2016-12-13 05:30:44 +01:00
---
title: "DSiWare Downgrade (Save Injection)"
permalink: /dsiware-downgrade-(save-injection).html
2017-01-07 19:05:43 +01:00
lang: en_US
2017-01-07 17:14:44 +01:00
ref: dsiware-downgrade-(save-injection)
2016-12-13 05:30:44 +01:00
---
2017-01-03 00:47:55 +01:00
If you are on version 11.0.0 or 11.1.0, you must follow this guide to downgrade your NATIVE_FIRM using DSiWare
2016-12-13 05:30:44 +01:00
{: .notice}
This takes advantage of an oversight which allows DSiWare titles to read and write anywhere in NAND.
{: .notice--info}
Be prepared to wait 20 minutes (New 3DS) to an hour (Old 3DS). Slowhax (waithax) is named so for a reason.
{: .notice--info}
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
{: .notice--info}
Your DSiWare's save will be backed up before getting replaced by the hacked save.
{: .notice--info}
#### What you need
2016-12-15 03:40:41 +01:00
* Already own (and install) one of the following exploitable DSiWare games installed on your 3DS *(you must have already installed one; they have all been pulled from the eShop)*
2016-12-13 05:30:44 +01:00
+ **Fieldrunners**
+ **Legends of Exidia**
+ **Guitar Rock Tour**
2016-12-13 21:21:30 +01:00
+ **The Legend of Zelda: Four Swords (Anniversary Edition)**
2016-12-30 06:59:36 +01:00
* An entrypoint from [Homebrew Launcher (SoundHax)](homebrew-launcher-(soundhax)) or [Homebrew Launcher (No Browser)](homebrew-launcher-(no-browser))
2016-12-13 07:16:32 +01:00
* [`4B51394A.zip`](images/4B51394A.zip)
2016-12-13 05:30:44 +01:00
* The latest release of [3ds_dsiwarehax_installer](https://github.com/yellows8/3ds_dsiwarehax_installer/releases/latest)
* The latest release of [waithax](https://github.com/Mrrraou/waithax/releases/latest)
* The latest release of [3DSident](https://github.com/joel16/3DSident/releases/latest)
* The latest release of [dgTool](https://github.com/Plailect/dgTool/releases/latest)
2016-12-14 19:24:15 +01:00
* The Homebrew [Starter Kit](http://smealum.github.io/ninjhax2/starter.zip)
2016-12-13 05:30:44 +01:00
* The NFIRM `.zip` corresponding to the device and version of **the target 3DS**:
2016-12-18 01:15:02 +01:00
+ [New 3DS 11.0.0](magnet:?xt=urn:btih:2d13a5ea1570f911bd5c6423e0c30e51d548837a&dn=11.0.0%5Fto%5F10.4.0%5Fn3ds.zip&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=http%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fzer0day.ch%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969%2Fannounce&tr=http%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2F9.rarbg.com%3A2710%2Fannounce&tr=udp%3A%2F%2Fp4p.arenabg.com%3A1337%2Fannounce&tr=http%3A%2F%2Fp4p.arenabg.com%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.aletorrenty.pl%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker.aletorrenty.pl%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker1.wasabii.com.tw%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.baravik.org%3A6970%2Fannounce&tr=http%3A%2F%2Ftracker.tfile.me%2Fannounce&tr=udp%3A%2F%2Ftorrent.gresille.org%3A80%2Fannounce&tr=http%3A%2F%2Ftorrent.gresille.org%2Fannounce&tr=udp%3A%2F%2Ftracker.yoshi210.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.tiny-vps.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.filetracker.pl%3A8089%2Fannounce)
+ [Old 3DS 11.0.0](magnet:?xt=urn:btih:72393bbd99bc285db84a9cabf39d9b3200058d6a&dn=11.0.0%5Fto%5F10.4.0%5Fo3ds.zip&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=http%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fzer0day.ch%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969%2Fannounce&tr=http%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2F9.rarbg.com%3A2710%2Fannounce&tr=udp%3A%2F%2Fp4p.arenabg.com%3A1337%2Fannounce&tr=http%3A%2F%2Fp4p.arenabg.com%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.aletorrenty.pl%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker.aletorrenty.pl%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker1.wasabii.com.tw%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.baravik.org%3A6970%2Fannounce&tr=http%3A%2F%2Ftracker.tfile.me%2Fannounce&tr=udp%3A%2F%2Ftorrent.gresille.org%3A80%2Fannounce&tr=http%3A%2F%2Ftorrent.gresille.org%2Fannounce&tr=udp%3A%2F%2Ftracker.yoshi210.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.tiny-vps.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.filetracker.pl%3A8089%2Fannounce)
2016-12-13 05:30:44 +01:00
~
2016-12-18 01:15:02 +01:00
+ [New 3DS 11.1.0](magnet:?xt=urn:btih:d7d60c27c18f53bd8508a194656a465f6448bedf&dn=11.1.0%5Fto%5F10.4.0%5Fn3ds.zip&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=http%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fzer0day.ch%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969%2Fannounce&tr=http%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2F9.rarbg.com%3A2710%2Fannounce&tr=udp%3A%2F%2Fp4p.arenabg.com%3A1337%2Fannounce&tr=http%3A%2F%2Fp4p.arenabg.com%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.aletorrenty.pl%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker.aletorrenty.pl%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker1.wasabii.com.tw%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.baravik.org%3A6970%2Fannounce&tr=http%3A%2F%2Ftracker.tfile.me%2Fannounce&tr=udp%3A%2F%2Ftorrent.gresille.org%3A80%2Fannounce&tr=http%3A%2F%2Ftorrent.gresille.org%2Fannounce&tr=udp%3A%2F%2Ftracker.yoshi210.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.tiny-vps.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.filetracker.pl%3A8089%2Fannounce)
+ [Old 3DS 11.1.0](magnet:?xt=urn:btih:0caf9a948a2d8bf23606d641f6628e2baeb983bb&dn=11.1.0%5Fto%5F10.4.0%5Fo3ds.zip&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=http%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fzer0day.ch%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969%2Fannounce&tr=http%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2F9.rarbg.com%3A2710%2Fannounce&tr=udp%3A%2F%2Fp4p.arenabg.com%3A1337%2Fannounce&tr=http%3A%2F%2Fp4p.arenabg.com%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.aletorrenty.pl%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker.aletorrenty.pl%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker1.wasabii.com.tw%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.baravik.org%3A6970%2Fannounce&tr=http%3A%2F%2Ftracker.tfile.me%2Fannounce&tr=udp%3A%2F%2Ftorrent.gresille.org%3A80%2Fannounce&tr=http%3A%2F%2Ftorrent.gresille.org%2Fannounce&tr=udp%3A%2F%2Ftracker.yoshi210.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.tiny-vps.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.filetracker.pl%3A8089%2Fannounce)
2016-12-13 05:30:44 +01:00
#### Instructions
##### Section I - Prep Work
2016-12-14 19:24:15 +01:00
1. Copy _the contents of_ the `starter.zip` to the root of your SD card, replace existing files
+ This will ensure that the Homebrew Launcher is up to date; older versions will freeze when your try to launch 3ds_dsiwarehax_installer
2016-12-13 05:30:44 +01:00
4. Copy and merge the `3ds` folder from the 3ds_dsiwarehax_installer `.zip` to the root of your SD card
2016-12-13 07:16:32 +01:00
4. Copy the `4B51394A` folder from `4B51394A.zip` to the `/3ds/3ds_dsiwarehax_installer/dsiware/` folder on your SD card.
2016-12-13 05:30:44 +01:00
5. Copy and merge the `3ds` folder from the 3DSident `.zip` to your SD card
5. Copy `waithax.3dsx` to the `/3ds/` folder on your SD card
2016-12-14 19:24:15 +01:00
6. Copy the dgTool `boot.nds` to the root of your SD card
2016-12-13 05:30:44 +01:00
1. Create a folder named `dgTool` on the root of your SD card if it does not already exist
3. Copy the contents of the NFIRM `.zip` to the `dgTool` folder on the root of your SD card
4. Reinsert your SD card into your 3DS
##### Section II - Backup DSiWare
2016-12-13 05:34:13 +01:00
After completing the entire guide, you can use this backup to restore your DSiWare saves by deleting the DSiWare from your System Memory and copying it from your SD Card.
2016-12-13 05:30:44 +01:00
{: .notice--info}
This backup can only be used on this NAND. If you format your 3DS or restore another NAND (specifically if `movable.sed` is ever modified), it will become unusable.
{: .notice--info}
2016-12-13 18:33:08 +01:00
1. Go to System Settings, then "Data Management", then "DSiWare"
2016-12-13 05:30:44 +01:00
3. Copy the DSiWare game you intend to use to the SD Card
4. Exit System Settings
##### Section III - waithax
1. Get into the Homebrew Launcher using your entrypoint
2. Launch waithax
3. Wait
2016-12-13 18:33:08 +01:00
+ On New 3DS, this will take about 20 minutes (due to a bug, this can take the same time as an Old 3DS for some systems)
2016-12-13 05:30:44 +01:00
+ On Old 3DS, this will take about an hour
4. Once it's done, press (Start) to exit
5. Launch 3ds_dsiwarehax_installer
6. Select the DSiWare game you want to install the exploit on
7. Once it's done, press (A) to exit
8. Press (Start) to open the homebrew launcher exit menu
9. Press (A) to exit
2017-01-03 00:38:43 +01:00
2016-12-26 06:23:39 +01:00
##### Section IV - Backing up NFIRM
2016-12-13 05:30:44 +01:00
3. Launch your DSiWare game
4. Launch dgTool using your DSiWare game
+ **Fieldrunners**: Touch the 'Scores' button at the main menu
+ **Legends of Exidia**: After pressing (A) or (Start) at the two title screens, select the first save slot and press continue
+ **Guitar Rock Tour**: Scroll down and go to High-Scores -> Drums -> Easy
2016-12-13 21:21:30 +01:00
+ **The Legend of Zelda: Four Swords (Anniversary Edition)**: Just start the game
2016-12-13 05:30:44 +01:00
+ If your game does not have the hacked save file installed, restart from the beginning
2016-12-26 06:23:39 +01:00
5. Select "Dump f0f1" to backup your NFIRM
2016-12-13 19:39:45 +01:00
+ This will take a while
2016-12-26 06:23:39 +01:00
6. Make note of the NFIRM backup's location
2016-12-13 05:30:44 +01:00
7. Exit dgTool
+ You may have to force power off by holding the power button
2016-12-26 06:23:39 +01:00
8. Put your SD card in your computer, then copy `F0F1_N3DS.bin` or `F0F1_O3DS.bin` (depending on your device) to a safe location
2016-12-13 19:39:45 +01:00
+ Make backups in multiple locations
+ This backup will save you from a brick if anything goes wrong in the future
2016-12-13 05:30:44 +01:00
##### Section V - Flashing NFIRM
**Never downgrade with dgTool on a device that already has arm9loaderhax installed or you will BRICK!**
{: .notice--danger}
1. Launch your DSiWare game on
4. Launch dgTool using your DSiWare game
+ **Fieldrunners**: Touch the 'Scores' button at the main menu
+ **Legends of Exidia**: After pressing (A) or (Start) at the two title screens, select the first save slot and press continue
+ **Guitar Rock Tour**: Scroll down and go to High-Scores -> Drums -> Easy
2016-12-13 21:21:30 +01:00
+ **The Legend of Zelda: Four Swords (Anniversary Edition)**: Just start the game
2016-12-13 05:30:44 +01:00
3. Select "Downgrade FIRM to 10.4" and confirm to flash the 10.4.0 NFIRM bin
4. Exit dgTool
+ You may have to force power off by holding the power button
5. Reboot
##### Section VI - Exploit verification
2. Reinsert your SD card into your 3DS
3. Launch the homebrew launcher on using your entrypoint
4. Launch 3DSident
5. Verify that the following:
+ **Kernel version**: 2.50-11
+ **FIRM version**: 2.50-11
+ If either of these do not display the versions above, make sure you used the correct NFIRM zip and try flashing NFIRM again
2016-12-13 19:39:45 +01:00
5. Press any button to exit back to the Homebrew Launcher
2016-12-13 05:30:44 +01:00
Your version number will *not* have changed in the settings.
{: .notice--info}
2017-01-03 00:38:43 +01:00
Continue to [Decrypt9 (Homebrew Launcher)](decrypt9-(homebrew-launcher))
2016-12-13 05:30:44 +01:00
{: .notice--primary}
