ROM Hack [Release] ExInjector - Inject original exheaders into repacked roms

  • Thread starter Thread starter piratesephiroth
  • Start date Start date
  • Views Views 123,899
  • Replies Replies 343
  • Likes Likes 29
v1.03

Testing New Supper Mario 2 US (gateways mode):
-Region Free YES
-Exinjector YES
-Spoofing Firmware to 4.x YES

The game can run and save stages well.
However, I could not run System Setting (stuck at loading) after exiting the game.
Moreover, the system always popups "new software has been added" when boot.
Could not see the game in NAND mode.
 
v1.03

Testing New Supper Mario 2 US (gateways mode):
-Region Free YES
-Exinjector YES
-Spoofing Firmware to 4.x YES

The game can run and save stages well.
However, I could not run System Setting (stuck at loading) after exiting the game.
Moreover, the system always popups "new software has been added" when boot.
Could not see the game in NAND mode.
Stuck opening System Settings might have ben some random bug. Did it happen more than once?
We can't do much about the gift animation (well, we can change the game id to a 'prototype' range so it will never show that, but I don't know how that change is going to affect other funcionality like savegames and online play).
 
v1.03

However, I could not run System Setting (stuck at loading) after exiting the game.
Moreover, the system always popups "new software has been added" when boot.
Could not see the game in NAND mode.

Even with normal roms after playing, systen settings stuck sometimes, > gw

Popping up "new software" after boot, dunno why, removed game, re-installed, problem was gone

"Nand" mode, the cia we create is for gw mode, you should be able to see it BUT never open nand's filemanager!
 
Yeah, your sysNAND will see the installed games on your SD but won't ever run it because it checks if you actually own them before anything. So they see you don't and deny it, telling you to re-download them.
 
Yeah, your sysNAND will see the installed games on your SD but won't ever run it because it checks if you actually own them before anything. So they see you don't and deny it, telling you to re-download them.
Just format your sysnand and then you won't have that problem.
 
3ds to cia v1.03

Required:
Python 2.7
(Add Path to windows enviroments!)

How to use:
1. Create your xorpads and put all files into 3ds to cia dir
2. Drag n drop .3ds / .3dz on make.bat

Freatures:

7.x Support
Region Free fix
Offers injecting original EXHEADER
Offers spoofing Firmware to 4.x
Offers using your own .rsf (no exinjector)
If a game manual is detected, it will be included
Choice to compress EXEFS - thx @ piratesephiroth

Info:
_makerom is 64bit makerom is 32bit

If your windows is 32bit, rename
makerom to _makerom (using _ in script!)

Included in Package:

ctrKeyGen
Launcher
slot0x25KeyX (you need to insert the key - google it!)

It looks pretty good at my side,
everything works well now.

Hatsune Miku - Project Mirai, and Hatsune Miku - Project Mirai 2 are not working.
 
The second one is compressed. The Exheader is injected. The regen is spoofed. I didn't wake my own rsf.

Indeed, i can confirm it working. As usual, i tested with my own .rsf
Code:
BasicInfo:
  Title                  : "mirai200" # 0x0 exheader.bin
  CompanyCode            : "00" # 0x1110 game.3ds
  ProductCode            : "CTR-P-AHNJ" # 0x1150 game.3ds
  ContentType            : Application
  Logo                    : Nintendo
 
TitleInfo:
  UniqueId                : 0x00000cc4 # 0x1108 game.3ds in little endian
  Category                : Application
 
CardInfo:
  MediaType              : Card1 # Card1 / Card2
 
Option:
  UseOnSD                : true
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : false # If true CCI files are created with padding
  EnableCompress          : true # Compresses exefs code
 
AccessControlInfo:
  ExtSaveDataId: 0x00000cc4 # same as UniqueId
  SystemSaveDataId1: 0x00000000 # plaintext exheader
  SystemSaveDataId2: 0x00000000 # plaintext exheader
  OtherUserSaveDataId1: 0x00000 # plaintext exheader
  OtherUserSaveDataId2: 0x00000 # plaintext exheader
  OtherUserSaveDataId3: 0x00000 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 128K # plaintext exheader / 0x1C0 exheader.bin
  RemasterVersion: 0000 # 0xE exheader.bin
  StackSize: 0x00008000 # 0x1C exheader.bin
 
CardInfo:
  MediaSize              : 4GB # 128MB / 256MB / 512MB / 1GB / 2GB / 4GB / 8GB / 16GB / 32GB #CHANGE ME
  CardDevice              : NorFlash # NorFlash / None #CHANGE ME
 
ExeFs: # these are the program segments from the ELF, check your elf for the appropriate segment names
  ReadOnly:
  - .rodata
  - RO
  ReadWrite:
  - .data
  - RO
  Text:
  - .init
  - .text
  - STUP_ENTRY
 
AccessControlInfo:
  FileSystemAccess:
  #- CategorySystemApplication
  #- CategoryHardwareCheck
  #- CategoryFileSystemTool
  - Debug
  #- TwlCardBackup
  #- TwlNandData
  #- Boss
  - DirectSdmc
  - DirectSdmcWrite
  #- Core
  #- CtrNandRo
  #- CtrNandRw
  #- CtrNandRoWrite
  #- CategorySystemSettings
  #- CardBoard
  #- ExportImportIvs
  #- DirectSdmcWrite
  #- SwitchCleanup
  #- SaveDataMove
  #- Shop
  #- Shell
  #- CategoryHomeMenu
  IoAccessControl:
  #- FsMountNand
  #- FsMountNandRoWrite
  #- FsMountTwln
  #- FsMountWnand
  #- FsMountCardSpi
  #- UseSdif3
  #- CreateSeed
  #- UseCardSpi
 
  IdealProcessor                : 0
  AffinityMask                  : 1
 
  Priority                      : 48
 
  MaxCpu                        : 0x9E # Default
 
  DisableDebug                  : false
  EnableForceDebug              : false
  CanWriteSharedPage            : false
  CanUsePrivilegedPriority      : false
  CanUseNonAlphabetAndNumber    : false
  PermitMainFunctionArgument    : false
  CanShareDeviceMemory          : false
  RunnableOnSleep              : false
  SpecialMemoryArrange          : false
 
  CoreVersion                  : 2
  DescVersion                  : 2
 
  ReleaseKernelMajor            : "02"
  ReleaseKernelMinor            : "33"
  MemoryType                    : Application # Application / System / Base
  HandleTableSize: 200
  IORegisterMapping:
  - 1ff50000-1ff57fff
  - 1ff70000-1ff77fff
  MemoryMapping:
  - 1f000000-1f5fffff:r
  SystemCallAccess:
    ArbitrateAddress: 34
    Break: 60
    CancelTimer: 28
    ClearEvent: 25
    ClearTimer: 29
    CloseHandle: 35
    ConnectToPort: 45
    ControlMemory: 1
    CreateAddressArbiter: 33
    CreateEvent: 23
    CreateMemoryBlock: 30
    CreateMutex: 19
    CreateSemaphore: 21
    CreateThread: 8
    CreateTimer: 26
    DuplicateHandle: 39
    ExitProcess: 3
    ExitThread: 9
    GetCurrentProcessorNumber: 17
    GetHandleInfo: 41
    GetProcessId: 53
    GetProcessIdOfThread: 54
    GetProcessIdealProcessor: 6
    GetProcessInfo: 43
    GetResourceLimit: 56
    GetResourceLimitCurrentValues: 58
    GetResourceLimitLimitValues: 57
    GetSystemInfo: 42
    GetSystemTick: 40
    GetThreadContext: 59
    GetThreadId: 55
    GetThreadIdealProcessor: 15
    GetThreadInfo: 44
    GetThreadPriority: 11
    MapMemoryBlock: 31
    OutputDebugString: 61
    QueryMemory: 2
    ReleaseMutex: 20
    ReleaseSemaphore: 22
    SendSyncRequest1: 46
    SendSyncRequest2: 47
    SendSyncRequest3: 48
    SendSyncRequest4: 49
    SendSyncRequest: 50
    SetThreadPriority: 12
    SetTimer: 27
    SignalEvent: 24
    SleepThread: 10
    UnmapMemoryBlock: 32
    WaitSynchronization1: 36
    WaitSynchronizationN: 37
  InterruptNumbers:
  ServiceAccessControl:
  - APT:U
  - $hioFIO
  - $hostio0
  - $hostio1
  - ac:u
  - boss:U
  - cam:u
  - cecd:u
  - cfg:u
  - dlp:FKCL
  - dlp:SRVR
  - dsp::DSP
  - frd:u
  - fs:USER
  - gsp::Gpu
  - hid:USER
  - http:C
  - mic:u
  - ndm:u
  - news:u
  - nwm::UDS
  - ptm:u
  - pxi:dev
  - soc:U
  - ssl:C
  - y2r:u
  - ldr:ro
  - ir:USER
 
SystemControlInfo:
  JumpId: 0x00040000000cc400
  Dependency:
    ac: 0x0004013000002402L
    am: 0x0004013000001502L
    boss: 0x0004013000003402L
    camera: 0x0004013000001602L
    cecd: 0x0004013000002602L
    cfg: 0x0004013000001702L
    codec: 0x0004013000001802L
    csnd: 0x0004013000002702L
    dlp: 0x0004013000002802L
    dsp: 0x0004013000001a02L
    friends: 0x0004013000003202L
    gpio: 0x0004013000001b02L
    gsp: 0x0004013000001c02L
    hid: 0x0004013000001d02L
    http: 0x0004013000002902L
    i2c: 0x0004013000001e02L
    ir: 0x0004013000003302L
    mcu: 0x0004013000001f02L
    mic: 0x0004013000002002L
    ndm: 0x0004013000002b02L
    news: 0x0004013000003502L
    nim: 0x0004013000002c02L
    nwm: 0x0004013000002d02L
    pdn: 0x0004013000002102L
    ps: 0x0004013000003102L
    ptm: 0x0004013000002202L
    ro: 0x0004013000003702L
    socket: 0x0004013000002e02L
    spi: 0x0004013000002302L
    ssl: 0x0004013000002f02L

EDIT:

Did create the game again using exinjector + spoof + region free, works as well fine.

aliak11

Maybe your src is borked, i dumped it myself and trimmed it with rom_tool because
my SD is FAT32 and the Size was too big for it untrimmed.
 
  • Like
Reactions: Margen67 and tjexp
Indeed, i can confirm it working. As usual, i tested with my own .rsf
Code:
BasicInfo:
  Title                  : "mirai200" # 0x0 exheader.bin
  CompanyCode            : "00" # 0x1110 game.3ds
  ProductCode            : "CTR-P-AHNJ" # 0x1150 game.3ds
  ContentType            : Application
  Logo                    : Nintendo
 
TitleInfo:
  UniqueId                : 0x00000cc4 # 0x1108 game.3ds in little endian
  Category                : Application
 
CardInfo:
  MediaType              : Card1 # Card1 / Card2
 
Option:
  UseOnSD                : true
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : false # If true CCI files are created with padding
  EnableCompress          : true # Compresses exefs code
 
AccessControlInfo:
  ExtSaveDataId: 0x00000cc4 # same as UniqueId
  SystemSaveDataId1: 0x00000000 # plaintext exheader
  SystemSaveDataId2: 0x00000000 # plaintext exheader
  OtherUserSaveDataId1: 0x00000 # plaintext exheader
  OtherUserSaveDataId2: 0x00000 # plaintext exheader
  OtherUserSaveDataId3: 0x00000 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 128K # plaintext exheader / 0x1C0 exheader.bin
  RemasterVersion: 0000 # 0xE exheader.bin
  StackSize: 0x00008000 # 0x1C exheader.bin
 
CardInfo:
  MediaSize              : 4GB # 128MB / 256MB / 512MB / 1GB / 2GB / 4GB / 8GB / 16GB / 32GB #CHANGE ME
  CardDevice              : NorFlash # NorFlash / None #CHANGE ME
 
ExeFs: # these are the program segments from the ELF, check your elf for the appropriate segment names
  ReadOnly:
  - .rodata
  - RO
  ReadWrite:
  - .data
  - RO
  Text:
  - .init
  - .text
  - STUP_ENTRY
 
AccessControlInfo:
  FileSystemAccess:
  #- CategorySystemApplication
  #- CategoryHardwareCheck
  #- CategoryFileSystemTool
  - Debug
  #- TwlCardBackup
  #- TwlNandData
  #- Boss
  - DirectSdmc
  - DirectSdmcWrite
  #- Core
  #- CtrNandRo
  #- CtrNandRw
  #- CtrNandRoWrite
  #- CategorySystemSettings
  #- CardBoard
  #- ExportImportIvs
  #- DirectSdmcWrite
  #- SwitchCleanup
  #- SaveDataMove
  #- Shop
  #- Shell
  #- CategoryHomeMenu
  IoAccessControl:
  #- FsMountNand
  #- FsMountNandRoWrite
  #- FsMountTwln
  #- FsMountWnand
  #- FsMountCardSpi
  #- UseSdif3
  #- CreateSeed
  #- UseCardSpi
 
  IdealProcessor                : 0
  AffinityMask                  : 1
 
  Priority                      : 48
 
  MaxCpu                        : 0x9E # Default
 
  DisableDebug                  : false
  EnableForceDebug              : false
  CanWriteSharedPage            : false
  CanUsePrivilegedPriority      : false
  CanUseNonAlphabetAndNumber    : false
  PermitMainFunctionArgument    : false
  CanShareDeviceMemory          : false
  RunnableOnSleep              : false
  SpecialMemoryArrange          : false
 
  CoreVersion                  : 2
  DescVersion                  : 2
 
  ReleaseKernelMajor            : "02"
  ReleaseKernelMinor            : "33"
  MemoryType                    : Application # Application / System / Base
  HandleTableSize: 200
  IORegisterMapping:
  - 1ff50000-1ff57fff
  - 1ff70000-1ff77fff
  MemoryMapping:
  - 1f000000-1f5fffff:r
  SystemCallAccess:
    ArbitrateAddress: 34
    Break: 60
    CancelTimer: 28
    ClearEvent: 25
    ClearTimer: 29
    CloseHandle: 35
    ConnectToPort: 45
    ControlMemory: 1
    CreateAddressArbiter: 33
    CreateEvent: 23
    CreateMemoryBlock: 30
    CreateMutex: 19
    CreateSemaphore: 21
    CreateThread: 8
    CreateTimer: 26
    DuplicateHandle: 39
    ExitProcess: 3
    ExitThread: 9
    GetCurrentProcessorNumber: 17
    GetHandleInfo: 41
    GetProcessId: 53
    GetProcessIdOfThread: 54
    GetProcessIdealProcessor: 6
    GetProcessInfo: 43
    GetResourceLimit: 56
    GetResourceLimitCurrentValues: 58
    GetResourceLimitLimitValues: 57
    GetSystemInfo: 42
    GetSystemTick: 40
    GetThreadContext: 59
    GetThreadId: 55
    GetThreadIdealProcessor: 15
    GetThreadInfo: 44
    GetThreadPriority: 11
    MapMemoryBlock: 31
    OutputDebugString: 61
    QueryMemory: 2
    ReleaseMutex: 20
    ReleaseSemaphore: 22
    SendSyncRequest1: 46
    SendSyncRequest2: 47
    SendSyncRequest3: 48
    SendSyncRequest4: 49
    SendSyncRequest: 50
    SetThreadPriority: 12
    SetTimer: 27
    SignalEvent: 24
    SleepThread: 10
    UnmapMemoryBlock: 32
    WaitSynchronization1: 36
    WaitSynchronizationN: 37
  InterruptNumbers:
  ServiceAccessControl:
  - APT:U
  - $hioFIO
  - $hostio0
  - $hostio1
  - ac:u
  - boss:U
  - cam:u
  - cecd:u
  - cfg:u
  - dlp:FKCL
  - dlp:SRVR
  - dsp::DSP
  - frd:u
  - fs:USER
  - gsp::Gpu
  - hid:USER
  - http:C
  - mic:u
  - ndm:u
  - news:u
  - nwm::UDS
  - ptm:u
  - pxi:dev
  - soc:U
  - ssl:C
  - y2r:u
  - ldr:ro
  - ir:USER
 
SystemControlInfo:
  JumpId: 0x00040000000cc400
  Dependency:
    ac: 0x0004013000002402L
    am: 0x0004013000001502L
    boss: 0x0004013000003402L
    camera: 0x0004013000001602L
    cecd: 0x0004013000002602L
    cfg: 0x0004013000001702L
    codec: 0x0004013000001802L
    csnd: 0x0004013000002702L
    dlp: 0x0004013000002802L
    dsp: 0x0004013000001a02L
    friends: 0x0004013000003202L
    gpio: 0x0004013000001b02L
    gsp: 0x0004013000001c02L
    hid: 0x0004013000001d02L
    http: 0x0004013000002902L
    i2c: 0x0004013000001e02L
    ir: 0x0004013000003302L
    mcu: 0x0004013000001f02L
    mic: 0x0004013000002002L
    ndm: 0x0004013000002b02L
    news: 0x0004013000003502L
    nim: 0x0004013000002c02L
    nwm: 0x0004013000002d02L
    pdn: 0x0004013000002102L
    ps: 0x0004013000003102L
    ptm: 0x0004013000002202L
    ro: 0x0004013000003702L
    socket: 0x0004013000002e02L
    spi: 0x0004013000002302L
    ssl: 0x0004013000002f02L

EDIT:

Did create the game again using exinjector + spoof + region free, works as well fine.

aliak11

Maybe your src is borked, i dumped it myself and trimmed it with rom_tool because
my SD is FAT32 and the Size was too big for it untrimmed.
What's the size limit?
 
In this thread it says to add the manuel to the cia with -content manual.cfa:1:1. But is the manual decrypted? I looked at the batch and I couldn't see where it is, which leads me to wonder how it can beadded to the cia when it's encrypted.
 
In this thread it says to add the manuel to the cia with -content manual.cfa:1:1. But is the manual decrypted? I looked at the batch and I couldn't see where it is, which leads me to wonder how it can added to the cia when it's encrypted.
Yeah, it must be decrypted.
 

Site & Scene News

Popular threads in this forum