Hacking (4.x only) CIA CFW Complete Guide

[aliak11]

If no one else has, I'll take a look when I wake up. I can't see it being any more difficult than any other game that falls into our compatible range.

It is the only game I can't get to load.

 

[Gadorach]

It is the only game I can't get to load.

What does your cia.rsf look like?

Also, it should be SDK 3, so I'd imagine the best switches would be:

makerom -f cia -rsf cia.rsf -target t -desc app:3 -icon icon.bin -banner banner.bin -exefslogo -code code.bin -exheader decrypted_exheader.bin -romfs decrypted_romfs.bin -o FE-A.cia

 

[Misiel]

That looks, to me, like you didn't decrypt your ExeFS correctly. My tutorial doesn't cover generating xorpads, unfortunately, as the latest version of crtKeyGen, the file that runs on your 3DS anyway, contains a private key owned by Nintendo. As a result, we can't post it on this forum. You'll have to refer to the original thread for insight on generating your xorpads.

I used the key.
so should I seek help in the decryptor thread?

 

[Gadorach]

I used the key.
so should I seek help in the decryptor thread?

Yes. Once you have your xorpads, my tutorial should help you with the rest.

 

[aliak11]

What does your cia.rsf look like?

Also, it should be SDK 3, so I'd imagine the best switches would be:

makerom -f cia -rsf cia.rsf -target t -desc app:3 -icon icon.bin -banner banner.bin -exefslogo -code code.bin -exheader decrypted_exheader.bin -romfs decrypted_romfs.bin -o FE-A.cia

BasicInfo:
  Title                  : "quartz00" # 0x0 exheader.bin
  CompanyCode            : "01" # 0x1110 game.3ds
  ProductCode            : "CTR-P-AFEE" # 0x1150 game.3ds
  ContentType            : Application
  Logo                    : Nintendo
 
TitleInfo:
  UniqueId                : 0x00000a05 # 0x1108 game.3ds in little endian
  Category                : Application
 
CardInfo:
  MediaType              : Card1 # Card1 / Card2
 
Option:
  UseOnSD                : true
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : false # If true CCI files are created with padding
  EnableCompress          : true # Compresses exefs code
 
AccessControlInfo:
  ExtSaveDataId: 0x00000a05 # same as UniqueId
  SystemSaveDataId1: 0x00000000 # plaintext exheader
  SystemSaveDataId2: 0x00000000 # plaintext exheader
  OtherUserSaveDataId1: 0x00000 # plaintext exheader
  OtherUserSaveDataId2: 0x00000 # plaintext exheader
  OtherUserSaveDataId3: 0x00000 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader / 0x1C0 exheader.bin
  RemasterVersion: 0000 # 0xE exheader.bin
  StackSize: 0x00004000 # 0x1C exheader.bin

makerom -f cia -rsf RSF.rsf -target t -desc app:4 -o rom.cia -icon exefs\icon.bin -banner exefs\banner.bin -exefslogo -code exefs\code.bin -exheader exheader.bin -romfs romfs.bin

 

[Gadorach]

BasicInfo:
  Title                  : "quartz00" # 0x0 exheader.bin
  CompanyCode            : "01" # 0x1110 game.3ds
  ProductCode            : "CTR-P-AFEE" # 0x1150 game.3ds
  ContentType            : Application
  Logo                    : Nintendo
 
TitleInfo:
  UniqueId                : 0x00000a05 # 0x1108 game.3ds in little endian
  Category                : Application
 
CardInfo:
  MediaType              : Card1 # Card1 / Card2
 
Option:
  UseOnSD                : true
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : false # If true CCI files are created with padding
  EnableCompress          : true # Compresses exefs code
 
AccessControlInfo:
  ExtSaveDataId: 0x00000a05 # same as UniqueId
  SystemSaveDataId1: 0x00000000 # plaintext exheader
  SystemSaveDataId2: 0x00000000 # plaintext exheader
  OtherUserSaveDataId1: 0x00000 # plaintext exheader
  OtherUserSaveDataId2: 0x00000 # plaintext exheader
  OtherUserSaveDataId3: 0x00000 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader / 0x1C0 exheader.bin
  RemasterVersion: 0000 # 0xE exheader.bin
  StackSize: 0x00004000 # 0x1C exheader.bin

makerom -f cia -rsf RSF.rsf -target t -desc app:4 -o rom.cia -icon exefs\icon.bin -banner exefs\banner.bin -exefslogo -code exefs\code.bin -exheader exheader.bin -romfs romfs.bin

Try this:

cia.rsf

BasicInfo:
  Title                  : "Fire Emblem - Awakening - USA"
  CompanyCode            : "01"
  ProductCode            : "CTR-P-AFEE"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x0a05
  Category                : Application
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
AccessControlInfo:
  ExtSaveDataId: 0xb0a05 # same as UniqueId
  SystemSaveDataId1: 0x000a0500 # plaintext exheader
  SystemSaveDataId2: 0x000a0500 # plaintext exheader
  OtherUserSaveDataId1: 0xa0500 # plaintext exheader
  OtherUserSaveDataId2: 0xa0500 # plaintext exheader
  OtherUserSaveDataId3: 0xa0500 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00040000 # plaintext exheader
  JumpId: 0x00040000000a0500L # plaintext exheader (<full UniqueID>L)

and my previous switches

makerom -f cia -rsf cia.rsf -target t -desc app:3 -icon icon.bin -banner banner.bin -exefslogo -code code.bin -exheader decrypted_exheader.bin -romfs decrypted_romfs.bin -o FE-A.cia

And as an aside, your .rsf was missing the jump ID, so that might have caused your problems right there.

 

[s-arash]

can't unpack exefs on SSB

Error, compression out of bounds

 

[ieatpixels]

can't unpack exefs on SSB

do you have the 7.x key?

 

[s-arash]

do you have the 7.x key?

yes i have and i used it to generate exefs.xorpad ,after decrypting exefs,i tried to unpack exefs with ctrtool but i gives me error
should i use 7.x key in ctrtool or somewhere else too?

btw its only for code.bin , banner and icon works fine

 

[drwhojan]

We really need some videos of you're converted games in action , Maybe proof if you own the original cart too .

 

[piratesephiroth]

An interesting fact about this CFW is that it can probably run more games than R4iGold 3DS Deluxe...

 

[Ziver.W]

step 3: creating the .cia
Open the command window in the folder with the exefs.bin, exheader.bin, romfs.bin, icon.bin, code.bin, banner.bin, cia.rsf and makerom. Now run the following command:



this will output an .cia file which you can install with the DevMenu and then run.

If you encounter an error saying "[ROMFS ERROR] Invalid RomFS Binary.", then remove the "-romfs romfs.bin" from the command.

no need for logo.bin and exefs.bin?

 

[gypsynimrod]

I will personally fly out and buy dinner for the first person to make a noob's guide for converting a .3ds file to .cia. The language used in the NCHH decryptor isn't helpful for someone who has no idea what "find your own key" means for a file that returns one hit on Google.

 

[VerseHell]

Here's my new 3ds to cia conversion guide :
Download this : http://jheberg.net/captcha/3ds-cia-conversion-tools-v7/
1. Put your rom in the folder, run rom_tool info.bat, enter your rom name without the .3ds extension and edit the rsf file with the right informations.
2. Follow the 3 first steps of this tutorial : https://gbatemp.net/threads/tutorial-how-to-decrypt-3ds-roms-for-dummies.372653/page-2#post-5136907

If you want to remove the region lock :
- Run unpack.bat enter your rom name without the .3ds extension
- Follow Gadorach's instructions here : https://gbatemp.net/threads/4-x-only-cia-cfw-complete-guide.373532/page-50#post-5149465 (works with Hex Worshop, just enter 2018 in the search bar)
- Run makerom.bat, enter the filename you want (without extension).

Else
- Just run unpack-makerom.bat, enter your rom name without the .3ds extension.

Edit : You can choose to delete the decrypted files after the conversion.

 

[ilollo360]

Here's my new 3ds to cia conversion guide :
Download this : http://jheberg.net/captcha/3ds-cia-conversion-tools-v3-2/
1. Put you rom in the folder, run rom_tool info.bat, enter your rom name without the .3ds extension and edit the rsf file with the right informations.
2. Follow the 3 first step of this tutorial : https://gbatemp.net/threads/tutorial-how-to-decrypt-3ds-roms-for-dummies.372653/page-2#post-5136907
3. Run unpack-makerom.bat, enter your rom name without the .3ds extension. A cia file will be generated.

Does it also converts 7.X games?

 

[The Real Jdbye]

Oops.

 

[VerseHell]

Does it also converts 7.X games?

Nope.

 

[kamo]

Why do I always get "Too many/few entries, or wrong version ncchinfo.bin" while trying to decrypt? Game is A Link Between Worlds

 

[Ziver.W]

guys,I did it!Thank you all!

 

[liomajor]

Why do I always get "Too many/few entries, or wrong version ncchinfo.bin" while trying to decrypt? Game is A Link Between Worlds

Because old ctrKeyGen.exe is not working with new launcher.dat

Recreate ncchinfo.bin with ctrKeyGen.py (python 2.7) or use old launcher.dat.