Tutorial Setting up 9.0 - 9.2 N3DS/XL for CFW, including EmuNAND, Coldboot, CIA Installer

PSA: TUTORIAL SUPPORT DISCONTINUED

It's still valid, up to date and working as of now (8/23/16), but as the vast majority is going for A9LH and using Plailect's guide, I will drop support for my guide and not answer any questions anymore. Feel free to discuss anyway. Thanks for all the interest it got in the first months and I hope I helped many of you get your 3DS hacked in the beginning.

Please read the whole guide first and especially the FAQ and Beginner's Advice section at the end! Many questions that pop up again and again are already answered there.


This is mainly valid for N3DS, but will in general also work for O3DS. Where needed I put O3DS alternatives in the explanations. Basically this tutorial will guide you from absolute scratch, e.g. formatting a suitable microSD to coldbooting CFW on EmuNAND where you can install and run unsigned titles. No exploitable game or flashcard is needed. The exploits are not 100% failsafe, so your N3DS can and probably will freeze a couple times. If you hang with a red screen when starting Homebrew Launcher or hang with a black screen when starting CFW, just press the power button for some seconds if that happens, the device will shut down and you can try again. So let's get started.

The tutorial is step by step. Just follow it closely from start to finish. If you see the little

icon, that means there is a helpful screenshot available for that step. Just click it to open the screenshot.

• If you already have your microSD working in your 3DS or want to keep your contents, you of course skip this step. This only needs to be done if you set up a new microSD.
• Find a microSD of desired size. I used a SanDisk 64GB Ultra SDXC but any good brand should do the job.
• The card needs to be formatted to FAT32. If using a SDHC (up to 32GB) you can just use Windows' own right-click on drive format tool for that.
  • If you have a larger SDXC, Windows won't let you format it to FAT32, so use this tool called guiformat
  • Simply select your drive letter which is your microSD and click Start
• Put the card in your N3DS and start it. This creates the \Nintendo 3DS folder.

Now your microSD is prepared correctly.


This step is adapted from Complete Custom Firmware Guide by @dark_samus3, How-to install a CFW on a 9.0-9.2 N3DS without CN/OOT by @VerseHell and More-or-less Catch-All Tutorial by @Sgt. Lulz

You will need the following:

• Homebrew starter pack by smealum (scroll down to Preparing your SD card)
• EmuNAND9 by @d0k3
• FBI by @Steveice10
• PastaCFW *hax 2.x modified
  • if that doesn't work, try MiniPasta by @zoogie
• TinyFormat by @javiMaD
• dbs.zip from this thread's attachment

• Extract the Starter Pack onto your microSD. In the \3ds folder you will find all "apps" that HBL can launch.
• In the packages of Pasta, EmuNAND9, TinyFormat and FBI you will also find folders that have *.3dsx and *.smdh files. Copy them to the \3ds folder on your microSD to add them to Homebrew Launcher.
• If you set up a fresh microSD, do the following two steps to create a working database.
  • Navigate to the \Nintendo 3DS folder on the microSD and open the folder that's all numbers and letters. Inside will be another folder that's all numbers and letters. Open that and you will see a folder called \extdata.
  • Create a new folder called \dbs there, next to the folder called \extdata. Put the two files that came in dbs.zip, called import.db and title.db, into the \dbs folder.
  • Don't do this if you already have a \dbs folder containing import.db and title.db in there!
• Find FBI.cia in your FBI package and copy it to your microSD.
  • I like to keep them in a folder called \cia, but it really doesn't matter where you put .cia files, you can browse for them later.
• Put the microSD back in your N3DS and start it.
• If you set up a fresh microSD, you need to rebuild the database now. Go to System Settings, Data Management, Nintendo 3DS, Software. It will show a warning that the database files are corrupt and need to be rebuilt. Do this and exit System settings.
  • Without this, FBI will give you an invalid database error and you will not be able to install .cia files. You will need to do this again for SysNAND after unlinking, so keep this in mind.
• Now you need to start HBL. Set up a working internet connection (don't worry, it won't update) and deactivate it using the little wrench icon on the top left of your touch screen. Then press L+R to bring up the camera, click the little checkerboard icon in the lower left and scan the QR Code you can find here. This will show an url, accept it and your browser will open. While the browser loads, press Home button, go to the little wrench icon again and activate your Internet connection. Then open the browser. Now the browserhax exploit will load and open up Homebrew Launcher.
  • This can take some tries, for me it works in about 9 out of 10 cases. If you get a red screen, just shut down your N3DS and try again.
• You will be in Homebrew Launcher now. Scroll down to PastaCFW and start it. This will bring up your home menu again, but with Pasta patches applied, meaning you can install unsigned .cia files now.
  • If for any reason you can not get any homebrew to run (blackscreens or throws you back to HBL), start FTBrony first. This oddly seems to fix this problem, though I have no idea why.
  • If nothing works at all, you might have an incomplete downgrade and should try downgrading again, making sure everything goes completely right.
• Repeat the steps to get into Homebrew Launcher, open FBI and install the .cia of FBI.
  • This is necessary so that it gets copied over to EmuNAND in the following step. If for any reason you don't have FBI in your EmuNAND at the end, look at the Beginner's Advice at the end of the tutorial for a solution.
  • This is a N3DS tutorial, but I'll include it as it comes up again and again: If you happen to be on O3DS it's possible that you have crashes when entering the HBL a second time after Pasta was started. See this posting for a solution.

If you have any problems with Pasta and/or FBI.cia installation, just skip it and continue with EmuNAND setup and inject FBI into Health and Safety when you are finished! See FAQ on how to do that.

• Now, if you at any point used Menuhax on your SysNAND (for example before downgrading from 10.3), you will have to kill it now again, otherwise it will cause problems later. If you did not use Menuhax, skip this step.
  • If you have Menuhax installed before creating EmuNAND, it will get taken over to EmuNAND and then cause problems when booting CFW (bootloop) or when updating EmuNAND (blackscreen or freeze on Preparing Home Menu)
  • So if you had Menuhax already, you can remove it by deleting a folder from your SD. Go to \Nintendo 3DS\<random number>\<random number>extdata and find a folder called 000002cc, 000002cd or 000002ce (depends on your region) and delete it. Now Menuhax is gone.
• Enter Homebrew Launcher via Browser again and start EmuNAND9. Now create a NAND backup by navigating to EmuNAND Manager Options and Backup SysNAND to file. Leave the standard name and press A.
  • This takes about 8 to 10 minutes I'd say, let it sit and connect it to power if you are a bit low on battery.
• Once that is done, press Select to unmount your microSD, take out the microSD and copy all contents of the card to your PC as the next step will delete everything on your microSD. Don't worry, you will restore your files afterwards.

Probably the most important file on your microSD now is your NAND backup in a file called NAND.bin. I can not stress this enough. Take that file, make copies in safe locations, burn it to a DVD-R, upload it to some cloud, I don't know, just never lose that thing. Thanks to the new downgrade exploits you won't need it for downgrades at the moment (but probably will once Nintendo fixes the exploits) but anyhow this file is your only way to recover your device if you screw something up so enormously that nothing but a hardmod can revive your N3DS.

• Put the microSD back into your device and press B twice to return to EmuNAND9 main menu. This time choose Complete EmuNAND Setupand ignore the warning that starter.bin is missing by pressing A. Follow the on-screen instructions to format your EmuNAND. Doing so will delete everything on your microSD, which is correct.
  • This will again take around 8 to 10 minutes. Power down your N3DS afterwards.
• Put the microSD back in your computer. Copy back everything from your backup to your microSD (except NAND.bin), overwriting existing files. Put it in your N3DS again and start it.
  • You may notice that the card is now seemingly around 2GB smaller than before. This is because EmuNAND is created in a hidden partition of your microSD.

If you run into any problems with EmuNAND9, you can use an alternative way with Gateway. Read the spoiler on how to do so:

• What you want to do now is unlink NANDs and that's easy. Basically, the 3DS now needs to be reset to factory default. To prevent any problems with your NNID not working anymore in EmuNAND (if you have one), we can use the homebrew tool TinyFormat to unlink. Using TinyFormat, the problem of NNID not being linked anymore will not appear. So go into Homebrew Launcher again, start TinyFormat, press Y and format your SysNAND.
  • if this doesn't work for you or you don't have / care about NNID, you can also unlink by formatting the device with System Settings. Go to System Settings, Other Settings, scroll to the last page and choose Format System Memory. Now remove your microSD and continue. When formatting is done, reboot the device and put your microSD back in. Do not forget removing your microSD, or it will delete everything on it.
• After unlinking, start your N3DS again and go through initial setup.
• Now your NANDs are unlinked and inside the \Nintendo 3DS folder on your microSD should now be two folders with letters and numbers. This is the proof that your NANDs are unlinked.
• Find the folder that does not have the \dbs folder inside (this is the folder for your SysNAND as you just formatted it), and repeat the steps with import.db and title.db as described above.
  • The other folder should already have the \dbs folder, because you restored your backup to the microSD already.

Now that EmuNAND is set up correctly, software installation can begin.


This is adapted from RXtools CFW coldboot full installation guide for New3DS, from Browserhax & Homemenuhax to Rxtools by @ChrisN8

This guide started out with rxTools, then I moved over to ReiNand when rxTools hung behind. As Cakes and rxTools catched up, I modified the guide to cover all three CFW. As for now, I resent to only using Luma3DS as it's the easy to use and supports everything both on N3DS and O3DS now. With Luma3DS you can have GBA VC working on EmuNAND, boot DS Carts from EmuNAND, have the former 3D Bug fixed and now also have region free patched implemented. This is both for N3DS and O3DS, so no differences, bugs and incompatibilities anymore.

You will need the following:

• CtrBootManager by @cpasjuste and my boot.cfg from this thread's attachment
• Latest Luma3DS build
  • To get to know more about Luma3DS' functions, go to the official thread

• Extract the Luma3DS package and find Luma3ds.dat and the \luma folder inside. Copy these two onto the root of your microSD.
• Now start your N3DS and repeat the dbs repair that was described in step 2 by going into System Settings, data management, Nintendo 3DSand repairing the database.
  • This is needed to be done again because you formatted your SysNAND.
• Now set up an internet connection again, click the little wrench icon and choose to the option to change a theme.
  • You don't need to change it, just bring up the menu once and leave again, or change the theme if you wish.
  • This step is necessary to set up the theme engine, which MenuHax uses as an exploit.
• Now go into Homebrew Launcher again, as it was described in step 2 - deactivate Internet, scan QR code, activate internet while browser is loading, and Homebrew Launcher will start.
• This time choose MenuHax and install it. If you want to switch on your N3DS and have it boot into EmuNAND automatically, choose Type2.
  • I strongly recommend that, as it makes things way more convenient. If for whatever reason you don't want that, read the following explanation:
    • In short, Type1 will mean you have to hold a specific button to coldboot CtrBootManager and if you don't hold it, SysNAND will boot. Type2 is the opposite - CtrBootManager will coldboot if you do not hold a specific button and only boot SysNAND if you hold the button during boot. If you want to switch on your N3DS and automatically be in EmuNAND, use Type2. I recommend Type2 and I will write the following parts of the tutorial as if you chose Type2. If you want Type1, just keep in mind that you will have to hold your button every time you boot your device
• You will have to set a button now that bypasses MenuHax, just press it and touch the bottom screen to confirm. This will set up the coldboot now.
  • If you don't hold the button you just set during booting, MenuHax will initiate.
  • If you hold it while booting, SysNAND will load.
• Switch off your N3DS, switch it on and your top screen should glitch and throw you directly into Homebrew Launcher. Your device is now set to coldboot a file called boot.3dsx, which loads Homebrew Launcher. We need to change that now.
• Switch your N3DS off again, put your microSD into your computer and find the menuhax payload on it. It starts with ropbinpayload_menuhax and then has your region (like EUR), a number corresponding to your system version (like 12288 for 9.2) and ultimately your device (new or old 3ds). We need to edit that now.
  • You can use Notepad++ or a hex editor like HxD. Do not use the standard Windows notepad.exe, as it seems to break the file.
  • So open the payload in your editor (this screenshot shows Notepad++) and find the two occurences of boot.3dsx and replace both of them with bctr.3dsx, then save the file again. Make absolutely sure you replace both, or it won't work.
• You want to add CtrBootManager now. Unzip the package and download the boot.cfg at the end of this thread under Attached Files. Replace the original boot.cfg with mine.
  • This sets up CtrBootManager to show Luma3DS and Homebrew Menu, and it's set to boot Luma3DS by default.
  • Of course you can edit the boot.cfg to your likings, add more homebrew apps or remove entries.
  • Rename CtrBootManager's boot.3dsx to bctr.3dsx and then copy bctr.3dsx and my boot.cfg from this thread to the root of your microSD.
• Check if everything goes as it should by switching on your N3DS. After the screen glitches you'll be in CtrBootManager, showing Luma3DS and Homebrew Menu.
  • CtrBootManager is for now set to Luma3DS as default. If you want to use change the default setting, navigate to More, Settings and choose a different entry under the option Default.
• Wait three seconds, or manually select and start Luma3DS now.
  • There will be a configuration menu on first boot. I'd recommend checking Show current NAND in system settings and Show GBA boot screen in patched AGB_FIRM. Select these with A, then press Start and go to ALuma3DS again.
  • If you ever want to enter that menu again, hold select while starting Luma3DS.
  • Luma3DS will show "Emu" in System Settings, so you know you are in EmuNAND.
• If nothing boots, power down your device and try it again. CtrBootManager is quite failsafe though, it only freezes one out of 20 or 30 times on my device which is a very good boot rate.
  • If you have the device rebooting after selecting Luma3DS and then crashing to red/black screen, chances are you have Menuhax in your EmuNAND where it doesn't belong. To get into EmuNAND, hold your Menuhax button after selecting to start your Luma3DS and once you are in EmuNAND, change themes once to remove Menuhax. Then Autoboot will work as it should.
• So once boot goes through, you are in your EmuNAND. There are several ways to confirm this. Check if you can start FBI from home menu, if that works, you are definitely in EmuNAND. Furthermore, Luma3DS will show a "Emu" before the version number in System Settings.

At this point remember: If you enter system settings and leave again, your device will do a full reboot. Meaning if you do set menuhax to only boot when holding a button and you don't hold it now, this will bring you back to your SysNAND! This is again why I recommend type2 in menuhax, as it can not happen that way, it will just load up CtrBootManager again if you leave system settings.

If you ever want to install a .cia in SysNAND, for example GBA VC Games or DS flashcard whitelists, you will have to install FBI.cia in SysNAND again. This works as described in step 2, just boot Homebrew Launcher in the Boot Manager, start Pasta, go into Homebrew Launcher again via Internet Browser exploit, open FBI and install FBI.cia. Next time you enter your SysNAND with Pasta active, it will appear as a gift, just as before.

Well, and that's it. Your N3DS will now automatically load CtrBootManager through menuhax, then boot to EmuNAND and you will be able to install .cia via FBI on your home screen. I hope this helps someone as lost as I was at the beginning to get the device running.

But wait... there's more.

This is adapted from How to update EmuNAND on a N3DS by @Xenon Hacks

Latest supported version by all CFW: 11.0

As long as the latest versions are supported by CFW you can update just by going into System Settings on your EmuNAND and updating there! Make an EmuNAND backup before just in case, see below on how to do that!

Alternatively we can use sysupdater. This comes in handy if at some point you can't update in system settings anymore, like it has been with 9.5 previously, or you blocked all updates with Tubehax DNS / router configuration etc. So if you would like to update manually, here we go:

You will need the following:

• Latest N3DS Update Pack from that iso site
  • search for update packs and you'll find the thread
  • be absolutely sure to download the correct packages! They are different for O3DS and N3DS.
• sysupdater by profi200

• Extract the update package and you will get a folder called \updates. Copy that folder onto your microSD.
• Extract the sysupdater package and find the .cia file. Copy that onto your microSD.
• Boot into Homebrew Launcher, start Emunand9 and create an EmuNAND backup.
  • select EmuNAND Manager Options and Backup EmuNAND to file
• Now start your N3DS in EmuNAND and install sysupdater.cia with FBI.
• I mean, it's clear you are in EmuNAND now, but be like one thousand percent sure you are. Otherwise you will update your SysNAND, which would be fatal.
• Start sysupdater and press the A button to start upgrading.
• Your device will then reboot. Once you are in EmuNAND again, check System Settings and it will state the new version number.

Congratulations, you are updated.

Help I don't have FBI in my EmuNAND!
If you for some reason don't have FBI in your EmuNAND, because you forgot to restore your backup, accidentally installed it to destination NAND and not SD or similar, you can use this tutorial to inject FBI into Health and Safety app. VERY IMPORTANT: If you go for injecting, you can not use FBI 2.x for now! You must use an older version like 1.4.17 for that. You can still install the latest version as .cia once you successfully injected the older one.

My 3DS bootloops / goes back to Menuhax!
Chances are you have Menuhax in your EmuNAND, where it doesn't belong. You can remove it by deleting a folder from your SD. Go to your Emunand folder in \Nintendo 3DS\<random number>\<random number>extdata and find a folder called 000002cc, 000002cd or 000002ce (depends on your region) and delete it. Now Menuhax is gone. In case you don't know which one the SysNAND and which one the EmuNAND folder is, make a backup of the folders before you delete them and just try it out. If you accidentally delete it from SysNAND, just copy it back in.

3D is not working in EmuNAND!
Feb 29 2016: This was fixed now in the latest builds of all CFW! If you are using an older build, update or read on: without the fix there is a 3D bug in EmuNAND, which shows you two offset images instead of a 3D image. This happens everytime you start your N3DS after it was completely shut down. Just close and open the lid of your N3DS once and it's fixed.

I can't enter eShop! Error 022-2634! My NNID doesn't work!
There are to ways to fix this. See this post or this post for the methods.

After updating EmuNAND it is stuck or freezes on Preparing Home Screen!
That is most likely a faulty Menuhax still in your EmuNAND. Restore your EmuNAND backup which you hopefully created before, enter Homebrew Launcher out of EmuNAND and uninstall Menuhax. Then update again.

Can I use various CFW next to each other?
A CFW like Luma3DS, rxTools, Cakes only runs in the consoles' RAM. So yes, you can just use whatever CFW you like and even switch between them. Just edit the boot.cfg to your likings, adding any other CFW and select it in CtrBootManager to start it.

How can I change themes?
Don't change themes via Quick Settings in SysNAND. This breaks MenuHax and you will have to set it up again. You can use Quick Settings to change themes in EmuNAND. To change themes in SysNAND, use CHMM in Homebrew Launcher. You can also find Themes as installable .cia files on the usual sources.

How can I get eShop access?
If you go to the latest EmuNAND, you can access eShop for now until a new firmware comes. If you are on a lower EmuNAND, check out Xenon Hacks' tutorial on how to spoof eShop access.

How do I update games?
If you have eShop access, you can update via eShop. Game updates are also available as .cia files on the pages and boards where you can find games. Just install them with FBI like you would install a game and your game is instantly updated and ready to go online again. If you are not on the latest EmuNAND, pay attention that some updates need to be cryptofixed for now to work. You can absolutely not update them with eshop, you will need the fixed .cia versions. You'll know when you run across one of those when your game just freezes with a black screen. If that happens, find a fixed .cia, install that and it will work again.

How can I generate xorpads?
Xorpads are needed to convert .3ds to .cia. The tool decrypt9 by d0k3 allows you to do that. Paste it to your \3ds folder and run it out of Homebrew Launcher.

DS Flashcard doesn't work in EmuNAND!
If your DS flashcard throws "An Error has occured", it was probably blocked by some update. You can patch the Whitelist to have it work again. Find a tutorial on how to do so on that iso site by searching for Proper Old DS Cart Enable. Remember that rxTools doesn't support that, should you wish to use this CFW.

How can I move that whole stuff onto a new microSD?
To switch your whole setup to a new or bigger microSD, follow this tutorial by @Zaazu

How do I update my CFW?
Just replace your folders on microSD with the ones from newer packages. If new firmware files are needed, make sure to also replace them. Maybe make a backup of your old one before or rename it, in case something doesn't work.

How do I launch Homebrew Launcher out of EmuNAND?
To start Homebrew Launcher directly out of EmuNAND, use this .cia Launcher.

I have constant notifications asking me to update the firmware!
See last bulletpoint in Beginner's Advice.

• Once your EmuNAND runs stable, make an EmuNAND backup. You can do this also with EmuNAND9 under EmuNAND Manager Options and Backup EmuNAND to file. With this done you can easily restore it in case you mess something up in EmuNAND.
• If you have the space on your hard drive, I would suggest making occasional backups of your whole microSD in case it breaks. Do it like every two weeks or so. The tool HDD Raw Copy allows you to clone the whole microSD including all partitions (and so including EmuNAND) and you can restore it back completely.
• Go into SysNAND and create three fake Internet connections. Just click manual setup, set the SSID to something that doesn't exist (like fake1, fake2, fake3) and type in any password. EmuNAND will take over those but you can change the first one to a working connection, so you will have Internet in EmuNAND but not in SysNAND. This will prevent avoidable dangers like updating your SysNAND by accident.

At the moment we can use the latest EmuNAND. If at any point we are locked out again like it was with 9.5 or if you want to prevent updating for some other reason, read the following advice.

• Avoid putting your device to sleep while on EmuNAND and being connected to the internet. This can initiate an update download in the background, resulting in constant messages that ask you to update. If you by accident happen upon that message (like I did literally the same day I set up my N3DS), you can follow these instructions by d0k3 to get rid of it again. It's done in two minutes, but still easily avoidable.
  • If you have the knowledge how to do so, you could also block access to the update servers in your router. This will entirely take any chance your N3DS could ever receive an unwanted update while being in your home network, but will also block eShop access. But if you don't need that, go ahead and block them. Here are the server names.
  • For added security you can use TubeHax DNS to prevent update access. Find out how to set it on smealum's HomebrewLauncher page at the point that says YouTube.

If you have any contributions, please let me know.
06/06/2016 minor adjustmens
04/23/2016 adapted to Luma3DS
04/21/2016 cleanup
04/13/2016 changed to AuReiNand
04/01/2016 changed to ReiNand
03/28/2016 fixed Emunand9 instructions due to new menu names
03/21/2016 removed lesshax as it's not updated anymore
03/16/2016 added home menu region free patch
03/04/2016 fixed rxTools links
02/23/2016 fixed Cakes links
02/17/2016 added lesshax payload
02/11/2016 rxTools added
01/28/2016 added new boot.cfg with theme offsets
01/23/2016 added GBA VC
01/21/2016 started adding screenshots
01/20/2016 replaced unlinking with TinyFormat
01/18/2016 added Cakes, updated ReiNand
01/14/2016 switched to ReiNand, added 10.3 EmuNAND update
01/12/2016 added FAQ, added microSD backup
01/07/2016 replaced the tool for formatting microSD with an easier one
01/06/2016 minor additions and improvements
01/04/2016 overhauled formatting, added Gateway as alternative for EmuNAND setup and older rxTools build as alternative if something doesn't work
12/29/2015 replaced Gateway EmuNAND setup with EmuNAND9
12/27/2015 switched to latest rxTools Nightly (12-05)
12/19/2015 replaced FBI injection into H&S with installation to SysNAND
12/12/2015 initial release