ROM Hack [Tutorial] How to Decrypt, Extract & Rebuild 3DS|CIA|CXI Files

[KhaiNovus]

i cannot down PackHack

 

[Asia81]

5.3 release
Uninstall the previous version with uninstall.exe in the program files folder, or with any uninstaller tool.

I improved all extraction scripts, and created a mass rebuild script (you need obviously to use a mass extraction before).
CIAE and CIAR are changed to something shorter, CE and CR.

 

[Asia81]

I updated the tuto for a new rebuild method

--------------------- MERGED ---------------------------

I also removed the cxi tutorial method in the tutorial, but you can always use the cxi command in HackingToolkit3DS (I just removed it from the tutorial).

 

[Gow supremo]

With this tutorial, you will be able to decrypt, extract, and rebuild a 3DS ROM.

This tutorial will try to help you decrypt a 3DS ROM to change its content and will also explain how to rebuild an edited game.

Thanks a lot to Ericzander & BullyWiiPlaza for their help to translate this tutorial in english
(Because I'm French, it’s difficult to make a full tutorial in a good English...)
If anyone see any typo or something wrong with my english (in the setup, the script, the tutorial...) let me know!

Ce tutoriel est également disponible pour les français ici (Pas à Jours) :
This tutorial is also available for french users here (Outdated):
http://www.pokemontrash.com/jeux-pokemon/decrypter-compiler-rom-3ds.php

For this tutorial, some words will be shortened:
- Homebrew(s) by HB (or HBs)
- The HomeBrew Launcher by HBL
- Decrypt9WIP by Decrypt9

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~​

Summary​

- What you need
- Prerequisites
- Decrypting
- Extracting
- Editing
- Rebuilding​

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~​

What you Need​

• A 2DS / O3DS / N3DS with a SysNand Firmware between 4.1 and 9.2 (4.1 and 11.X with A9LH)
• A 3DS ROM
• WinRAR, or another archive extractor
• A way to launch HomeBrews, see here: http://smealum.github.io/3ds/
• A SD card with a minimum free capacity of 2GB (4 is recommended)
• This PackHack (HackingToolkit3DS) -> Click Here

Note: If you're on a firmware that is between 9.3 and 10.7, you will have to downgrade to 9.2 to use the tutorial. Except if you're already using A9LH, of course.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Prerequisites​

Install the new SetupUS(FR).exe of HackingToolkit3DS as a common tool:


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~​

Decrypting​

First of all, you'll need to have a way to launch HBs on your 3DS.
For this, I recommend the A9LH payload of Decrypt9, or Ninjhax / FreakyHax / BrowserHax.
There is some other ways, you can choose one of them here: http://smealum.github.io/3ds/

Once you have access to the HBL, copy the Decrypt9WIP folder to your 3ds folder (like another HB).

Put in the root of your SD Card:
- seeddb.bin
- slot0x1BKeyX.bin
- slot0x05KeyY.bin
- slot0x11key96.bin
- slot0x18KeyX.bin
- slot0x25KeyX.bin

Note: You can also build these 5 slot0xXXkeyXX.bin files in 1 aeskeydb.bin file using Decrypt9 -> Maintenance Options -> Build Key Database.
Once done, you can delete these 5 slot0xXXkeyXX.bin files from your SD.

In the root of your 3DS' SD Card, create a new folder, and call it D9Game, then put inside YourRom.3ds. Make sure Windows is not hidding extensions.

Start HBL, start Decrypt9, choose Content Decryptor Options, then NCCH/NCSD Decryptor.

Wait while it's decrypting.

Once done, copy and past your decrypted game in your PackHack folder.
Now it's done, go to Extracting.

Note: If you don't see any decrypted files, it's normal.
Decrypt9 decrypt the game itself. No extra file.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~​

Extracting​

Open HackingToolkit3DS:

Write D, and enter the name of your decrypted file.
Your file should not have any spaces in its name, nor special characters, like é or à.
You are asked if you want decompress your code.bin file, choose (n/y).
Wait while it's extracting.

The ExeFS content will be extracted in an ExtractedExeFS folder.
The RomFS content will be extracted in a ExtractedRomFS folder.
The DownloadPlay content will be extracted in a ExtractedDownloadPlay folder.
The Old3DS update will be extracted in a ExtractedO3DSUpdate folder.
The New3DS update will be extracted in a ExtractedN3DSUpdate folder.
The Manual will be extracted in a ExtractedManual folder.
The Banner (shown on the Home Menu) will be extracted in a ExtractedBanner folder.

Now you’re able to edit the game, go to Editing.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~​

Editing​

Do what you want.
Edit music, textures..
If you follow this tutorial, you know what you want to do.
Once it's finished, rebuild your game.

Optional: If you want, you can also edit the TitleID / UniqueID of your game:
Read here for more informations.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~​

Rebuilding for HANS​

Part 1: Rebuild your RomFS

Open HackingToolkit3DS, write RFSB.
RomFS Builder is now open.
With it, open your ExtractedRomFS folder (in PackHack).

Click GO. Wait and save it named RomFS.bin.
Done !

Part 2: Set the files on your SD Card
First of all, you'll need to have HBL and HANS ready on your 3DS.

In the root of your 3DS' SD Card, create a new folder, and name it HANS.
Inside, put your new RomFS file, and name it with the TitleID of your game + romfs as the extension.
Do the same for the code.bin file (only if you edited it). The code.bin is in your ExtractedExeFS folder.
Example: 00XXXX00.romfs & 00XXXX00.code

For example, for Pokémon Alpha Sapphire, it's:


It's ready. Start your HBL, then start HANS.
Use the Title Selector, select your game, and confirm.

In HANS, you will have to edit:


And OK, now start your game and check if it's working.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~​

Rebuilding for CFW / FlashCards​

If you have extracted the game using this tutorial and the "D" command, then you can just use the "R" command to rebuild your .3DS.

Once done, don't forget to encrypt it using Decrypt9 -> Content Decryptor Options -> NCCH/NCSD Encryptor.

If you don't encrypt it back, you won't can use it in the Gateway menu (white Icon, and won't load).
For the fact, because this rebuilt game has the update partition, it will can run on a Sky3DS+, but ONLY if you have signature check disabled, so a CFW.

Enjoy!

Spoiler: Changelog V5.3

- Tutorial updated and HackingToolkit3DS updated to V5.3
- New Build added. You'll have to uninstall the previous Setup and install the new one. For uninstall, it's as all your other tools, use the uninstall.exe in the ProgramFiles folder.
- Added a MassRebuild option
- HackingToolkit3DS is always more faster to load (The main file is just 100kb).
- New Links

Spoiler: Credits and Thanks To

Credits:
CtrTool : Neimod & 3DSGuy
Makerom : 3DSGuy
RomFS Builder : SciresM
RomFS Extractor : SciresM
3DS Builder : SciresM
BrainDump : neobrain
Decrypt9 : d0k3, Shadowtrance & Archshift
3DS Simple CIA Converter : Riku
Patch RomFS Pointer Tool : AHP_Person
HackingToolkit3DS : Asia81 / Mizoré
CleanTool : Asia81 / Mizoré

Thanks to:
Megadrifter
Stratovarius
Reisyukaku
Guitoh
Weby
Apache Thunder
Ericzander
BullyWiiPlaza
Cellenseres​

I have a this tool but in v3.2 and to extract sdk6 give a error on extract romFS. I need so it works to aply animal crossing new leaf patch. Leave the page of the patch.
https://gbatemp.net/threads/release-animal-crossing-wild-leaf.402337/

 

[WiiUBricker]

@Asia81 Your HackingToolkit3DS doesn't create an ExtractedRomFS folder. It says the extraction is done, but I can't find the folder. Where does it create it? I was trying to extract a CXI.

Edit: Nevermind. I didn't install it. IMO HackingToolkit3DS.exe shouldn't launch when it's not installed.

 

[Asia81]

@Asia81 Your HackingToolkit3DS doesn't create an ExtractedRomFS folder. It says the extraction is done, but I can't find the folder. Where does it create it? I was trying to extract a CXI.

Edit: Nevermind. I didn't install it. IMO HackingToolkit3DS.exe shouldn't launch when it's not installed.

I would like do it, but idk how to check if the script is installed or know (in batch)

 

[Nanquitas]

Maybe a check on the file ?

From stackoverflow:

if exist <insert file name here> (
    rem file exists
) else (
    rem file doesn't exist
)

 

[Asia81]

Maybe a check on the file ?

From stackoverflow:

if exist <insert file name here> (
    rem file exists
) else (
    rem file doesn't exist
)

Thanks but actually I found an easiest way:

@Echo off
IF NOT EXIST "%PROGRAMFILES%\HackingToolkit3DS\" goto:eof

 

[pinguino1234]

Why when i try to edit the "ExtractedBanner" in a hex editor i get this (in all file)?:

 

[huma_dawii]

So with this I'm able to extract the games from my 3DS and convert them to CIA.? Or 3DS?

 

[d4mation]

Thanks but actually I found an easiest way:

@Echo off
IF NOT EXIST "%PROGRAMFILES%\HackingToolkit3DS\" goto:eof

It could use a check for 32bit systems as well, because ctrtool does not work on a 32bit system.

Took me forever to realize why my Virtual Machine of 32bit Windows 7 wasn't extracting a .CXI properly.

 

[Asia81]

It could use a check for 32bit systems as well, because ctrtool does not work on a 32bit system.

Took me forever to realize why my Virtual Machine of 32bit Windows 7 wasn't extracting a .CXI properly.

Only ctrtool doesn't work on 32b?
If so, If someone can build a ctrtool for 32b, or send me one, I can easily update the script and automtically use 32b or 64b ctrtool using the computer settings.

 

[d4mation]

@Asia81, I'm not sure if it is just ctrtool, but in that GitHub Issue I linked you they pretty much said that a 32bit ctrtool would be pointless since it would eat through the maximum 4GB of RAM very quickly in a 32bit environment.

It may be best for this automation program to be 64bit only.

 

[Asia81]

better than nothing

 

[NewTOTHIS WOOO]

Hey it's weird but I am only getting the .bin files and NO folders after extraction of my .cia

Anyone know the problem?

 

[iHateEggBreeding]

.

 

[AliceTheGorgon]

There seems to be a problem with building .cia files.
When I extract and rebuild a game, my 3DS gives me the "An Error has occurred. Hold down the power button to turn off the power" message when I try to run it after installing.

If I build a .3ds file instead of a .cia file, and then convert that .3ds to a .cia with 3DSConv, then everything works fine.

I'm using a US version of Alpha Sapphire that I dumped from a retail cartridge with Decrypt9. The issue occurred with both the "decrypt (trim)" and "decrypt (full)" options.
I also tried a US version of Hyrule Warriors Legends, and got the same error.
I'm on a New3DS XL, running arm9loaderhax, Luma3DS, and firmware 11.0.0-33U.

Hey it's weird but I am only getting the .bin files and NO folders after extraction of my .cia

Anyone know the problem?

Sounds like your game might not be properly decrypted. Did decrypt9 give you any errors or anything when decrypting?

 

[samcambolt270]

i can't download packhack, it keeps telling me there is a virus

 

[Bedel]

Well I'm tring this out to learn something, but I get stuked. I have all the decrypted files from the .cia, but I'm not able to extract the data from the romfs. Whenever I use the RomFS extractor, it says "Not a valid romfs binary". What should I do?

 

[TheNintendoEnthusiast]

Hey, is there a way you can release the scripts you made for this? Is this all a easy way to use python scripts? I ask because I own a Mac and I would love to utilize this program.

Thanks!