Hacking (4.x only) CIA CFW Complete Guide

CalebW · Nov 4, 2014

Well, I managed to compile a cia, but when I try to install it I get an error. :/

VerseHell · Nov 4, 2014

I decrypted my rom (sims 3) using that :
https://gbatemp.net/threads/tutorial-how-to-decrypt-3ds-roms-for-dummies.372653/page-2#post-5136907
then I put the rsf file and the makerom.exe in the decrypted folder ) and I typed this

Code:

makerom.exe -f cia -target d -rsf RSF.rsf -o 3dsrom.cia -exheader exheader.bin -code exefs/code.bin -icon exefs/icon.bin -banner exefs/banner.bin -romfs romfs.bin -logo exefs/logo.bin

and I have this :

Code:

[CIA ERROR] Content 0 Is Corrupt (res = -10)
[RESULT] Failed to build CIA

Here's my rsf file

Code:

BasicInfo:
  Title                  : "Sims3"
  CompanyCode            : "00"
  ProductCode            : "CTRP-P-AS3P"
  ContentType            : Application
  Logo                    : Licensed # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
Rom:
  # Specifies the root path of the file system to include in the ROM.
  HostRoot                : "romfs"
 
 
TitleInfo:
  UniqueId                : 0x1242
  Category                : Application
 
CardInfo:
  MediaSize              : 512MB # 128MB / 256MB / 512MB / 1GB / 2GB / 4GB
  MediaType              : Card1 # Card1 / Card2
  CardDevice              : Norflash # NorFlash(Pick this if you use savedata) / None
 
 
Option:
  FreeProductCode        : true # Removes limitations on ProductCode
  MediaFootPadding        : true # If true CCI files are created with padding
  EnableCrypt            : true # Enables encryption for NCCH and CIA
  EnableCompress          : true # Compresses exefs code
 
ExeFs: # these are the program segments from the ELF, check your elf for the appropriate segment names
  ReadOnly:
  - .rodata
  - RO
  ReadWrite:
  - .data
  - RO
  Text:
  - .init
  - .text
  - STUP_ENTRY
 
PlainRegion: # only used with SDK ELFs
- .module_id
 
AccessControlInfo:
  #UseExtSaveData : true
  #ExtSaveDataId: 0xff3ff
  #UseExtendedSaveDataAccessControl: true
  #AccessibleSaveDataIds: [0x101, 0x202, 0x303, 0x404, 0x505, 0x606]
 
SystemControlInfo:
  SaveDataSize: 512KB
  RemasterVersion: 0
  StackSize: 0x40000
 
# DO NOT EDIT BELOW HERE OR PROGRAMS WILL NOT LAUNCH (most likely)
 
AccessControlInfo:
  FileSystemAccess:
  - Debug
  - DirectSdmc
  - DirectSdmcWrite
 
  IdealProcessor                : 0
  AffinityMask                  : 1
 
  Priority                      : 16
 
  MaxCpu                        : 0x9E # Default
 
  CoreVersion                  : 2
  DescVersion                  : 2
 
  ReleaseKernelMajor            : "02"
  ReleaseKernelMinor            : "33"
  MemoryType                    : Application
  HandleTableSize: 512
  IORegisterMapping:
  - 1ff50000-1ff57fff
  - 1ff70000-1ff77fff
  MemoryMapping:
  - 1f000000-1f5fffff:r
  SystemCallAccess:
    ArbitrateAddress: 34
    Break: 60
    CancelTimer: 28
    ClearEvent: 25
    ClearTimer: 29
    CloseHandle: 35
    ConnectToPort: 45
    ControlMemory: 1
    CreateAddressArbiter: 33
    CreateEvent: 23
    CreateMemoryBlock: 30
    CreateMutex: 19
    CreateSemaphore: 21
    CreateThread: 8
    CreateTimer: 26
    DuplicateHandle: 39
    ExitProcess: 3
    ExitThread: 9
    GetCurrentProcessorNumber: 17
    GetHandleInfo: 41
    GetProcessId: 53
    GetProcessIdOfThread: 54
    GetProcessIdealProcessor: 6
    GetProcessInfo: 43
    GetResourceLimit: 56
    GetResourceLimitCurrentValues: 58
    GetResourceLimitLimitValues: 57
    GetSystemInfo: 42
    GetSystemTick: 40
    GetThreadContext: 59
    GetThreadId: 55
    GetThreadIdealProcessor: 15
    GetThreadInfo: 44
    GetThreadPriority: 11
    MapMemoryBlock: 31
    OutputDebugString: 61
    QueryMemory: 2
    ReleaseMutex: 20
    ReleaseSemaphore: 22
    SendSyncRequest1: 46
    SendSyncRequest2: 47
    SendSyncRequest3: 48
    SendSyncRequest4: 49
    SendSyncRequest: 50
    SetThreadPriority: 12
    SetTimer: 27
    SignalEvent: 24
    SleepThread: 10
    UnmapMemoryBlock: 32
    WaitSynchronization1: 36
    WaitSynchronizationN: 37
  InterruptNumbers:
  ServiceAccessControl:
  - APT:U
  - $hioFIO
  - $hostio0
  - $hostio1
  - ac:u
  - boss:U
  - cam:u
  - cecd:u
  - cfg:u
  - dlp:FKCL
  - dlp:SRVR
  - dsp::DSP
  - frd:u
  - fs:USER
  - gsp::Gpu
  - hid:USER
  - http:C
  - mic:u
  - ndm:u
  - news:u
  - nwm::UDS
  - ptm:u
  - pxi:dev
  - soc:U
  - ssl:C
  - y2r:u
  - ldr:ro
  - ir:USER
 
 
SystemControlInfo:
  Dependency:
    ac: 0x0004013000002402L
    am: 0x0004013000001502L
    boss: 0x0004013000003402L
    camera: 0x0004013000001602L
    cecd: 0x0004013000002602L
    cfg: 0x0004013000001702L
    codec: 0x0004013000001802L
    csnd: 0x0004013000002702L
    dlp: 0x0004013000002802L
    dsp: 0x0004013000001a02L
    friends: 0x0004013000003202L
    gpio: 0x0004013000001b02L
    gsp: 0x0004013000001c02L
    hid: 0x0004013000001d02L
    http: 0x0004013000002902L
    i2c: 0x0004013000001e02L
    ir: 0x0004013000003302L
    mcu: 0x0004013000001f02L
    mic: 0x0004013000002002L
    ndm: 0x0004013000002b02L
    news: 0x0004013000003502L
    nim: 0x0004013000002c02L
    nwm: 0x0004013000002d02L
    pdn: 0x0004013000002102L
    ps: 0x0004013000003102L
    ptm: 0x0004013000002202L
    ro: 0x0004013000003702L
    socket: 0x0004013000002e02L
    spi: 0x0004013000002302L
    ssl: 0x0004013000002f02L
CommonHeaderKey:
  D: |
    jL2yO86eUQnYbXIrzgFVMm7FVze0LglZ2f5g+c42hWoEdnb5BOotaMQPBfqt
    aUyAEmzQPaoi/4l4V+hTJRXQfthVRqIEx27B84l8LA6Tl5Fy9PaQaQ+4yRfP
    g6ylH2l0EikrIVjy2uMlFgl0QJCrG+QGKHftxhaGCifdAwFNmiZuyJ/TmktZ
    0RCb66lYcr2h/p2G7SnpKUliS9h9KnpmG+UEgVYQUK+4SCfByUa9PxYGpT0E
    nw1UcRz0gsBmdOqcgzwnAd9vVqgb42hVn6uQZyAl+j1RKiMWywZarazIR/k5
    Lmr4+groimSEa+3ajyoIho9WaWTDmFU3mkhA2tUDIQ==
  Exponent: |
    AQAB
  Modulus: |
    zwCcsyCgMkdlieCgQMVXA6X2jmb1ICjup0Q+jk/AydPkOgsx7I/MjUymFEkU
    vgXBtCKtzh3NKXtFFuW51tJ60GPOabLKuG0Qm5li+UXALrWhzWuvd5vv2FZI
    dTQCbrq/MFS/M02xNtwqzWiBjE/LwqIdbrDAAvX4HGy0ydaQJ1DKYeQeph5D
    lAGBw2nQ4izXhhuLaU3w8VQkIJHdhxIKI5gJY/20AGkG0vHD553Mh5kBINrWp
    CRYmmJS8DCYbAiQtKbkeUfzHViGTZuj6PwaY8Mv39PGO47a++pt45IUyCEs4/
    LjMS72cyfo8tU4twRGp76SFGYejYj3wGC1f/POQw==
  Signature: |
    BOPR0jL0BOV5Zx502BuPbOvi/hvOq5ID8Dz1MQfOjkey6FKP/6cb4f9YXpm6c
    ZCHAZLo0GduKdMepiKPUq1rsbbAxkRdQdjOOusEWoxNA58x3E4373tCAhlqM2
    DvuQERrIIQ/XnYLV9C3uw4efZwhFqog1jvVyoEHpuvs8xnYtGbsKQ8FrgLwXv
    pOZYy9cSgq+jqLy2D9IxiowPcbq2cRlbW9d2xlUfpq0AohyuXQhpxn7d9RUor
    9veoARRAdxRJK12EpcSoEM1LhTRYdJnSRCY3x3p6YIV3c+l1sWvaQwKt0sZ/U
    8TTDx2gb9g7r/+U9icneu/zlqUpSkexCS009Q==
  Descriptor: |
    AP///wAABAACAAAAAAAFGJ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiIAAAAAAAABBUFQ6VQAAACRo
    aW9GSU8AJGhvc3RpbzAkaG9zdGlvMWFjOnUAAAAAYm9zczpVAABjYW06dQAA
    AGNlY2Q6dQAAY2ZnOnUAAABkbHA6RktDTGRscDpTUlZSZHNwOjpEU1BmcmQ6
    dQAAAGZzOlVTRVIAZ3NwOjpHcHVoaWQ6VVNFUmh0dHA6QwAAbWljOnUAAABu
    ZG06dQAAAG5ld3M6dQAAbndtOjpVRFNwdG06dQAAAHB4aTpkZXYAc29jOlUA
    AABzc2w6QwAAAHkycjp1AAAAbGRyOnJvAABpcjpVU0VSAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAABOn/rw/7//8ec/APIA8JH/APaR/1D/gf9Y/4H/cP+B/3j/gf8B
    AQD/AAIA/iECAPz/////////////////////////////////////////////
    ////////////////////////////////////////AAAAAAAAAAAAAAAAAAAA
    AAADAAAAAAAAAAAAAAAAAAI=

EDIT : I also got this during the decryption process :

Code:

Error, exheader hash mismatch. Wrong key?

Don't knw if it's important though.

CalebW · Nov 4, 2014

schuko1982 said:
C:\makerom>makerom -f cia -romfs decrypted_romfs.bin -exefs decrypted_exefs.bin
-exheader decrypted_exheader.bin -rsf RSF.rsf -o rom.cia
[SETTING ERROR] Unrecognised argument '-exefs'
[RESULT] Invalid arguments, see 'makerom -help'

Sorry, my bad. You need to extract the decrypted exefs.bin with

Code:

ctrtool -t exefs --exefsdir=dir dec_exefs.bin

Then you would you use

Code:

C:\makerom>makerom -f cia -romfs decrypted_romfs.bin -icon icon.bin -banner banner.bin -code code.bin -logo logo.bin
-exheader decrypted_exheader.bin -rsf RSF.rsf -o rom.cia -exefslogo

(that -exefslogo is only for games <5.0. Remove it if it's greater than 5.0)

asesin22 · Nov 4, 2014

not working for me o my god alwayd stuck and failed to conect

piratesephiroth · Nov 4, 2014

schuko1982 said:
piratesephiroth

C:\makerom>makerom -target d -ccitocia yourrom.3ds
[SETTING ERROR] Unrecognised argument '-ccitocia'
[RESULT] Invalid arguments, see 'makerom -help'

Which version of makerom is that? Must be real old.

CalebW · Nov 4, 2014

Why do we have to send the cia from our computer to the 3ds? Couldn't we modify the code to allow installing it off the sd card?

piratesephiroth · Nov 4, 2014

CalebW said:
Sorry, my bad. You need to extract the decrypted exefs.bin with

Code:

ctrtool -t exefs --exefsdir=dir dec_exefs.bin

That would be

Code:

ctrtool -t exefs --exefsdir=exefsdir dec_exefs.bin --decompresscode

CalebW · Nov 4, 2014

piratesephiroth said:
That would be

Code:

ctrtool -t exefs --exefsdir=exefsdir dec_exefs.bin --decompresscode

I didn't have to use the --decompresscode

VerseHell · Nov 4, 2014

I retried and i just got these warnings this time

Code:

[NCCH WARNING] NCCH AES Key could not be loaded, NCCH will not be encrypted
[CIA WARNING] Common Key could not be loaded, CIA will not be encrypted

I'm gonna test the cia generated now.

asesin22 · Nov 4, 2014

CalebW said:
Why do we have to send the cia from our computer to the 3ds? Couldn't we modify the code to allow installing it off the sd card?

yes

PieFace · Nov 4, 2014

CalebW said:
Why do we have to send the cia from our computer to the 3ds? Couldn't we modify the code to allow installing it off the sd card?

Because then giovanify would have to actually write code himself

It is a valid point though, but it still only needs to be done once, then just use devmenu afterwards

VerseHell · Nov 4, 2014

VerseHell said:
I retried and i just got these warnings this time

Code:

[NCCH WARNING] NCCH AES Key could not be loaded, NCCH will not be encrypted [CIA WARNING] Common Key could not be loaded, CIA will not be encrypted

I'm gonna test the cia generated now.

Now it's say that i put off my sd card -_-. Tryning with the exefslogo...

asesin22 · Nov 4, 2014

dont work XD

asesin22 · Nov 4, 2014

[/url] share image[/IMG]

schuko1982 · Nov 4, 2014

piratesephiroth said:
Which version of makerom is that? Must be real old.

C:\makerom>makerom -target d -ccitocia pilotwings.3ds
[NCCH ERROR] Failed to load ncch aes key
[CIA WARNING] CXI AES Key could not be loaded
Meta Region, SaveDataSize, Remaster Version cannot be obtained

CalebW said:
Sorry, my bad. You need to extract the decrypted exefs.bin with

Code:

ctrtool -t exefs --exefsdir=dir dec_exefs.bin

Then you would you use

Code:

C:\makerom>makerom -f cia -romfs decrypted_romfs.bin -icon icon.bin -banner banner.bin -code code.bin -logo logo.bin -exheader decrypted_exheader.bin -rsf RSF.rsf -o rom.cia -exefslogo

(that -exefslogo is only for games <5.0. Remove it if it's greater than 5.0)

C:\makeroms>ctrtool -t exefs --exefsdir=dir dec_exefs.bin
error: could not open input file!

as himself RSF.rsf???

thank

CalebW · Nov 4, 2014

schuko1982 said:
C:\makerom>makerom -target d -ccitocia pilotwings.3ds
[NCCH ERROR] Failed to load ncch aes key
[CIA WARNING] CXI AES Key could not be loaded
Meta Region, SaveDataSize, Remaster Version cannot be obtained

C:\makeroms>ctrtool -t exefs --exefsdir=dir dec_exefs.bin
error: could not open input file!

as himself RSF.rsf???

thank

Well you'd need to change the "dec_exefs.bin" to whatever name you use...you shouldn't just copy and paste code.

mocalacace · Nov 4, 2014

PieFace said:
Because then giovanify would have to actually write code himself
It is a valid point though, but it still only needs to be done once, then just use devmenu afterwards

Libctru was recently updated with the application manager commands. It shouldn't be too hard to make a CIA installer with thes functions.

Cacacea · Nov 4, 2014

Can anyone confirm that this "CIA CFW Complete Guide" works on 4.1 firmware?

VerseHell · Nov 4, 2014

Yes it does.

schuko1982 · Nov 4, 2014

CalebW said:
Well you'd need to change the "dec_exefs.bin" to whatever name you use...you shouldn't just copy and paste code.

sorry

I created an empty folder

C:\makerom>ctrtool -t exefs --exefsdir=dir exefs.bin

ExeFS:
Section name: Kaà█$─S«
Section offset: 0x670fafa0
Section size: 0x155e43e0
Section hash: 7F3E39AAF628AF01BE41DE4A86025DCE00007BCD40217F03EE258443
59FE3236
Section name: ötçƒuÈU
Section offset: 0x88bedc13
Section size: 0x9134b812
Section hash: 8C83175FE787B836CE9F8C3AFAD7533F9B0A27AC5BFBD64D0CB0390A
24D4E4DE
Section name: LM®ñÇ─
Section offset: 0xec859992
Section size: 0x653a622f
Section hash: 533CB868CA49324836E77D3E843076FAC33001BBE6B8AAF10B4EDF4D
69F576BC
Section name: $¼│SÚ¸|t
Section offset: 0xf3a035cc
Section size: 0xd70429c3
Section hash: 3B35B4DB9E3080D8D45541CAA6D169DD0658B3BF57AFCD3333B0CDCF
38D21473
Section name: ¹©♣·♣
Section offset: 0xaae817ad
Section size: 0x39361f68
Section hash: 4C6129B4B349E08ABFACD970F1E33F0C5C82BF45A49FB92BAC3AF63B
86CFBB00
Section name: TÅúSð¸Z{
Section offset: 0xc2d1cfd0
Section size: 0x7af4a1b7
Section hash: 2220172B711697B076F84B88554943438474CA8671A0CCF5C87EA9BD
0D66F569
Section name: ¶ãÎê*³Ç¸
Section offset: 0xf7ce6a4d
Section size: 0xc4cdec6e
Section hash: F555B2CA6ACFAD41B7EA037A6778B645FDDA76911D4E6E507B8D6C02
7A6E0A87
Section name: â─wb9âÏ└
Section offset: 0x4826fe07
Section size: 0xaa337a45
Section hash: 551B66C733596BD3669B2698021F2463F37B98CF43BB997B52D05EF2
95EDEBF6
Error, ExeFS section 0 size invalid
Error, ExeFS section 1 size invalid
Error, ExeFS section 2 size invalid
Error, ExeFS section 3 size invalid
Error, ExeFS section 4 size invalid
Error, ExeFS section 5 size invalid
Error, ExeFS section 6 size invalid
Error, ExeFS section 7 size invalid

Hacking (4.x only) CIA CFW Complete Guide

Fellow Temper

Well-Known Member

Fellow Temper

Well-Known Member

I wish I could read

Fellow Temper

I wish I could read

Fellow Temper

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Member

Fellow Temper

Well-Known Member

Active Member

Well-Known Member

Member

Similar threads

Popular threads in this forum