This little script is used to get the movable.sed if you have previously transfered LFCS_B from another system and did a system format afterwards.

bruteforce_movable_after_format.php

<?php

//movable.sed_bak is the movable of the old/donor 3ds extracted from a backup or wherever
$fileContentOriginal = file_get_contents('movable.sed_bak');
$keyYOriginal = substr($fileContentOriginal, 0x110, 16);

//movable.sed is the movable.sed_bak from the old/donor 3ds with the LFCS changed to the new dumped one
$fileContentNewLFCS = file_get_contents('movable.sed');
$keyYNewLFCS = substr($fileContentNewLFCS, 0x110, 16);

//id0 of the new system that you want to find keyY for
$targetId0 = "addf05abd438385ea403b721cb770f2f";

function getId0($keyY) {
	$sha = hex2bin(hash("sha256", $keyY));
	$checkid0 = bin2hex(strrev(substr($sha, 0, 4)).
	strrev(substr($sha, 4, 4)).
	strrev(substr($sha, 8, 4)).
	strrev(substr($sha, 12, 4)));
	return $checkid0;
}

for ($i = 0; $i < 8; $i++) {
	for ($x = 0; $x < 150; $x++) {
		$currentKeyY = $keyYOriginal;
		
		$currentKeyY[8+$i] = chr(ord($currentKeyY[8+$i]) + $x);
		$id0Result = getId0($currentKeyY);
		if ($id0Result == $targetId0) {
			echo "got a hit keyY = " . bin2hex($currentKeyY);die;
		}
	}
}
	

for ($i = 0; $i < 8; $i++) {
	for ($x = 0; $x < 150; $x++) {
		$currentKeyY = $keyYNewLFCS;
		
		$currentKeyY[8+$i] = chr(ord($currentKeyY[8+$i]) + $x);
		$id0Result = getId0($currentKeyY);
		if ($id0Result == $targetId0) {
			echo "got a hit keyY = " . bin2hex($currentKeyY);die;
		}
	}
}
echo "no hit";