Hacking (4.x only) CIA CFW Complete Guide

[VerseHell]

You just need the gateway launcher, not the gateway itself (and a ds flashcart)

 

[asesin22]

but eshop XD i dont have eshop acces

 

[VerseHell]

but eshop XD i dont have eshop acces

You don't need eshop anymore, read the tutorial.

 

[CalebW]

but eshop XD i dont have eshop acces

That's already been explained in the original post.

 

[asesin22]

omg yes really import db da fuck this is new

 

[asesin22]

awesome

 

[VerseHell]

Ok, and what does the rsf file have to look like for each game?

Here's an example :
https://mega.co.nz/#!YxFxjJpR!x0VUhZDNQokRga9vwNreAaoahwsWVYJgtGeFeup_IvM

 

[Kane49]

Someone said something about an open source implementation of the cfw ?
Open source as in proper sourcecode and not the half baked disassembly made into a source file ^^

 

[Gadorach]

Someone said something about an open source implementation of the cfw ?
Open source as in proper sourcecode and not the half baked disassembly made into a source file ^^

Yeah, I'm pretty sure that was the plan. They're working to open-source everything so we know what we're working with before we start trying to add new features. Proper C code would be a treat to look at over this assembly, seeing as most young devs aren't going to be able to read any assembly, of course.

 

[Relys]

make_cia is a open source alternative to ctr_makecia32, has anyone tried it out?

https://gbatemp.net/threads/where-ctr-toolkit-sits-in-the-scheme-of-things.353276/

I found a newer version than what was linked in that thread.

The version uploaded in that thread was version 6.1. This is version 6.4 and has more tools: https://github.com/ctrdev/ctrsdk

 

[CalebW]

Ok, I decrypted the rom, but when I try to compile it into a cci I get:

$ makerom -f cci -target d -rsf gw.rsf -exheader dec_exheader.bin -code dec_exef
s/code.bin -icon dec_exefs/icon.bin -banner dec_exefs/banner.bin -logo dec_exefs/logo.bin -romfs dec_romfs.bin -alignwr -o LM.3ds -v

[NCCH] NCCH AES keys:
 > key0: 00000000000000000000000000000000
 > key1: 00000000000000000000000000000000
Segmentation fault (core dumped)

Here's my rsf file:

Spoiler

BasicInfo:
  Title                   : "LM3DS"
  CompanyCode             : "01"
  ProductCode             : "CTR-P-AGGE"
  ContentType             : Application
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem

RomFs:
  # Specifies the root path of the file system to include in the ROM.
  #RootPath                : "decrypted_romfs"

TitleInfo:
  UniqueId                : 0x085E
  Category                : Application
  
CardInfo:
  MediaSize               : 1GB # 128MB / 256MB / 512MB / 1GB / 2GB / 4GB
  MediaType               : Card1 # Card1 / Card2
  CardDevice              : NorFlash # NorFlash(if you use savedata and Card1) / None (for Card2)
  

Option:
  UseOnSD                 : true # true if App is to be installed to SD
  FreeProductCode         : true # Removes limitations on ProductCode
  MediaFootPadding        : true # If true CCI files are created with padding
  EnableCrypt             : true # Enables encryption for NCCH and CIA
  EnableCompress          : true # Compresses exefs code

ExeFs: # these are the program segments from the ELF, check your elf for the appropriate segment names
  ReadOnly: 
   - .rodata
   - RO
  ReadWrite: 
   - .data
   - RO
  Text: 
   - .init
   - .text
   - STUP_ENTRY
   
PlainRegion: # only used with SDK ELFs 
 - .module_id
  
AccessControlInfo:
  ExtSaveDataId: 0x00000000
  SystemSaveDataId1: 0x00000000
  SystemSaveDataId2: 0x00000000
  OtherUserSaveDataId1: 0x00000
  OtherUserSaveDataId2: 0x00000
  OtherUserSaveDataId3: 0x00000
  UseOtherVariationSaveData : true
  #UseExtendedSaveDataAccessControl: true
  #AccessibleSaveDataIds: [0x101, 0x202, 0x303, 0x404, 0x505, 0x606]
  FileSystemAccess:
   #- Boss
   #- CardBoard
   #- CategoryFileSystemTool
   #- CategoryHardwareCheck
   #- CategoryHomeMenu
   #- CategorySystemApplication
   #- CategorySystemSettings
   #- Core
   #- CtrNandRo
   #- CtrNandRoWrite
   #- CtrNandRw
   #- Debug
   #- DirectSdmc
   #- DirectSdmcWrite
   #- ExportImportIvs
   #- SaveDataMove
   #- Shell
   #- Shop
   #- SwitchCleanup
   #- TwlCardBackup
   #- TwlNandData
   
SystemControlInfo:
  SaveDataSize: 128K
  RemasterVersion: 0000
  StackSize: 0x00028000
  JumpId: 0x0004000000055F00L

  
# DO NOT EDIT BELOW HERE OR PROGRAMS WILL NOT LAUNCH (most likely)

AccessControlInfo:
  #IoAccessControl:
   #- FsMountNand
   #- FsMountNandRoWrite
   #- FsMountTwln
   #- FsMountWnand
   #- FsMountCardSpi
   #- UseSdif3
   #- CreateSeed
   #- UseCardSpi
   
  IdealProcessor                : 0
  AffinityMask                  : 1
  
  Priority                      : 48
  MaxCpu                        : 0x9E # Default
  
  CoreVersion                   : 2
  DescVersion                   : 2
  
  #Kernelflags
  DisableDebug                  : false
  EnableForceDebug              : false
  CanUseNonAlphabetAndNumber    : false
  CanWriteSharedPage            : false
  CanUsePrivilegedPriority      : false
  PermitMainFunctionArgument    : false
  CanShareDeviceMemory          : false
  RunnableOnSleep               : false
  SpecialMemoryArrange          : false
  MemoryType                    : Application # Application / System / Base
  HandleTableSize: 0x200
  
  #Kernel release version:
  ReleaseKernelMajor            : "02"
  ReleaseKernelMinor            : "33" # must be 33 or else Gateway won't accept it

  IORegisterMapping: 
   - 1ff50000-1ff57fff
   - 1ff70000-1ff77fff
  MemoryMapping: 
   - 1f000000-1f5fffff:r
  SystemCallAccess: 
    ArbitrateAddress: 34
    Break: 60
    CancelTimer: 28
    ClearEvent: 25
    ClearTimer: 29
    CloseHandle: 35
    ConnectToPort: 45
    ControlMemory: 1
    CreateAddressArbiter: 33
    CreateEvent: 23
    CreateMemoryBlock: 30
    CreateMutex: 19
    CreateSemaphore: 21
    CreateThread: 8
    CreateTimer: 26
    DuplicateHandle: 39
    ExitProcess: 3
    ExitThread: 9
    GetCurrentProcessorNumber: 17
    GetHandleInfo: 41
    GetProcessId: 53
    GetProcessIdOfThread: 54
    GetProcessIdealProcessor: 6
    GetProcessInfo: 43
    GetResourceLimit: 56
    GetResourceLimitCurrentValues: 58
    GetResourceLimitLimitValues: 57
    GetSystemInfo: 42
    GetSystemTick: 40
    GetThreadContext: 59
    GetThreadId: 55
    GetThreadIdealProcessor: 15
    GetThreadInfo: 44
    GetThreadPriority: 11
    MapMemoryBlock: 31
    OutputDebugString: 61
    QueryMemory: 2
    ReleaseMutex: 20
    ReleaseSemaphore: 22
    SendSyncRequest1: 46
    SendSyncRequest2: 47
    SendSyncRequest3: 48
    SendSyncRequest4: 49
    SendSyncRequest: 50
    SetThreadPriority: 12
    SetTimer: 27
    SignalEvent: 24
    SleepThread: 10
    UnmapMemoryBlock: 32
    WaitSynchronization1: 36
    WaitSynchronizationN: 37
  InterruptNumbers:
  ServiceAccessControl: 
   - APT:U
   - $hioFIO
   - $hostio0
   - $hostio1
   - ac:u
   - boss:U
   - cam:u
   - cecd:u
   - cfg:u
   - dlp:FKCL
   - dlp:SRVR
   - dsp::DSP
   - frd:u
   - fs:USER
   - gsp::Gpu
   - hid:USER
   - http:C
   - mic:u
   - ndm:u
   - news:u
   - nwm::UDS
   - ptm:u
   - pxi:dev
   - soc:U
   - ssl:C
   - y2r:u
   - ldr:ro
   - ir:USER
  
   
SystemControlInfo:
  Dependency: 
    ac: 0x0004013000002402L
    am: 0x0004013000001502L
    boss: 0x0004013000003402L
    camera: 0x0004013000001602L
    cecd: 0x0004013000002602L
    cfg: 0x0004013000001702L
    codec: 0x0004013000001802L
    csnd: 0x0004013000002702L
    dlp: 0x0004013000002802L
    dsp: 0x0004013000001a02L
    friends: 0x0004013000003202L
    gpio: 0x0004013000001b02L
    gsp: 0x0004013000001c02L
    hid: 0x0004013000001d02L
    http: 0x0004013000002902L
    i2c: 0x0004013000001e02L
    ir: 0x0004013000003302L
    mcu: 0x0004013000001f02L
    mic: 0x0004013000002002L
    ndm: 0x0004013000002b02L
    news: 0x0004013000003502L
    nim: 0x0004013000002c02L
    nwm: 0x0004013000002d02L
    pdn: 0x0004013000002102L
    ps: 0x0004013000003102L
    ptm: 0x0004013000002202L
    ro: 0x0004013000003702L
    socket: 0x0004013000002e02L
    spi: 0x0004013000002302L
    ssl: 0x0004013000002f02L
CommonHeaderKey: 
  D: |
    jL2yO86eUQnYbXIrzgFVMm7FVze0LglZ2f5g+c42hWoEdnb5BOotaMQPBfqt
    aUyAEmzQPaoi/4l4V+hTJRXQfthVRqIEx27B84l8LA6Tl5Fy9PaQaQ+4yRfP
    g6ylH2l0EikrIVjy2uMlFgl0QJCrG+QGKHftxhaGCifdAwFNmiZuyJ/TmktZ
    0RCb66lYcr2h/p2G7SnpKUliS9h9KnpmG+UEgVYQUK+4SCfByUa9PxYGpT0E
    nw1UcRz0gsBmdOqcgzwnAd9vVqgb42hVn6uQZyAl+j1RKiMWywZarazIR/k5
    Lmr4+groimSEa+3ajyoIho9WaWTDmFU3mkhA2tUDIQ==
  Exponent: |
    AQAB
  Modulus: |
    zwCcsyCgMkdlieCgQMVXA6X2jmb1ICjup0Q+jk/AydPkOgsx7I/MjUymFEkU
    vgXBtCKtzh3NKXtFFuW51tJ60GPOabLKuG0Qm5li+UXALrWhzWuvd5vv2FZI
    dTQCbrq/MFS/M02xNtwqzWiBjE/LwqIdbrDAAvX4HGy0ydaQJ1DKYeQeph5D
    lAGBw2nQ4izXhhuLaU3w8VQkIJHdhxIKI5gJY/20AGkG0vHD553Mh5kBINrWp
    CRYmmJS8DCYbAiQtKbkeUfzHViGTZuj6PwaY8Mv39PGO47a++pt45IUyCEs4/
    LjMS72cyfo8tU4twRGp76SFGYejYj3wGC1f/POQw==
  Signature: |
    BOPR0jL0BOV5Zx502BuPbOvi/hvOq5ID8Dz1MQfOjkey6FKP/6cb4f9YXpm6c
    ZCHAZLo0GduKdMepiKPUq1rsbbAxkRdQdjOOusEWoxNA58x3E4373tCAhlqM2
    DvuQERrIIQ/XnYLV9C3uw4efZwhFqog1jvVyoEHpuvs8xnYtGbsKQ8FrgLwXv
    pOZYy9cSgq+jqLy2D9IxiowPcbq2cRlbW9d2xlUfpq0AohyuXQhpxn7d9RUor
    9veoARRAdxRJK12EpcSoEM1LhTRYdJnSRCY3x3p6YIV3c+l1sWvaQwKt0sZ/U
    8TTDx2gb9g7r/+U9icneu/zlqUpSkexCS009Q==
  Descriptor: |
    AP///wAABAACAAAAAAAFGJ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiIAAAAAAAABBUFQ6VQAAACRo
    aW9GSU8AJGhvc3RpbzAkaG9zdGlvMWFjOnUAAAAAYm9zczpVAABjYW06dQAA
    AGNlY2Q6dQAAY2ZnOnUAAABkbHA6RktDTGRscDpTUlZSZHNwOjpEU1BmcmQ6
    dQAAAGZzOlVTRVIAZ3NwOjpHcHVoaWQ6VVNFUmh0dHA6QwAAbWljOnUAAABu
    ZG06dQAAAG5ld3M6dQAAbndtOjpVRFNwdG06dQAAAHB4aTpkZXYAc29jOlUA
    AABzc2w6QwAAAHkycjp1AAAAbGRyOnJvAABpcjpVU0VSAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAABOn/rw/7//8ec/APIA8JH/APaR/1D/gf9Y/4H/cP+B/3j/gf8B
    AQD/AAIA/iECAPz/////////////////////////////////////////////
    ////////////////////////////////////////AAAAAAAAAAAAAAAAAAAA
    AAADAAAAAAAAAAAAAAAAAAI=

 

[asesin22]

not working -_- ip adress 3ds i correctly aand ipconfig rename my ip 3ds 192.168.0.33 and failed to conect

 

[PieFace]

not working -_- ip adress 3ds i correctly aand ipconfig rename my ip 3ds 192.168.0.33 and failed to conect

Open the browser, load a page, then close the browser, and try to connect again

 

[asesin22]

i need update the console -_-

 

[asesin22]

Open the browser, load a page, then close the browser, and try to connect again

in the pc?

 

[PieFace]

in the pc?

on the 3ds

 

[asesin22]

pfff i need update

 

[asesin22]

imposible on 4.5 nand

 

[kamo]

imposible on 4.5 nand

Nah, keep trying. It worked for me.

 

[asesin22]

Nah, keep trying. It worked for me.

omg thanks you dont hace eshop and internet?