Homebrew Official [Download] Decrypt9 - Open Source Decryption Tools (WIP)

  • Thread starter d0k3
  • Start date
  • Views 842,782
  • Replies 4,476
  • Likes 71

zoogie

playing around in the end of life
Developer
Joined
Nov 30, 2014
Messages
8,560
Trophies
2
XP
15,000
Country
Micronesia, Federated States of
Good idea! Especially before injecting anything. You don't happen to know how to enable ITCM access in the Decrypt9 launcher.dat exploit method?
Wish I knew. Maybe switch to running on process9? (don't know how to do that lol)
 

d0k3

3DS Homebrew Legend
OP
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
Can i get the xorpads generated with the ncchinfo.bin from the emunand? or nand only?
I'd say, for ncchinfo.bin files that should not matter. Just try it. BTW, you noticed there's a much more convenient title decryptor (meaning: direct decryption of 3DS files) in there now, right? ;)
 

StevenSeegal

Well-Known Member
Newcomer
Joined
Jul 22, 2015
Messages
45
Trophies
0
Age
39
XP
387
Country
Netherlands
I'd say, for ncchinfo.bin files that should not matter. Just try it. BTW, you noticed there's a much more convenient title decryptor (meaning: direct decryption of 3DS files) in there now, right? ;)
I shall give it a try tomorrow. I'm aiming on decrypting something what in the firmware. it did work on FW 9.2 which my ds is running on but the file has changed in FW 9.6. That's the reason why i asked as the 9.6 firmware is running on the emunand :). The direct encryption sounds cool too, i'll check it out for my next project!
 

d0k3

3DS Homebrew Legend
OP
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
I shall give it a try tomorrow. I'm aiming on decrypting something what in the firmware. it did work on FW 9.2 which my ds is running on but the file has changed in FW 9.6. That's the reason why i asked as the 9.6 firmware is running on the emunand :). The direct encryption sounds cool too, i'll check it out for my next project!
Okay, I'm not entirely sure what you want to do :). On 9.6 EmuNAND you should have no way of launching Decrypt9. If you mean the seed crypto, well, then you need the seeddb.bin. You can describe the thing you want to do in more detail, and I'll try to help, but for now I suggest just try it.
 
Last edited by d0k3,

StevenSeegal

Well-Known Member
Newcomer
Joined
Jul 22, 2015
Messages
45
Trophies
0
Age
39
XP
387
Country
Netherlands
Okay, I'm not entirely sure what you want to do :). On 9.6 EmuNAND you should have no way of launching Decrypt9. If you mean the seed crypto, well, then you need the seeddb.bin. You can describe the thing you want to do in more detail, and I'll try to help, bus for now I suggest just try it.
I already have the seeddb.bin :), was able to dump the emuNand in the nand dump menu. What i want to do is extract a romfs located in the newer firmware (located on my emuNand) and for decrypting it i need to generate a xorpad from the ncchinfo.bin. I've done it with my 9.2 firmware on my systemNand which went great but now i want to repeat it for the 9.6 firmware located on my emuNand. If i do a nand dump i can select either the systemNand or emuNand but for generating the xorpad i don't get that selection so i'm assuming the xorpad is only generated from the systemNand. I'll try things out tomorrow, heading off to bed now :)
 

d0k3

3DS Homebrew Legend
OP
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
I already have the seeddb.bin :), was able to dump the emuNand in the nand dump menu. What i want to do is extract a romfs located in the newer firmware (located on my emuNand) and for decrypting it i need to generate a xorpad from the ncchinfo.bin. I've done it with my 9.2 firmware on my systemNand which went great but now i want to repeat it for the 9.6 firmware located on my emuNand. If i do a nand dump i can select either the systemNand or emuNand but for generating the xorpad i don't get that selection so i'm assuming the xorpad is only generated from the systemNand. I'll try things out tomorrow, heading off to bed now :)
In fact, SysNand or EmuNAND shouldn't matter for ncchinfo.bin files, as all the info is inside the files and the NAND is not even peeked at. Tell me how it goes!
 

mixups

Active Member
Newcomer
Joined
May 26, 2015
Messages
28
Trophies
0
XP
74
Country
United States
That was a hard one... New release available that should fix the remaining problems.

By the way, has anyone tested Pony Pets 3D (Japan) with the new title decryptor yet? @mixups maybe? Pony Pets 3D is the title that failed with the NCCH xorpad generator, because it seems to use seed crypto but no 7x crypto.
I've tested Pony Pets 3D failed with the New release.
Check your PM:)

BTW. We can switch the options push R button,
However, it switched next options when I pull R button.
 

d0k3

3DS Homebrew Legend
OP
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
I've tested Pony Pets 3D failed with the New release.
Check your PM:)

BTW. We can switch the options push R button,
However, it switched next options when I pull R button.
Okay, thank you! The fix that was pulled into Archshifts repo, I assume that is one hundred percent tested? Meaning, decryption is okay, converted .CIA works, etc? I'm asking because your fix directly contradicts something written on 3Dbrew:
3Dbrew.org said:
Starting with 9.6.0-X Process9 can now generate the NCCH keyY with the first 0x10-bytes from a SHA256 hash (when ncchflag[7] has bitmask 0x20 set).
[...]
This new keyY generation can only be used with 7.0.0-X NCCH encryption or above (that is, the new keyY is only used with the non-0x2C-keyslots).
As 3Dbrew.org is a work in progress, that must not mean you're wrong - it can also mean the author is.

And the R button issue - I know. Somehow the hid input routines are not perfect. I'll try to think about a solution.
 

mixups

Active Member
Newcomer
Joined
May 26, 2015
Messages
28
Trophies
0
XP
74
Country
United States
3Dbrew.org said:
Keyslots
0x25 v7.0 NCCH key, when ncchflag[3] is 0x01.
0x2C Original NCCH key, when ncchflag[3] is 0x00 and always for certain NCCH sections.
From http://3dbrew.org/wiki/AES_Registers
Keyslots has been managed in ncchflag[3].
If you set ncchflag[3] to 0x00, Keyslots 0x2C is used.
It should be same as SeedCrypto.

I make a cryptofix .3ds rom worked in GW n3ds 9.5.
also decrypted rom worked in citra.
Edit: I tested converted .CIA worked in GW n3ds 9.5. so, more accurate that written on 3Dbrew.
 
Last edited by mixups,

d0k3

3DS Homebrew Legend
OP
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
Keyslots has been managed in ncchflag[3].
If you set ncchflag[3] to 0x00, Keyslots 0x2C is used.
It should be same as SeedCrypto.

I make a cryptofix .3ds rom worked in GW n3ds 9.5.
also decrypted rom worked in citra.
Edit: I tested converted .CIA worked in GW n3ds 9.5. so, more accurate that written on 3Dbrew.
Alright, thank you! I'll do some testing of my own and then write about it. By the way, the title decryptor (in the newest release version) should work for Pony Pets 3D. It does everything exactly the same as you do.

@everyone:
The title decryptor was the last planned feature, so what I'll do now is tightening up the loose ends. That means:
  • Testing of new and old functionality (participation is highly welcome)
  • Merging Shadowtrances and my branches
  • Feeding back functionality to Archshifts branch via Github pull requests
  • Fixing bugs and cosmetic problems
So, are there any features you still wish to have in Decrypt9? Any bugs, or anything you wish worked differently? Let me hear it! Feedback is highly welcome.
 

d0k3

3DS Homebrew Legend
OP
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
Ticket.db dumper from (Gateway) Emunand :D
To be honest, I wouldn't be too happy to add funtionality for a proprietal EmuNAND solution in there. Plus, that would require a ton of changes and further O3DS / N3DS customizations. So, unlikely for now. What would be possible pretty easily is a specialed Decrypt9 version that uses the Gateway EmuNAND instead of the SystemNAND. Problem here is: I can't test this, I don't have the Gateway, and I would need further information.
 

Asia81

Yuri Lover ~
Member
Joined
Nov 15, 2014
Messages
6,662
Trophies
3
Age
29
XP
3,537
Country
France
It's not a problem for me, I have my own batch script and your FAT16 CTOOL for extract my ticket.db from my N3DS EmuNand, it's so easy.

It was just an idea for you :)

--------------------- MERGED ---------------------------

To be honest, I wouldn't be too happy to add funtionality for a proprietal EmuNAND solution in there. Plus, that would require a ton of changes and further O3DS / N3DS customizations. So, unlikely for now. What would be possible pretty easily is a specialed Decrypt9 version that uses the Gateway EmuNAND instead of the SystemNAND. Problem here is: I can't test this, I don't have the Gateway, and I would need further information.

I have my GateWay, if you need a tester :)
 

zoogie

playing around in the end of life
Developer
Joined
Nov 30, 2014
Messages
8,560
Trophies
2
XP
15,000
Country
Micronesia, Federated States of
ROM dumping from gamecart:D
There's already uncart. There's already gateway. Let's ask for something that doesn't exist instead of wasting devs time reinventing the wheel.

The thing most people would appreciate is a one-step cci to cia tool. Would be well received I think.
 

Zidapi

Well-Known Member
Member
Joined
Dec 1, 2002
Messages
3,112
Trophies
3
Age
42
Website
Visit site
XP
2,681
Country
The title decryptor was the last planned feature, so what I'll do now is tightening up the loose ends.
*tying up loose ends.

Think of it in the context of shoe laces, as opposed to a well used vagina ;)

To be honest, I wouldn't be too happy to add funtionality for a proprietal EmuNAND solution in there. Plus, that would require a ton of changes and further O3DS / N3DS customizations. So, unlikely for now. What would be possible pretty easily is a specialed Decrypt9 version that uses the Gateway EmuNAND instead of the SystemNAND. Problem here is: I can't test this, I don't have the Gateway, and I would need further information.
What's so proprietary about Gateway's emuNAND?

Isn't it the same format that reiNAND and SALT (will) use, or are they simply "compatible" with Gateway's emuNAND format?

I'm sure many here would be happy to help test a Gateway/reiNAND compatible version of decrypt9.

As for new features; the ability to import/export/delete individual tickets from Title.db would be amazing! But that might be a bigger task than you're willing to tackle.
 

Shadowtrance

Well-Known Member
Member
Joined
May 9, 2014
Messages
2,493
Trophies
0
Location
Hervey Bay, Queensland
XP
1,807
Country
To be honest, I wouldn't be too happy to add funtionality for a proprietal EmuNAND solution in there. Plus, that would require a ton of changes and further O3DS / N3DS customizations. So, unlikely for now. What would be possible pretty easily is a specialed Decrypt9 version that uses the Gateway EmuNAND instead of the SystemNAND. Problem here is: I can't test this, I don't have the Gateway, and I would need further information.

What's so proprietary about Gateway's emuNAND?
Isn't it the same format that reiNAND and SALT (will) use, or are they simply "compatible" with Gateway's emuNAND format?
I'm sure many here would be happy to help test a Gateway/reiNAND compatible version of decrypt9.
As for new features; the ability to import/export/delete individual tickets from Title.db would be amazing! But that might be a bigger task than you're willing to tackle.

There's nothing proprietary about it at all really. It's just a RAW partition mirror image of the nand on the sd card but basically every cfw there is atm that has emunand uses that setup (besides the old 4.x only cfw with its REDNAND, which i doubt anyone uses anymore anyway).
That being said, i know rxTools had (has?) the ability to dump files from emunand as well as sysnand (i haven't looked in a while), so not sure how hard it would be to implement ticket.db dumping from emunand.
And of course, as you know @d0k3 i have 3 3ds's at my disposal to test anything thrown at me :P (as well as gateway and sky3ds). :)

As for your suggestion @Zidapi i have no idea how hard that would be to add, I'm going to guess difficult. haha
 

d0k3

3DS Homebrew Legend
OP
Member
Joined
Dec 3, 2004
Messages
2,786
Trophies
1
XP
3,896
Country
Germany
ROM dumping from gamecart:D
I know, all-in-one solutions are convenient, but as zoogie said, you can just use uncart or the GW launcher (GW card not needed). Shadowtrance tried at one point to just copy the uncart code into Decrypt9, but that didn't work for one reason or the other. I might take a short look at merging the uncart code into Decrypt9 at a later point, but don't get your hopes too high up.

The thing most people would appreciate is a one-step cci to cia tool. Would be well received I think.
That's a feature I'd like to have, too. It might be a too complicated process, though, as all 3DS -> CIA conversion guides I've seen so far seem to indicate. I'm looking into the possibility, more about that later.

As for new features; the ability to import/export/delete individual tickets from Title.db would be amazing! But that might be a bigger task than you're willing to tackle.

That would require a ton of UI work (and Decrypt9 was never designed for complex UI interactions). Plus, apart from a working but somewhat brute force approach to extract title keys, we don't know enough about the ticket.db to be able to safely alter it. So, unlikely for now.

I'm sure many here would be happy to help test a Gateway/reiNAND compatible version of decrypt9.
It's just a RAW partition mirror image of the nand on the sd card but basically every cfw there is atm that has emunand uses that setup (besides the old 4.x only cfw with its REDNAND, which i doubt anyone uses anymore anyway).
That being said, i know rxTools had (has?) the ability to dump files from emunand as well as sysnand (i haven't looked in a while), so not sure how hard it would be to implement ticket.db dumping from emunand.
And of course, as you know @d0k3 i have 3 3ds's at my disposal to test anything thrown at me :P (as well as gateway and sky3ds). :)
So, can rxTools dump stuff from Gateways EmuNAND and does EmuNAND work the same on O3DS and N3DS? Is the raw NAND image always in the same place and has the same name for each solution (and where is it)? If so, I'll make a specialized Decrypt9 version that uses EmuNAND instead of SysNAND. Including that functionality (via some switch functionality) into main Decrypt9 is not a good idea right now, as it would require some critical changes that could backfire at a later point.


Two requests of my own:
  • I'm still unsure wether the NAND title key decryptor really catches all title keys. There might or might not still be problems with DSIware title keys. If someone could test and give me feedback, that would be welcome.
  • Some of you may already know, but my N3DS (regular, not XL) has a broken L shoulder button right now. It is bad, and it needs a replacement. Spare parts for N3DS are not yet available (you can't use any O3DS spare parts), a warranty repair would lead to me getting a refurbished bad FW version N3DS back and good version N3DS consoles are 250€ (~= 280$) used here in germany right now (which I don't want to pay). I'd be willing to shell out the regular price for a good FW version N3DS (regular or XL) though, in which case the other one will get the warranty repair and will be sold on eBay afterwards. If you got any ideas about that, let me know!
 
Last edited by d0k3,

StevenSeegal

Well-Known Member
Newcomer
Joined
Jul 22, 2015
Messages
45
Trophies
0
Age
39
XP
387
Country
Netherlands
I shall give it a try tomorrow. I'm aiming on decrypting something what in the firmware. it did work on FW 9.2 which my ds is running on but the file has changed in FW 9.6. That's the reason why i asked as the 9.6 firmware is running on the emunand :). The direct encryption sounds cool too, i'll check it out for my next project!

In fact, SysNand or EmuNAND shouldn't matter for ncchinfo.bin files, as all the info is inside the files and the NAND is not even peeked at. Tell me how it goes!

Just wanted to let you know that it did work perfectly
 
  • Like
Reactions: d0k3

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    bassviolet @ bassviolet: uwu