bf_sysformat.php

<?php
//movable.sed_bak is the movable of the old/source 3ds extracted from a backup or wherever
$fileContentOriginal = file_get_contents('movable.sed');
$keyYOriginal = substr($fileContentOriginal, 0x110, 16);

//id0 of the new system that you want to find keyY for
$targetId0 = "ID0 here";

function getId0($keyY) {
	$sha = hex2bin(hash("sha256", $keyY));
	$checkid0 = bin2hex(strrev(substr($sha, 0, 4)).
	strrev(substr($sha, 4, 4)).
	strrev(substr($sha, 8, 4)).
	strrev(substr($sha, 12, 4)));
	echo $checkid0 . PHP_EOL;
	return $checkid0;
}

$x = 1;
while (true) {
	$currentKeyY = $keyYOriginal;
	$originalMsed3 = unpack('V', substr($keyYOriginal, 12, 4))[1];
	//var_dump(pack('V', $originalMsed2 + $x));die;
	$currentKeyY = substr($keyYOriginal, 0, 12) . pack('V', $originalMsed3 + $x);// . substr($keyYOriginal, 12, 4);
	//var_dump($originalMsed2);die;
	//$currentKeyY[8+$i] = chr($x);
	$id0Result = getId0($currentKeyY);
	if ($id0Result == $targetId0) {
		echo "got a hit keyY = " . bin2hex($currentKeyY);die;
	}
	$x++;
}
	
echo "no hit";