From 943b461de31d43f1ce6561483662ea32ca7df995 Mon Sep 17 00:00:00 2001
From: DannyAAM <danny@saru.moe>
Date: Thu, 27 Feb 2025 03:10:07 +0800
Subject: [PATCH] hotfix for uninstall cfw script brick issue

---
 docs/public/gm9_scripts/uninstall_hax.gm9 | 84 +++++++++++++++++++++++
 docs/uninstall-cfw.md                     | 10 ++-
 2 files changed, 88 insertions(+), 6 deletions(-)
 create mode 100755 docs/public/gm9_scripts/uninstall_hax.gm9

diff --git a/docs/public/gm9_scripts/uninstall_hax.gm9 b/docs/public/gm9_scripts/uninstall_hax.gm9
new file mode 100755
index 0000000000..e57e49741f
--- /dev/null
+++ b/docs/public/gm9_scripts/uninstall_hax.gm9
@@ -0,0 +1,84 @@
+set PREVIEW_MODE "Hax Uninstaller Script\n\nDerived from\nGODMODE9 ALL-IN-ONE MEGASCRIPT\noriginally by annson24"
+
+if	not ask "!!WARNING!!\nThis will completely remove CFW and\nrevert your system to stock.\n \nProceed anyway?"
+	goto Exit
+end
+
+if	not chk $[HAX] "ntrboot"
+	if	not ask "!!WARNING!!\nntrboot not detected!\nYou should at least have ntrboot or a hardmod\nwith you before proceeding in case of brick.\n \nProceed anyway?"
+		goto Exit
+	end
+end
+
+if	chk -u $[ONTYPE] "N3DS"
+	goto Unhax_Old
+end
+
+if	not sha S:/sector0x96.bin 82F2730D2C2DA3F30165F987FDCCAC5CBAB24B4E5F65C981CD7BE6F438E6D9D3
+	if	not find 0:/boot9strap/secret_sector.bin SECRET
+		if	not find $[GM9IN]/boot9strap/secret_sector.bin SECRET
+			echo "Sector 0x96 is not genuine.\nYou must have the secret_sector.bin file in the\nboot9strap folder first then try again.\n \nAborting."
+			goto Exit
+		end
+	end
+
+	if	not allow -a S:
+		echo "Permissions denied. Aborting."
+		goto Exit
+	end
+
+	cp -n -w S:/sector0x96.bin $[SECRET].bak
+	cp -n -w $[SECRET] S:/sector0x96.bin
+end
+
+if	not find 1:/title/00040138/20000002/content/????????.app NATIVE_NCCH
+	echo "NATIVE_FIRM not found.\nIs this a N3DS?"
+	goto Exit
+end
+goto Actual_Unhax
+
+@Unhax_Old
+
+if	not find 1:/title/00040138/00000002/content/????????.app NATIVE_NCCH
+	echo "NATIVE_FIRM not found.\nIs this an O3DS?"
+	goto Exit
+end
+
+@Actual_Unhax
+
+imgmount $[NATIVE_NCCH]
+verify G:/exefs/.firm
+shaget G:/exefs/.firm@0:200 NFIRM_HDR_HASH
+set NATIVE_FIRM 9:/NATIVE_FIRM.firm
+cp -w G:/exefs/.firm $[NATIVE_FIRM]
+imgumount
+
+if	allow -a S:
+	allow -a 1:
+	cp -n $[NATIVE_FIRM] S:/firm0.bin
+	shaget S:/firm0.bin@0:200 FIRM0_HDR_HASH
+	if chk -u $[FIRM0_HDR_HASH] $[NFIRM_HDR_HASH]
+		echo "FIRM0 get corrupted during uninstallation! Aborting!"
+		goto Exit
+	end
+	verify S:/firm0.bin
+	cp -n $[NATIVE_FIRM] S:/firm1.bin
+	shaget S:/firm1.bin@0:200 FIRM1_HDR_HASH
+	if chk -u $[FIRM1_HDR_HASH] $[NFIRM_HDR_HASH]
+		echo "FIRM1 get corrupted during uninstallation! Aborting!"
+		goto Exit
+	end
+	verify S:/firm1.bin
+	rm -o -s 1:/boot.firm
+	rm -o -s 1:/rw/luma
+	shaget S:/nand.bin@57FFE00:200 PRE_STAGE2_HASH
+	if not sha S:/nand.bin@B800000:200 $[PRE_STAGE2_HASH]
+		fget S:/nand.bin@57FFE00:1 PRE_STAGE2
+		fill S:/nand.bin@B7FFE00:89C00 $[PRE_STAGE2]
+	end
+	echo "CFW uninstalled successfully"
+else
+	echo "Permissions denied. Aborting."
+end
+
+@Exit
diff --git a/docs/uninstall-cfw.md b/docs/uninstall-cfw.md
index cd8c671f33..f8e35c75d2 100644
--- a/docs/uninstall-cfw.md
+++ b/docs/uninstall-cfw.md
@@ -46,6 +46,7 @@ These instructions will only work on consoles with a Luma3DS version of 8.0 or h
 * The latest release of [GodMode9](https://github.com/d0k3/GodMode9/releases/latest) (the GodMode9 `.zip` file)
 * The latest release of [DSiWare Uninstaller](https://github.com/MechanicalDragon0687/DSiWare-Uninstaller/releases/latest)
 * [safety_test.gm9](/gm9_scripts/safety_test.gm9)
+* [uninstall_hax.gm9](/gm9_scripts/uninstall_hax.gm9)
 
 ## Instructions
 
@@ -56,7 +57,7 @@ These instructions will only work on consoles with a Luma3DS version of 8.0 or h
 1. Copy `GodMode9.firm` from the GodMode9 `.zip` to the `/luma/payloads/` folder on your SD card
 1. Copy the `gm9` folder from the GodMode9 `.zip` to the root of your SD card
 1. Copy `DSiWareUninstaller.3dsx` to the `/3ds/` folder on your SD card
-1. Copy `safety_test.gm9` to the `/gm9/scripts/` folder on your SD card
+1. Copy `safety_test.gm9` and `uninstall_hax.gm9` to the `/gm9/scripts/` folder on your SD card
 1. Reinsert your SD card into your console
 
 ### Section II - DS Mode Tests
@@ -197,14 +198,11 @@ If you're removing CFW because:
     + If you instead see the Luma3DS chainloader, use the D-Pad and the (A) button to select GodMode9
 1. Press (Home) to bring up the action menu
 1. Select "Scripts..."
-1. Select "GM9Megascript"
-1. Select "Hax Options"
-1. Select "Un-install Hax"
+1. Select "uninstall_hax"
 1. When prompted, press (A) to proceed
+2. press (A) again to proceed
 1. Press (A) to unlock SysNAND (lvl3) writing, then input the key combo given
 1. Press (A) to continue
-1. Press (B) to return to the main menu
-1. Select "Exit"
 1. Press (A) to relock write permissions if prompted
 1. Press (Start) to reboot your console