Hacking 3DS Firmware has been decrypted

[totalnoob617]

You seem to forget that companies are out there to make money, and purposely putting tools for piracy into the hands of the users is... not the way to make money.

but they do it
http://www.youtube.com/watch?v=WJIuYgIvKsc

 

[3DSGuy]

Source:Myself/Knowledge of PS3/looking at TB eboots. There are many speculated methods on obtaining decrypted eboots, which mostly surrounds dumping the RAM, in some form (and having the keys, but having the keys is unlikely). Nothing confirmed of course. But they are re-encrypted versions of the original disc eboots, I haven't checked Duplex's 'anti-drmed' TB eboots, but they should be the same size as the disc original eboot. When they say debug eboot, they mean an eboot flagged as debug in the SCE header. Again TB obtain decrypted eboots (to which they apply DRM to) from a source other than debug fselfs(that is unless they get debug copies of every game they've patched again unlikely). What you see when you look at a TB eboot, is simply the result of their DRM process. The fself flag among other things in the SCE Header, is simply a way for the DRM distinguish between regular eboots and TB eboots(after all, all a SCE header does(for selfs) is tell the PS3 what the eboot is). Especially since fselfs are treated differently by the PS3 simply for been an fself(it has to be modified to accept them). And of course the encryption of TB eboots is part of the DRM.

EDIT: If you don't believe me, here's a quote from the dev wiki regarding the 'fself nature' of TB eboots:

I get what you're saying, true FSLEFs aren't encrypted. But that doesn't mean that the decrypted EBOOTs TB have access to aren't the debug EBOOTs (i.e. FSELFs). As I see it, it is perfectly possible they have access to the FSELFs (debug EBOOTs) of the games they release "patches" for, and they apply their DRM to those (including the encryption with their own keys) so they only work with the dongle. I see no other way for them to obtain decrypted EBOOTs for newer games unless they had all the newer keys, in which case they could release far more fixed games than they do. They could possibly also create some sort of software to allow users to fix games themselves (without giving the keys away; that part could be tricky, but they've managed to protect their EBOOTs this far, they could probably have a decent attempt at protecting the keys also). AFAIK, the only way to get unencrypted EBOOTs is debug EBOOTs (FSELFs), so that must be their "starting point" for each fix, right?

EDIT: The quote from the dev wiki you posted is found under this header:

old talk

(seems obsolete and incorrect in many ways)

I wouldn't put too much faith in that quote...

Yes it is possible that TB got access to original disc debug fselfs, but that is almost as likely as me having access to debug executables of mario kart 7, Super mario 3D land and New Super Bros 2 and playing backups of them right now, on a dev 3ds. Unless they have connections with an employee for each of the companies which developed each of the games they've managed to patch, they don't have access original debug fselfs.

It is true that debug consoles can retrieve debug game updates which contain fselfs, but these are not the same as the original disc fselfs. Also Game of thrones, one of their patched games, doesn't have any updates see: https://a0.ww.np.dl....S30939-ver.xml. If there aren't any updates for the game, then there won't be a debug update, to get a game fself from.

(I've just checked now the TB patch eboot and disc original eboot are not the same size, but my point still stands, to get original disc fselfs, you have to have access to where they are created. To get game update fselfs, there has to be a game update, and for game of thrones, there isn't one)

Now explain to me how they are getting fselfs/elfs? (The most likely explanation is they managed to dump retail eboots out of the RAM, as the PS3 decrypts them, most likely with a debug unit.)

That quote by the way, was explaining, why one of the 'old/wrong ideas' was wrong . It so I put faith in that quote.

EDIT: Some food for thought, a 'payload-less' xmb launchable self decrypter, which could be re-compiled to work on the latest DEX FW.

EDIT2: Yeah, if you still want to continue this conversation SifJar, we should move it elsewhere.

 

[sohaib]

it is true 3ds firmware has been decrypted and now you can make homebrew channel like the wii or not

and thanks

 

[Tom Bombadildo]

it is true 3ds firmware has been decrypted and now you can make homebrew channel like the wii or not

and thanks

My god. Read the thread. NO HOMEBREW CHANNEL. This is like the first tiny baby step of hacking the console. Read the stickies.

 

[LuigiBlood]

[19:12] firmware isn't really decrypted

So some of us talked to him and he said this. No luck guys.

So no one did get it yet. Pretty much the last time I remind everyone.
And the fact that tool that neimod is updating absolutely doesn't mean anything.

And also: even if decrypting firmware was done, NOTHING can be done yet.
Same thing for the Common Key (which he doesn't have BTW).

Trying to open some eyes, but under the excuse that others finds to think that IRC logs can be faked, in that case, the 1st post CAN BE A FAKE.
EDIT: So seriously, if the firmware was decrypted, that would be said on 3dbrew, not just on IRC.

 

[3DSGuy]

Anyway, here is a re-construction of a 'FIRM' file I made based on the specs from ctrtool. Download here: http://depositfiles.com/files/lzpo8yqyo

Interestingly, from reading the ctrtool code and seeing how it outputs the firmware sections, I get the impression that the ARM code sections aren't encrypted in the FIRM format. I could be wrong though.

@LuigiBlood "So seriously, if the firmware was decrypted, that would be said on 3dbrew, not just on IRC." Well neimod had reversed the ExeFS format, and implemented it in ctrtool. But it wasn't until I started documenting the ExeFS format myself on 3DBrew, that he decided to put his findings.

 

[LuigiBlood]

Oh? Well. Nevermind about a part of what I said.
But anyway: I'm mostly only interested on getting a key to decrypt RomFS and be able to extract files. That's all I want.

 

[raystriker]

So what can a decrypted firmware do?


add1- (couldn't read the whole topic)

 

[3DSGuy]

So what can a decrypted firmware do?


add1- (couldn't read the whole topic)

Well if it's decrypted, then you can take a peek into the lowest level of code next up from the bootloader.

 

[3DSDSXL]

I would be hey with a home brew channel like the wii.

I would be happy with a home brew channel like the wii.

 

[DiscostewSM]

it is true 3ds firmware has been decrypted and now you can make homebrew channel like the wii or not

and thanks

My god. Read the thread. NO HOMEBREW CHANNEL. This is like the first tiny baby step of hacking the console. Read the stickies.

I just look at the post count and say "......yep..."

 

[DiNo29]

Ironically, if everyone DID read the thread before posting, it would be 15-20 pages shorter.

 

[3DSGuy]

Well there is now a page on 3DBrew regarding the format of firmware files http://3dbrew.org/wiki/FIRM

 

[Ericthegreat]

Well there is now a page on 3DBrew regarding the format of firmware files http://3dbrew.org/wiki/FIRM

Interesting, I wonder tho if this is just gotten from a hex editor or somthing?

 

[yuyuyup]

https://github.com/3dshax/ctr was just updated an hour ago. Someone let me know if these updates from me are a waste of time. I don't know what they mean, I'm merely relaying them for anyone else who might care. The previous update was 5 days ago.

 

[Rydian]

I can point out some of the basics, but compared to the people making these I'm like that uneducated tour guide that's all "And if you look to your left there's some building with people in it..."

 

[Paranoid Mouse C]

https://github.com/3dshax/ctr was just updated an hour ago. Someone let me know if these updates from me are a waste of time. I don't know what they mean, I'm merely relaying them for anyone else who might care. The previous update was 5 days ago.

decoding/encoding wave/pcm audio.

 

[3DSDSXL]

Something big is brewing i cant wait.

 

[Tom Bombadildo]

Something big is brewing i cant wait.

No. no there isn't. As mentioned by me way earlier, this is like a tiny little baby step.

 

[Ericthegreat]

Just wondering if he can decrypt the firmware shouldnt the roms use the same encryption?