Hacking Xenoblade Chronicle 3D xorpads

[motezazer]

Anyone looking to extract the .arc archives may be interested in this: http://pastebin.com/4MC8548R

Also, the .tpl files are wrappers for .ctex (same basic image storage format as bclim, different metadata). Here's the code I used to convert them to .bclim when I was looking at the game: http://pastebin.com/fmczHE85

I have two questions about the game (not trying to do an undub because I think the basic way will fail just like the wii) :
-how sizes are stored in fsize.dat? (any obfuscation, built-in verification?) just saw your edit
-how the sb files are checked? (because I remember you said there is built-in verification for these files)

 

[Zap Rowsdower]

Is this new style n3ds decryption still 'Ninjhax exclusive'? Meaning it'd be cheaper to buy a sky3ds than trying to get a copy of CN...?

 

[SciresM]

I have two questions about the game (not trying to do an undub because I think the basic way will fail just like the wii) :
-how sizes are stored in fsize.dat? (any obfuscation, built-in verification?)
-how the sb files are checked? (because I remember you said there is built-in verification for these files)

Undub update : both games decrypted and extracted, I just need to figure how fsize.dat works...

fsize.dat is pretty standard.

u32 magic; // "zsif", "fsiz" backwards
u32 filecount;
byte[8] reserved;

filecount*entry;

struct entry
{

u32 unk; // Related to File Path?
u32 FileSize;

}

That unknown u32 in each entry will be the sticking point for editing, I think, probably.
I'm not sure how the .sb files are verified, but I know that they *are* verified.

 

[motezazer]

That unknown u32 in each entry will be the sticking point for editing, I think, probably.

Found more simple : I searched the size of the file I want to edit.

 

[motezazer]

Undub status ---> Fail
Freezes at 3DS logo screen

 

[Pacman`]

Man these xorpads take forever! Took a good handful of HOURS to finish. Still don't know why xorpad generation is so slow on n3ds vs o3ds.

Anyway, for those who can't/don't want to/whatever compile stuff here's my copy of Decrypt9 updated to the latest, runs on Brahma rather than bootstrap as I've found it a hell of alot more reliable.

Hi,

Took me like 4 hours to generate the xorpads for the USA version of XC, using a N3DS 9.0.0 USA.
Thanks for the files. Put your Decrypt9 folder into the 3ds Ninjhax folder. Worked great.
Had a working slot0x25KeyX.bin, just in case (not sure if it was needed, but decrypt9 did open it).

Created the cia using 3DS To CIA Converter v4.1 (link removed - use google).
Didn't have to futz with any RSF files (the converter generates one automatically)
Used the ncchinfo.bin created using "2 - ncchinfo (Higher)".
Rom results were: Region Lock: No Manual: Yes SDK: 5 AMC: 3

 

[liomajor]

It contains bbm and sdk files, so it's not for gbatemp.

Tested it, doesn't work well and failed in generation.

 

[Pacman`]

It contains bbm and sdk files, so it's not for gbatemp.

Tested it, doesn't work well and failed in generation.

Read it again. It worked great

The first time I tried back in April, I didn't use Decrypt9, so of course it failed.
This time, it didn't (first try too).

 

[liomajor]

Xorpad worked, i was talking about "3DS To CIA Converter v4.1"

You might consider removing the links because sdk is a no go on gbatemp.

 

[Pacman`]

Xorpad worked, i was talking about "3DS To CIA Converter v4.1"

You might consider removing the links because sdk is a no go on gbatemp.

Alright

 

[drfsupercenter]

I don't think it's against the rules to post decrypt9.3dsx here, as I've found it before myself, so here's the one I compiled earlier today that has the new 3DS key slot decryption

I tried this on my Monster Hunter N3DS XL that's on 9.2, was able to get NinjHax loaded up but when I tried to open decrypt9 I got "an error has occurred, the system will now restart"

I generated the ncchinfo.bin using VOID's tool, is that not how I'm supposed to do it?

 

[motezazer]

I tried this on my Monster Hunter N3DS XL that's on 9.2, was able to get NinjHax loaded up but when I tried to open decrypt9 I got "an error has occurred, the system will now restart"

I generated the ncchinfo.bin using VOID's tool, is that not how I'm supposed to do it?

Try again.
It's an exploit, it doesn't have 100% launch rate.

 

[drfsupercenter]

Try again.
It's an exploit, it doesn't have 100% launch rate.

Hm, actually it works on the first try with the .zip attachment in a later post. I don't know much about how NinjHax works, but that one has the .3dsx and .smdh and other files, rather than just a .3dsx. Maybe that's why, I have no idea... anyway, letting it generate now!

 

[Ichii Giki]

So I've tried to create a CIA about 5 times now with no success between various methods.

1. Dumped rom (in 2 parts) with Gateway launcher
2. Combined with "copy /b CAFE.3D0 + CAFE.3D1 CAFE.3DS" command prompt command
3. Generated "ncchinfo.bin" with "ncchinfo_gen.py" script from rxTools scripts
4. Generated Xorpads with new Decrypt9 (Brahma based distro from this post: http://gbatemp.net/threads/xenoblade-chronicle-3d-xorpads.388470/page-2#post-5486607)
(this ncchinfo.bin seemed odd as it wanted to make 16 xorpads, 1MB, 4MB, 4MB, 3598MB, and then the 5th one was going to be 1MILLION+ MB [Manual Xorpad according to name, only got to 95MB before card filled], which obviously failed on a 4GB SD card)
5. Used Xorpads and rom from previous steps (minus the manual xorpad) with various different CIA creation programs/scripts, with varying levels of success trying to install with FBI
A. 3ds_to_cia_v2.04 by Katsu - using the US RSF from this post: http://gbatemp.net/threads/release-3ds-to-cia-by-katsu.384381/page-2#post-5486880
I got the CIA to install with FBI but it would hang at launch with the 3DS logo and red bars
B. 3ds_to_cia_v2.05 by Katsu - using auto-generated RSF and installing with FBI again received hang at launch with 3DS logo and red bars
C. 3DS To CIA Converter v4.1 - using auto-generated RSF and installing with FBI loaded past 3DS logo and red bars, but then presented "an Error has occurred" screen prompting to power down the system and restart
D. 3DS Simple CIA Converter v2.0b (windows executable) - generated ncchinfo.bin from rom with this app (single xorpad) and made xorpad with rxTools on O3DS (as described in this post: http://gbatemp.net/threads/official...way-or-sky-thread.385251/page-32#post-5479206) - install with FBI failed at the end citing NCCH error
E. 240148-QuenoPack 3DS to CIA v5.1.4b (which I have used to create almost all my other installed CIAs from my dumped 3DS roms) - failed to create CIA with all possible build options

Am I doing something wrong for this specific game? I have successfully dumped and installed CIAs for 14 of my other cart-based games with little to no issue. I would appreciate any step by step help people could offer me for getting Xenoblade specifically from Cart to CIA. Thanks in advance!

 

[cearp]

So I've tried to create a CIA about 5 times now with no success between various methods.

1. Dumped rom (in 2 parts) with Gateway launcher
2. Combined with "copy /b CAFE.3D0 + CAFE.3D1 CAFE.3DS" command prompt command
3. Generated "ncchinfo.bin" with "ncchinfo_gen.py" script from rxTools scripts
4. Generated Xorpads with new Decrypt9 (Brahma based distro from this post: http://gbatemp.net/threads/xenoblade-chronicle-3d-xorpads.388470/page-2#post-5486607)
(this ncchinfo.bin seemed odd as it wanted to make 16 xorpads, 1MB, 4MB, 4MB, 3598MB, and then the 5th one was going to be 1MILLION+ MB [Manual Xorpad according to name, only got to 95MB before card filled], which obviously failed on a 4GB SD card)
5. Used Xorpads and rom from previous steps (minus the manual xorpad) with various different CIA creation programs/scripts, with varying levels of success trying to install with FBI
A. 3ds_to_cia_v2.04 by Katsu - using the US RSF from this post: http://gbatemp.net/threads/release-3ds-to-cia-by-katsu.384381/page-2#post-5486880
I got the CIA to install with FBI but it would hang at launch with the 3DS logo and red bars
B. 3ds_to_cia_v2.05 by Katsu - using auto-generated RSF and installing with FBI again received hang at launch with 3DS logo and red bars
C. 3DS To CIA Converter v4.1 - using auto-generated RSF and installing with FBI loaded past 3DS logo and red bars, but then presented "an Error has occurred" screen prompting to power down the system and restart
D. 3DS Simple CIA Converter v2.0b (windows executable) - generated ncchinfo.bin from rom with this app (single xorpad) and made xorpad with rxTools on O3DS (as described in this post: http://gbatemp.net/threads/official...way-or-sky-thread.385251/page-32#post-5479206) - install with FBI failed at the end citing NCCH error
E. 240148-QuenoPack 3DS to CIA v5.1.4b (which I have used to create almost all my other installed CIAs from my dumped 3DS roms) - failed to create CIA with all possible build options

Am I doing something wrong for this specific game? I have successfully dumped and installed CIAs for 14 of my other cart-based games with little to no issue. I would appreciate any step by step help people could offer me for getting Xenoblade specifically from Cart to CIA. Thanks in advance!

ok, why are you using that tool? is there a reason? do you want to decrypt the game, maybe to edit some files, and then repack as cia?
also, i have seen this cia available online, why not just use that one? already made, the exact game you want... etc
maybe your internet is bad, or, you want to make it yourself because it is less of a legal issue, maybe.

i see you tried to use method 'D' - use this tool/method - https://gbatemp.net/threads/release-3ds-simple-cia-converter.384559
it only requires you to decrypt the exheader, it is faster, less hassle, better. (unless you specifically want to decrypt the full game for some reason)
i can only say keep trying, because that will be the most foolproof.
or, just download the cia from online. no need to waste time like this

 

[Ichii Giki]

ok, why are you using that tool? is there a reason? do you want to decrypt the game, maybe to edit some files, and then repack as cia?
also, i have seen this cia available online, why not just use that one? already made, the exact game you want... etc
maybe your internet is bad, or, you want to make it yourself because it is less of a legal issue, maybe.

i see you tried to use method 'D' - use this tool/method - https://gbatemp.net/threads/release-3ds-simple-cia-converter.384559
it only requires you to decrypt the exheader, it is faster, less hassle, better. (unless you specifically want to decrypt the full game for some reason)
i can only say keep trying, because that will be the most foolproof.
or, just download the cia from online. no need to waste time like this

I was trying to go a more legal route (as with my other carts)...but perhaps at this point downloading might be easier (and I did purchase the game cart). Do you know why else method D (3ds simple cia converter Windows executable) failed? Should I try to install the CIA with something besides FBI? I like FBI mostly, but if this CIA would work better with like BRM/DevMenu I could try that. Each install is just painful though as it takes over 1.5 hours just to see the installed game fail/not launch...

 

[blindseer]

I manually made a rsf that worked with 2.04 but I deleted it, I know that it can work but yeah, Im not going to wait 4 hours to make xorpads again for it sorry.

 

[drfsupercenter]

A friend of mine rebuilt padxorer to support files >2GB, which is totally useful for this game

http://www.sendspace.com/file/xucnri

The "64" just means that it's 64-bit C code, it's still a normal win32 binary that will work on 32-bit operating systems.

 

[Kohmei]

I was trying to go a more legal route (as with my other carts)...but perhaps at this point downloading might be easier (and I did purchase the game cart). Do you know why else method D (3ds simple cia converter Windows executable) failed? Should I try to install the CIA with something besides FBI? I like FBI mostly, but if this CIA would work better with like BRM/DevMenu I could try that. Each install is just painful though as it takes over 1.5 hours just to see the installed game fail/not launch...

Based on what you said about ncchinfo.bin wanting to generate data for 16 partitions, any of the following might have gone wrong:
-the .3ds became corrupted for some reason when copying from your SD card or combining files
-you're using an outdated ncch_gen script
-the decrypt9 you're using wasn't compiled correctly

FBI might also be the problem. I essentially did exactly what you're trying to do and it came out just fine with BBM

 

[cearp]

I was trying to go a more legal route (as with my other carts)...but perhaps at this point downloading might be easier (and I did purchase the game cart). Do you know why else method D (3ds simple cia converter Windows executable) failed? Should I try to install the CIA with something besides FBI? I like FBI mostly, but if this CIA would work better with like BRM/DevMenu I could try that. Each install is just painful though as it takes over 1.5 hours just to see the installed game fail/not launch...

1.5 hours ouch!
yes, it could be your installer, i like devmenu, but failing that then fbi is nice.
if that is not the problem, then i can only imagine you did something wrong, as i saw the other xenoblades cias were made with it and they work.
download one, see if it works in fbi it might not be your fault

A friend of mine rebuilt padxorer to support files >2GB, which is totally useful for this game

http://www.sendspace.com/file/xucnri

The "64" just means that it's 64-bit C code, it's still a normal win32 binary that will work on 32-bit operating systems.

is the source here too? or just a windows executable?