**They are only useful if you already own "Fieldrunners", "Legends of Exidia", "Guitar Rock Tour", or "The Legend of Zelda: Four Swords" on the source 3DS. Each game has been pulled from the eShop; you must have already gotten them.**
If you are between versions 11.0.0 and 11.2.0, you must follow this guide to downgrade your NATIVE_FIRM using DSiWare and a second 3DS which has already has a Custom Firmware installed on it in order to dump and restore your NAND.
If you are below 11.2.0 on either device, then you should do the ctr-httpwn steps (when prompted) on each device under 11.2.0 to allow you to System Transfer with them.
{: .notice--info}
This takes advantage of an oversight which allows DSiWare titles to read and write anywhere in NAND.
{: .notice--info}
This is a currently working implementation of the "FIRM partitions known-plaintext" exploit detailed [here](https://www.3dbrew.org/wiki/3DS_System_Flaws).
{: .notice--info}
This guide will assume the CFW 3DS is running arm9loaderhax and was setup with this guide, but will work (with slight modifications such as doing all SysNAND steps on EmuNAND) on systems running an EmuNAND. Note that the terms EmuNAND and RedNAND refer to slightly different implementations of [the same concept](http://3dbrew.org/wiki/NAND_Redirection).
{: .notice--info}
You can skip everything related to **Steel Diver: Sub Wars** and steelhax if you already have a working primary entrypoint (e.g: OOT3dHax, FreakyHax) for **the target 3DS**, and use that instead.
This exploit requires you to [System Transfer](http://en-americas-support.nintendo.com/app/answers/detail/a_id/13996/) from a CFW 3DS to a stock 3DS as part of the steps. System Transfers will work in the following directions *only*:
* Download a legitimate copy of **Steel Diver: Sub Wars** (the game is free, but any copy of the game not from the eShop will **not** work) on **the source 3DS**
* The previous release of [steelhax](https://vegaroxas.github.io/files/steelhax-installer.zip)
* If **the target 3DS** is below 11.2.0, you will _also_ need the following
+ The latest release of [ctr-httpwn](https://github.com/yellows8/ctr-httpwn/releases/latest)
#### Instructions
##### Section I - Prep Work
1. Create a folder named `files9` on the root of **the source 3DS**'s SD card if it does not already exist
2.**Use a [save manager](https://github.com/J-D-K/JKSM/releases/latest) to backup any saves you care about on the target 3DS (it will be formatted!)**
3. Copy the relevant `public.sav` from the `/dsiware/(8 Character ID)/` folder in the 3ds_dsiwarehax_installer `.zip` to the root of **the source 3DS**'s SD card
6. Go to SysNAND Options, then SysNAND Backup/Restore, then backup **(min size)** SysNAND to `NANDmin.bin`
7. Press (Select) on the main menu to eject **the source 3DS**'s SD card, then put it in your computer
8. Copy `NANDmin.bin` and `NANDmin.bin.sha` from the `/files9/` folder on your SD card to a safe location; make backups in multiple locations; this backup will save you from a brick if anything goes wrong in the future **(Your backup should match one of the sizes on [this](nand-size) page; if it does not, you should delete it and make a new one!)**
9. Put **the target 3DS**'s SD card into your computer
10.**Backup every file on both 3DS's SD cards to two separate folders on your computer (keep track of which is which)!**
11. Reinsert each SD card back into their corresponding 3DS
After completing the entire guide, you can use this backup to restore your DSiWare saves
{: .notice--info}
This backup can only be used on this NAND. If you format your 3DS or restore another NAND (specifically if `movable.sed` is ever modified), it will become unusable.
{: .notice--info}
1. Go to System Settings, then "Data Management", then "DSiWare", then "Nintendo DS Profile" on **the source 3DS**
2. Copy any DSiWare games that are already on the SD Card back to the System Memory
3. Copy the DSiWare game you intend to use to the SD Card
1.**Backup every file on both 3DS's SD cards to two separate folders on your computer (keep track of which is which)!**
2. Reinsert each SD card back into their corresponding 3DS
4. If **the target 3DS** has a Nintendo Network ID on it, you must format the device using System Settings:
+ Go to the last page of "Other Settings" and select "Format System Memory", then follow all instructions
5. Read the following:
+ Your CFW 3DS = the source 3DS = "Source System"
+ Your Stock 3DS = the target 3DS = "Target System"
+ **Move DSiWare titles if prompted!**
+ Do **NOT** delete the source system's SD card contents if prompted
+ Make sure neither device's battery dies during the transfer
+ 2DS/Old 3DS (source) to New 3DS (target) only - if asked which method you wish to use to transfer the SD card data:
+ **Do NOT** choose the "Low-Capacity microSD Card Transfer" or minimal option (option 2), it will only transfer tickets and likely will not transfer the DSiWare save.
+ Fast Method: If you have the ability to move the data from the SD card (source) to the microSD card (target), when prompted use the "PC-Based Transfer" option (option 3).
+ Slowest Method: If you don't have the ability to move the data on a PC use the **full** "Wireless Transfer" option (option 1).
6. Go to [this link](http://en-americas-support.nintendo.com/app/answers/detail/a_id/227/) and follow Nintendo's official instructions for System Transferring from one system to another while keeping in mind what you just read
2. Do one of the following *(or neither if you don't mind __the source 3DS__'s NNID being nonfunctional)*
+ Do the rest of the sections and then the full guide on **the target 3DS**, then wait one week, then System Transfer from **the target 3DS** back to **the source 3DS***(remember you cannot transfer back from a New 3DS to an Old 3DS)*
+ Call Nintendo and tell them you no longer have access to the device that your NNID is linked to (which is **the target 3DS** in this case), and would like it linked to a different device (which is **the source 3DS** in this case)
3. Reboot **the source 3DS** while holding Start to launch Hourglass9
4. Go to SysNAND Backup/Restore and restore SysNAND from `NANDmin.bin`
+ **Fieldrunners**: Touch the 'Scores' button at the main menu
+ **Legends of Exidia**: After pressing (A) or (Start) at the two title screens, select the first save slot and press continue
+ **Guitar Rock Tour**: Scroll down and go to High-Scores -> Drums -> Easy
+ **The Legend of Zelda: Four Swords**: Just start the game
+ If your game does not have the hacked save file installed, [follow this troubleshooting guide](troubleshooting#ts_dsiware)
5. Select "Dump f0f1" to backup **the target 3DS**'s NFIRM
6. Make note of the NFIRM backup's location
7. Exit dgTool
+ You may have to force power off by holding the power button
8. Put your SD card in your computer, then copy `F0F1_N3DS.bin` or `F0F1_O3DS.bin` (depending on your device) to a safe location; make backups in multiple locations; this backup will save you from a brick if anything goes wrong
