Downgrading (ugopwn)


If you need help, ask the Nintendo DSiBrew Discord!
I worked hard on this guide! If you want, you can donate through PayPal or Bitcoin!

We will now start downgrading to 1.4 system firmware.

You MUST have the Flipnote Studio app on your DSi in order for this to work. Your console must also be a USA region console, due to the limitations of the Flipnote exploit. If your console is a USA region console, its system version should end with the letter "U".

THERE IS A HIGH CHANCE OF BRICK WITH THE CURRENT METHOD, UNLESS YOU FOLLOW THESE INSTRUCTIONS CAREFULLY. ONLY YOU ARE RESPONSIBLE IF YOUR CONSOLE BRICKS. PROCEED WITH CAUTION. MOST IMPORTANTLY, DO NOT SKIP THE SECTION THAT DEALS WITH TESTING YOUR BACKUP, BECAUSE TESTING THE BACKUP IS THE EASIEST WAY TO PREVENT BRICKS.

You MUST Download a torrent client to download some of the below files. One such as Deluge would work fine.

What you need

Instructions

Section I - Dumping the Necessary Files

  1. Power off your device
  2. Insert your SD card into your computer
  3. Copy the contents of FWTool.zip to the root of your SD card and rename FWTool.nds to boot.nds
  4. Copy the contents of the ugopwn zip file to the root of your SD card.
  5. Remove the SD card from your computer and insert it into the SD card slot on your DSi
  6. Power on your device
  7. Go to System Settings > Data Management > Flipnote Studio (if you copy another DSiWare title, note that the .bin name will differ) > Copy > Yes and then exit to the DSi Menu
  8. Find the application named "Flipnote Studio" and open it.
  9. Choose "view flipnote", then choose "SD card"
  10. Choose "select folder", then choose "user" instead of "normal"
  11. Open the ugopwn folder
  12. Click on the note with the red bottom half, then choose "edit"
  13. Once you are on the editing page, click on the flipnote frog icon in the bottom left
  14. Click on the film roll icon, then choose "copy"
  15. Choose "back", then "exit"
  16. Click on the second note, then choose "edit"
  17. Click on the flipnote frog icon in the bottom left
  18. Click on the film roll icon
  19. Click on the single right arrow (the next to last arrow icon) two times. You should see a new frame be created.
  20. Now comes the hard part: Click on the paste button exactly 122 times
  21. Click the erase button, then the paste button
  22. Wait for FWTool to load. If it does not, you may have not renamed FWTool to boot.nds, or you may have clicked "paste" an incorrect number of times. If errors keep persisting, make sure your SD card is SDHC
  23. Select the options Dump CID and Dump nand_dsi.bin. This may take a while
  24. When both dumps are done, power off your device

  25. Section II - Downgrading your NAND

  26. Plug your SD card from your DSi into your PC
  27. Open your SD Card's drive and navigate to Private > DS > Title > 4B475545.bin and drag it to the same directory as dsi_srl_extract(make sure that you unzipped dsi_srl_extract.zip)
  28. Drag 4B475545.bin onto extract srl.bat
  29. Wait, and, when prompted, press any key to continue.
  30. You should see some new files
  31. Open HxD.exe and select the "Open" option
  32. Find the file named OUT.footer (in your dsi_srl_extract folder) and select "Open"
  33. You should see two blue lines of numbers and letters, one going up and down, and one going left to right
  34. Find the number "00000380" on the up-and-down line, and find "0F" on the left-to-right line. When you look at where they both lead, you should see two characters. Highlight them.
  35. Look to the right, and you should see a number that is also highlighted, followed by 15 other numbers below. Save all 16 of those (Not the pairs of letters and numbers!) to a text file to use for later. (This is called your Console ID)
  36. Open CID.bin in HxD (CID.bin is located in a folder of your SD Card with random letters and numbers!)
  37. Copy all the pairs of letters and numbers and paste it into a text file. (This is your CID, different from Console ID.)
  38. Open Codes.txt and replace "CID Here" and "ConsoleID Here" with your CID and ConsoleID (Make sure to delete the spaces of the CID! DO NOT DELETE THE [BRACKETS].)
  39. Save Codes.txt
  40. Open the directory of your SD Card, the folder with random letters and numbers, and copy nand_dsi.bin to the folder named twltool-v1.6 (make sure that you unzipped twltool-v1.6.zip)
  41. In the folder named twltool-v1.6, press shift and right click in an empty space and select "Open command window here" or "Open Powershell window here." Then paste in Code 1 (from our new Codes.txt) and press Enter
  42. When done, you should now have a file named NAND_DEC.bin
  43. With the DSi key torrent downloaded, place the file named dsikey.bin into the NUSDownloader folder when you finish generating the key.
  44. Open NUS Downloader.exe and check the box that says "Create Decryped Contents (*.app)"
  45. Select: Database > System (DSi) > System Menu (Launcher) > [Your Region] > v512
  46. Select "Start NUS Download!"
  47. When done, select: Database > System (DSi) > Nintendo DS Cart Whitelist > All > v256
  48. Select "Start NUS Download!"
  49. When done, select: Database > System (DSi) > System Settings > [Your Region] > v512
  50. Select "Start NUS Download!"
  51. When done, select: Database > System (DSi) > Version Data > [Your Region] > v4 (China)
  52. Select "Start NUS Download!"
  53. Install and open OSFMount
  54. Click the "Mount new..." button, followed by the "Image File" tick mark
  55. Press the button with the three periods (...) and select NAND_DEC.bin
  56. Select "Partition 0" when prompted. This file should be around 200 MB
  57. Uncheck the box that says "Read-Only Drive", and press OK
  58. Go to the "My Computer" directory, and you should see a new drive. Double-click it
  59. Delete anything inside of the "title\0003000f\484e4841\content" directory
  60. Open the folder called "titles" in the NUSDownloader_v19_DSi directory of your PC, open the folder named "0003000f484e4841", and open the folder named "256"
  61. Copy "00000001.app" and "tmd.256" from the folder you are now in, and paste them in the "title\0003000f\484e4841\content" folder on your new drive in your computer
  62. Rename "tmd.256" to "title.tmd."
  63. Delete anything inside of the "title\00030017\484e4145\content" directory of the new drive.
  64. Open the folder called "titles" in the NUSDownloader_v19_DSi directory of your PC, open the folder named "00030017484e41[XX]", and open the folder named "512"
  65. Copy "00000002.app" and "tmd.512" from the folder you are now in, and paste them in the "title\00030017\484e41[XX]\content" folder on your new drive in your computer
  66. Rename "tmd.512 to "title.tmd".
  67. Delete anything inside of the "title\00030015\484e4245\content" directory of the new drive.
  68. Open the folder called "titles" in the NUSDownloader_v19_DSi directory of your PC, open the folder named "00030015484e42[XX]", and open the folder named "512"
  69. Copy "00000002.app" and "tmd.512" from the folder you are now in, and paste them in the "title\00030015\484e42[XX]\content" folder on your new drive in your computer
  70. Rename "tmd.512 to "title.tmd".
  71. Delete anything inside of the "title\0003000f\484e4c45\content" directory of the new drive.
  72. Open the folder called "titles" in the NUSDownloader_v19_DSi directory of your PC, open the folder named "0003000f484e4c[XX]", and open the folder named "4"
  73. Copy "00000004.app" and "tmd.4" from the folder you are now in, and paste them in the "title\0003000f\484e4c[XX]\content" folder on your new drive in your computer
  74. Rename "tmd.4" to "title.tmd".
  75. Go to your OSFMount window, and press "Dismount". Exit OSFMount.
  76. In the folder named twltool-v1.6, press shift and right click in an empty space and select "Open command window here" or "Open Powershell Window here", then paste in Code 2 (from our new Codes.txt) and press Enter
  77. When it is done, you should see a file named "NAND_ENC.bin" in the "twltool-v1.6" folder

  78. Section III - Testing Your Downgraded NAND with NO$GBA

  79. Download and extract NO$GBA to a directory.
  80. Copy the NAND_ENC.bin file to your NO$GBA directory (make sure you have extracted the NO$GBA archive) and rename it to DSI-1.mmc
  81. Extract the DSi BIOS files from the "DSi firmware files.zip" archive into the NO$GBA directory
  82. Download the DSi footer template file and extract it to the NO$GBA directory.
  83. Open it in HxD.
  84. Replace the 16 bytes filed with AAs with your CID
  85. Replace the 8 bytes filed with BBs with your Console ID, but reversed. This means that if your Console ID starts with the byte 26 and ends with 08, for example, it should now end with 26 and start with 08.
  86. After you have inserted your CID and Console ID, highlight and copy the entire footer file.
  87. Open DSi-1.mmc and scroll to the end of the file. At the end of the file, paste in the footer.
  88. Save and close DSi-1.mmc and open No$GBA.
  89. Go to options and then Emulation setup.
  90. In the Emulation tab, set “Reset/Startup Entrypoint” to “GBA/NDS BIOS (Nintendo logo)” and NDS Mode Colors to “DSi (retail/16MB)”. Then click Save Now and then OK.
  91. Go to File, Cartridge Menu (FileName), and then open any .nds file (such as FWTool).
  92. Your NAND will now be emulated by NO$GBA. Check that your NAND works perfectly
  93. If your encrypted NAND works on NO$GBA, then rename the "NAND_ENC.bin" file to nand_dsi.bin (if it asks you to overwrite, you may want to move the other nand_dsi.bin somewhere else and try renaming it again)
  94. Move the new nand_dsi.bin to the folder in your SD card with random letters (if it asks to overwrite, simply accept)

  95. Section IV - Installing Your Downgraded NAND

  96. Follow steps 8-22 on section I of this page to re-open FWTool using ugopwn
  97. Once in FWTool again, select Restore nand_dsi.bin (This may take a while. DO NOT EXIT FWTool until the restoration is complete.)
  98. Exit FWTool. You should now be completely downgraded to version 1.4! You are ready to install HiyaCFW.

Continue to Installing HiyaCFW

If you would like a way to access DSi Homebrew without having to use ugopwn every time, follow the procedure for Installing exploitable DSiWare