[GUIDE] Downgrading your 3DS and installing CFW

A guide to downgrading from >=9.3 and installing custom firmware (CFW).

NOTE: O3DS refers to the old 3DS, the original model, whether it's XL or not, and N3DS refers to the new model with a c stick and extra buttons (also XL or not). The 2DS is an O3DS.

If you get stuck along the way, please read the FAQ at the bottom of this pastebin before asking questions.

=====Downgrade=====
Get the 9.2 firmware for your system here. Make sure to get the right one, or you risk bricking your system. The letter in the file name pertains to your region. (United States, Europe, Japan, etc.)
https://mega.nz/#F!IApGwLJL!kYHL5jMlDfd0rmn6a8DaFw
copy the updates folder to the root of your SD card.

JAPAN N3DS ONLY: Delete the 000400102002CA00.cia file from your updates folder. (or else you will brick)

This is Julian20's latest sysUpdater; run it till it works.
https://my.mixtape.moe/fgaxct.zip
If you're not sure where the files go, make sure the .3dsx and .smdh are both in a folder called sysUpdater inside your 3DS folder on the SD card.

After getting to the homebrew menu, find sysUpdater. It's probably near the bottom of your list.

=====cakepack=====

Below I have compiled every file you should need for the process for you to download all at once if you so choose. If you'd like to do this manually, continue on to the Files section.
O3DS cakepack: https://my.mixtape.moe/nasuuo.7z
N3DS cakepack: https://my.mixtape.moe/wnkzxj.7z

=====Files=====

Homebrew Starter Kit
https://smealum.github.io/ninjhax2/starter.zip

EmuNAND9
https://github.com/d0k3/EmuNAND9/releases
(put the 3DS folder on the root of the SD card)

FBI
https://github.com/Steveice10/FBI/releases
(put the 3ds folder on the root of your SD card/merge with your existing one, place the cia file either in a folder called cia or at the root of your SD card, either works)

miniPasta
https://gbatemp.net/attachments/minipasta-zip.28168/
(place the miniPasta folder inside the 3DS folder)

TinyFormat
https://github.com/javimadgit/TinyFormat/releases

=====FBI/Menuhax (optional) installation=====

To start with, we need to get to the homebrew menu. Feel free to use your favorite method. Here, we'll use browserhax since anyone can use it. Navigate to http://yls8.mtheall.com/3dsbrowserhax_auto.php and you should arrive at the homebrew menu. Once here, you may want to install menuhax as an easier entrypoint. (NOTE: to setup menuhax you must have gone to the theme settings at least once. These are at the top left of the bottom screen on the home menu. Go to where you would change your theme, but then back out if you don't want to. You should see a message about data being created)

First off we'll need signature patching so we can run FBI. To do this, you'll launch miniPasta. If you don't want to use browserhax, hold your menuhax trigger right after launching miniPasta. If you're using browserhax, just wait. It'll kick you back to your home menu, only this time with signature patching, allowing you to install whatever you want. Now return to the homebrew menu via the browserhax URL again. Once here, launch FBI. Now that you're in FBI you can install .cia files. Go to where you save FBI.cia and install it. This will allow you to access FBI from your home menu instead of the homebrew launcher.

=====SysNAND backup=====

Once you're done with that, return to the homebrew launcher and run the Emunand9 application. From here select emuNAND Manager Options, then dump sysNAND to NAND.bin. This can take up to ten minutes, so make sure it's plugged into a charger if the battery is low. Once this is finished, press select to unmount your SD card. At this point you're going to leave the 3DS powered on, but eject the SD card. Put the SD card in your computer and back up all your files. The next step is going to wipe your SD card so this is important. You may also want to backup NAND.bin to several places, as it's useful for restoring your sysNAND in an emergency.

=====EmuNAND creation and backup=====
DISCLAIMER: if you don't want an emuNAND and you're willing to go through some extra work, you may skip this step as well as the unlinking step and go setup a9lh (arm9loaderhax) instead. See FAQ for more info.

Once you've finished transferring those files to your computer and you've put the SD card back in, press b twice to get back to the main menu of Emunand9. This time you're going to select Complete emuNAND Setup, it will format your SD card, create an emuNAND partition, and copy your sysnand to it. If you get a message about starter.bin missing, it's safe to ignore it and continue. This will likely take as long as it took to dump your NAND earlier. Once it's done, you now have an emuNAND. Your CIA manager is already installed there if you did this right, since you installed FBI before creating an emuNAND. Once that's done, you might want to make an emuNAND backup as well. This is next to the option you selected before for dumping sysNAND to a file. After you've done that, shutdown your 3DS and put your SD card back in your computer, then copy all your backed up files to your SD card again. The emuNAND you just created will take up 1GB of space on an O3DS and 2GB of space on an N3DS. This space takes the form of a hidden partition, not a file. Keep this in mind if you ever switch SD cards. You'll have to do more than just copy all your files over.

=====Unlinking NANDs=====

You can unlink your NANDs at this point by formatting your sysNAND. To do this, we're going to use TinyFormat. You should've downloaded it earlier. You're going to go Homebrew Launcher > TinyFormat (or if you're using the cakepack, you can use the file manager in ctrbootmanager to boot TinyFormat right after you trigger one of the *hax). This method is better than just removing your SD card and formatting sysNAND. It won't require you to have your SD card out, and it'll also avoid your NNID becoming unlinked on Nintendo's servers. All your data on sysNAND will be wiped, but will still be safe on your emuNAND after you do so.

WARNING: You must run TinyFormat from the NAND you want to format. Don't run it in emuNAND.

=====Cakes installation=====
This is the hardest part (but it's not that hard). Cakes is easy and straightforward to run and use compared to everything else, but finding the right files and setting up your SD card for it the first time can be a bit confusing.

If you got the cakepack from earlier in the guide, you don't need to download any other files.

Cakes
https://github.com/mid-kid/CakesForeveryWan/releases
Just download the .zip.

slot0x11key96.bin (for 9.6 or higher emuNAND on N3DS)
https://mega.nz/#!tNtCETAS!IanlyPjKlPnmoS-QhXmVbROeOVC0_0q71VgKYvvwTK0

--o3DS--
firmware.bin
http://nus.cdn.c.shop.nintendowifi.net/ccs/download/0004013800000002/00000049 (rename it to firmware.bin)
mirror:
https://mega.nz/#!gNFAHC6S!Qma2ec3NWKq8td8-JrjN1tXYl9UfyknvLMZ0oTIWhbc

cetk
http://nus.cdn.c.shop.nintendowifi.net/ccs/download/0004013800000002/cetk
---

--n3DS--
firmware.bin
http://nus.cdn.c.shop.nintendowifi.net/ccs/download/0004013820000002/0000001B (rename it to firmware.bin)
mirror:
https://my.mixtape.moe/shhpjw.bin

cetk
http://nus.cdn.c.shop.nintendowifi.net/ccs/download/0004013820000002/cetk
---

Just place the relevant files for your system on your SD card. For every .here file on your SD card you should have the real file next to it. Once done you can safely delete the .here files. To review: firmware.bin and firmkey.bin both go in the /cakes folder. Now launch Cakes through the homebrew launcher, and hopefully you get to a menu. Go to "Select Patches" and check "Enable emuNAND" as well as "Disable signature checks". Now Boot your CFW.

Welcome to emuNAND. Protip: make a new folder right now so you can tell when you're in emuNAND or not. Cakes does not yet tell you which NAND you're in. To do this, tap on an empty square of your home menu and press new folder. If you're ever unsure which NAND you're in, just check to see if it's there or not. Another way to tell NANDs apart is by themes/installed content. Creating this folder is not necessary and is only for the paranoid/unsure.

=====Installing other common homebrew applications=====

DevMenu (The official Nintendo CIA Manager that's better than FBI in some ways)
https://my.mixtape.moe/vppkko.cia

HBLauncher Loader (.cia file to load the homebrew launcher)
https://github.com/yellows8/hblauncher_loader/releases

sysUpdater
https://github.com/profi200/sysUpdater/releases

Decrypt9
https://github.com/d0k3/Decrypt9/releases

Universal Inject Generator (this runs on your computer)
https://github.com/d0k3/Universal-Inject-Generator

=====Updating emuNAND=====

You may also want to update your emuNAND to be newer than your sysNAND
If you're on an O3DS, you can just go to System Settings from emuNAND and update. If you're on an N3DS, make sure you have the proper firmware.bin file as well as slot0x11key96.bin and do the same. (if you have the cakepack it is safe to update)

=====Coldboot=====

The last useful thing to do is to setup coldbooting into emuNAND with ctrbootmanager. This is a handy tool similar to GRUB if you're familiar with GNU/Linux.

To start with, go to your sysNAND and make sure you've loaded a theme. I touched on this further up, but you've probably formatted sysNAND since then, so you'll have to do it again. Once this data has been created, get back to the homebrew launcher via the browserhax URL. (http://yls8.mtheall.com/3dsbrowserhax_auto.php) From here run Menuhax Manager to setup Menuhax. Once it's done installing, go to where you configure how it's triggered. Select type 2, then decide what button you want to press to NOT run Menuhax on startup. I chose X, as it's often easier to reach then the shoulder buttons. When you've decided on the button, hold it down and then touch the touch screen to set it. At this point we could move on, but you should probably make sure menuhax works. Power off your 3DS and then turn it back on. If everything went okay you should return to the homebrew launcher without having to press any buttons.

=====ctrbootmanager=====

Now that menuhax works, we're moving on to ctrbootmanager. This can be downloaded here: https://gbatemp.net/attachments/ctrbootmanager-1-2-zip.29831/ Next, remove your SD card and put it back in your computer for this next part.

What we're doing now is taking advantage of menuhax automatically launching the file titled boot.3dsx by switching that file. Don't delete your boot.3dsx! Just rename it. We'll want this for later. Rename it to boot_hb.3dsx. Once that's done, drag the boot.3dsx and boot.cfg files from the ctrbootmanager download on to the root of your SD card. Now you'll want to edit your boot.cfg file. Since we're using Cakes instead of rxTools, but we still have miniPasta and the homebrew launcher, let's just overwrite the entry for rxTools with one for Cakes. It should look something like this

title = "CakesFW";
path = "/Cakes.dat";
offset = "0x12000";

That's it! Save the file and put your SD card back in your 3DS. It should now boot to ctrbootmanager when you power it on, and after waiting a few seconds, it should boot Cakes. If you want to boot sysnand ever, just hold the key you assigned for menuhax earlier when you power on your 3DS.

=====Region Free=====
Cakes is currently lacking Region Free features found in other CFWs. To make up for this you can run NTR on top of Cakes.
https://github.com/44670/BootNTR/releases
Download BootNTR as well as NTR3.2.zip from this page. From the zip file place ntr.bin on the root of your SD card, and put BootNTR.cia wherever you've been keeping .cia files. After that just install BootNTR with FBI or BigBlueMenu and then run it.

=====FAQ=====

Q: My 3DS has been at the "Rebooting in 10 seconds" stage of the downgrade for a long time, what do I do?
A: It should be safe to power it off and back on. If you still can't get to the home menu successfully, remove your SD card and then try to boot. If this works, you just have to change your theme or delete the Menuhax related files on your SD card. (read further down for more info)

Q: How do I install games now?
A: When looking for games, make sure they come in a .cia file. Once you've got that, just place it anywhere on your SD card and then install it from FBI or BigBlueMenu.

Q: I'm having problems autobooting into Cakes, it just keeps freezing, can someone help me out?
A: Try setting autobootfix = 200

Q: Is it true that rxTools is better for O3DS and Cakes for N3DS?
A: No! mid-kid, the creator of Cakes, has an O3DS with no plans of upgrading. Cakes is fine for use on both.

Q: *hax freezes on a yellow screen, what do I do?
A: This is normal, homebrew doesn't have a 100% boot rate. If you want to improve your bootrate, check out this thread: https://gbatemp.net/threads/guide-how-to-improve-menuhax-boot-rate-to-nearly-100.410764/

Q: Why does FBI give me INVALID SIGNATURE?
A: You might be trying to install a .cia file without signature patching, use miniPasta if you're on sysNAND, if it's happening on emuNAND make sure you disabled signature checking in the Cakes menu under patches

Q: FBI gives DATABASE_ERROR
A: Enter eshop once, it doesn't have to let you in. This should create database files.

Q: FBI gives INVALID_COMMAND
A: You can't install .cia files using FBI.3dsx from emuNAND.

Q: Menuhax keeps looping!
A: You have to unlink your NANDs to make autoboot work

Q: Why do games keep re-wrapping themselves?
A: You have to unlink your NANDs to fix this

Q: After downgrading my screen stays black
A: Remove your SD from your 3DS and try to boot again. If that worked,  delete the following on your computer:
SD:/Nintendo 3DS/gibberish/gibberish/extdata

Q: I just set all this up, but now I don't have room for games! How hard will it be to switch to a new SD card after I've already made my emuNAND?
A: Not that hard, but still more than a simple copy/pasting of files. You'll still do said copy/pasting of files, but you'll also need Emunand Tool.
Windows: https://my.mixtape.moe/nbxxqi.zip
GNU/Linux or Mac OS: https://mega.nz/#F!o5pzFD6Q!1tZEMtYfp21chwOnsyEQRA
A2: If you want to try another method, you can use dd on Mac OS or GNU/Linux, and bbcopy on Windows to make an image (exact copy) of your SD card and save it to a .bin file or equivalent, then put in the new SD card and flash that image to it. From there it'll be the size of the old SD card, so you'll have to backup the files on the fat32 partition, then resize the fat32 partition, and lastly reformat the fat32 partition because resizing fat32 breaks it.

Q: How do I fix CHMM2.cia displaying an error about sound modules?
A: Get this homebrew application and run it from emuNAND.
https://rinnegatamante.it/dsp_firmware_dumper.rar

Q: Where can I get themes for my 3DS?
A: https://3dsthem.es

Q: Where is the slot0x25KeyX.bin download? Why is it not in the cakepack?
A: New CakesFW no longer requires this. If you're on 7.x or older there's a patch in the menu you can enable for the same effect. You now don't need any slotkey file on the O3DS, and you only need slot0x11key96.bin on an N3DS on 9.6 emuNAND or higher.

Q: I forgot to install FBI before making my emuNAND! Do I have to start over?
A: Injecting FBI to your Health & Safety app on emuNAND is the easiest option.
>download Decrypt9 and Universal Inject Generator and run it from sysNAND
>go to emuNAND options and then dump Health & Safety
>put hs.app into the input folder in the Universal Inject Generator Folder and then run go.bat on Windows or go.sh on a UNIX-like OS
>it should output "FBI_inject_no_banner.app" and "FBI_inject_with_banner.app" to outside the input folder
>rename one of these files (your choice) to hs.app and put it back on your SD card
>return to Decrypt9/emuNAND options and now inject it

Q: I believe I made a mistake, how do I restore my sysNAND backup?
A: Decrypt9

Q: How do I extract .tar.gz?
A: 7zip should handle this fine on Windows, I use 'file-roller' on GNU/Linux. Alternatively just run 'tar -xvf'.

Q: Does Cakes work on 10.7 emuNAND?
A: Yes, of course. Why wouldn't it? NATIVE_FIRM did not change. This also means NTR still works.

Q: Isn't NTR still buggy to the point where you can't launch one game after another without it causing a reboot error?
A: 3.3 has this issue, 3.2 does not. Both work on latest emuNAND using 10.2 NATIVE_FIRM.

Q: Where's the arm9loaderhax tutorial?
A: There's already a great guide written and I'm not sure I could improve upon it in any way: https://github.com/Plailect/Guide/wiki/Part-4-(Getting-the-OTP)

Q: What version of Cakes is in the cakepack?
A: It was 108 stable for a while, but with the rising popularity of a9lh recently, I have now compiled the latest source and put that build in there. Last change was a week ago. Says it's version 137 but it might have some differences from the nightly anyway.

Q: I already dumped my otp.bin, now where do I get the input_files for the arm9loaderhax installer?
A: http://pastebin.com/iSdfHnDY

Q: I ran the arm9loaderhax installer and now my 3DS instantly shuts off!
A: This is normal. Next you need a boot manager, such as ctrbootmanager9. You can find it in the cakepack, or download it from here: https://gbatemp.net/threads/release-ctrbootmanager9.417159/

Q: Is Cakes with a9lh as safe as aureinand?
A: Yes. They both can protect firm0 and firm1 files. If you need this (if you're using cfw in sysNAND) make sure to enable the patch in the Cakes menu. It's not needed, however, for emuNAND.