Hacking (4.x only) CIA CFW Complete Guide

[CalebW]

Wow! I got really far with this!

I haven't tried it yet, but the cia generated is half the size of the Rom. Is this alright, or did I do something wrong? I am trying to make Fire Emblem: Awakening.

Your rom probably has update data, manuals, etc.

 

[misterb98]

You need to do a few things, but assuming that rsf was generated correctly, here's an rsf that should have everything you need.

BasicInfo:
  Title                  : "Luigi's Mansion 2"
  CompanyCode            : "01"
  ProductCode            : "CTR-P-AGGP"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x033d
  Category                : Application
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
AccessControlInfo:
  ExtSaveDataId: 0xb033d # same as UniqueId
  SystemSaveDataId1: 0x00033d00 # plaintext exheader
  SystemSaveDataId2: 0x00033d00 # plaintext exheader
  OtherUserSaveDataId1: 0x33d00 # plaintext exheader
  OtherUserSaveDataId2: 0x33d00 # plaintext exheader
  OtherUserSaveDataId3: 0x33d00 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00040000 # plaintext exheader
  JumpId: 0x0004000000033d00L # plaintext exheader (<full UniqueID>L)

If you didn't trim your backup "ROM.3DS" file's CCI data, then it's entirely possible that your final .CIA file will be half the size of your ROM.

Somebody give this man a title! "CIA Lord" or something.

 

[Reecey]

Get the latest MakeROM and CTRTool, yours are out of date.

You will have to PM me the files I dont know where to get them from?

 

[Gadorach]

You will have to PM me the files I dont know where to get them from?

Look at the guide in my signature, it has everything you need.

 

[Gadorach]

Somebody give this man a title! "CIA Lord" or something.

Ha ha, I'm hardly that, I just got lucky and found a combination of files that works rather well. Without everyone else on here working at figuring this stuff out, just like me, I wouldn't know half as much about this, and couldn't help anyone. I still haven't put together a game manual inclusive version of my cia bats, so there's that. I know there was a method posted earlier.

[And seriously, I need to double check replies before posting. I'm going to get banned for all these double posts. ]

 

[misterb98]

One last thing, what do I do to remove region restrictions? I saw a post at some point that says to hex edit some file to change the region, how is this done?

 

[Misiel]

I got this error "exheader hash mismatch,wrong key?" when it was creating the cia

i have the key already edited on my sd.

the cia is created but it doesnt run when installed.

 

[CalebW]

One last thing, what do I do to remove region restrictions? I saw a post at some point that says to hex edit some file to change the region, how is this done?

It's actually in the icon.bin file of all places, but I forgot what byte...look on 3dbrew.

 

[Reecey]

at misterb98 & Gadorach. Thanks for your help guys, really appreciated from me . OK I have changed the tools to the correct ones, checked and double checked my rsf file all OK, I'm running it again now to see I will let you know.

Edit: No still wont have it its erroring the same as the old comment it just errors out after the building .cia, maybe its got something to do with running it on windows 8.1 and dont work?. I'm really not sure whats going on. Also I dumped my files on a fresh sd card is that correct?

also Gadorach cant use your files the keygen wont work it shows up as a blank file.

I'm going to try another sd card, maybe the one I used was faulty or something so I'm going to dump the files again and try

 

[Gadorach]

It's actually in the icon.bin file of all places, but I forgot what byte...look on 3dbrew.

According to 3dbrew ( http://3dbrew.org/wiki/SMDH )

icon.bin

Offset 0x2018

Regions:

Japan 0x01
North America 0x02
Europe 0x04
Australia 0x08
China 0x10
Korea 0x20
Taiwan 0x40

Edit the bit as desired.

I don't completely understand region free yet though, so you'll have to give me some time to figure out how to patch it out.

Apparently, it's viewed as 0x7fffffff, but I'm not sure if that's starting from 0x2018, or earlier in the configuration bits.

Edit: This is the exact change needed to enable Region Free, tested with Hatsune Miku - Project Mirai 2:

Change this:

to this:

 

[kamo]

Here's my new 3ds to cia conversion guide :
Download this : http://jheberg.net/captcha/3ds-cia-conversion-tools-v4/
1. Put your rom in the folder, run rom_tool info.bat, enter your rom name without the .3ds extension and edit the rsf file with the right informations.
2. Follow the 3 first step of this tutorial : https://gbatemp.net/threads/tutorial-how-to-decrypt-3ds-roms-for-dummies.372653/page-2#post-5136907
3. Run unpack-makerom.bat, enter your rom name without the .3ds extension. A cia file will be generated.

Edit : You can now delete the decrypted files after the conversion.

Thank you! This worked for me. Just one question. I want to make a game region free. How can I do that with your setup?

 

[Reecey]

Somebody give this man a title! "CIA Lord" or something.

Where do you get the full unique ID from to paste in?

 

[drwhojan]

Sorry, how do you generate RFS / RSF.rsf file from a game ?

Still had no luck finding a win 32bit 86x version of XOR.exe sadly xd , anyone have ?

 

[Reecey]

Thank you! This worked for me. Just one question. I want to make a game region free. How can I do that with your setup?

In your rsf file what did you change to get it to work? cause that can be my only issue as far as I can tell.

 

[Gadorach]

Sorry, how do you generate RFS / RSF.rsf file from a game ?

Manually, refer to my signature.
VerseHell made an auto script earlier in the thread as well, you can check that out.

 

[pLaYeR^^]

I feel like I should upload my conversion directory, minus the stuff I can't. If nothing else, we'd all be on the same page then.

You know what, here. It's full of bat files, some written by me, some stolen from others. Enjoy.

http://www.mediafire.com/download/c82sc7gdw2e42zv/3DS_to_CIA_Package.rar

---------------------------------------------------------
Instructions
---------------------------------------------------------

Step 1)

Open the "padgen_v3" folder and drop your .3ds file on "ctrKeyGen.py". It will generate an "ncchinfo.bin".
Put this onto your bigSD card, and use your copy of PadGen v3 to create your xorpads.

Step 2)

Open 3DSExplorer, and right-click -> save to each of the main sectors of your backup ROM.3DS.
Save them as the following:

romfs.bin
exheader.bin
exefs.bin

Copy/move these files to "workdir".

Step 3)

Copy your newly generated xorpads from your bigSD card and place them in "workdir".
Rename them to the following:

romfs.xorpad
exheader.xorpad
exefs.xorpad

Step 4)

Run batch files 1, 3, and 4.

Now, in 3DSExplorer, with your ROM.3ds opened, select "PlainRegion" and look to the right ride window.
You'll see something like this:

Where it says [SDK+NINTENDO:Firmware-XX_XX], the "XX_XX" is your clue to the required SDK permissions.
As this one says "02_27", that's Firmware 2, so we can safely assume it uses firmware 2 and lower functions.
The SDK is also shown as SDK 1.2.0.200, so it may even run at Firmware 1, but we'll use 2 to be safe.
This will be needed for editing batch file 5.

Also, while still in 3DSExplorer, look at "NCCH (CTR-P-XXXX) 0". The value shown at "CTR-P-XXXX" is your game's product code. Add that to the cia.rsf in the Product code section.

Step 5)

Open the .rsf file.
It will look like this:

BasicInfo:
  Title                  : "Cave Story - USA"
  CompanyCode            : "01"
  ProductCode            : "CTR-P-ACVE"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x04a1
  Category                : Application
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
AccessControlInfo:
  ExtSaveDataId: 0xb04a1 # same as UniqueId
  SystemSaveDataId1: 0x0004a100 # plaintext exheader
  SystemSaveDataId2: 0x0004a100 # plaintext exheader
  OtherUserSaveDataId1: 0x4a100 # plaintext exheader
  OtherUserSaveDataId2: 0x4a100 # plaintext exheader
  OtherUserSaveDataId3: 0x4a100 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00040000 # plaintext exheader
  JumpId: 0x000400000004a100L # plaintext exheader (<full UniqueID>L)

Now, look inside "workdir" for your exheader.txt.
Open it, and search for the line "Program id: XXXXXXXXXXXXXXXX"
The unique ID is from the 5th last position to the 3rd last position.
If yours says, for example, "Program id: 000400000004a100", which is Cave Story USA, your unique ID would be "4a1".
Simply replace all the entries in the above "cia.rsf" that say "4a1" with your game's unique ID.
Also replace the title and product code information with the ones from your game.
Save and close your cia.rsf file, you're done with it for now.

Step 6)

right-click -> edit the "5-build-cia.bat" file, and look for the part that says "-desc app:2". Edit the "2" to the SDK version hinted at by the earlier check we made. For example, if it's SDK 4, make that say "-desc app:4", which would be used by, for example, LoZ-ALBW.

Save the edited batch file, and then run it. You should be presented with an "Install.cia" file. You can rename that to the name of your game now, and copy it to the root of your SD card.

Step 7)

Install the new "Install.cia" you generated with either DevMenu or over your network.
Done.

Nothing happens, when i start "5-build-cia.bat"...

 

[Gadorach]

In your rsf file what did you change to get it to work? cause that can be my only issue as far as I can tell.

I haven't looked at how VerseHell has his scripts setup, so I can't help much there. If you retry using the process and files from my signature, I can help you a lot more.

 

[schuko1982]

I have a problem with the ocarina of time, it freezes on me nintendo logo, you can see if there is something wrong?

BasicInfo:
Title : "CtrApp"
CompanyCode : "01"
ProductCode : "CTR-P-AQEP"
ContentType : Application # Application / SystemUpdate / Manual / Child / Trial
Logo : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem

TitleInfo:
UniqueId : 0x0336
Category : Application

Option:
UseOnSD : true # true if App is to be #installed to SD
EnableCompress : true # Compresses exefs code
FreeProductCode : true # Removes limitations on ProductCode
EnableCrypt : false # Enables encryption for NCCH and CIA
MediaFootPadding : true # If true CCI files are created with padding

AccessControlInfo:
ExtSaveDataId: 0x0336 # same as UniqueId
SystemSaveDataId1: 0x00033600 # plaintext exheader
SystemSaveDataId2: 0x00033600 # plaintext exheader
OtherUserSaveDataId1: 0x33600 # plaintext exheader
OtherUserSaveDataId2: 0x33600 # plaintext exheader
OtherUserSaveDataId3: 0x33600 # plaintext exheader
UseOtherVariationSaveData : false

SystemControlInfo:
SaveDataSize: 1M # plaintext exheader dejar en 1M
RemasterVersion: 0 # plaintext exheader version dejarla como quieras
StackSize: 0x00004000 # plaintext exheader
JumpId: 0x0004000000033600L # plaintext exheader (<full UniqueID>L) ID del juego



AccescontrolInfo is always the game id?


thanks

 

[Gadorach]

Nothing happens, when i start "5-build-cia.bat"...

Verbose switch isn't active. It simply converts and closes. Look for Install.cia in the workdir.

 

[Seraphiel]

a bit of a noobish question but is it possible to generate the xorpads without actually using the 3ds?