USA 9.2.0-20U O3DS -> JAP 9.2.0-20U N3DS (region swapped) system transfer

gistfile1.txt

This documentation is mostly for archival purposes. I will not provide support or clarifications because the process is complicated and others issues not noted in the steps will occur. The way I patched the requests/responses is set up Charles Proxy to forward all ECS/NUS/IVS requests (at ip:8888) to Nintendo's server (ClCert needed). Then I put a breakpoint on all requests/responses. Modifying requests will change what Nintendo sees. Modifying responses will change what the 3DS sees. Both are needed.

Prerequisites:

1) Both O3DS and N3DS are on 9.2.0-20U
2) N3DS has been formatted after region swap and no NNID linked

O3DS code.bin patches needed: https://gist.github.com/yifanlu/b59b6d83d11bdb244cbd

System Transfer:

1) Create code.bin with your IP address, copy it to O3DS
2) Enter system transfer and start sending
3) On N3DS, enter NTR mode, enter the following commands
write(0x14e1bc,tuple(map(ord, "http://ip:8888/ECommerceSOAP\0")), pid=0x25)
write(0x14e533,tuple(map(ord, "http://ip:8888/ECommerceSOAP\0")), pid=0x25)
write(0x14e4f4,tuple(map(ord, "http://ip:8888/NetUpdateSOAP\0")), pid=0x25)
write(0xfffffd5,tuple(map(ord, "N3DS_SERIAL_HERE\0")),pid=0x7)
write(0x0010DD28, (0x00, 0x20, 0x08, 0x60, 0x70, 0x47), pid=0x25)
4) Enter system settings -> system transfer
5) (*) First response: ecs:GetAccountStatusResponse, patch the last couple of service urls:
<ServiceURLs><Name>EcsURL</Name><URI>http://ip:8888/ECommerceSOAP</URI></ServiceURLs><ServiceURLs><Name>IasURL</Name><URI>http://ip:8888/IdentityAuthenticationSOAP</URI></ServiceURLs><ServiceURLs><Name>CasURL</Name><URI>http://ip:8888/CatalogingSOAP</URI></ServiceURLs><ServiceURLs><Name>NusURL</Name><URI>http://ip:8888/NetUpdateSOAP</URI></ServiceURLs>
Also patch <Currency>USD</Currency></Balance><Country>US</Country><Region>USA</Region>
5a) If the next request is to ivs:GetChallenge, then run the following NTR command:
write(0x1febec,tuple(map(ord, "JP")),pid=0x25)
5b) After the ivs:RegisterResponse response, it will make another ecs:GetAccountStatus request, make the same changes to the response
5c) This may take a couple of tries; if it errors, enter system transfer and try again
6) Wait until: ivs:MoveAccountResponse, change ErrorCode response to <ErrorCode>0</ErrorCode>
7) Go through system transfer... until step 5, moving eshop
8) Two ivs:MoveAccountResponse will be made, change both ErrorCode response to <ErrorCode>0</ErrorCode>

At this point, the NNID will be linked to your New 3DS

NNID Linking:

1) On N3DS, go into system settings and link existing NNID to the one you moved
2) Reboot into NTR mode, and run the following commands:
write(0xfffffd5,tuple(map(ord, "N3DS_SERIAL_HERE\0")),pid=0x7)
write(0x0013E74C,tuple(map(ord, "N3DS_SERIAL_HERE\0")),pid=0x22)
write(0x0010DD28, (0x00, 0x20, 0x08, 0x60, 0x70, 0x47), pid=0x25)
write(0x001314F8, (0x06, 0x9A, 0x03, 0x20, 0x90, 0x47, 0x55, 0x21, 0x01, 0x70, 0x53, 0x21, 0x41, 0x70, 0x00, 0x21, 0x81, 0x70, 0x60, 0x61, 0x00, 0x20), pid=0x25)
write(0x0010e44c, tuple(map(ord, "http://yourip:8888/%s%sa/\0")),pid=0x22)
3) Enter eshop (follow (*) on GetAccountStatusResponse) and login to NNID. Capture all requests.
3a) Specifically capture the request (headers and all) to https://account.nintendo.net/v1/api/oauth20/access_token/generate
4) On O3DS create a new dummy NNID
5) Load code.bin and enter eshop (follow (*) on GetAccountStatusResponse)
6) Patch the request for https://account.nintendo.net/v1/api/oauth20/access_token/generate and replace the 
entire request by the one you captured in 3a. Let the response through.
7) Next request will be to https://account.nintendo.net/v1/api/people/@me/profile, change X-Nintendo-Device-ID, X-Nintendo-Serial-Number, X-Nintendo-Device-Cert to patch that from 3a
7a) When response for @me/profile comes in, replace user_id with your dummy nnid username
7b) If it errors, you need to capture the correct @me/profile request. To do that, on the O3DS, close and re-enter eshop, and pass the oauth20 request through (no patches), then pass the @me/profile request through and save the response. Finally log-out of your NNID by either restarting eshop and replacing the next request to account.nintendo.net with an invalid Authorization header (replace with junk) or go into system settings -> NNID settings and setting auto-login to false
8) The next request is for https://account.nintendo.net/v1/api/provider/service_token/@me, replace X-Nintendo-Device-ID, X-Nintendo-Serial-Number, X-Nintendo-Device-Cert headers with that from 3a
9) Once that request succeeds (200 OK), your NNID is linked to your N3DS

eShop:

Every time you wish to use eShop on the N3DS, you must enter NTR mode and use the following commands:
write(0xfffffd5,tuple(map(ord, "N3DS_SERIAL_HERE\0")),pid=0x7)
write(0x0013E74C,tuple(map(ord, "N3DS_SERIAL_HERE\0")),pid=0x22)
write(0x0010DD28, (0x00, 0x20, 0x08, 0x60, 0x70, 0x47), pid=0x25)
write(0x001314F8, (0x06, 0x9A, 0x03, 0x20, 0x90, 0x47, 0x55, 0x21, 0x01, 0x70, 0x53, 0x21, 0x41, 0x70, 0x00, 0x21, 0x81, 0x70, 0x60, 0x61, 0x00, 0x20), pid=0x25)
(details: http://gbatemp.net/threads/creating-a-north-american-non-xl-new-3ds.381775/page-37#post-5459760)