Extracting CTRNAND

[BufferOverflow]

Due to the recent announcement from Nintendo that the services will be shutting down April this year, I would like to extract my partitionA.bin from an older NAND backup for Pretendo. I was able to extract the NAND bin using Ninfs. To access the internal CTR files, I tried to mount the ctrnand_full.img using OSFMount or open it using 7-ZIP but none of them worked. AFAIR, the ctrnand_full.img is encrypted. Using GodMode9, I can open the full backup, but It only displays the content that I already see on Windows. The older backup was created with an older version of GodMode9, which should be an issue here. Is there anything I missed out here? Thanks for any help!

PS: There is a way to "convert" the ctrnand_full.img using hex editor to a readable FAT partition (ctrnand_fat.img) but I was unable to find the necessary HEX values in my extracted ctrnand_full.img. I was also 1 year ago able to extract the CTRNAND, but I can't recall how I pulled this off.

 

[Kwyjor]

To access the internal CTR files, I tried to mount the ctrnand_full.img using OSFMount or open it using 7-ZIP but none of them worked. AFAIR, the ctrnand_full.img is encrypted.

The whole point of ninfs is that it decrypts these things for you.

Did you try copying ctrnand_full.img to somewhere else on your hard drive before using OSFMount or 7-Zip?

 

[BufferOverflow]

Yes, it did that before. I also tried two different NAND backups. Still no luck.

EDIT: Same results on a different PC.

 

[Kwyjor]

And how exactly are you trying to mount them with OSFMount? https://gbatemp.net/threads/extract...nd-backups-and-sd-contents-with-ninfs.499994/ specifically cautions against using drive letters.

Your screenshot suggests you have WinImage; does that work? (I'm not entirely sure 7-Zip supports hard drive images.)

 

[BufferOverflow]

And how exactly are you trying to mount them with OSFMount? https://gbatemp.net/threads/extract...nd-backups-and-sd-contents-with-ninfs.499994/ specifically cautions against using drive letters.

Your screenshot suggests you have WinImage; does that work? (I'm not entirely sure 7-Zip supports hard drive images.)

I tried to mount my image with and without a drive letter using OSFMount. I still can't read the image. WinImage reports an invalid image. I also tried the same thing with a current backup from my N3DS XL; same issue here. None of the tools, I used, recognized the image as a readable partition.

 

[Kwyjor]

Finally occurred to me to give this a go. I used DiskExplorer, which I had handy, and it opened right up. (I specified the default "plain image".)

PS: There is a way to "convert" the ctrnand_full.img using hex editor to a readable FAT partition (ctrnand_fat.img) but I was unable to find the necessary HEX values in my extracted ctrnand_full.img.

Also, I have no idea what you are referring to here. Doesn't ninfs provide the option of extracting either ctrnand_full or ctrnand_fat ?

 

[ihaveahax]

ninfs doesn't provide ctrnand_fat like GM9, only ctrnand_full.

 

[Kwyjor]

I was just looking with 1.7b2, and it had both ctrnand_fat and ctrnand_full. Perhaps something changed in newer versions?

 

[ihaveahax]

Yes, I had removed ctrnand_fat because it was basically the same as ctrnand_full. And unlike GodMode9, both files could be accessed at the same time, and if the two files were read and written to at the same time, bad things could happen. So I decided to not show duplicate writable files. Same reason for twl_main and twl_photo being removed and only leaving twlnand_full.

 

[Kwyjor]

I see, changed in version 2.0a1.

So... How does one convert ctrnand_full into ctrnand_fat? I assume they can both be opened with osfmount?

 

[ihaveahax]

OSFMount can mount single filesystem images as well as partitioned images, so in this case it supports ctrnand_fat (single filesystem image), ctrnand_full (partitioned drive with one partition) and twlnand_full (which has two partitions).

If you mount twlnand_full.img for example:

If OSFMount isn't accepting the file, it's probably just corrupt. Or maybe there's a bug in ninfs (but check to see if it can't be decrypted with different tools before assuming this).

If you really need to get the individual FAT partitions, I'm not sure how to do this on Windows at the moment. You could probably script it yourself with a library like pymbr. On Linux and macOS this could be done by attaching the drive and dd-ing the correct partition from /dev.

 

[BufferOverflow]

Thanks for your reply. Using ninfs version 1.7b2 I was able to extract ctrnand_fat.img, which I could open 7-ZIP without any issues. So I don't have to bother with ctrnand_full.img again to make it readable.