How To: Dump 3DS Carts to CIA, 3DS to CIA, Dump Private Headers & DS Carts

Jayro · Jul 1, 2016

Still waiting for a .3DS to .CIA conversion app on the 3DS side of things, meaning no computer required to copy my carts to my sysnand and play them... Simple cart dumping to a readily-installable .CIA is my goal, and hopefully somebody will eventually pull through.

Temptress Cerise · Jul 1, 2016

Jayro said:
Still waiting for a .3DS to .CIA conversion app on the 3DS side of things, meaning no computer required to copy my carts to my sysnand and play them... Simple cart dumping to a readily-installable .CIA is my goal, and hopefully somebody will eventually pull through.

I would not be surprised if d0k3 is already working on it.

d0k3 · Jul 5, 2016

Nice, new tuts! It may have already pointed out, but you can drag and drop .3ds files on 3dsconv.exe just fine. No need to bother standard users with entering stuff on the command line!

Temptress Cerise · Jul 5, 2016

d0k3 said:
Nice, new tuts! It may have already pointed out, but you can drag and drop .3ds files on 3dsconv.exe just fine. No need to bother standard users with entering stuff on the command line!

Yus~ I included steps for both, Decypted and Encrypted. The steps are just a tad longer for people who have Encrypted 3DS dumps~

I guess I could have shown people how to decrypt their dumps using Decrypt9, without the need for xorpads, but I don't think that's the best option, especially for N3DS users, who some would have to use wireless transfer to push their Encrypted 3DS dumps to their 3DS, and then back to convert, only to push the converted CIA back. While, getting xorpads would be a faster and more convenient method for N3DS users. I think.

Edit: You rock~ <3

ihaveahax · Jul 10, 2016

just a small note, makerom isn't needed anymore. I managed to figure out what I could ~~get away with not updating in the CIA format~~ and now the script builds the CIA itself entirely.

I've only tested it with two games so far, both encrypted and decrypted. please tell me if anything goes wrong, including game name.

https://github.com/ihaveamac/3dsconv/releases/tag/v3.0

d0k3 · Jul 10, 2016

ihaveamac said:
just a small note, makerom isn't needed anymore. I managed to figure out what I could ~~get away with not updating in the CIA format~~ and now the script builds the CIA itself entirely.

I've only tested it with two games so far, both encrypted and decrypted. please tell me if anything goes wrong, including game name.

https://github.com/ihaveamac/3dsconv/releases/tag/v3.0

Whoa, makerrom is not needed anymore? Is this all in that commit?
https://github.com/ihaveamac/3dsconv/commit/fc67c69ed580f98f64999448543239a62cfcb9f7

ihaveahax · Jul 10, 2016

d0k3 said:
Whoa, makerrom is not needed anymore? Is this all in that commit?
https://github.com/ihaveamac/3dsconv/commit/fc67c69ed580f98f64999448543239a62cfcb9f7

you could see this for all of the commits, though most is in that one: https://github.com/ihaveamac/3dsconv/compare/f640f3fce1dffaec495f5072b749d21a153ee4ff...master

I basically hard-coded the certificate chain (it doesn't change on any CIA), a template ticket to write the title ID to, and a partial TMD to write content count, save data size, title ID, hashes, etc...

after testing it with encrypted + decrypted games, it works including the Manual on both.

code's probably bad in some places, but it works ~~on my machine~~. took a few hours to figure out what to do and what order.

it's also faster, since it writes to the CIA immediately and calculates hashes while it does that.

d0k3 · Jul 10, 2016

ihaveamac said:
you could see this for all of the commits, though most is in that one: https://github.com/ihaveamac/3dsconv/compare/f640f3fce1dffaec495f5072b749d21a153ee4ff...master

I basically hard-coded the certificate chain (it doesn't change on any CIA), a template ticket to write the title ID to, and a partial TMD to write content count, save data size, title ID, hashes, etc...

after testing it with encrypted + decrypted games, it works including the Manual on both.

code's probably bad in some places, but it works ~~on my machine~~. took a few hours to figure out what to do and what order.

it's also faster, since it writes to the CIA immediately and calculates hashes while it does that.

This is great stuff! I'm actually thinking about adding this to D9 now. Don't worry, it won't make your tool obsolete, cause obviously doing it in D9 will be slow as hell.

ihaveahax · Jul 10, 2016

d0k3 said:
This is great stuff! I'm actually thinking about adding this to D9 now. Don't worry, it won't make your tool obsolete, cause obviously doing it in D9 will be slow as hell.

oh of course, I was thinking "if this works, decrypt9 could dump directly to cia" when doing this. I have no issue if it "makes my tool obsolete", that's just how things work.

again, my code is probably not very good, especially since I was kind of tired. if something doesn't make sense, I can try to help with what's going on.

first thing you'll probably want to do is decode the block of text(it's base64), then decompress it. I used zlib for that. then add 2412 "00" bytes to the end (these aren't here at fist just so it compresses better). now you have the cert chain, template ticket, and partial TMD (doesn't have content chunk records at the end, since the size of this varies).

I hope this makes sense.... I'm tired-ish lol

Temptress Cerise · Jul 10, 2016

ihaveamac said:
just a small note, makerom isn't needed anymore. I managed to figure out what I could ~~get away with not updating in the CIA format~~ and now the script builds the CIA itself entirely.

I've only tested it with two games so far, both encrypted and decrypted. please tell me if anything goes wrong, including game name.

https://github.com/ihaveamac/3dsconv/releases/tag/v3.0

Guide updated (makerom removed).

Games tested.
Pokemon Alpha Sapphire (Decrypted Dump)
Pokemon Omega Ruby (Decrypted Dump)
Pokemon Y (Encrypted Dump)
Etrian Odyssey IV (Encrypted Dump)
Etrian Odyssey Untold (Encrypted Dump)
Fire Emblem Fates (Encrypted Dump)
Freakyforms Deluxe (Encrypted Dump)

Everything seems to have converted just fine. Haven't actually attempted to install the .CIAs these spit out, I guess I'll do that tonight for some of these games, though doubt I'll have problem installing them.

d0k3 said:
This is great stuff! I'm actually thinking about adding this to D9 now. Don't worry, it won't make your tool obsolete, cause obviously doing it in D9 will be slow as hell.

Think some people would appreciate being able to dump .3ds and convert right to .cia, even if it's super slow and time consuming.

I personally prefer dumping and storing my .3ds dumps, then converting when I want to.

d0k3 · Jul 10, 2016

ihaveamac said:
oh of course, I was thinking "if this works, decrypt9 could dump directly to cia" when doing this. I have no issue if it "makes my tool obsolete", that's just how things work.

again, my code is probably not very good, especially since I was kind of tired. if something doesn't make sense, I can try to help with what's going on.

first thing you'll probably want to do is decode the block of text(it's base64), then decompress it. I used zlib for that. then add 2412 "00" bytes to the end (these aren't here at fist just so it compresses better). now you have the cert chain, template ticket, and partial TMD (doesn't have content chunk records at the end, since the size of this varies).

I hope this makes sense.... I'm tired-ish lol

What are you using for the title key, btw? Riku did use one and the same titlekey for every CIA, which might be a bad idea (easy to detect illegit CIAs). A randomized titlekey maybe better, especially since you don't actually use a titlekey in these CIAs. Not completely sure, though.

ihaveahax · Jul 10, 2016

d0k3 said:
What are you using for the title key, btw? Riku did use one and the same titlekey for every CIA, which might be a bad idea (easy to detect illegit CIAs). A randomized titlekey maybe better, especially since you don't actually use a titlekey in these CIAs. Not completely sure, though.

00000000000000000000000000000000 every time, in the "template". I can try adding a randomized titlekey if you'd like.

d0k3 · Jul 10, 2016

ihaveamac said:
00000000000000000000000000000000 every time, in the "template". I can try adding a randomized titlekey if you'd like.

Nah, maybe leave that be. This hasn't been any real problem with Riku converted roms in the past, and it most likely will never be with yours.

ihaveahax · Jul 10, 2016

d0k3 said:
This is great stuff! I'm actually thinking about adding this to D9 now. Don't worry, it won't make your tool obsolete, cause obviously doing it in D9 will be slow as hell.

actually now I have to ask, how would it be "slow as hell"? it would just dump (and maybe decrypt) the partitions directly to a CIA file and calculate the content hashes while dumping, not dump partitions then create a CIA from them. then when it's done, edit the ticket/tmd/etc for a few sha256 hashes, add save data size from exheader, etc. if anything it should be just as fast as normally dumping. unless I'm missing something...

d0k3 · Jul 10, 2016

ihaveamac said:
actually now I have to ask, how would it be "slow as hell"? it would just dump (and maybe decrypt) the partitions directly to a CIA file and calculate the content hashes while dumping, not dump partitions then create a CIA from them. then when it's done, edit the ticket/tmd/etc for a few sha256 hashes, add save data size from exheader, etc. if anything it should be just as fast as normally dumping. unless I'm missing something...

You do miss something... Actually, decrypting NCCHs on the fly is not a straightforward process, and calculating SHA on the fly would only make things more complicated (no guarantees it is possible at all). Also, think about cases where users already have 3DS files - your tool would be x times faster in those cases.

ihaveahax · Jul 10, 2016

d0k3 said:
You do miss something... Actually, decrypting NCCHs on the fly is not a straightforward process, and calculating SHA on the fly would only make things more complicated (no guarantees it is possible at all). Also, think about cases where users already have 3DS files - your tool would be x times faster in those cases.

for existing dumps, of course PC is faster.

but for dumping cards, does it actually need to dump decrypted to a CIA? since this happens on the 3DS, you can probably read the encrypted contents just fine. the only parts that need modification are the bit in the exheader, and the exheader hash in the NCCH header. the rest doesn't need to be decrypted.

I mean, these are just my thoughts. I'm not entirely sure if it's possible exactly this way, you know more about how this could work than me.

d0k3 · Jul 10, 2016

ihaveamac said:
for existing dumps, of course PC is faster.

but for dumping cards, does it actually need to dump decrypted to a CIA? since this happens on the 3DS, you can probably read the encrypted contents just fine. the only parts that need modification are the bit in the exheader, and the exheader hash in the NCCH header. the rest doesn't need to be decrypted.

I mean, these are just my thoughts. I'm not entirely sure if it's possible exactly this way, you know more about how this could work than me.

I'll look into it

. Tbh, another possible issue I see with this is the cert... Idk if it's okay to include this (copyright issues), and I need to pay attention (as D9 by now has received a lot of attention). Could be solved with an external file, of course... Anyways, more later.

ihaveahax · Jul 10, 2016

d0k3 said:
I'll look into it . Tbh, another possible issue I see with this is the cert... Idk if it's okay to include this (copyright issues), and I need to pay attention (as D9 by now has received a lot of attention). Could be solved with an external file, of course... Anyways, more later.

the certificate chain is the same for every CIA i've seen from makerom and (I think) make_cdn_cia. these two tools get shared around all the time, on gbatemp included. i'm fairly sure it's fine. but, up to you.

d0k3 · Jul 13, 2016

ihaveamac said:
the certificate chain is the same for every CIA i've seen from makerom and (I think) make_cdn_cia. these two tools get shared around all the time, on gbatemp included. i'm fairly sure it's fine. but, up to you.

Could you perhaps provide the decompressed helper file? I know, this is lazy, but you're bound to have it lying around somewhere anyways, and I could save an hour or so figuring out how to decompress it myself. I might have more questions later, ofc, too.

ihaveahax · Jul 13, 2016

d0k3 said:
Could you perhaps provide the decompressed helper file? I know, this is lazy, but you're bound to have it lying around somewhere anyways, and I could save an hour or so figuring out how to decompress it myself. I might have more questions later, ofc, too.

like magic...

this is basically what I used, for future reference:

Code:

#!/usr/bin/env python2
import zlib

ciainfo = """
<base64 encoded string>
"""

with open("decoded.bin", "wb") as f:
    f.write(zlib.decompress(ciainfo.decode('base64')) + ("\x00" * 2412))  # encoded string doesn't include the zeros at the end to compress better

sure, ask anything you need/want.

just a reminder: this contains the cert chain, template ticket with blank titlekey/title id, and incomplete template ticket (doesn't include Content chunk records, since this varies in size it's added manually)

MediCat USB Dev

Miss Magic~ <3

3DS Homebrew Legend

Miss Magic~ <3

Well-Known Member

3DS Homebrew Legend

Well-Known Member

3DS Homebrew Legend

Well-Known Member

Miss Magic~ <3

3DS Homebrew Legend

Well-Known Member

3DS Homebrew Legend

Well-Known Member

3DS Homebrew Legend

Well-Known Member

3DS Homebrew Legend

Well-Known Member

3DS Homebrew Legend

Well-Known Member

Attachments

Similar threads

Popular threads in this forum