[Guide] A Detailed and Beginner Friendly Walkthrough Guide for Installing BrowserHax, MenuHax, and Downgrade New 3DS LL/XL from Firmware 9.9J to 9.2J

Prelude 

Why I Upgrade from Original 3DS to New 3DS LL

tldr; Skip to the next section <Guide Start> to jump straight into my ordeal of downgrading my 3DS LL v9.9J firmware into v9.2 and booting into Gateway Mode

Having played on the Original 3DS (yes the small clamshell one that Nintendo first released back in 2011) for quite some time now, I finally decided to purchase a New 3DS LL (also known as New Nintendo 3DS XL outside Japan). As opposed to what others had complained about the LL/XL for its huge size, bulkiness and unportability, I actually found it to be pleasing to my play style. Main reason that I purchased it is its large 4.88 inch screen size. If the number seems meaningless to you, think of it being almost the same size as the PS Vita. Sure you wouldn't see much crisp image like the O3DS or the New 3DS regular edition due to its larger PPI, but frankly, for me that is negligible and it's the 3D immersion that really benefits from such a big screen. Not that 3DS console is known for its HD like image for gaming on-the-go.

Mind you that I had an average sized hands as well and holding it definitely helps to prolong my play time until I start to feel hand cramp.

Another reason for choosing the New 3DSLL over the regular size one is I think the 20% screen estate increase from my O3DS wouldn't be that much noticeable after all.

So there you have it.

New 3DS LL + Hori TPU Transparent Casing + Screen Protector

Downgrading from Firmware v9.9J to v9.2J

Despite all the quick excitement I had with the unit when I unboxed it, it also ended quickly when I noticed that it came preinstalled with firmware 9.9J, in which Gateway doesn't support at the moment. FYI Gateway only support firmware until v9.2. To verify this statement, I actually managed use the Browserhax exploit and boot into Homebrew Launcher. However I only see a blank screen after starting the Gateway app. Up until this point it became clear that downgrading to firmware v9.2 is the only possible choice now to boot into Gateway mode. Other choice is, of course to wait for months or probably years before Gateway support it.

Even though I had previous experience in console exploit (PS Vita and 3DS), I still find it a bit challenging given the vast updates of the tools and how long I had left the hacking scene. If you are like me, terms like Homebrew Launcher, sysupdater, browserhax, menuhax are all but a foreign language. Then you are definitely the audience that I had in mind when I was writing this tutorial :=)

Frankly I had left the 3DS hacking/homebrew scene for quite some years now and only had tried two exploits. The first exploit I tried is the DS Profile Exploit 3-4 years back when I first acquired my O3DS. Next is the browser exploit which you open Internet browser and go to go.gateway.com to boot into Gateway mode after I upgraded my O3DS to v9.1.

Enough of the rambling :-p, here goes my personal written guide after referencing tons of others tutorial that will work 100% if you had similar setup like I do, a New Nintendo 3DS LL on firmware 9.9J, fresh from the box. No step is skipped! To be honest, some other tutorial are either out to date, only compatible to certain tools. In fact, I jotted these down while I was attempting the process, so it is still all clear to me, at least for now.

Guide Start

This guide is divided into several topics which addresses different topic

• Install BrowserHax to boot into Homebrew Launcher for the first time (think of it like app selection)
• Install MenuHax using MenuHax manager home-brew app in Homebrew Launcher. This will allow you to boot into Homebrew Launcher after you power on the system without requiring any Internet connection since this is done locally). This is actually optional, but recommended. Other wise you'll have to use the BrowserHax to boot into Homebrew Launcher (which of course, requires Internet connection).
• Downgrade Firmware v9.9J to v9.2J in order to boot into Gateway Mode

Before you begin, please download the following .zip files containing all the necessary files for the browserHax, menuHax exploits and Downgrade firmware v9.2.0-20J.

==============================

<Download Link>

MD5 Checksum: 256bbf7df97c57a7b628c18e2421457c

==============================

You may find the password by combining all the ORANGE coloured letters you found after this section. This is done to make sure you read through every single steps before attempt. I do not held responsible if you brick you 3DS without have a full picture of the walkthrough.

After download the zip file, you may perform md5 check to make sure the file is complete and not tampered with. Then extract and copy all the files in toNew3DSMicroSD to your microSD card.

These files should be copied to the root of your microSD card, e.g. G:\

Say Hello to Your First Exploit - BrowserHax

Most of the steps are taken from Gateway 3.7.1 User Manual file, with certain steps edited to reflect the problems that I encountered. Some people also complained about Browser lockup on firmware > 9.2. The lockup will happen but you can circumvent it by simply following my steps below :-D

Note that you must not have launch the Internet Browser before attempting the following. Not sure whether launching the Browser before setting the DNS will work, but I followed the guide closely and didn't launch the browser until I changed the DNS.

1. Connect your N3DS to a Wi-Fi Access Point and Setup DNS manually instead of automatic:
Primary: 107.211.140.165
Secondary: 107.211.140.065

Setting up custom DNS

From what I gathered, setting the DNS to the aforementioned will delay the time your Browser will take to visit a website. I think the increase delay is used to launch the BrowserHax exploit before your request reaches Nintendo server which will prompt a message asking you to upgrade your firmware version in order to use the browser.

2. Check the network connectivity and make sure your N3DS can connect to the Internet successfully.

3. A little sidestep here before we attempt to start the BrowserHax exploit, change the default theme to any of the coloured theme. This will create an additional theme files on the microSD card which is needed for the later MenuHax exploit. After you changed the theme, be sure to change it back to the default theme (no coloured one).

Change theme

4. Turn off Wi-Fi by going to Home screen > tap on the upper-left icon > scroll midway and turn off Wifi/NFC

Disable Wi-Fi

5. Launch Internet browser and an error will prompt out shortly asking you to connect enable Wifi. Ignore that and enter http://yls8.mtheall.com/browserhax_fright_tx3g.php in the URL and bookmark it (Star icon). m

Add the entered URL as favourite

Note: Do not use the QR code in the Gateway PDF or http://yls8.mtheall.com/3dsbrowserhax_auto.php. In my case an error asking me to update the system firmware always prompt out whenever I used these URL.

6. Click the Home button and enable Wifi again.

Enable Wi-Fi

7. Quickly open Internet browser and wait for ~10-15 seconds. You should see a 3x3 matrix cube at the upper screen and flashing colour (Yellow, Gray, etc.) at the bottom screen. Wait for a couple of seconds and Homebrew Launcher (blue background) will then shows up at the upper screen.

Launching the BrowserHax Exploit to launch Homebrew Launcher

MenuHax

With Homebrew Launcher successfully launched, we'll then install MenuHax to launch Homebrew Launcher every time we power on N3DS, without the need to do the BrowserHax anymore. In other words, you will not need to have Internet connectivity to do the BrowserHax to boot into Homebrew Launcher.

While still in Homebrew Launcher,
1. Scroll down and select MenuHax manager

Launch menuhax_manager to install MenuHax

2. Select the 4th option to configure MenuHax. O

Configuring menuHax

3. Select Type 1.

So what's the difference between Type1 and Type2 setup?
Basically Type1 require you to hold a button every time you power on your console to boot into Homebrew Launcher. If you're not holding any key in Type1 and you power on your console, you'll then boot straight into the official 3DS Operating System (OS).

Type2 is simply a counterpart of Type1. It will boot into Homebrew Launcher immediately without having to hold any key instead of booting into 3DS OS as in Type1. Holding the trigger key when you power on will then boot into 3DS OS.

Configuring menuHax trigger method

4. Keep holding [R] button and touch the bottom screen. This will assign the button that you hold as the trigger key.

You can, of course, assign other button as the trigger key that you'll have to hold when you power on your console to boot into Homebrew Launcher. L button is usually used for Gateway mode, so avoid assigning that key.

It should prompt a message saying [R] button is registered to trigger MenuHax. j

Assigning [R] button to trigger MenuHax at console power on

5. Install Menuhax

Installing menuHax

6. Power off N3DS by clicking the Power button at the bottom

7. While holding the [R] button or any of your assigned button, power on your N3DS

8. You should see a glitch covering the entire upper screen (kind of like MissingNo. in Pokemon Blue haha) followed by flashing color sequence at the bottom screen. Soon after you'll then see the familiar Homebrew Launcher!

Using menuHax to launch Homebrew Launcher by holding the assigned trigger [R] button during menuHax config.

All is well so far for setting up BrowserHax and Homebrew Launcher. They are perhaps the most straightforward task when compare to what you're about to attempt next.

# Downgrading from Firmware v9.9J to v9.2J

You might have seen a lot of people warning about the possibility to brick your N3DS during the downgrade when not done correctly. There are a lot of culprits, such as:

• Different tool version (e.g. sys updater)
• Different firmware version. Downloaded a wrong region firmware for the 3DS. E.g. 9.2U firmware on a japanese 3DS LL
• Out of battery during the downgrade. Not sure whether this happened to people, but make sure your N3DS has at least 50% of battery or keep it plugged in to the power adapter to be safe.

Fret not as long as you followed my guide and downloaded my release pack which contains the necessary files that you copied to your 3DS microSD card, the chances that you'll brick your 3DS is slim.

Make sure you FULLY READ and UNDERSTAND the entire steps below (including any of my personal experience) before attempt the downgrade process to make sure you know exactly what will happen next.

1. While in Homebrew Launcher screen (or boot into Homebrew Launcher if you are not already), select sysupdater-safe folder and click on the SafeSysUpdater app. @

2. Press [A] button to start verifying files. If all is well, then press the [Y] button to start the downgrade. This is the point of no return. Rab

If you're using a regular sysupdater 0.4.2b such as this one here which doesn't comes with memchunkhax v2 exploit, you'll see a CIA file mismatch or missing error when you press the [Y] button. This will not happen if you use the sysupdater-safe version which I bundled with my release pack. This version of sysupdater-safe will also verify all firmware CIA update files and make sure they are the correct one before actually start to overwrite the downgraded firmware files over your existing newer firmware files.

Also I noticed that the 9.2.0-20J(Full) firmware which I downloaded from [MEGA] [CIA/BIN] MSET 4.X & 6.X backups, Browser backups, Update packs (All Regions) will gives me a MD5 hash code mismatch for one of the file while sysupdater is checking the files. I then downloaded another similar firmware version from KanadeEngel Firmware Collection (3DS) and sysupdater is then able to verify all files correctly. I then compare the files between the one from the blogspot and KanadeEngel version and I noticed the total files number and CRC is different for some of the files! I would rather trust KanadeEngel version for its authencity.

You might also read others saying to remove the 000400102002CA00.cia file from the updates folder when you downgrade your Japanese 3DSLL, otherwise you'll brick your N3DS. No worries as I had removed it from my release pack.

Just for some fun fact, you'll also see other people mentioning launching the FBEtony app (which is a FTP app that allows you to copy files to your microSD card using WiFi without having to take out your microSD card from the console) in Homebrew Launcher, keep spamming the [B] button until it exit, and then quickly launch the sysupdater app again spam the [Y] button. This is only needed for the earlier version for those that see a blank screen when they launch sysupdater. In some occasion I do noticed a blank screen when launching sysupdater. But the chances are slim and if that do happen, simply reboot your console and launch the sysupdater again.

Verifying firmware CIA update files

3. If all is well you'll see a Downgrade Success message and it will then reboot your N3DS after 10 seconds.

4. Check that the system firmware is at 9.1 (not sure why since I download the firmware 9.2 pack) after it reboot. Not that the firmware 9.1 matters as long as it is <= 9.2! Time to setup Gateway! *2T

Firmware v9.1.0-20J after successful downgrade

Booting into Gateway Mode and Setup

This is as simple as booting into Homebrew Launcher and select Gateway app.

Boot into Gateway mode. Make sure the Gateway RED cart is inserted to the cartridge slot. The cart is needed only during ROM selection and not during the setup.

You can then then do the following:

• Backup the NAND file, which is the original firmware that came with the N3DS.
• Copy the NAND.bin to PC for backup in case of future need, who knows?
• While the microSD card is still plugged in the PC, copy all the files in the microSD card to the computer. The next step will require you to format the microSD card in Gateway mode, which will erase all content in the microSD card in order for Gateway to boot into emuNAND.
• Boot into Gateway mode again and select [Format emuNAND]. This is required in order for Gateway to allocate some space to hold the emuNAND, which is a replica of your original firmware or sysNAND. Basically you boot into emuNAND to launch your 3DS Roms and update the emuNAND firmware to the latest one that Gateway support.
• After formatting the emuNAND, click [Boot Gateway Mode] and you should then see a familiar 3DS OS, press the [Select] button and you'll then see emuNAND at the ROM selection menu!
• Finally power off your N3DS, remove the microSD card and copy all the backup files that you did before back to the microSD card. Remember that Gateway 3DS had erase all the content in our microSD card to make room for emuNAND?

Setting up Gateway mode.

At this point you can try to press [Select] button to launch some game. Or check the system version. Note that you'll then be switched into sysNAND after you exit the System Preference screen.

Loading a 3DS ROM using Gateway [Select] ROM selection

Gateway firmware version, which is similar to our sysNAND or the firmware version that we downgraded from v9.9.

My Despair During the Downgrade, and Hope Resurfaces

In my case, downgrading is not a smooth sail at all. An error message prompted out near the end of the downgrade asking me to power off. When I powered on my console again I see nothing but blank screen. At that point I thought I had bricked my N3DS, which I haven't even start to enjoy any games yet! With despair, I then tried to remove the microSD card and keeping my finger crossed while powering on the unit again. Thank goodness I can still boot into the OS just fine! Clicking the System Info now shows 9.1J, which is peculiar since I didn't actually complete the entire downgrade process, see the downgrade success message, and it doesn't automatically reboot the console.

I then tried to reformat my microSD card into FAT32 using my PC. Then I basically reattempt to install BrowserHax and MenuHax again. Thinking that it will work this time since my firmware is at 9.1J (or partially), I then tried my luck on launching Gateway Mode in Homebrew Launcher while keeping the [L] button pressed. Alas, it is still the same blank screen.

Thinking that the reason might because of the partial firmware update, I then tried to launch sysupdater-safe again to start the whole downgrading process. And this time around I can see the Downgrade Success message and then it proceed to reboot my N3DS! Yay! All hope is not lost for the patience!

Upon rebooting, I then once again verify that the system firmware is still at 9.1J, and it is indeed! My hopes are high now. I then boot into Homebrew Launcher and click the Gateway Mode again while holding the [L] button. And voila! It works and I can see the red dragon image at the upper screen. I then pat myself at the back, literally! What a emotional of roller coaster ride just within 10 minutes!

From that point onwards it is all getting back to me from my previous Gateway experience. What's next is simply a matter of:

• Backup the NAND file, which is the original firmware that came with the N3DS.
• Copy the NAND.bin to PC for backup in case of future need, who knows?
• While the microSD card is still plugged in the PC, copy all the files in the microSD card to the computer. The next step will require you to format the microSD card in Gateway mode, which will erase all content in the microSD card in order for Gateway to boot into emuNAND.
• Boot into Gateway mode again and select [Format emuNAND]. This is required in order for Gateway to allocate some space to hold the emuNAND, which is a replica of your original firmware or sysNAND. Basically you boot into emuNAND to launch your 3DS Roms and update the emuNAND firmware to the latest one that Gateway support.
• After formatting the emuNAND, click [Boot Gateway Mode] and you should then see a familiar 3DS OS, press the [Select] button and you'll then see emuNAND at the ROM selection menu!
• Finally power off your N3DS, remove the microSD card and copy all the backup files that you did before back to the microSD card. Remember that Gateway 3DS had erase all the content in our microSD card to make room for emuNAND?

You can read more about sysNAND and emuNAND on GBAtemp, which I shall not mentioned here. That's not the purpose of this guide are they?

Other stuff that you could do from this point onwards:

• Launch BigBlueMenu and install SaveDataFiler.cia
• Use SaveDataFiler.cia to transfer your save file from other 3DS to N3DS

Troubleshooting

Whenever you boot into Gateway Mode, you might find that the 3D effect is no longer the 'right' 3D effect when you have it enabled. In fact the 3D looks like superimposed or cross eyed 2D image. To fix it, simply close the 3DS lid and open it again. Not really sure what's the reason but this method works every single time.

The awkward 3D effect when you boot into Gateway mode. To fix this peculiar issue, simply close the lid and open it again.

Epilogue

Hopefully you found this guide to be helpful. Leave a comment below if the walkthrough works for you and you encountered the same experience as I did.

Now then I'm back to the 3DS scene and enjoying my 3DS LL, I might even write more post about 3DS home-brew if I got request  for those :-D

External References

https://gbatemp.net/threads/tutorial-the-homebrew-launcher-and-custom-themes-all-in-one-noobs-guide.395652/

http://www27.atwiki.jp/nand3ds/pages/14.html

http://wololo.net/2016/01/04/3ds-system-software-downgrade-tutorial/

http://3dsfirmware.blogspot.tw/

https://translate.google.com/translate?hl=en&sl=ja&u=http://ameblo.jp/shoanddiggy/entry-12114578043.html&prev=search

http://twigstechtips.blogspot.tw/2016/01/how-to-safely-downgrade-your-oldnew.html

https://gbatemp.net/threads/wip-safesysupdater.409392/

https://www.reddit.com/r/3dshacks/comments/3yyegv/new_n3dsxl_w_990_26u_trying_to_browserhax_but/

https://gbatemp.net/threads/new-3ds-emunand-and-3d-problems.392581/