Hacking 3DS NAND is rippd!

[Knyaz Vladimir]

Heh, I'd love to spam the guy in our native language. But, no.

Anyone actually dl it? I'd love to fuck around with the file, but I really doubt I'd get anywhere. Besides, it's encypted.

And it makes sense why it's 128MB, it's because the 3DS firmware isn't complete and the rest of the space is for savefiles and shit.

Also, APRIL FOOLS, guys! 37 minutes in!

 

[DeadlyFoez]

So, what's your verdict, NANDmaster? Real?
I don't have it downloaded fully yet, but even when I do I won't have any way of being able to confirm or deny it by any means especially being that there are no keys with this.

Since google only shows this thread, the fact that no one has yet said how to dump this NAND chip that the datasheet is not available for, I will call it fake also, just like how I did on the first page.

On a brighter note, I'm going to get my 3DS in a few days if there are still some in stock by the time I get my tax return. When I get my 3DS I will remove the NAND chip and map out the traces and find out which test points they lead to. Of course only a small portion of the leads actually go somewhere, the rest are just for stable mounting of the BGA chip.

I will not even power on my 3DS until I can dump and write to the nand. There are priorities here

----

QUOTE(Slowking @ Mar 31 2011, 04:34 PM) I'm pretty sure it is completely encrypted. At least team fail0verflow said so in their presentation at the last C3, and they should know, most of them are twiizers.

I would bet that the REAL 3DS NAND is in fact fully encrypted, more reason to call this file a fake.

But about this presentation at C3, do you got a link to it, i somehow missed it.

 

[Slowking]

http://www.youtube.com/watch?v=eVXfgg7otJw It's a side note while talking about the different securiy measures this and last gens consoles.

 

[earny]

could this be done if nand were more easy to dump

1) dump your 3ds nand
2) add a picture (like qr code mii etc..)
3) dump again
4) compare the 2 nand to find where is the picture
5) then use your original picture to find the key

unless of course personnel data aren't crypted at all

 

[DeadlyFoez]

http://www.youtube.com/watch?v=eVXfgg7otJw It's a side note while talking about the different securiy measures this and last gens consoles.

Oh, Yeah, I did see that. But I don't remember them mentioning the 3DS, nor was the 3DS released yet so there is no way they could have commented on the NAND of the 3DS.

 

[Schlupi]

DELETE ME PLEASE MODS

A majority of the file is all 00s, and it's in some bizarre format viewing in Hex. Looks like bullshit to me.

It's not just zeroes, there's more than 100 MB of data around in the file.

CAN A MOD please delete this image form this post? The account is already being terrorized.

 

[Bent]

DeadlyFoez,

I will be the first to admit I am wrong if you can tell me why I haven't seen any significant 00's in a nand dump, even on a sparsly populated one. And I am not talking about an extracted dump, just to clear that up. Even before bootmii existed I saw nand dumps that were 512mb of encrypted data, with very little 00's.

 

[Slowking]

http://www.youtube.com/watch?v=eVXfgg7otJw It's a side note while talking about the different securiy measures this and last gens consoles.

Oh, Yeah, I did see that. But I don't remember them mentioning the 3DS, nor was the 3DS released yet so there is no way they could have commented on the NAND of the 3DS.

No, they commented on the Wiis Nand, which you were talking about in the post I quoted. Try to read your own posts next time. XD

 

[DeadlyFoez]

DeadlyFoez,

I will be the first to admit I am wrong if you can tell me why I haven't seen any significant 00's in a nand dump, even on a sparsly populated one. And I am not talking about an extracted dump, just to clear that up. Even before bootmii existed I saw nand dumps that were 512mb of encrypted data, with very little 00's.

Would you like me to upload my nand dump to you via torrent and you can take a look into it? I promise you that you will mostly see zeros.

There is a reason why N decided to do it like that because there is an easy function of the nand chip that allows you to quickly erase blocks of data so something can be quickly deleted from flash. N wouldn't go and use this function and then go and take the time to re encrypt blank space.

Ask any of the wii brick repair experts and they will tell you the same thing.

The reason why you saw very little 00's was probably because you just grabbed the scroll bard and slid it up and down in the hex editor and shitloads of date went past without ever being displayed on the screen.

How many free blocks on this NAND you say you looked at under the hex editor? I have only once seen a wii say it had more than 2000 free blocks, but in fact the nand chip has 4096 blocks on it. Then there is also the ECC data, and all the data is always scattered on the NAND, it's never all in one group.

Trust me, I do know what I am talking about. And to prove it even more, use punes NAND extractor app and have it open your nand up, but supply the app with keys to a different wii and you will see that his app still does show up the file system of the nand with directory structure and file names.

 

[DeadlyFoez]

http://www.youtube.com/watch?v=eVXfgg7otJw It's a side note while talking about the different securiy measures this and last gens consoles.
Oh, Yeah, I did see that. But I don't remember them mentioning the 3DS, nor was the 3DS released yet so there is no way they could have commented on the NAND of the 3DS.

No, they commented on the Wiis Nand, which you were talking about in the post I quoted. Try to read your own posts next time. XD

Sorry, getting lost on things since this is a 3DS thread. But the filesystem is not encrypted. Boot0, Boot1, and the individual files are encrypted, but not the file system itself.
and for proof, I just asked pune on IRC
QUOTE Question, is the wii's filesystem encrypted?
which wii?
i think a betwiin made with my library will work just as fast as ohneswanzenegger. so it should work in like 3-7 minutes
People are saying the wii's filesystem is encrypted, I'm under the belief that it is not.
which wii?
all wii's
in general
depends on which part of the filesystem you are talking abut
just about the file system, obviously not the files
directory structure and file names
those are not
Thank you.
http://www.wiibrew.org/wiki/NAND
search for "plain text"
which parts are encrypted?
you can decrypt boot2 since the ticket and tmd are readable from the nand directly before it. and all the directory tree and filenames is not encrypted 1 little bit
they are signed with hmac, so you cannot edit the names, but you can still read them
it is the actual data that belongs to the files that is encrypted

Ok and here is the page from www.wiibrew.org/wiki/NAND that pune was referring to. Notice what I have bolded out for you guys to see.
QUOTE

Physical layout

The NAND flash device is divided into 4096 blocks of 8 clusters. Each cluster is 8 pages. Each page is 2048 bytes of data and 64 bytes of "spare data" (used for error-correction (ECC) data and HMAC signatures on individual clusters).
Block 0 (pages 0-0x3F): boot1
boot1 is the second-stage bootloader; it is decrypted by boot0, which resides on a read-only mask rom inside the Starlet coprocessor. Its primary function is to load and decrypt boot2.
Block 0 is guaranteed by the manufacturer to be valid, so there is no bad block map necessary.
Blocks 1-7 (Pages 0x40 - 0x1ff) : boot2 (two copies and blockmaps)
boot2 is the third-stage bootloader; it is stored in a modified WAD format, including a ticket that is encrypted with the common key and signed.
Block 8 / Cluster 0x40 / Page 0x200: beginning of per-console unique data
Clusters 0x40 - 0x7EFF: Encrypted filesystem data. Data is encrypted with a per-console AES key, and then signed with a (separate, per-console) HMAC key.
Clusters 0x7F00-0x7FFF: Filesystem metadata (SFFS, unencrypted). There are 16 superblocks contained therein -- one every 16 clusters.
Metadata layout

The authoritative source of information about the Wii's metadata layout is Segher's zestig.c, but here is an attempt to describe that in English.
Each metadata "superblock" starts with the 4 magic bytes "SFFS", followed by a 4-byte "generation number" and another 4-byte number (always 0x10?). When accessing the FS, IOS will choose the superblock with the highest generation number and use it; whenever it modifies the filesystem in any way, it will increment the generation number by 1 and write out an entirely new superblock in the next slot (in round-robin order).
The next 0x10000 bytes (bytes 0xc:0x1000c within the superblock) are 0x8000 2-byte cluster numbers, and comprise the FAT. The FAT is followed by the FST -- the tree structure containing the directory hierarchy and (plaintext!) filenames.
FAT
The FAT contains cluster chain / allocation information for the entire NAND chip, including parts of it which are not technically part of the filesystem!
The first 64 entries will always be 0xFFFC, which indicates that this cluster is "reserved". These correspond to the first 64 clusters or 8 blocks -- which is where boot1 and boot2 are stored.
Special values include:
0xFFFB - last cluster within a chain
0xFFFC - reserved cluster
0xFFFD - bad block (marked at factory) -- you should always see these in groups of 8 (8 clusters per NAND block)
0xFFFE - empty (unused / available) space
Otherwise, the value stored within a slot in the FAT for a given cluster points to the next cluster in the chain, similar to the FAT used in DOS. Therefore, in order to figure out what clusters belong to what file, you must use the information in the FST to find the starting cluster for each file, and then follow each cluster chain.
FST
Each entry in the FST is 0x20 bytes. Here is a typical entry for a leaf node (regular file):

I rest my case.

 

[doyama]

Honestly we need to close this thread and ban the original poster. It doesn't take a genius to realize he was trolling. Consulting Occam's Razor we have 2 scenarios

1) A random person who is to shy to go to any regular DSi forum, makes his FRIEND create an account and post a link. This random person is so shy s/he does not want ANY recognition about this achievement but rather would proxy it out on a random forum. Because the scene is full of modest people and not glory seekers in any way.

2) Troll