In December 2015, after having my original 3DS since 2011 and had a repair twice, I got a New 3DS (not XL). It was bundled with Animal Crossing: Happy Home Designer. (My dad wanted to get me an XL one though). Remember when downgrading to 9.2 was the craze? That following month, late at night, I tried a downgrade since I successfully did it on a 2DS. However, since I got a pack for a regular 3DS and not a new 3DS (and there was no warning about that anywhere), my new 3DS bricked. I was very upset.
Talking to my dad, he said we should return it to Amazon. I wanted to solder on it to get the save files and data back, but my dad said if we did that we couldn't get the money back to exchange it. (Today, you can use the magnet trick with a flash cart, and I have one.) So I didn't do that.
I got a red New 3DS XL now and I think we called Nintendo or went online to unlink the NNID from the bricked 3DS. I then downloaded all my legit games from it. I was still sad for a while not to have my saves back, but I had a dump of the extra data and got my Tomodachi Life save back. Instead of replaying some of the games, I installed 100% save files.
This is how it was for a while. I did some research and found out the movable.sed on the 3DS NAND was needed to decrypt the save data. (I made a disk image of my microSD card.) The problem became more forgotten about. Until, about years later, seedminer came out which let you mod your 3DS by brute forcing the movable.sed!
I talked with zoogie in PMs and I was missing the LFCS code to brute force a movable.sed. However, some time later, you could now generate the first part of the movable.sed with a Mii QR code, which I found when I uploaded some Miis I created to a site. (Apparently you only need the friend code now?)
Now I needed to brute force it, but I use a Mac (don't complain, I don't want to hear it) so I couldn't mine with the GPU and the CPU didn't really find a match. Before the online mining service was a thing, people would ask on this forum to brute force for them. Someone named Hunter kindly brute forced it for me and I had a movable.sed now.
Now, I was wondering, what would I use to decrypt with the movable.sed? I was wondering if JKSM could do it, but it doesn't let you do it with a movable.sed.
Well, I found a tool written in Python called 3ds-save-tool on GitHub by someone named "wwylele" (that's a hard name to spell lol). It needs keys from the bootrom in order to decrypt. I tried to dump my bootrom and use a tool by yellows8 to get the keys, but it didn't work,
After talking to wwylele on Discord, it turns out yellows8's script gave me the wrong keys. He gave me the first byte of the keys, but I still didn't get the right ones until I Googled and eventually found a useful Google Sheet with the keys to decrypt. Now I was able to decrypt the saves I wanted.
It was an amazing (and kind of fun) journey to get the saves back, and persistence was key. I haven't really played any of the games I got the save for after I got them back, but I might go back to 100% them later.
This was a few months ago when I got the saves back. I hope this blog post helps people in the future which had problems like this before.
Thanks zoogie, wwylele, and Hunter!
Talking to my dad, he said we should return it to Amazon. I wanted to solder on it to get the save files and data back, but my dad said if we did that we couldn't get the money back to exchange it. (Today, you can use the magnet trick with a flash cart, and I have one.) So I didn't do that.
I got a red New 3DS XL now and I think we called Nintendo or went online to unlink the NNID from the bricked 3DS. I then downloaded all my legit games from it. I was still sad for a while not to have my saves back, but I had a dump of the extra data and got my Tomodachi Life save back. Instead of replaying some of the games, I installed 100% save files.
This is how it was for a while. I did some research and found out the movable.sed on the 3DS NAND was needed to decrypt the save data. (I made a disk image of my microSD card.) The problem became more forgotten about. Until, about years later, seedminer came out which let you mod your 3DS by brute forcing the movable.sed!
I talked with zoogie in PMs and I was missing the LFCS code to brute force a movable.sed. However, some time later, you could now generate the first part of the movable.sed with a Mii QR code, which I found when I uploaded some Miis I created to a site. (Apparently you only need the friend code now?)
Now I needed to brute force it, but I use a Mac (don't complain, I don't want to hear it) so I couldn't mine with the GPU and the CPU didn't really find a match. Before the online mining service was a thing, people would ask on this forum to brute force for them. Someone named Hunter kindly brute forced it for me and I had a movable.sed now.
Now, I was wondering, what would I use to decrypt with the movable.sed? I was wondering if JKSM could do it, but it doesn't let you do it with a movable.sed.
Well, I found a tool written in Python called 3ds-save-tool on GitHub by someone named "wwylele" (that's a hard name to spell lol). It needs keys from the bootrom in order to decrypt. I tried to dump my bootrom and use a tool by yellows8 to get the keys, but it didn't work,
After talking to wwylele on Discord, it turns out yellows8's script gave me the wrong keys. He gave me the first byte of the keys, but I still didn't get the right ones until I Googled and eventually found a useful Google Sheet with the keys to decrypt. Now I was able to decrypt the saves I wanted.
It was an amazing (and kind of fun) journey to get the saves back, and persistence was key. I haven't really played any of the games I got the save for after I got them back, but I might go back to 100% them later.
This was a few months ago when I got the saves back. I hope this blog post helps people in the future which had problems like this before.
Thanks zoogie, wwylele, and Hunter!
