Hacking (4.x only) CIA CFW Complete Guide

[daxtsu]

Could possibly be ctrtool. I compiled my own copy of that as well. I suppose I could upload that, too..

 

[kamo]

Would a converted A Link Between Worlds or SMT4 run? Or would it need a higher firmware?

 

[Vappy]

It was built with SDK 5.x, so probably!

Thanks a bunch for that, but it didn't fix my issue with MK7. Probably something with my RSF or something.

I tried again with -desc app:3 -target t and it worked.

 

[kamo]

It was built with SDK 5.x, so probably!

I tried again with -desc app:3 -target t and it worked.

How do you check which SDK was used?

 

[Vappy]

Either use 3DSExplorer http://puu.sh/cE1CC/e4125daf6a.png or open the .3ds in a hex editor, should be at 0x4A00

 

[kamo]

Either use 3DSExplorer http://puu.sh/cE1CC/e4125daf6a.png or open the .3ds in a hex editor, should be at 0x4A00

Thanks!

 

[Gadorach]

As I mostly expected, LoZ-ALBW will appear, and get past the 3DS loading screen, but will instantly error. LoZ-OoT is no issue though, and boots just fine.
I think we need a priority list for what the CFW's features should be as well. Also, it could have other things like homebrew that would go well with it. Think of it like a developer wishlist.

Something like:

------------------
HIGH
------------------

Opensource Firmware
Raise boot probability to as close to 100% as possible
Implement 7.x KeyX, and make compatible with latest firmware [emuNAND, not SysNAND, to clarify]

------------------
MEDIUM
------------------

Opensource DevMenu/Homebrew CIA Installer [Make able to install DLC, maybe themes]
Implement 6.x KeyY to fix save encryption [when it becomes available]
Patch region check for retail game carts
Auto-install a CIA from SD root on first boot, or if booted while holding a specific button combo


------------------
LOW / EXTRA
------------------

Custom Theme support
RomFS decryption directly from OS, and/or .3DS Install option
Detect Flashcart and mount using normal functions, to keep them useful for extra storage, perhaps a multi-rom menu for supportable flashcarts
OTF RAM peek/poke, homebrew RAM editing application
Save decryptor/resigner, maybe editor as well

 

[sonic2756]

I got it working! Thanks Vappy and daxtsu!

 

[Vappy]

profi200 says he has an app in the making for managing CIAs among other things, but is on the fence about releasing because warez. I do agree though getting an open version of the rest of the files would be a great thing. 173210's kicked that off by getting st4rk's reversed arm9_code.bin working, anyone else interested in trying to reverse the rest could contact him for a collaborative effort. Or maybe the original devs will be struck with generosity and feel like sharing the original!

 

[Gadorach]

Or maybe the original devs will be struck with generosity and feel like sharing the original!

I'm pretty sure, at least right now, we'd be more likely to see Nintendo hand us their latest source code than to get anything out of the devs who made this originally.

And as for profi200, it's a bit too late for worrying about piracy, as we already have it up and running now with what we already have.

 

[Vappy]

And as for profi200, it's a bit too late for worrying about piracy, as we already have it up and running now with what we already have.

<@smea> i'm curious, do you plan on releasing it ?
<@profi200> Not yet. Later maybe (i need to think about that. The warezers use the illegal originals anyway).

Hope he releases, since nothing lost if he does, and potential gain of a really useful tool for developers.

Also, no GUI, but I've put together a few really shoddy batch files and an even shoddier python script for automating most of the conversion process, including filling in most of the .rsf, worked for every game I've thrown at it so far. Unless anyone has something better they can share, I could upload what I've got?

 

[Kane49]

<@smea> i'm curious, do you plan on releasing it ?
<@profi200> Not yet. Later maybe (i need to think about that. The warezers use the illegal originals anyway).

Hope he releases, since nothing lost if he does, and potential gain of a really useful tool for developers.

Also, no GUI, but I've put together a few really shoddy batch files and an even shoddier python script for automating most of the conversion process, including filling in most of the .rsf, worked for every game I've thrown at it so far. Unless anyone has something better they can share, I could upload what I've got?

Please do

 

[cearp]

Thanks, i will test today. If the roms are decrypted, this mean I also can install 7X games, right?

just because they are decrypted does not necessarily mean they will work on a lower firmware.
as someone else said, the game might check to see what version the 3ds is on (probably relatively easy to patch out)
and also, the game might require newer apis/functions that do not exist in the lower firmwares

 

[Dark Fulgore]

If I change the header of my .3DS file and then create the .CIA and it will work online?

 

[gamesquest1]

If I change the header of my .3DS file and then create the .CIA and it will work online?

i doubt it without a lot of work (or ever even) that games converted to .cia will work online.....and if they do at some point i imagine it would be 100x easier for nintendo to ban consoles based on that

oh and I'm pretty sure that the header is stored in part of the unused cci structure.....so it wouldn't be transferred to the .cia anyway

 

[kamo]

<@smea> i'm curious, do you plan on releasing it ?
<@profi200> Not yet. Later maybe (i need to think about that. The warezers use the illegal originals anyway).

Hope he releases, since nothing lost if he does, and potential gain of a really useful tool for developers.

Also, no GUI, but I've put together a few really shoddy batch files and an even shoddier python script for automating most of the conversion process, including filling in most of the .rsf, worked for every game I've thrown at it so far. Unless anyone has something better they can share, I could upload what I've got?

Yes, please. Any way to ease the process is appreciated.

 

[Vappy]

Alright, in lieu of anyone far more skilled making something far better, here's my halfassed approach https://mega.co.nz/#!WoUhkIzR!B3I7Gl6IL835n3ZOduOa2NwL8dt9jvHXsnAjaJcPyjY
Includes builds of ctrtool and makerom, not sure which but they worked for me. Feel free to substitute your own versions if you're paranoid about running unsourced executables linked to you on GBATemp. Also, the rsfgen.py is really badly done and only works for that specific template.rsf untouched, so don't edit anything in it until after running all the batch files.

 

[djalmafreestyler]

Is this normal sub folders? It will be created when I format Emunand?

sdmc:/Nintendo 3DS/<id0>/<id1>/dbs/

 

[Reecey]

Just because there's no one-click installer yet that always works without 10 3DS reboots between successful runs doesn't warrant insulting the people (e.g. Palantine and whoever else helps him) that are working on this in their spare time for you and the community, for free. It'll take time for this to become easier, as it does with all scene-related stuff.

Sorry guys you have mis read me, no by all means I was not insulting anyone they have done a fantastic job here, he knows that, I was only kidding I missed the smily of the end as the joke bit I was just getting annoyed it was very late then in the UK and I was tired and grotty but I wont let it beat me I shall try again the fat lady has not sang for me yet!

I could not get the present to open on the CFW I put the dbs files in with data base files import.db and the other but the sd card back in tried again but it does not register 0 it always comes out with result c0897u for example, I'm stuck at that point?

 

[piratesephiroth]

It this normal sub folders? It will be created when I format Emunand?

sdmc:/Nintendo 3DS/<id0>/<id1>/dbs/

You'll have to create the dbs folder.