Go to SD then find where you put the rom. Choose the rom and then NCSD image options. Decrypt File..Decrypt inplace or to the gm9 out folder if you have it. If you didn't create the folder gmout then just decypt in place.
I found the cia but it only gives me the option to build cia either standard or legit. I got there by going to sysnand sd, tittle, 40000, then fates tittle id, content and then the .tmd file.