ROM Hack [Tutorial] Edit the HomeMenu

[D0GMEAT]

Is it possible to extract a Home Menu CIA from NAND?

I managed to dump mine using GodMode9.

 

[chronoss]

I managed to dump mine using GodMode9.

And have a title ID for home menu 11.5 EUR ?
I got it : 0004003000009802 EUR & 0004003000008F02 USA

On 11.5, the home menu has been again changed :

RomFS:

"/message/<dirname>/menu_msbt_LZ.bin" Updated with strings which are used on New2DSXL.
"/news/US_news/news002_jan_LZ.bin" New file.
"/news/US_news/news012_jan_LZ.bin" New file.

@TheDeKay
Your last Home Menu Rebuilding Tool can't extract the last home menu .cia file "11.5"

 

[D0GMEAT]

And have a title ID for home menu 11.5 EUR ?
I got it : 0004003000009802 EUR & 0004003000008F02 USA

On 11.5, the home menu has been again changed :

RomFS:


@TheDeKay
Your last Home Menu Rebuilding Tool can't extract the last home menu .cia file "11.5"

Remember to back up your NAND before editing. (Its just a reminder. ^^ )

 

[chronoss]

Remember to back up your NAND before editing. (Its just a reminder. ^^ )

Yes i know

 

[NekoMichi]

Managed to brick on an O3DS (11.5/B9S), not sure what the cause is. Here are the steps I used:

1. Dumped 0004003000009802.cia with GodMode9
2. Decrypted (deep) 0004003000009802.cia with Decrypt9
3. Extracted 0004003000009802.cia's contents with PackHack
4. Decompressed menu_msbt_LZ.bin with pk3ds' decompression tool
5. Edited one string in the power-down menu with Kuriimu
6. Recompressed menu_msbt_LZ.bin with pk3ds
7. Rebuilt romfs with PackHack
8. Rebuilt 0004003000009802.cia with PackHack
9. Encrypted 0004003000009802.cia with Decrypt9
10. Installed the encrypted 0004003000009802.cia with FBI

System was not able to boot up, fixed with NAND restore.

Update:
I dumped the encrypted 0004003000009802.cia with GodMode9 and then installed it using FBI without any modifications, and it still bricked. It looks like the culprit may be one of these.

Update 2:
The brick is likely caused by FBI (I'm running version 2.4.11). Whenever I try to install the .cia (regardless if modified or original), it will display the following error:

Failed to install CIA file
Result code: 0xC8E083FC
Level: Status (25)
Summary: Invalid argument (7)
Module: AM (32)
Desc: Already exists (1020)

This implies that the .cia was not installed, but the system would brick nonetheless. Attempting to install via DevMenu will display a similar "already installed" error, but not result in a brick. The same also happens when attempting to install a clean .cia downloaded through 3DNUS. Therefore, it can be concluded that FBI is the culprit, not GodMode9.

Update 3:
Even if I delete 0004003000009802 and its ticket with FBI, the same problem happens. Strangely it's detecting 0004003000009802 as being installed even when deleted.

 

[Nosrama]

Managed to brick on an O3DS (11.5/B9S), not sure what the cause is. Here are the steps I used:

1. Dumped 0004003000009802.cia with GodMode9
2. Decrypted (deep) 0004003000009802.cia with Decrypt9
3. Extracted 0004003000009802.cia's contents with PackHack
4. Decompressed menu_msbt_LZ.bin with pk3ds' decompression tool
5. Edited one string in the power-down menu with Kuriimu
6. Recompressed menu_msbt_LZ.bin with pk3ds
7. Rebuilt romfs with PackHack
8. Rebuilt 0004003000009802.cia with PackHack
9. Encrypted 0004003000009802.cia with Decrypt9
10. Installed the encrypted 0004003000009802.cia with FBI

System was not able to boot up, fixed with NAND restore.

Update:
I dumped the encrypted 0004003000009802.cia with GodMode9 and then installed it using FBI without any modifications, and it still bricked. It looks like the culprit may be one of these.

Update 2:
The brick is likely caused by FBI (I'm running version 2.4.11). Whenever I try to install the .cia (regardless if modified or original), it will display the following error:

Failed to install CIA file
Result code: 0xC8E083FC
Level: Status (25)
Summary: Invalid argument (7)
Module: AM (32)
Desc: Already exists (1020)

This implies that the .cia was not installed, but the system would brick nonetheless. Attempting to install via DevMenu will display a similar "already installed" error, but not result in a brick. The same also happens when attempting to install a clean .cia downloaded through 3DNUS. Therefore, it can be concluded that FBI is the culprit, not GodMode9.

Same problem "already exist" here

 

[Jtinzimpailer]

Thanks bud nice tut

 

[froggestspirit]

Failed to install CIA file
Result code: 0xC8E083FC
Level: Status (25)
Summary: Invalid argument (7)
Module: AM (32)
Desc: Already exists (1020)

Same problem "already exist" here

I got mine to work with the latest FBI.
When I tried installing the edited cia, I got that error, so I installed the vanilla un-edited (still encrypted) HomeMenu.cia (I left it in the decrypt9 folder, so it got re-encrypted when the edited one got encrypted). The vanilla one installed fine, then immediately after that installed, I was able to install the edited one. I now have a full english home menu on my JP 2dsxl

 

[NekoMichi]

I got mine to work with the latest FBI.
When I tried installing the edited cia, I got that error, so I installed the vanilla un-edited (still encrypted) HomeMenu.cia (I left it in the decrypt9 folder, so it got re-encrypted when the edited one got encrypted). The vanilla one installed fine, then immediately after that installed, I was able to install the edited one. I now have a full english home menu on my JP 2dsxl

Are you using FBI 2.4.11? I'm using that version and even if I try to install the vanilla home menu .cia file it will display the same error and proceed to brick the device nonetheless.

 

[froggestspirit]

Are you using FBI 2.4.11? I'm using that version and even if I try to install the vanilla home menu .cia file it will display the same error and proceed to brick the device nonetheless.

yes, thats the version I'm using.
It goes like this for me:
Try to install edited.cia (fails)
Try to install vanilla.cia (succeeds)
Try to install edited.cia (succeeds)
make sure the cia's are re-encrypted too

 

[NekoMichi]

yes, thats the version I'm using.
It goes like this for me:
Try to install edited.cia (fails)
Try to install vanilla.cia (succeeds)
Try to install edited.cia (succeeds)
make sure the cia's are re-encrypted too

IT WORKED! The order in which error messages appear isn't consistent on my systems but eventually I got it to work after trying several variations of your method. Thanks again.

 

[TheCyberQuake]

Haven't messed with this in a while. Probably should do this again. Is the versions listed in OP the most recent versions of home menu still? If not what is the latest version number.

 

[Alex4nder001]

Wait... won’t the home menu stop working if I was to uninstall boot9strap? It needs to be signed, right?

 

[Boured]

Wait... won’t the home menu stop working if I was to uninstall boot9strap? It needs to be signed, right?

As far as I know yes.

 

[Majickhat55]

Wait... won’t the home menu stop working if I was to uninstall boot9strap? It needs to be signed, right?

Yes, and you also can't update properly when you have edited system titles. You need to install the vanilla home menu before making any changes to your console. Otherwise you're more than likely to get errors.

--------------------- MERGED ---------------------------

Haven't messed with this in a while. Probably should do this again. Is the versions listed in OP the most recent versions of home menu still? If not what is the latest version number.

It is, it's just v.27648 now

 

[Deleted member 414991]

I'm running linux, Solus. When I run Part1.bat, it spits out this error:

Spoiler: error

nu.cia
Header size 0x00002020
Type 0000
Version 0000
Certificates offset: 0x00002040
Certificates size: 0x0a00
Ticket offset: 0x00002a40
Ticket size 0x0350
TMD offset: 0x00002dc0
TMD size: 0x0b34
Meta offset: 0x395900
Meta size: 0x0000
Content offset: 0x00003900
Content size: 0x0000000000392000
Warning, could not read common key.

Ticket content:
Signature Type: 04000100
Issuer: Root-CA00000003-XS0000000c
Signature:
000000: ab 4b 42 a1 7b 68 49 37 01 d8 22 fe bc 42 f7 1a .KB.{hI7.."..B..
000010: e2 6e 73 b9 29 69 dd 92 15 f8 ec a2 1e 5b 04 cf .ns.)i.......[..
000020: a1 a3 c8 f0 7a 30 d8 92 5f d2 14 fa d6 1b ad 6c ....z0.._......l
000030: ff a2 de 3b ff b8 cb 45 78 46 84 f9 8d 2c dc a6 ...;...ExF...,..
000040: 73 e6 65 37 6c bd 39 f0 a6 90 31 24 9d 13 31 b2 s.e7l.9...1$..1.
000050: 8c 31 48 fd a3 ae 7f cd 38 31 2a c7 36 6a 1c 04 .1H.....81*.6j..
000060: 8c 36 56 33 21 d9 4e d1 63 c6 79 bf 60 45 b5 03 .6V3!.N.c.y.`E..
000070: d2 18 cc 1c 51 43 61 37 a8 20 67 9c c4 bb c4 ec ....QCa7. g.....
000080: 34 16 25 17 7c 24 3b 87 b7 db 01 7d 14 fa 47 c8 4.%.|$;....}..G.
000090: f7 07 31 7e 0d 70 91 7f 6f 28 8e 25 87 47 ff e1 ..1~.p..o(.%.G..
0000a0: b8 c1 29 51 3b c9 7e 0b 81 22 50 e2 ab df d8 58 ..)Q;.~.."P....X
0000b0: 50 a1 42 cc 26 c0 17 c4 7d 44 c9 cc e5 90 8b 98 P.B.&...}D......
0000c0: 07 ef 83 99 1a 44 51 d1 b6 6c b4 58 61 98 be 7b .....DQ..l.Xa..{
0000d0: 0b 28 63 fb 16 21 d4 9c 3e 5b 74 b0 78 7a 61 7b .(c..!..>[t.xza{
0000e0: c4 cf 54 03 3d aa 4c da fe 99 4a 0a dd ee 7a 08 ..T.=.L...J...z.
0000f0: c4 29 c3 d4 fa 67 0e 3f 41 45 77 ee e0 b4 04 91 .)...g.?AEw.....

Encrypted Titlekey: 84498A43A6F7D7944FA983BDC3E11B84
Ticket ID: 0004D59BE704D6CB
Ticket Version: 368
Title ID: 0004003000008F02
Common Key Index: 1
Content permission map:
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00


TMD header:
Signature type: RSA 2048 - SHA256
Issuer: Root-CA00000003-CP0000000b
Version: 1
CA CRL version: 0
Signer CRL version: 0
System version: 0000000000000000
Title id: 0004003000008F02
Title type: 00000040
Group id: 0000
Save Size: 00000000
Access rights: 00000000
Title version: 7001
Content count: 0001
Boot content: 0000
Hash: 15993D98813FC590AA1CE63F01296FE85573C4B953468347DABFD54F3FEAEFB9

TMD content info:
Content index: 0000
Command count: 0001
Unknown: B578B27FAC0BECC375EEF34F75B9D92E6A97EA893C7B70D0BCA94B91A95F0E69

TMD contents:
Content id: 00000087
Content index: 0000
Content type: 0000
Content size: 0000000000392000
Content hash: 7037463A80C4D1A8BFACC92415BDE93C9E841F0813C47FA81EE48DE75E8BB081

Saving content #0000 to SystemApp.0000.00000087

Z:\home\jupitteer\Desktop\HomeMenuEdition>3dstool.exe -xvtf cxi SystemApp.0000.00000082 --header NCCH.Header --exh DecryptedExHeader.bin --exefs DecryptedExeFS.bin --romfs DecryptedRomFS.bin --logo Logo.bcma.LZ --plain PlainRGN.bin
fixme:ver:GetCurrentPackageId (0x33f9dc (nil)): stub
ERROR: open file SystemApp.0000.00000082 failed

ERROR: the file type is mismatch


Z:\home\jupitteer\Desktop\HomeMenuEdition>3dstool.exe -xvtf exefs DecryptedExeFS.bin --exefs-dir ExtractedExeFS --header ExeFS.Header
fixme:ver:GetCurrentPackageId (0x33f9d4 (nil)): stub
ERROR: open file DecryptedExeFS.bin failed

ERROR: the file type is mismatch


Z:\home\jupitteer\Desktop\HomeMenuEdition>3dstool.exe -xvtf romfs DecryptedRomFS.bin --romfs-dir ExtractedRomFS
fixme:ver:GetCurrentPackageId (0x33fb80 (nil)): stub
ERROR: open file DecryptedRomFS.bin failed

ERROR: the file type is mismatch

I tried with both a cia decrypted with godmode9 and decrypt9wip. Both gave the same error. Any ideas?

 

[Deleted member 414991]

IT WORKED! The order in which error messages appear isn't consistent on my systems but eventually I got it to work after trying several variations of your method. Thanks again.
View attachment 96152

do all dev 3DSs have that red slider? It looks nice.

 

[a-cotten]

Sorry what I said is against the rules

 

[Namesnipe]

Hey do you mind getting me a US 11.6? 3dsnus isn't working for me. Thanks in advance

That's against the site rules my good dude.

 

[a-cotten]

That's against the site rules my good dude.

I'm deleting it. I'm sorry I didn't know

--------------------- MERGED ---------------------------

That's against the site rules my good dude.

Sorry, sorry. I didn't know. Well gbatemp was fun while it lasted.