doing)

But only up to a specific version, I take it? Online, you may only upgrade to the latest version. Rent / borrow a retail cart that has the update you want and update from there. Or, you may also use a Sky3DS to do this, but don't try it via Gateway. You may find out which cartridge / backup you want from this list. If you actually meant you still want to upgrade to the latest version, then, why are you reading this in the first place?

 

[MelonGx]

• Leave the three WiFi slots empty or fill them with fake data - Be aware that the 3DS will connect to some Nintendo partners hotspots without asking, even if you did fill all slots with fake data. So, this on itself is not enough protection. Such hotspots are, for example, found in McDonald's Restaurants. Filling with fake data (vs. leaving empty) is recommended if you use an EmuNAND alongside your SysNAND.

I always teach people to set an mobile AP with "attwifi / NZ@McD1" SSID to affect those 3-fake-slot 3DS users intentionally HA HA HA!!!!!!!!!

 

[viral777]

does the tubehax dns still work? I wanna play Monster Hunter X online, but don't want to risk downloading an update.

 

[Wekker]

...

I wish you could add the following statement.
Set your current date time in the date time setting for emuNAND.
Set wrong (obviously for you to see that the date time is off) date time in the date time setting for sysNAND.
With the both instruction above, the user can use the date time to identify whenever the console is in which NAND. That is the only identification in the update screen with the final button press for updating the console.

 

[d0k3]

I wish you could add the following statement.
Set your current date time in the date time setting for emuNAND.
Set wrong (obviously for you to see that the date time is off) date time in the date time setting for sysNAND.
With the both instruction above, the user can use the date time to identify whenever the console is in which NAND. That is the only identification in the update screen with the final button press for updating the console.

Does that really work? The internal clock is a hardware component, meaning that any changes to it should affect both, EmuNAND and SysNAND.

 

[Wekker]

Does that really work? The internal clock is a hardware component, meaning that any changes to it should affect both, EmuNAND and SysNAND.

I have different date time in my sysNAND and emuNAND.
Before a update i always check the theme i have in emuNAND (in sysNand i don't have theme),
then i check the GW symbol in the setting menu, after that i check the date time before i press the final button.

EDIT: My emuNand and sysNAND is unlinked if that matters. Although i had all ready different date time before i had unlinked the NANDs.

EDIT: My sysNAND has wrong date time. That means i will abort the update when i see that the date time is not the current date time. Which is the final check for me.

 

[ChrisCurious]

The Tubehax DNS won't work, at least for me - I got the update with 107.211.140.065 as my primary and secondary DNS on my home connection.

N3DS 10.3 Sysnand