ROM Hack Extract Ambassador Title ROM

[Narles]

I have been looking for a long time through these forums and haven't found any thread dealing quite with what I am trying to do. As a note, I have successfully extracted playable music from one of my own 3DS cartridges so I do have some idea as to how this process should work.

One thing I've always loved about the Wii scene was the ability to purchase games on Virtual Console, extract the Wii's NAND, and then process the NAND in order to extract the purchased ROMs. I have been trying to replicate something similar with the 3DS but have had no luck. I appear to have more luck with NES titles compared to GBA titles so, for this example, let's say I am dealing with an Ambassador NES title (that has been fully updated). What I've tried:

- Used 3DS_Multi_Decryptor and RxTools to download my titles via CDN, decrypt them, and ultimately end up with (what I believe to be) a decrypted .3ds file
- Used PackHack (from https://gbatemp.net/threads/tutoria...d-3ds-roms-run-xy-oras-without-update.383055/) to extract decrypted versions of RomFS, ExeFS, and ExHeader from the selected NES .3ds title. The tool then outputs the contents of decryptedExeFS into a folder called "exe" which contains 4 files: banner.bin, code.bin, icon.bin, logo.bin. My understanding is that code.bin should be the ROM that I am trying to get. Apparently I am mistaken.

I have tried decompressing and not decompressing the ExeFS and I still don't seem to be able to make code.bin into a usable NES ROM. Is there a step after this that I am missing?

Now, this is how far I get with NES. With GBA, as soon as I try to run the partition option on PackHack to extract the contents of the ExeFS partition of my GBA .3ds title, it will look like it is working but then towards the end it will say "Error, ExeFS section 0 size invalid" and will repeat until it gets to section 7 then it will stop. The resulting "exe" folder will be empty. Now, I had heard that the entire decryptedExeFS.bin file may represent the ROM, but that doesn't work seem to work either.

Has anyone had any luck with extracting ROMs (GBA or NES) from Ambassador titles on the 3DS?

 

[hippy dave]

For NES VC the rom is a file within the extracted romfs. I don't have a decrypted GBA VC handy and can't remember the details.

 

[Asia81]

for gba, the rom is in the exefs

 

[Narles]

For NES VC the rom is a file within the extracted romfs. I don't have a decrypted GBA VC handy and can't remember the details.

Thanks! It looks like my problem with extracting RomFS is that when I try to extract it using Packhack's partition command, I get the error

Error, IVFC segment corrupted
Error, RomFS corrupted

Do you have any idea how I might be able to fix that problem?

--------------------- MERGED ---------------------------

for gba, the rom is in the exefs

Thank you @Asia81! Your tutorial was actually what got me to where I am right now with this process. I had thought that it was located in the ExeFS but I am getting the error message "Error, ExeFS section 0 size invalid" when I try to extract the decrypted ExeFS. Do you know what might be causing that? Thanks again!

 

[Narles]

Ok, update.

It looks like, for whatever reason, RxTools's Decrypt CTR Titles feature has not been working for me. It might have something to do with RxTools seeming to modify my slot0x25KeyX.bin file stored at the root of my SD card when I use it. I copy slot0x25KeyX to my SD, check its MD5 hash value. Then I launch RxTools, do the Decrypt CTR Titles, then check the slot0x25KeyX hash value and it is changed. When I examine the changed file with a hex editor, it looks like RxTools padded in a bunch of 0s to the end of the file. Anyway, I found that when I follow @Asia81's tutorial for decrypting without Internet using 3DS Multitool and generating XORpads, I was able to get perfectly decrypted ExeFS and I was able to extract GBA ROMs from it! That solves the GBA extraction issue. Thank you for your help, @Asia81.

What's weird is that even when I do the exact same process for my NES titles, I cannot extract a usable NES ROM from RomFS. What's even weirder is that the ROM file I am finding in RomFS has a valid NES ROM header and is even detected as the appropriate ROM by my emulator (OpenEmu for Mac which checks the ROM and fetches metadata if it recognizes the ROM). I cannot get it to play for me at all though and I have tried several different emulators. It's very strange. This process has worked for GBA, Game Boy, and Game Boy Color ROMs but I cannot for the life of me get NES ROMs to work. Any suggestions would be greatly appreciated.

 

[HaloEffect17]

Obviously, you guys know a lot more about 3DS hacking than me. I'm trying to decrypt a .3DS file (that I have the Xorpads for) so that it can be playable on the Citra 3DS Emulator. No, I am not using RxTools with a 3DS (like @Narles) -- rather I am trying to decrypt it on a PC. Curious... has any of you been able to do this successfully?

 

[Asia81]

Obviously, you guys know a lot more about 3DS hacking than me. I'm trying to decrypt a .3DS file (that I have the Xorpads for) so that it can be playable on the Citra 3DS Emulator. No, I am not using RxTools with a 3DS (like @Narles) -- rather I am trying to decrypt it on a PC. Curious... has any of you been able to do this successfully?

Decrypt a CIA and rebuild it in 3DS with 3DS Builder

 

[Ailuros27]

Can you link me to the tutorial you used? I can only find the one from @Asia81 that uses PackHack. I've never seen a tutorial that uses 3DS Multi Tool. Also, can Braindump be used to get the romfs and exefs from a GBA VC title?