Homebrew The bootroms

Aletron9000 · Jul 27, 2016

Poryhack said:
That should already be quite doable without any bootroms. Hell the "bigbluemenu" that everyone was using for so long is nothing but a dev "rom" with a banner and (maybe) encryption/signing swap.

But at first, it was a dev .cia, someone took it, put it into a dev unit and decrypted the cia, then reencrypted it on a retail system. I mean we would be able to decrypt dev roms on the computer without a dev unit.

Which would make things easier and cheaper

Thee_BaBs · Jul 27, 2016

-snip-

sirocyl · Jul 27, 2016

The "Dev bootrom" is identical to the master, production, retail bootrom. In fact, the only place the bootrom itself would vary, is in an engineering sample pre-release - likely one with a socketed SoC, too.

The only thing that differs, is the contents of the OTP area, and what bootrom does with them - the OTP holds secondary keys, system identification/registration numbers, and system configurations/provisioning.

The bootrom holds a key which is used to decrypt the OTP area, which is the same key in all configurations.

Also, the bootrom key may be responsible for "factory things", such as preinstall and the provision/registration process (which "burns" the OTP in the first place).
That way, if said "factory things" were to leak from the factory, they'd be useless without the bootrom secret.

Poryhack · Jul 28, 2016

Aletron9000 said:
But at first, it was a dev .cia, someone took it, put it into a dev unit and decrypted the cia, then reencrypted it on a retail system. I mean we would be able to decrypt dev roms on the computer without a dev unit.

That has also been possible for some time using nothing but ctrtool/makerom, provided the dev CIA is using the "fixed" dev NCCH keys. See for yourself (ctrl+F, "dev_fixed_ncch_key"). Spoiler alert: For non-system titles it's literally just zeros.

Aletron9000 · Jul 28, 2016

Poryhack said:
That has also been possible for some time using nothing but ctrtool/makerom, provided the dev CIA is using the "fixed" dev NCCH keys. See for yourself (ctrl+F, "dev_fixed_ncch_key"). Spoiler alert: For non-system titles it's literally just zeros.

I have alot of work to catch up on now that i know this.

dankzegriefer · Jul 28, 2016

PabloMK7 said:
So if timing is that short, what about making a loop that increments the number of ms each time so we get the timing with brute force?

ms might be too fast.

--------------------- MERGED ---------------------------

Poryhack said:
That has also been possible for some time using nothing but ctrtool/makerom, provided the dev CIA is using the "fixed" dev NCCH keys. See for yourself (ctrl+F, "dev_fixed_ncch_key"). Spoiler alert: For non-system titles it's literally just zeros.

DevMenu is always encrypted as a system title.

PabloMK7 · Jul 28, 2016

dankzegriefer said:
ms might be too fast.

I said ms, but I meant any time unit, I know it is much smaller time

dankzegriefer · Jul 28, 2016

PabloMK7 said:
I said ms, but I meant any time unit, I know it is much smaller time

The best device for the job might be an FPGA.

dankzegriefer · Jul 28, 2016

Xenon Hacks said:
Is the actual timing known but not feasible to get?

The timing is unknown and infeasible unless you have a very fast device. I think an old estimation is you'd need a processor faster than the 3DS's to even attempt.

Poryhack · Jul 29, 2016

dankzegriefer said:
DevMenu is always encrypted as a system title.

Yes but the fixed crypto key for system titles is on that page as well, right next to the non-system key.

dankzegriefer · Jul 29, 2016

Poryhack said:
Yes but the fixed crypto key for system titles is on that page as well, right next to the non-system key.

New versions use new NCCH crypto.

Poryhack · Jul 29, 2016

dankzegriefer said:
New versions use new NCCH crypto.

Ah, well in that case yes. It would require keys from the bootrom (or at least keys that haven't been discovered yet) to decrypt on a computer. Should also be possible to decrypt with Decrypt9 on an updated dev system.

dankzegriefer · Jul 29, 2016

Poryhack said:
Ah, well in that case yes. It would require keys from the bootrom (or at least keys that haven't been discovered yet) to decrypt on a computer. Should also be possible to decrypt with Decrypt9 on an updated dev system.

And dev systems grow on trees.

Swiftloke · Jul 29, 2016

dankzegriefer said:
The timing is unknown and infeasible unless you have a very fast device. I think an old estimation is you'd need a processor faster than the 3DS's to even attempt.

That's not that hard these days xD

dankzegriefer · Jul 29, 2016

Swiftloke said:
That's not that hard these days xD

True, but it would probably need a direct connection, so an FPGA is probably the only thing that COULD do it.

Poryhack · Jul 29, 2016

dankzegriefer said:
And dev systems grow on trees.

Not sure if sarcasm or not, but they've never been easier to acquire. Even without going the NDA route there is sure to be a fairly active secondhand market on ASSEMblergames. Hell, there's even a debugger unit for sale on eBay. Cost will always be an issue, but from what I hear the "panda" units can be had for surprisingly cheap.

Suiginou · Jul 29, 2016

dankzegriefer said:
New versions use new NCCH crypto.

New NCCH crypto (7.x crypto) does not use hardcoded bootrom keys. It's possible to write an a9lh tool to regenerate the keys.

dankzegriefer · Jul 29, 2016

Suiginou said:
New NCCH crypto (7.x crypto) does not use hardcoded bootrom keys. It's possible to write an a9lh tool to regenerate the keys.

Yeah, now you get a SNAKE devkit and install arm9loaderhax on it. If @Reisyukaku hasn't already done it, nobody will.

Suiginou · Jul 29, 2016

dankzegriefer said:
Yeah, now you get a SNAKE devkit and install arm9loaderhax on it. If @Reisyukaku hasn't already done it, nobody will.

But he has.

Xenon Hacks · Jul 29, 2016

Suiginou said:
But he has.

Please tell this is just a language gap and when you said "he" you meant "it"

Homebrew The bootroms

Well-Known Member

I do things, sometimes

Are we Geniuses or what?

Well-Known Member

Well-Known Member

Banned!

Red Yoshi! ^ω^

Banned!

Banned!

Well-Known Member

Banned!

Well-Known Member

Banned!

Hwaaaa!

Banned!

Well-Known Member

(null)

Banned!

(null)

Well-Known Member

Similar threads

Popular threads in this forum