Hacking [How To] Remove the 022-2812 ban error with a CFW

[Joom]

Is this CXI you're talking about a NATIVE_FIRM patch or something?

No. It patches the device ID with a static ID in the same way that @Nanquitas's fork does.

 

[Deleted member 355359]

No. It patches the device ID with a static ID in the same way that @Nanquitas's fork does.

Oh. I was thinking that since there is a DER to verify CTCert there. I thought there was something like a separate ARM9 payload to do that, but okay.

 

[Nanquitas]

Note: this is not my patch.

It's a POC patch from the work of @PF2M. All credits goes to him.
As for the patch, it should be reworked to allow random generation at boot.

 

[Rangnarok]

So from what I understand, the method is to patch the DeviceID in CTCert, and also somehow patch how the signature is checked to match with the DeviceID?

What I don't get is now that you need a 100% legit CTCert to send to the Nintendo server, how do you change the DeviceID in the CTCert and still make the signature check work? But I guess that's the million dollars secret here.

 

[Deleted-19228]

No one is changing the DeviceID *IN* the CTCert, yet. It's being changed in ram.

 

[Joom]

As for the patch, it should be reworked to allow random generation at boot.

No, it shouldn't. This would mean that DeviceCert would also have to have the exact same ID that was randomly generated. This obviously would require a lot more work to be done by the end user. People just shouldn't all use the exact same device ID. That's why unique sysmodules are much more practical.

--------------------- MERGED ---------------------------

No one is changing the DeviceID *IN* the CTCert, yet. It's being changed in ram.

Right. It's impossible to directly manipulate CTRCert because it resides in the OTP.

 

[fodder]

Anyone know what error 022-2402 is?

 

[SilverfalconLP]

im look in act module similar hex of patch Deviceid used in Luma (id 1234 ...) .Its the cxi say here, onli change same luma .can be swap whit compiled luma whit your id need?

PD:i can enter on miiverse whit my compiled luma (before ninti patch check cert .im not use nanquitas fork im make my compiled whit other id not 1234)not whit luma on this

 

[xBleedingSoulx]

Has anyone tried System Transferring from a 3DS (With an NNID) that isn't banned to a 3DS(Without an NNID) that is banned? What was the outcome?

 

[Retroarcade2003]

when i try to create a new NNID with this patch i say error 22-2452, is for the deviceCert ecc right?
Sorry for my bad english

 

[mrmiguebass]

when i try to create a new NNID with this patch i say error 22-2452, is for the deviceCert ecc right?
Sorry for my bad english

the same question... any possible solution?

 

[Retroarcade2003]

the same question... any possible solution?

I think that one possible solution is the luma module of previos comments... with the CXI ecc if i understand right
Sorry for my bad english

 

[phillyrider807]

Will this method work to unban me from eshop so I can download LoE so I can downgrade my new3ds black Friday bundle?

 

[Retroarcade2003]

Will this method work to unban me from eshop so I can download LoE so I can downgrade my new3ds black Friday bundle?

If you intend the arm9loaderhax.bin at the first post no... Nintendo has fix it

 

[Deleted member 355359]

the same question... any possible solution?

022-2452 is "Unauthorized device", which means your Device-Cert doesn't match your DeviceID. This started happening a week ago. No (public) solution yet, just wait for one.

 

[fodder]

It's either in OTP or just encrypted there. You can find it Base64 encoded in process 21 @0x0013F7A0 if you dump it.

Afterwards, convert it to hex and then back to Base64 with these sites:
http://tomeko.net/online_tools/base64.php?lang=en
http://tomeko.net/online_tools/hex_to_base64.php?lang=en

Once you're done, you could modify it in RAM by using this NTR Debugger code:
write(0x0013FAA4, tuple(map(ord, "Insert device cert here")),pid=0x21)


The server won't accept modified CTCerts, they use the same signature types used to protect Bitcoins.
You're probably just getting a CTCert from one system and using it on another, and boom, problem solved.
If you're even being serious, that is.
I could do that by dumping anyone's process 21 and then extracting its DeviceID.

If you're just modifying it in ITCM according to the DeviceID you want to use and then modifying the DeviceID using your own binary, that means the 3DS can sign CTCerts, apparently.

Eh, tried this with another unbanned system's info (whatever that is, according to you device cert, also this write command is wrong btw, unless I used it wrong), didn't make a difference, still got 2812

 

[Retroarcade2003]

Eh, tried this with another unbanned system's info (whatever that is, according to you device cert, also this write command is wrong btw, unless I used it wrong), didn't make a difference, still got 2812

Ye... i planning to buy a new nintendo 3ds, i have lose the hopes...
Sorry for my bad english

 

[Durig]

Eh, tried this with another unbanned system's info (whatever that is, according to you device cert, also this write command is wrong btw, unless I used it wrong), didn't make a difference, still got 2812

do you use linux or dd for windows?
i use dd for windows and output is cert.bin
but i'm missing smthg
cant figure out what to do next

 

[Deleted member 355359]

I was going to start work on reverse-engineering the Wii networking and then starting work on the 3DS Device-Certs, but then I found something.
There was a file on Dolphin's NAND called device.cert. Edit: that I dumped from my Wii.

Man, this looks familiar!
I tried this for the lelz. I thought it wouldn't work, but it's worth a try. I converted it to Base64, got the DeviceID, set the platform to Wii U, and..
it worked.

The most unexpected thing to happen happened.

This means 2 things:
1. This was solved a while ago. A LONG while ago, like 5 years ago. If Dolphin can generate device certs, we can, especially if it's using an old cert from 2006 and was achieved a long time ago. This further supports that generating movable.seds is very possible.
2. There is hope! Making a method from this wouldn't be impossible.
But, we haven't made anything like a quick patch for this in NTR yet. I mean, I discovered this 2 minutes ago, but just wanted to report this.
That's (mostly) all.

EDIT: Read this. Of course it was too good to be true, but hey, we can still use Wii certs, which opens up a huge portal of possibilities since a lot of people have a Wii (aka 70% of people on this site maybe)

 

[ninjadudexp]

So did we verify sumo early release was the ban and not an antipiracy in the game?