Hacking Can We Unbrick a 3DS With No NAND Backups and a Hard Mod Yet?

[Pokéidiot]

Decrypt9 does generate NAND xorpads.
You can even generate only those that decrypt FIRM0 and FIRM1. But, NAND xorpads are console-unique.

 

[Urbanshadow]

Decrypt9 does generate NAND xorpads.
You can even generate only those that decrypt FIRM0 and FIRM1. But, NAND xorpads are console-unique.

Yeah ofc, but if you happen to have two systems in the same version, you should be able to decrypt the nand backup from system A with xorpads of the system A then encrypt the backup with xorpads of system B to obtain a nand backup from system B.

I remember something not working in there though.

 

[gamesquest1]

Bear in mind that if there was a interrupted firm update, the plaintext firm attack method relies on knowing the exact plaintext of the existing firm.....if you crashed half way through flashing firm you wouldnt have the exact plaintext as it would obviously of not completely written so you would not really be able to do the plaintext attack unless you
A) know the exact offset it crashed at and can make your own plaintext bricked firm
B) already have your xorpads to write a new firm (which is essentially nearly as good as having a nand backup as long as you know roughly what you messed up)
C) you fancy spending weeks going through every possible offset hoping to by chance get licky and manage to build a corrupt firm that mayches exactly how your firm was corrupt



Basically, unless we get a way of generating the xorpad for a bricked console on a different console using an existing pre-exisitng dump of the unique info used to make the console specific nand encryprion, im not certain but i assume the nand encryption is derived in some way from the otp, in which case maybe one day a otp dump may be enough to generate xorpads for another console, but honestly idk how things go at bootup and if the values loaded by otp could be substituted for those from another console (or even if the otp has anything to do with nand encryption)

Tldr: - make a god damn nand backup already ffs :^)

 

[emanoel182]

I believe with 2 nands good, it is possible to fix one NAND through the Hex editor.Anyone tried it? It is something that will give a lot of work.

 

[emanoel182]

If someone help in uploading two nands different N3DS, I would try the hex editor to fix my corrupted Nand ....

 

[vb_encryption_vb]

If someone help in uploading two nands different N3DS, I would try the hex editor to fix my corrupted Nand ....

Wont work, you need the proper keys.

 

[Xenon Hacks]

 

[Sgt. Lulz]

-snip-

 

[emanoel182]

Wont work, you need the proper keys.

I suppose the keys are inside the dump nand . we would not modify the keys , only the OS.

 

[solress]

I suppose the keys are inside the dump nand . we would not modify the keys , only the OS.

If it was only that easy

 

[GothicIII]

I believe with 2 nands good, it is possible to fix one NAND through the Hex editor.Anyone tried it? It is something that will give a lot of work.

You don't understand how the encryption works. The xorpad is a key which is as (nearly) big as the nand itself and it consist of only random generated data (or algorythm).
If you dump the nand and compare it to another from a different console they will have pretty much nothing in common. It's impossible to hack this encryption without knowing the masterkey from which the xorpads are generated or have the exact xorpads to decrypt the content.

Example:

Cleartext on both console:

DEAD BEEF

written on NAND1 (XORPAD is A383 203D):
7D2E 9ED2
written on NAND2 (XORPAD is 92BC 7657):
4C11 C8B8

There is nothing you can hexedit with comparing two nands because they have nothing in common.

 

[emanoel182]

please someone can upload a dump nand a N3DS

 

[GothicIII]

@emanoel182: Nobody will do this if they know what it is. The nand contains very unique information (e.g. Secureinfo) and should NOT be uploaded by anybody.
Without xorpads the nanddump will be useless anyway.

It does not make sense what you are trying to do.

 

[solress]

please someone can upload a dump nand a N3DS

there's no use for that whatsoever

 

[emanoel182]

You don't understand how the encryption works. The xorpad is a key which is as (nearly) big as the nand itself and it consist of only random generated data (or algorythm).
If you dump the nand and compare it to another from a different console they will have pretty much nothing in common. It's impossible to hack this encryption without knowing the masterkey from which the xorpads are generated or have the exact xorpads to decrypt the content.

Example:

Cleartext on both console:

DEAD BEEF

written on NAND1 (XORPAD is A383 203D):
7D2E 9ED2
written on NAND2 (XORPAD is 92BC 7657):
4C11 C8B8

There is nothing you can hexedit with comparing two nands because they have nothing in common.

I think I understand now .

 

[emanoel182]

Is there someone or some forum Trying to somehow solve these "problems" encryption ?

 

[Xenon Hacks]

Is there someone or some forum Trying to somehow solve these "problems" encryption ?

unless you're a wizard and you can dump the Bootrom there's nothing you can do so don't bother.

 

[astronautlevel]

unless you're a wizard and you can dump the Bootrom there's nothing you can do so don't bother.

Even with a bootrom dump we won't necessarily know how it encrypts it. Keys are useless if you don't know the algorithm.

 

[emanoel182]

I found something about unlocking the nand with a raspberry pi, anyone know?

 

[vb_encryption_vb]

I found something about unlocking the nand with a raspberry pi, anyone know?

That's to unbrick GW. It's been stated may times, without the keys, you can NOT DO ANYTHING.