https://gist.github.com/khang06/84aabeac507fa99a676d22bb6120cea8

i wrote it all in markdown so...

https://gbatemp.net/threads/nintendo-switch-sd-to-nsp-dumper.514816/ for an automated way to do this

 

[ShaytheStar]

-k keys.ini -t nax0 --sdseed="your_sdseed_here_without_quotation_marks" --sdpath="/registered/0000008E/db0efb9c3352208b5249eaf40e9d442e.nca" --plaintext=game.nca "H:/Nintendo/Contents/registered/0000008E/db0efb9c3352208b5249eaf40e9d442e.nca/00"

Here you are, just make sure keys.ini is in the same directory with the hactool application and stuff with it.

It's very stubborn.

 

[der:Tom]

Hey guys, prob a stupid question but can someone help me with the SD Seed?

"Copy the hex representation of it and put it somewhere for later"

What excactly is meant by this? The 32 hex digits?

"Search for the contents of private"

content is 7 hex digits

"Copy the 16 bytes after that. This is your SD seed"

After the content of private the file is empty.

Can someone please explain me how i can get my SD Seed?

 

[FoxofGrey]

It's very stubborn.

Did you check to make sure that the SD card is the same drive letter, and make sure the nca folder is in the same folder as the hexadecimal folder?

 

[huma_dawii]

Help please, im losing my mind T.T

 

[AbuLela]

@Khangaroo
Could you give me the hactool syntax for extracting nca from a nsp?
I cant find a good example...

Greetings

 

[FoxofGrey]

Hey guys, prob a stupid question but can someone help me with the SD Seed?

"Copy the hex representation of it and put it somewhere for later"

What excactly is meant by this? The 32 hex digits?

"Search for the contents of private"

content is 7 hex digits

"Copy the 16 bytes after that. This is your SD seed"

After the content of private the file is empty.

Can someone please explain me how i can get my SD Seed?

So, if you're looking at HxD, one line represents 16 bytes. 1 Hexadecimal letter, like let's say B, is a half of a byte. So you'll have 16 sets of two Hexadecimal characters like this, for example:
A1 56 31 4D 8A 09 7A 3C 01 90 AC B1 51 0A 1B 11
This is what your SD Key MIGHT look like, lengthwise. Just get rid of the spaces in-between though.


But, yes, there will be 16 bytes within the hex contents of the "private" file. You will need to dump your eMMC and use HacDiskMount to mount the "SYSTEM" portion. Navigate to the directory (folder) the github tutorial mentions within the SYSTEM partition, open that file up with the same hex editor, and use "ctrl-f" to find the contents of the Private file in hex representation. The 16 bytes (the line below) is your SD Key. Do not show it to anyone.

View attachment 134165
Help please, im losing my mind T.T

You see the slashes in your directory paths for sdpath and the "00" file? Reverse those to be "/" slashes due to how Hactool interprets the slashes.
And make sure your key file is in the "ini" format (so make it keys.ini rather than keys.txt, as that'll have the best result).

 

[PeterGemp]

Ah yes, you're doing gods work, too, @FoxofGrey. I also explained it somewhere else. I hope you're okay if I add my wording for visibility:

In necessary detail, since the guide (https://gist.github.com/khang06/84aabeac507fa99a676d22bb6120cea8#file-0-sd-guide-md) is too god damn vague at the most inconvenient times:

"The hex representation of private", the only line of 16 Bytes in Hex within "private"- aka. "THE CONTENTS OF PRIVATE", for example:

F6 67 A5 9E 8B 62 65 65 AF D5 FF 0D 9E 80 15 8E

THEN open "save\8000000000000043" from your mounted NAND system partition that you dumped beforehand, right?
The search for "the content of "private" " within "save\8000000000000043":
This means nothing else than to look for the hex digit combination from "private" within "save\8000000000000043".
Make sure that you are searching for Hex-values in the search (see open tab in "Find"-search mask, HxD editor).

You then copy the next line that come after your matched search result (=private).

F6 67 A5 9E 8B 62 65 65 AF D5 FF 0D 9E 80 15 8E <= Aforementioned "The hex representation of private", only one line of 16 Bytes in Hex - aka. "THE CONTENTS OF PRIVATE"
A5 6E A5 5E 86 62 35 6D AF D5 F2 0C 9E F0 15 8E <= YOUR SD SEED, the line following "the contents of private"

Lose the spaces and these 16 bytes become your SD Seed: A56EA55E8662356DAFD5F20C9EF0158E

 

[huma_dawii]

So, if you're looking at HxD, one line represents 16 bytes. 1 Hexadecimal letter, like let's say B, is a half of a byte. So you'll have 16 sets of two Hexadecimal characters like this, for example:
A1 56 31 4D 8A 09 7A 3C 01 90 AC B1 51 0A 1B 11
This is what your SD Key MIGHT look like, lengthwise. Just get rid of the spaces in-between though.


But, yes, there will be 16 bytes within the hex contents of the "private" file. You will need to dump your eMMC and use HacDiskMount to mount the "SYSTEM" portion. Navigate to the directory (folder) the github tutorial mentions within the SYSTEM partition, open that file up with the same hex editor, and use "ctrl-f" to find the contents of the Private file in hex representation. The 16 bytes (the line below) is your SD Key. Do not show it to anyone.



You see the slashes in your directory paths for sdpath and the "00" file? Reverse those to be "/" slashes due to how Hactool interprets the slashes.
And make sure your key file is in the "ini" format (so make it keys.ini rather than keys.txt, as that'll have the best result).

I'll try that.

 

[huma_dawii]

So, if you're looking at HxD, one line represents 16 bytes. 1 Hexadecimal letter, like let's say B, is a half of a byte. So you'll have 16 sets of two Hexadecimal characters like this, for example:
A1 56 31 4D 8A 09 7A 3C 01 90 AC B1 51 0A 1B 11
This is what your SD Key MIGHT look like, lengthwise. Just get rid of the spaces in-between though.


But, yes, there will be 16 bytes within the hex contents of the "private" file. You will need to dump your eMMC and use HacDiskMount to mount the "SYSTEM" portion. Navigate to the directory (folder) the github tutorial mentions within the SYSTEM partition, open that file up with the same hex editor, and use "ctrl-f" to find the contents of the Private file in hex representation. The 16 bytes (the line below) is your SD Key. Do not show it to anyone.



You see the slashes in your directory paths for sdpath and the "00" file? Reverse those to be "/" slashes due to how Hactool interprets the slashes.
And make sure your key file is in the "ini" format (so make it keys.ini rather than keys.txt, as that'll have the best result).

OMG IT WORKED!!!! D:

 

[Mat37]

I got this when loading get_titlekeys :
F:\Switch\SD>"C:\Program Files (x86)\Python27\python.exe" get_titlekeys.py PRODINFO.bin common_ticketblob.bin
Traceback (most recent call last):
File "get_titlekeys.py", line 4, in <module>
from Crypto.Cipher import AES
ImportError: DLL load failed: %1 nÆest pas une application Win32 valide.

 

[huma_dawii]

I got this when loading get_titlekeys :
F:\Switch\SD>"C:\Program Files (x86)\Python27\python.exe" get_titlekeys.py PRODINFO.bin common_ticketblob.bin
Traceback (most recent call last):
File "get_titlekeys.py", line 4, in <module>
from Crypto.Cipher import AES
ImportError: DLL load failed: %1 nÆest pas une application Win32 valide.

You need to install crypto via pip command

pip install pycrypto

and to install that you need Visual Basic C++ 9.0.0 or something like that....

 

[Mat37]

You need to install crypto via pip command

pip install pycrypto

and to install that you need Visual Basic C++ 9.0.0 or something like that....

I already have installed both

 

[huma_dawii]

I already have installed both

Weird, try yo uninstall everything and re install, and reboot after installing?

 

[supermariorick]

Ah yes, you're doing gods work, too, @FoxofGrey. I also explained it somewhere else. I hope you're okay if I add my wording for visibility:

In necessary detail, since the guide (https://gist.github.com/khang06/84aabeac507fa99a676d22bb6120cea8#file-0-sd-guide-md) is too god damn vague at the most inconvenient times:

"The hex representation of private", the only line of 16 Bytes in Hex within "private"- aka. "THE CONTENTS OF PRIVATE", for example:

F6 67 A5 9E 8B 62 65 65 AF D5 FF 0D 9E 80 15 8E

THEN open "save\8000000000000043" from your mounted NAND system partition that you dumped beforehand, right?
The search for "the content of "private" " within "save\8000000000000043":
This means nothing else than to look for the hex digit combination from "private" within "save\8000000000000043".
Make sure that you are searching for Hex-values in the search (see open tab in "Find"-search mask, HxD editor).

You then copy the next line that come after your matched search result (=private).

F6 67 A5 9E 8B 62 65 65 AF D5 FF 0D 9E 80 15 8E <= Aforementioned "The hex representation of private", only one line of 16 Bytes in Hex - aka. "THE CONTENTS OF PRIVATE"
A5 6E A5 5E 86 62 35 6D AF D5 F2 0C 9E F0 15 8E <= YOUR SD SEED, the line following "the contents of private"

Lose the spaces and these 16 bytes become your SD Seed: A56EA55E8662356DAFD5F20C9EF0158E

you can actually skip mounting a nand dump as you can just use the memloader payload to access the Switch's filesystem and hacdiskmount to mount it as a drive on the computer.

 

[Mat37]

Weird, try yo uninstall everything and re install, and reboot after installing?

Thanks it worked ^^ but now i wonder why i have the ticket for fifa 18 cause i don't have the game or anything related to it

 

[huma_dawii]

Thanks it worked ^^ but now i an wonder why i have the ticket for fifa 18 cause i don't have the game or anything related to it

go to eshop and try to download it? xD

 

[Mat37]

go to eshop and try to download it? xD

I'm banned. But i'll try with eXhop and try loading it. (first i need the FE Warriors DL to finish, i need it to get the update for layeredFS) as i have a shitty connection you may (probably) have an answer wednesday.

 

[supermariorick]

also if you can't get hacdiskmount to run because you dont have x64 Windows then you can use @ihaveamac 's SwitchFS with Winfsp for Windows and FUSE for MacOS (requires latest python 3 and latest vcredist-x86 if u dont have x64 for Windows or Xcode for MacOS)

oh yeah and you also need visual studio c++ build tools which the readme has a deprecated link and so you'll have to google the installation package

 

[der:Tom]

@FoxofGrey: Thank you very much it worked! I succesfully dumped, decrypted and loaded an eShop title (Limbo) through LayeredFS

 

[Leozairus]

Now "we" can just grab the nca/nsp game + update, use a common update key (easy to find) + LayeredFS and play any game... In skillful hands, that's will be a game changer...

Don’t quote me on that