# Dumping 3DS PANDA NAND

## What you need
- A ntrboot compatible flashcart
- A magnet that triggers the sleep mode of your PANDA (if using a folding style 3DS)
- An already hacked retail 3DS (with Luma3DS)
- A 3DS PANDA
    - **Insert a new SD card into the PANDA** (in case deleted data could be recovered by imaging the SD card the PANDA came with)
- The latest release of [ntrboot_flasher](https://github.com/ntrteam/ntrboot_flasher/releases/latest)
- Dev-signed GodMode9 (this build has a more complete aeskeydb; files are renamed since the flasher looks for boot9strap-named files)
    - https://cdn.discordapp.com/attachments/457908268287918090/1036420146073436220/boot9strap_ntr_dev.firm
    - https://cdn.discordapp.com/attachments/457908268287918090/1036420146476093440/boot9strap_ntr_dev.firm.sha

## Section I - Prep Work

1. Power off the retail 3DS
2. Insert the retail 3DS's SD card into your computer
3. Create a folder named `ntrboot` on the root of the SD card
4. Copy `boot9strap_ntr_dev.firm` and `boot9strap_ntr_dev.firm.sha` to the `/ntrboot/` folder on the SD card
5. Copy `ntrboot_flasher.firm` to the `/luma/payloads/` folder on the SD card
6. Reinsert the SD card back into the retail 3DS
7. Insert your ntrboot compatible DS / DSi flashcart into the retail 3DS

## Section II - Flashing dev-signed godmode9 ntrboot to the flashcart
1. Launch the Luma3DS chainloader by holding (Start) during boot on the retail 3DS
2. Select “ntrboot_flasher”
3. Read the red screen warning
4. Press (A) to continue
5. Select your flashcart
    -  If you do not see your flashcart in the list at the top, read the bottom screen for more info on each option
6. Select “Dump Flash”
7. Wait until the process is completed
8. Press (A) to continue
9. Press (A) to return to the main menu
10. Select “Inject Ntrboot”
11. Press (Y) for developer unit ntrboot
12. Wait until the process is completed
13. Press (A) to return to the main menu
14. Press (B) to power off the retail 3DS

## Section III - ntrboot
1. Use the magnet to find the spot on the PANDA where the sleep sensor is triggered
    - This step is not needed on the old 2DS (which has a sleep mode switch)
2. Power off the PANDA
3. Insert your flashcart into the PANDA
4. Place the magnet on the PANDA to trigger the sleep sensor
    - On old 2DS, you should instead enable the sleep mode switch
5. Hold (Start) + (Select) + (X) + (Power) for several seconds, then release the buttons
    - It may take a few attempts to get this to work because the positioning is awkward
6. If the exploit was successful, you will have booted into GodMode9

## Section IV - Dumping NAND
1. Press (Home) to bring up the action menu
2. Select “Scripts…”
3. Select “GM9Megascript”
4. Select “Backup Options”
5. Select “SysNAND Backup”
6. Press (A) to confirm
    - This process will take some time
7. Press (A) to continue
8. Press (B) to return to the main menu
9. Select “Exit”
10. Press (A) to relock write permissions if prompted
11. Navigate to `[S:] SYSNAND VIRTUAL`
12. See if `essential.exefs` shows up; if it does, press (A) to select it, select “Copy to 0:/gm9/out”, and press (A) to continue
13. Navigate to `[M:] MEMORY VIRTUAL`
14. Press (A) on the following files, select “Copy to 0:/gm9/out”, and press (A) to continue
    - `otp.mem`, `otp_dec.mem` (if it shows up) and `nvram.mem`
    - If there is no `essential.exefs` in `[S:] SYSNAND VIRTUAL`, copy `nand_cid.mem` as well
15. Press (Home) to bring up the action menu
16. Select “Poweroff system” to power off the PANDA
17. Insert the SD card into your computer
18. Copy `<date>_<serialnumber>_sysnand_##.bin`, `<date>_<serialnumber>_sysnand_##.bin.sha`, `essential.exefs`, `otp.mem`, `otp_dec.mem`, `nvram.mem` and `nand_cid.mem` from the `/gm9/out/` folder on the SD card to a safe location on your computer

## Section V - Removing ntrboot from the flashcart
1. Insert the SD card from the retail 3DS into your computer
2. Copy the .bin file from your flashrom backup to the `/ntrboot/` folder on the root of the SD card
3. Insert your ntrboot compatible DS / DSi flashcart into the retail 3DS
4. Launch ntrboot_flasher by holding (Start) during boot
5. Read the red screen warning
6. Press (A) to continue
7. Select your flashcart
    - If you do not see your flashcart in the list at the top, read the bottom screen for more info on each option
8. Select “Restore Flash”
9. Press (A) to proceed
10. Wait until the process is completed
11. Press (A) to return to the main menu
12. Press (B) to power off the retail 3DS