Hacking (4.x only) CIA CFW Complete Guide

Brandon1990 · Nov 5, 2014

CalebW said:
If you made it could you add cia support as well?

Sorry, my bad. I forgot a dash. Change it to "--exefsdir=dec_exefs"

Thank you so much calebw you are the best

CalebW · Nov 5, 2014

palantine said:
I'm working on a tutorial for converting roms to CIA files! Should be ready tonight hopefully.

So you've managed to actually install a rom and get it to run?

aliak11 · Nov 5, 2014

palantine said:
I'm working on a tutorial for converting roms to CIA files! Should be ready tonight hopefully.

Do you know what causes this error on import?

Code:

Import failed
Level: LEVEL_PERMANENT(-5)
Summary: SUMMARY_INVALID_ARGUMENT(7)
Module: MODULE_NN_AM(32)
Desc: (unknown)(106)

ground · Nov 5, 2014

aliak11 said:
Do you know what causes this error on import?

Code:

Import failed Level: LEVEL_PERMANENT(-5) Summary: SUMMARY_INVALID_ARGUMENT(7) Module: MODULE_NN_AM(32) Desc: (unknown)(106)

i had this error once, and i guess it is a faulty cia file. did you edit the .cia file after compiling?

p.s. anybody who wants to switch between regions: edit the byte at offset 2018 in icon.bin before compiling (http://3dbrew.org/wiki/SMDH#Region_Lockout), i had succes with pilotwings

CalebW · Nov 5, 2014

ground said:
i had this error once, and i guess it is a faulty cia file. did you edit the .cia file after compiling?

p.s. anybody who wants to switch between regions: edit the byte at offset 2018 in icon.bin before compiling (http://3dbrew.org/wiki/SMDH#Region_Lockout), i had succes with pilotwings

Why is it in the icon file?

Hmmm, so I compiled my decrypted Ocarina of time into a cia. Then I converted it to cci with -ccitocia in order to inject the decrypted exheader as mentioned earlier in this thread. I then converted back to cia with -ccitocia and installed it to rednand. But when I try to run it, I get "An error has occurred" instead of the usual freezing on the black 3ds screen.

palantine · Nov 5, 2014

aliak11 said:
Do you know what causes this error on import?

Code:

Import failed Level: LEVEL_PERMANENT(-5) Summary: SUMMARY_INVALID_ARGUMENT(7) Module: MODULE_NN_AM(32) Desc: (unknown)(106)

I'm not sure what causes it, but I do know that almost all of the BBB sdk CIA files cause this error. The error code says its happening in "Application Manager" (AM)

aliak11 · Nov 5, 2014

palantine said:
I'm not sure what causes it, but I do know that almost all of the BBB sdk CIA files cause this error. The error code says its happening in "Application Manager" (AM)

It's The Legend of Zelda OOT. The CIA compiles without any errors.

williamcesar2 · Nov 5, 2014

palantine said:
I'm working on a tutorial for converting roms to CIA files! Should be ready tonight hopefully.

keep up the good job

palantine · Nov 5, 2014

ROM to CIA Guide

This guide requires makerom and ctrtool.

Step1: decrypt the .3ds rom.
I will not explain it in this tutorial, as it is explained a couple of times around the forum. (http://gbatemp.net/threads/release-3ds_ctr_decryptor-void.370684/)

If you end up with a decrypted romfs.bin, exheader.bin, code.bin (decompressed), icon.bin and banner.bin you did everything correct.

Step2: creating an .rsf file
The .rsf file is a little bit different then the one for .3ds roms. Anyway here is the proper one, make sure you fill in the XXXX the right way. Just copy the text in the codebox underneath in a text editor and save it as cia.rsf in the folder with the other stuff.

• you can open the exheader or original rom in a hex editor to look up the right values for the companycode, producttyp and productcode
•For the correct UniqueID you can check ctrtool and the official rom. Just remove the last 2 0 and write the 4 digits before that in the .rsf file:

Code:

BasicInfo:
  Title                  : "Custom Title"
  CompanyCode            : "00"
  ProductCode            : "CTR-P-DERP"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x7850
  Category                : Application
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : true # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
AccessControlInfo:
  ExtSaveDataId: 0xb7850 # same as UniqueId
  SystemSaveDataId1: 0x00000000 # plaintext exheader
  SystemSaveDataId2: 0x00000000 # plaintext exheader
  OtherUserSaveDataId1: 0x00000 # plaintext exheader
  OtherUserSaveDataId2: 0x00000 # plaintext exheader
  OtherUserSaveDataId3: 0x00000 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00040000 # plaintext exheader
  JumpId: 0x000400000b000000L # plaintext exheader (<full UniqueID>L)

step 3: creating the .cia
Open the command window in the folder with the exefs.bin, exheader.bin, romfs.bin, icon.bin, code.bin, banner.bin, cia.rsf and makerom. Now run the following command:

makerom -f cia -target t -desc app:1 -icon icon.bin -banner banner.bin -exefslogo -code code.bin -exheader exh.bin -romfs romfs.bin -rsf cia.rsf -o Install.cia

this will output an .cia file which you can install with the DevMenu and then run.

If you encounter an error saying "[ROMFS ERROR] Invalid RomFS Binary.", then remove the "-romfs romfs.bin" from the command.

pLaYeR^^ · Nov 5, 2014

palantine said:
ROM to CIA Guide

This guide requires makerom and ctrtool.

Step1: decrypt the .3ds rom.
I will not explain it in this tutorial, as it is explained a couple of times around the forum. (http://gbatemp.net/threads/release-3ds_ctr_decryptor-void.370684/)

If you end up with a decrypted romfs.bin, exheader.bin, code.bin (decompressed), icon.bin and banner.bin you did everything correct.

Step2: creating an .rsf file
The .rsf file is a little bit different then the one for .3ds roms. Anyway here is the proper one, make sure you fill in the XXXX the right way. Just copy the text in the codebox underneath in a text editor and save it as cia.rsf in the folder with the other stuff.

• you can open the exheader or original rom in a hex editor to look up the right values for the companycode, producttyp and productcode
•For the correct UniqueID you can check ctrtool and the official rom. Just remove the last 2 0 and write the 4 digits before that in the .rsf file:

Code:

BasicInfo: Title : "Custom Title" CompanyCode : "00" ProductCode : "CTR-P-DERP" ContentType : Application # Application / SystemUpdate / Manual / Child / Trial Logo : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem TitleInfo: UniqueId : 0x7850 Category : Application Option: UseOnSD : true # true if App is to be #installed to SD EnableCompress : true # Compresses exefs code FreeProductCode : true # Removes limitations on ProductCode EnableCrypt : true # Enables encryption for NCCH and CIA MediaFootPadding : true # If true CCI files are created with padding AccessControlInfo: ExtSaveDataId: 0xb7850 # same as UniqueId SystemSaveDataId1: 0x00000000 # plaintext exheader SystemSaveDataId2: 0x00000000 # plaintext exheader OtherUserSaveDataId1: 0x00000 # plaintext exheader OtherUserSaveDataId2: 0x00000 # plaintext exheader OtherUserSaveDataId3: 0x00000 # plaintext exheader UseOtherVariationSaveData : false SystemControlInfo: SaveDataSize: 1M # plaintext exheader RemasterVersion: 0 # plaintext exheader StackSize: 0x00040000 # plaintext exheader JumpId: 0x000400000b000000L # plaintext exheader (<full UniqueID>L)

step 3: creating the .cia
Open the command window in the folder with the exefs.bin, exheader.bin, romfs.bin, icon.bin, code.bin, banner.bin, cia.rsf and makerom. Now run the following command:

this will output an .cia file which you can install with the DevMenu and then run.

If you encounter an error saying "[ROMFS ERROR] Invalid RomFS Binary.", then remove the "-romfs romfs.bin" from the command.

Thanks, i will test today. If the roms are decrypted, this mean I also can install 7X games, right?

sonic2756 · Nov 5, 2014

palantine said:
-snip-

Getting this when trying to build the CIA

[EXHEADER ERROR] Failed to set ExtSaveDataId. UseExtSaveData must be true.
[EXHEADER ERROR] Failed to create ExHeader
[NCCH ERROR] NCCH Build Process Failed
[RESULT] Failed to build outfile

EDIT:

Set UseExtSaveData to true under AccessControlInfo in the .rsf and it compiled.

ilollo360 · Nov 5, 2014

Is it normale that my upper screen becomes blue when trying to installare CIA?

palantine · Nov 5, 2014

ilollo360 said:
Is it normale that my upper screen becomes blue when trying to installare CIA?

You mean when you try to boot the cfw? Yes thats normal. When you install a CIA nothing should happen visibly.

ilollo360 · Nov 5, 2014

I mean when i'm holding the L button. And is this sequencer of color right? Black-->White-->Black

Relys · Nov 5, 2014

pLaYeR^^ said:
Thanks, i will test today. If the roms are decrypted, this mean I also can install 7X games, right?

Yeah, but most porbably won't boot due to firmware version.

mocalacace · Nov 5, 2014

VerseHell said:

Mario Kart 7, and I typed this :

Code:

makerom -f cia -o MK7.cia -rsf RSF.rsf -target d -desc app:2 -exheader decrypted/exheader.bin -exefslogo -code decrypted/exefs/code.bin -icon decrypted/exefs/icon.bin -banner decrypted/exefs/banner.bin
pause

If you got mk7 compiled did it work for you? I got it installed but when I run it I get black screen an error has occurred message. If it did work can you post your rsf file.

sonic2756 · Nov 5, 2014

The .cia compiled and installed. When I boot it it shows the Mario Kart 7 logo for a moment then goes to "an error has occured."

Vappy · Nov 5, 2014

Code:

ctrtool -t exheader exheader.bin > exheader.txt

might make it a bit easier pulling info from the exheader

aliak11 · Nov 5, 2014

I got the cia to install, but when I start it, it says "The SD card was removed".

daxtsu · Nov 5, 2014

palantine said:
ROM to CIA Guide

This guide requires makerom and ctrtool.

-snip-

Before I start, let me say thanks for removing the sketchy network calls, and for writing up the tutorial.

Figured I'd have a go at this with my Ocarina of Time cart, but makerom (compiled myself from the latest source at https://github.com/3DSGuy/Project_CTR) says [SETTING ERROR] Argument "-elf" is required.

Here's how I tried to run makerom:

Code:

makerom -f cia -rsf rsf.rsf -target t -desc app:1
-icon decrypted/exefs/icon.bin -banner decrypted/exefs/banner.bin -exefslogo -ex
header decrypted/exheader.bin -romfs decrypted/romfs.bin -rsf rsf.rsf -o rom.cia

Note that the -rsf is listed twice, like the tutorial deems it so (so it's not a mistake on my end, if it is indeed a mistake).

Here's the RSF I'm using (UniqueId is the same thing as "Program ID" in ctrtool, right?):

Code:

BasicInfo:
  Title                  : "The Legend of Zelda: Ocarina of Time 3D"
  CompanyCode            : "00"
  ProductCode            : "CTR-P-AQEE"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x0335
  Category                : Application
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : true # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
AccessControlInfo:
  ExtSaveDataId: 0x0335 # same as UniqueId
  SystemSaveDataId1: 0x00000000 # plaintext exheader
  SystemSaveDataId2: 0x00000000 # plaintext exheader
  OtherUserSaveDataId1: 0x00000 # plaintext exheader
  OtherUserSaveDataId2: 0x00000 # plaintext exheader
  OtherUserSaveDataId3: 0x00000 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 128K # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00004000 # plaintext exheader
  JumpId: 0x0004000000033500L # plaintext exheader (<full UniqueID>L)

Any insight is appreciated.

Hacking (4.x only) CIA CFW Complete Guide

Member

Fellow Temper

Pokemon Master

Well-Known Member

Fellow Temper

Well-Known Member

Pokemon Master

Well-Known Member

Well-Known Member

Doctor Switch

Friendly Neighborhood Wolf

Well-Known Member

Well-Known Member

Well-Known Member

^(Software | Hardware) Exploit? Development.$

Well-Known Member

Friendly Neighborhood Wolf

Well-Known Member

Pokemon Master

Well-Known Member

Similar threads

Popular threads in this forum