Homebrew Cubic Ninja Blowfish

[gudenau]

How does one get the blowfish keys from Cubic Ninja? I would like to work on NINJHAX, but I do not know how to get the keys. How do I do this? Could I have a hash to check my keys as-well?

 

[Vappy]

Apparently you can get the processed key from a RAM dump. If someone gives a hash of the key, should be easy enough to find it with that.

 

[gudenau]

Apparently you can get the processed key from a RAM dump. If someone gives a hash of the key, should be easy enough to find it with that.

Still, it has 129028 possibilities, based on my dump.

 

[Vappy]

Still, it has 129028 possibilities, based on my dump.

StapleButter says it's 0x1048 bytes, so that narrows it down at least a little.

 

[dubbz82]

Still, it has 129028 possibilities, based on my dump.

If this could be brute force attempted, it might not be all that terrible to be honest.

 

[The Real Jdbye]

If this could be brute force attempted, it might not be all that terrible to be honest.

Indeed. With a fast computer it should be a breeze.

 

[zoogie]

Funny the coincidence of this thread appearing. I think I found it today.

Dump your CN RAM around the time when it's doing QR stuff, go to file offset 0x200000 and copy 0x1048 worth of data to a separate file.
The checksums I have are,

  File: blowfish_processed.bin
CRC-32: 2bbc1e5c
   MD4: 549c79aa95a83d253ccd11aeb64cbff0
   MD5: 33f38ab6f0821bc64b6f6bf98c1494f0
SHA-1: 5b1c58e93827a1b440fa2d33524affc9822a2688

 

[gudenau]

StapleButter says it's 0x1048 bytes, so that narrows it down at least a little.

I included that.

If this could be brute force attempted, it might not be all that terrible to be honest.

That was an idea.

Indeed. With a fast computer it should be a breeze.

Exactly.

Funny the coincidence of this thread appearing. I think I found it today.

Dump your CN RAM around the time when it's doing QR stuff, go to file offset 0x200000 and copy 0x1048 worth of data to a separate file.
The checksums I have are,

  File: blowfish_processed.bin
CRC-32: 2bbc1e5c
   MD4: 549c79aa95a83d253ccd11aeb64cbff0
   MD5: 33f38ab6f0821bc64b6f6bf98c1494f0
SHA-1: 5b1c58e93827a1b440fa2d33524affc9822a2688

I will check that in a little while.

 

[dubbz82]

Since I'm apparently a little out of the loop and missing something here, what exactly are you trying to do with the blowfish key, anyways?

 

[zoogie]

Since I'm apparently a little out of the loop and missing something here, what exactly are you trying to do with the blowfish key, anyways?

Compile ninjhax, regionfour, etc.

 

[gudenau]

Since I'm apparently a little out of the loop and missing something here, what exactly are you trying to do with the blowfish key, anyways?

I want to compile NIJHAX, the key is used in the creation of the QR code that you scan.

 

[pseudov]

Funny the coincidence of this thread appearing. I think I found it today.

Dump your CN RAM around the time when it's doing QR stuff, go to file offset 0x200000 and copy 0x1048 worth of data to a separate file.
The checksums I have are,

  File: blowfish_processed.bin
CRC-32: 2bbc1e5c
   MD4: 549c79aa95a83d253ccd11aeb64cbff0
   MD5: 33f38ab6f0821bc64b6f6bf98c1494f0
SHA-1: 5b1c58e93827a1b440fa2d33524affc9822a2688

Hey zoogie, which ram dumper are you using? I've used two different ones, and both of them contain just 00's (null) at offset 0x200000 and beyond. I timed my ramdumps while scanning a QR code.

 

[zoogie]

Hey zoogie, which ram dumper are you using? I've used two different ones, and both of them contain just 00's (null) at offset 0x200000 and beyond. I timed my ramdumps while scanning a QR code.

I'm using kazowar's memdumper (which one are you using?).
I've noticed the zeros problem too with some of my more recent dumps. This dump I used that worked is from a while back. I faintly remember actually activating the dump right before the ninjhax text screen comes up (while "loading" and the -> moving left to right).

The big break in finding the key was noticing the memory location is given away in the ninjhax repo right here:
https://github.com/smealum/ninjhax/...ial_loader/WEST/cn_initial/source/main.c#L243

I suspect though, that it's only there for an instant and my timing was lucky. My key is definitely legit because the QR's generated are valid and they install the payload. Tested with regionfour.

 

[pseudov]

I'm using kazowar's memdumper (which one are you using?).
I've noticed the zeros problem too with some of my more recent dumps. This dump I used that worked is from a while back. I faintly remember actually activating the dump right before the ninjhax text screen comes up (while "loading" and the -> moving left to right).

The big break in finding the key was noticing the memory location is given away in the ninjhax repo right here:
https://github.com/smealum/ninjhax/...ial_loader/WEST/cn_initial/source/main.c#L243

I suspect though, that it's only there for an instant and my timing was lucky. My key is definitely legit because the QR's generated are valid and they install the payload. Tested with regionfour.

I used kazowar's as well, and the one from projectpokemon. Okay, I'll try a few more dumps at different timings and report back.

 

[gudenau]

I'm using kazowar's memdumper (which one are you using?).
I've noticed the zeros problem too with some of my more recent dumps. This dump I used that worked is from a while back. I faintly remember actually activating the dump right before the ninjhax text screen comes up (while "loading" and the -> moving left to right).

The big break in finding the key was noticing the memory location is given away in the ninjhax repo right here:
https://github.com/smealum/ninjhax/...ial_loader/WEST/cn_initial/source/main.c#L243

I suspect though, that it's only there for an instant and my timing was lucky. My key is definitely legit because the QR's generated are valid and they install the payload. Tested with regionfour.

I frogot about the browser exploit.

I'm using kazowar's memdumper (which one are you using?).
I've noticed the zeros problem too with some of my more recent dumps. This dump I used that worked is from a while back. I faintly remember actually activating the dump right before the ninjhax text screen comes up (while "loading" and the -> moving left to right).

The big break in finding the key was noticing the memory location is given away in the ninjhax repo right here:
https://github.com/smealum/ninjhax/...ial_loader/WEST/cn_initial/source/main.c#L243

I suspect though, that it's only there for an instant and my timing was lucky. My key is definitely legit because the QR's generated are valid and they install the payload. Tested with regionfour.

I used kazowar's as well, and the one from projectpokemon. Okay, I'll try a few more dumps at different timings and report back.

Could I have a link?

Edit:
For now I am brute forcing is, just in case I get lucky.

 

[pseudov]

I frogot about the browser exploit.





Could I have a link?

Edit:
For now I am brute forcing is, just in case I get lucky.

Here's kazowar's:

https://gbatemp.net/threads/spider-arcode.383937/

 

[Intronaut]

I want to compile NIJHAX, the key is used in the creation of the QR code that you scan.

Are you trying to finish SpiderNinja?

 

[gudenau]

Are you trying to finish SpiderNinja?

No, I am trying to improve NINJHAX.

 

[pseudov]

I'm using kazowar's memdumper (which one are you using?).
I've noticed the zeros problem too with some of my more recent dumps. This dump I used that worked is from a while back. I faintly remember actually activating the dump right before the ninjhax text screen comes up (while "loading" and the -> moving left to right).

The big break in finding the key was noticing the memory location is given away in the ninjhax repo right here:
https://github.com/smealum/ninjhax/...ial_loader/WEST/cn_initial/source/main.c#L243

I suspect though, that it's only there for an instant and my timing was lucky. My key is definitely legit because the QR's generated are valid and they install the payload. Tested with regionfour.

I tried around 8 ramdumps as close as possible before the ninjhax screen, but they resulted in all zeroes at 0x200000. Once "Loading ->" comes up, the home button doesn't respond anymore, and ninjhax loads all the way without a chance to dump.

Any luck, gudenaurock?

 

[gudenau]

I tried around 8 ramdumps as close as possible before the ninjhax screen, but they resulted in all zeroes at 0x200000. Once "Loading ->" comes up, the home button doesn't respond anymore, and ninjhax loads all the way without a chance to dump.

Any luck, gudenaurock?

Can not check at the moment, I deleted my save so I could start the QR code thing. My camera is busted so I was hoping that would help.