Make a clean dump of a 3DS PANDA

dump_3ds_panda.md

Dumping 3DS PANDA NAND

What you need

• A ntrboot compatible flashcart
• A magnet that triggers the sleep mode of your PANDA (if using a folding style 3DS)
• An already hacked retail 3DS (with Luma3DS)
• A 3DS PANDA
  • Insert a new SD card into the PANDA (in case deleted data could be recovered by imaging the SD card the PANDA came with)
• The latest release of ntrboot_flasher (download the ntrboot_flasher.firm)
• The latest release of GodMode9 (download the GodMode9-(version)-(date).zip)
• Dev-signed GodMode9 (this build has a more complete aeskeydb; files are renamed since the flasher looks for boot9strap-named files)
  • https://cdn.randommeaninglesscharacters.com/gm9_dev/boot9strap_ntr_dev.firm
  • https://cdn.randommeaninglesscharacters.com/gm9_dev/boot9strap_ntr_dev.firm.sha

Section I - Prep Work

1. Power off the retail 3DS
2. Insert the retail 3DS's SD card into your computer
3. Create a folder named ntrboot on the root of the SD card
4. Copy boot9strap_ntr_dev.firm and boot9strap_ntr_dev.firm.sha to the /ntrboot/ folder on the SD card
5. Copy ntrboot_flasher.firm to the /luma/payloads/ folder on the SD card
6. Reinsert the SD card back into the retail 3DS
7. Insert your ntrboot compatible DS / DSi flashcart into the retail 3DS

Section II - Flashing dev-signed godmode9 ntrboot to the flashcart

1. Launch the Luma3DS chainloader by holding (Start) during boot on the retail 3DS
2. Select “ntrboot_flasher”
3. Read the red screen warning
4. Press (A) to continue
5. Select your flashcart
   • If you do not see your flashcart in the list at the top, read the bottom screen for more info on each option
6. Select “Dump Flash”
7. Wait until the process is completed
8. Press (A) to continue
9. Press (A) to return to the main menu
10. Select “Inject Ntrboot”
11. Press (Y) for developer unit ntrboot
12. Wait until the process is completed
13. Press (A) to return to the main menu
14. Press (B) to power off the retail 3DS

Section III - ntrboot

1. Use the magnet to find the spot on the PANDA where the sleep sensor is triggered
   • This step is not needed on the old 2DS (which has a sleep mode switch)
2. Power off the PANDA
3. Insert the PANDA's SD card into your computer
4. Copy the gm9 folder from GodMode9-(version)-(date).zip to the root of the SD card
5. Reinsert the SD card back into the PANDA
6. Insert your flashcart into the PANDA
7. Place the magnet on the PANDA to trigger the sleep sensor
   • On old 2DS, you should instead enable the sleep mode switch
8. Hold (Start) + (Select) + (X) + (Power) for several seconds, then release the buttons
   • It may take a few attempts to get this to work because the positioning is awkward
9. If the exploit was successful, you will have booted into GodMode9

Section IV - Dumping NAND

1. Press (Home) to bring up the action menu
2. Select “Scripts…”
3. Select “GM9Megascript”
4. Select “Backup Options”
5. Select “SysNAND Backup”
6. Press (A) to confirm
   • This process will take some time
7. Press (A) to continue
8. Press (B) to return to the main menu
9. Select “Exit”
10. Press (A) to relock write permissions if prompted
11. Navigate to [S:] SYSNAND VIRTUAL
12. See if essential.exefs shows up; if it does, press (A) to select it, select “Copy to 0:/gm9/out”, and press (A) to continue
13. Navigate to [M:] MEMORY VIRTUAL
14. Press (A) on the following files, select “Copy to 0:/gm9/out”, and press (A) to continue
    • otp.mem, otp_dec.mem (if it shows up) and nvram.mem
    • If there is no essential.exefs in [S:] SYSNAND VIRTUAL, copy nand_cid.mem as well
15. Press (Home) to bring up the action menu
16. Select “Poweroff system” to power off the PANDA
17. Insert the SD card into your computer
18. Copy <date>_<serialnumber>_sysnand_##.bin, <date>_<serialnumber>_sysnand_##.bin.sha, essential.exefs, otp.mem, otp_dec.mem, nvram.mem and nand_cid.mem from the /gm9/out/ folder on the SD card to a safe location on your computer

Section V - Removing ntrboot from the flashcart

1. Insert the SD card from the retail 3DS into your computer
2. Copy the .bin file from your flashrom backup to the /ntrboot/ folder on the root of the SD card
3. Insert your ntrboot compatible DS / DSi flashcart into the retail 3DS
4. Launch ntrboot_flasher by holding (Start) during boot
5. Read the red screen warning
6. Press (A) to continue
7. Select your flashcart
   • If you do not see your flashcart in the list at the top, read the bottom screen for more info on each option
8. Select “Restore Flash”
9. Press (A) to proceed
10. Wait until the process is completed
11. Press (A) to return to the main menu
12. Press (B) to power off the retail 3DS