Hacking Can Nintendo ban gateway users?

[ComeTurismO]

Usually people frighten out when they read the back of a 3DS game box art.

But it's nothing to worry about, really.

 

[Foxi4]

I think banning is possible, they could just ban the console ID without a problem. They can keep track of your downloads(which are console tied) so why can't they ban the console? They can also transfer content etc.

Transfer of content occurs between two systems and does not require Nintendo's intervention. The only things unique about the 3DS is its Friend Code which is assigned when the console is first used online as well as the shop key which is generated the same way - both of which can be replaced by formatting the system. There is no magical, unique console ID on the 3DS hence banning the console is impossible unless such ID's are assigned and since there's no account system in place, the user can't be banned either. The very reason why System Transfer was introduced was because Nintendo isn't storing your purchases on their servers and the only file sent is an encrypted list of what was installed on a given system.

That, or use the same legality checker that was in Gen 4 and 5, but updated for X & Y.

The fabled "legality checker" of Pokemon as far as Online is concerned is based on maximum possible stats for each Pokemon and a few other variables (place where the Pokemon was caught etc.) as far as I know, it can be effectively cheated and you can generate "legal" Pokemon perfectly fine. Moreover, it only applies to this one game - it can't be used for "anything else", not without modifying it heavily for each game. The NoEXP AP was based on simple cartridge reads which could be and were effectively faked each and every time - that kind of protection is useless and the obstruction it creates is temporary.

 

[Yamagushi]

Transfer of content occurs between two systems and does not require Nintendo's intervention. The only things unique about the 3DS is its Friend Code which is assigned when the console is first used online as well as the shop key which is generated the same way - both of which can be replaced by formatting the system. There is no magical, unique console ID on the 3DS hence banning the console is impossible unless such ID's are assigned and since there's no account system in place, the user can't be banned either. The very reason why System Transfer was introduced was because Nintendo isn't storing your purchases on their servers and the only file sent is an encrypted list of what was installed on a given system. .

If this was the case, everyone could share their SD card contents and easily pirate everything.. There is definitely a console ID..

 

[Foxi4]

If this was the case, everyone could share their SD card contents and easily pirate everything.. There is definitely a console ID..

System Transfer deletes the content from the 3DS of origin after the process is complete, you can't just share your SD card with anyone because it's signed with your unique keys, however those keys are generated - they're not embedded in the device and can be re-generated for each system.

http://www.3dbrew.org/wiki/Nand/private/movable.sed

EDIT: And before you say that keyY is console-unique, I'll have you know that it's set by NATIVE_FIRM and the key generator - it's not there from the get-go.

 

[Yamagushi]

System Transfer deletes the content from the 3DS of origin after the process is complete, you can't just share your SD card with anyone because it's signed with your unique keys, however those keys are generated - they're not embedded in the device and can be re-generated for each system. All that's sent is a list of titles after receiving the "green light" from Nintendo server-side.

http://www.3dbrew.org/wiki/Nand/private/movable.sed

I wasn't talking about system transfer. The console has a unique key. That is why you can't take the SD card out, stick it in another 3ds and play. They should have no problem banning systems.

 

[Foxi4]

I wasn't talking about system transfer. The console has a unique key. That is why you can't take the SD card out, stick it in another 3ds and play. They should have no problem banning systems.

The encryption keys for the SD card are generated, they are console-unique but cannot be used for banning - you can format the system and you'll magically get a new set of keys from the key generator which is the whole point. If you get "banned" on its basis, you can get "unbanned" within minutes.

Of course I'm not incredibly well-versed in the subject, but from what I'm reading that's the case - if it's not, I'd love to be corrected with a source link.

 

[Yamagushi]

*sighs* The encryption keys for the SD card are generated, they are console-unique but cannot be used for banning - you can format the system and you'll magically get a new set of keys from the key generator which is the whole point. If you get "banned" on its basis, you can get "unbanned" within minutes.

You get new keys based off of a non-changing system key. If the keys were generated and placed on the SD card, you could pop out the SD card, pop it into another 3ds, and it would be good to go.

 

[Foxi4]

You get new keys based off of a non-changing system key. If the keys were generated and placed on the SD card, you could pop out the SD card, pop it into another 3ds, and it would be good to go.

They're not "placed on the SD card", that would be stupid. Upon boot they're generated from a seed and stored in NAND (also hashed), then used for file encryption.

Everything stored under sdmc/Nintendo 3DS/<ID0>/<ID1> is encrypted with console-unique keyslots, files stored under nand/data/<ID0> only use these keyslots for MACs. All CTR files under these directories use the keyslots initialized by nand/private/movable.sed. ~http://www.3dbrew.org/wiki/SD_Filesystem

Which is why movable.sed is a file transferred during a System Transfer and it's all the system needs to decrypt or re-download content from a title list.

 

[Yamagushi]

They're not "placed on the SD card", that would be stupid. Upon boot they're generated from a seed and stored in NAND (also hashed), then used for file encryption.

Which is why movable.sed is a file transferred during a System Transfer and it's all the system needs to decrypt or re-download content from a title list.

So the system transfer clears the key in the NAND as well?

Edit: Wait but then how does formatting the system clear the key? Formatting clears the NAND key? So if you format you can't download any of your e-shop content again?

 

[Foxi4]

So the system transfer clears the key in the NAND as well?

It updates the file invalidating everything that was previously on the system as soon as the transfer is complete however if what is currently known is correct, provided you are capable of dumping the NAND, then performing the System Transfer and finally re-flashing the backup on, you should technically end up with two 3DS's with the same content installed. Of course this is all theory and I have no way of validating what I just said - I'm basing this on what I've read.

 

[Yamagushi]

It updates the file invalidating everything that was previously on the system as soon as the transfer is complete however if what is currently known is correct, provided you are capable of dumping the NAND, then performing the System Transfer and finally re-flashing the backup on, you should technically end up with two 3DS's with the same content installed. Of course this is all theory and I have no way of validating what I just said - I'm basing this on what I've read.

So what about formatting the system, you were saying this would reset everything? This updates the key as well? Wouldn't that mean you can't redownload any of your e-shop content if you format?

 

[Foxi4]

So what about formatting the system, you were saying this would reset everything? This updates the key as well? Wouldn't that mean you can't redownload any of your e-shop content if you format?

According to 3DBrew, movable.sed is updated in three circumstances - when it does not exist (in which case the system borrows a part of it from LocalFriendCodeSeed which is unique but doesn't have to be used for the key present, for example if movable.sed was transferred from a different unit then they wouldn't match, and the rest is generated), when a System Transfer is performed and when a System Format is performed, although all three work according to different mechanisms and with different end results (formatting likely prevents loss of content ).

 

[McHaggis]

The infrastructure doesn't support banning as of today and would have to be revamped entirely to do so. Hell, it doesn't even support accounts - what are we talking about?

You have a source on that Foxi? Because it seems like the kind of thing that wouldn't publicly be announced by Nintendo, whether they can ban or not sounds like the kind of thing that would only be known internally. Also, it doesn't need to support accounts, nor would it require an entire revamp. The fact that there's no account system would only make it easier to permaban because there would be no way to circumvent it. A simple flag in a database would suffice.

Nobody knows how they're going to react. But going by XBL bans and PSN bans, then NN bans seem like a logical response to expect from Nintendo. And since both XBL bans and PSN bans came around well before the 3DS's launch it's entirely possible they have a system in place to apply bans to hacked consoles. How could they identify you? Who knows? Friend codes, maybe. They're unique and even a system transfer couldn't get you unbanned.

 

[Foxi4]

Friend codes, maybe. They're unique and even a system transfer couldn't get you unbanned.

As far as I know Friend Codes are not unique - they're generated by the system from a Friend Code seed and can be changed.

As for the source, have you heard of any 3DS-related bans yet? We have people playing with flashcarts almost since day 1 using WFC on DS titles and the Gateway has been out for a while for 3DS games and although it does not allow playing online as of today, Nintendo would still be getting system reports when other online features are used.

The only bans (suspensions, really) I've heard of were related to Mario Kart which runs on a custom server and they were Friend Code-based, issued for foul play and exploiting the game's bugs.

tl;dr If Nintendo wants to effectively ban users they'd have to start using unique CPU ID's which cannot be overwritten - worked on the PS3/360 (until people found a way to fake/swap them as well), it should work on the 3DS.

 

[osm70]

You have a source on that Foxi? Because it seems like the kind of thing that wouldn't publicly be announced by Nintendo, whether they can ban or not sounds like the kind of thing that would only be known internally. Also, it doesn't need to support accounts, nor would it require an entire revamp. The fact that there's no account system would only make it easier to permaban because there would be no way to circumvent it. A simple flag in a database would suffice.

Nobody knows how they're going to react. But going by XBL bans and PSN bans, then NN bans seem like a logical response to expect from Nintendo. And since both XBL bans and PSN bans came around well before the 3DS's launch it's entirely possible they have a system in place to apply bans to hacked consoles. How could they identify you? Who knows? Friend codes, maybe. They're unique and even a system transfer couldn't get you unbanned.

Format and you get new friend code.

 

[McHaggis]

As far as I know Friend Codes are not unique - they're generated by the system from a Friend Code seed and can be changed.

But they could still be practically unique. See implementations of UUIDs, such as Microsoft's GUIDs. There's also the fact that the eShop manages to tie itself to your console and remains tied even after a format, so they must be able to uniquely identify the console (much like the Wii did).

As for the source, have you heard of any 3DS-related bans yet? We have people playing with flashcarts almost since day 1 using WFC on DS titles and the Gateway has been out for a while for 3DS games and although it does not allow playing online as of today, Nintendo would still be getting system reports when other online features are used.

I'd say that they probably couldn't have banned people using DS flashcarts without also risking bans of legitimate users of the games they were spoofing. Also, I didn't receive my PSN ban threat until at least a year after the USB hack and about 4-6 months after the softmods were made public.

The only bans (suspensions, really) I've heard of were related to Mario Kart which runs on a custom server and they were Friend Code-based, issued for foul play and exploiting the game's bugs.

I think banning based on Friend Codes would be enough to satisfy Nintendo. If people want to unban themselves, they'd have to somehow change the friend code and then stop using the Gateway, in which case it's "mission complete". I'm one of the people who removed the hacks from my PS3 because I couldn't stand being without PSN any longer, and the only thing the scene was interested in was backup loaders and virtually no good homebrew.

Format and you get new friend code.

Maybe, but the eShop can still identify your console as it always did in order for you to download all your previously purchased games. So... what's stopping the rest of the online infrastructure from recognising who you were. Also, see above; they may be satisfied with the fact that you have to completely reformat just to get unbanned if it means you lose your friend code, streetpass data, everything. And you'd just get banned again the next time you use your Gateway whilst connected.

 

[Foxi4]

But they could still be practically unique. See implementations of UUIDs, such as Microsoft's GUIDs. There's also the fact that the eShop manages to tie itself to your console and remains tied even after a format, so they must be able to uniquely identify the console (much like the Wii did).

Have you considered that the eShop doesn't actually tie itself with the console in any way and in such a scenario the title list simply remains on the system, allowing for title re-downloading?

As for using the Wii as a good example of fantastic online security - please stahp. If it's anything like the Wii's then we have nothing to worry about whatsoever.

 

[McHaggis]

Have you considered that the eShop doesn't actually tie itself with the console in any way and in such a scenario the title list simply remains on the system, allowing for title re-downloading?

Yeah, that's probably how they do it. But like I said, they'd probably be happy enough banning the friend code and making you jump through hoops to get unbanned. As long as they can prevent pirates from playing online, that's the win for them, right? Stop being a pirate, that's also a win for them. In fact, it's probably better that way because a permaban would give you absolutely no incentive to stop being a pirate .

As for using the Wii as a good example of fantastic online security - please stahp. If it's anything like the Wii's then we have nothing to worry about whatsoever.

I don't believe that's what I said or even implied, but it brings me to another point. We know that several improvements were made between the online infrastructure for the Wii and the one for 3DS. Such an opportunity is usually where you look at not making the same mistakes that you did in the past. In the same vein, we also know that they're currently making some infrastructure improvements in order to bring Miiverse to the 3DS. During this transition they might once again look at improving the system, especially in light of the Gateway's release.

All I'm saying is we probably shouldn't rule it out. None of us can say people will, won't, can or can't be banned, because we really don't know what Nintendo are cooking. Depending on how worried you are about being banned, you should probably weigh up whether it's worth the risk.

 

[Langin]

Transfer of content occurs between two systems and does not require Nintendo's intervention. The only things unique about the 3DS is its Friend Code which is assigned when the console is first used online as well as the shop key which is generated the same way - both of which can be replaced by formatting the system. There is no magical, unique console ID on the 3DS hence banning the console is impossible unless such ID's are assigned and since there's no account system in place, the user can't be banned either. The very reason why System Transfer was introduced was because Nintendo isn't storing your purchases on their servers and the only file sent is an encrypted list of what was installed on a given system.

Actually there is an account! I lost my first 3DS, and Nintendo could actually remove ALL content and placed it on my new 3DS from a distance. They could remove your eshop content, so why not ban a console?

 

[Foxi4]

Actually there is an account! I lost my first 3DS, and Nintendo could actually remove ALL content and placed it on my new 3DS from a distance. They could remove your eshop content, so why not ban a console?

Have you given them any form of ID whatsoever? If that's the case then I'll have you know that the eShop does hold records of your purchases for fiscal reasons (and in case of such emergencies) but again, those ID variables cannot be used to ban a system.