ROM Hack RELEASE Switch port of Planescape Torment contains fully-working copy of PC version

[Cirosan]

Two things before we start:

1. I wasn't sure which subforum to post this in or what to tag this thread as, since this is an odd blend of news post and tutorial, so please excuse me if there was a subforum/tag more fitting for this.

2. I also want to preface this by saying that I like Beamdog, the developer, and think you should support them, as their Switch ports of the Infinity Engine games have been very good. However, as a long-time modder, I also believe in the first-sale doctrine - in this case, your right as a consumer to use and modify every part of a piece of software you bought, even if the devs probably didn't want you knowing something is there. Ultimately, I believe in the latter more than the former, and so I'm publishing my findings, but I sincerely hope Beamdog doesn't get into any trouble for this.

Alright, on to business. Just like the title says, the Switch port of PST - the bundle with it and IWD - contains a fully-working copy of the PC version of the game, complete with an executable. I've extracted it and it plays perfectly on PC, although tutorial dialogue still makes references to non-existent Switch buttons (screenshot: https://i.imgur.com/oJxHIZ2.png ).

This effectively means all Switch users also have a copy of the PC version, since it can be extracted with free homebrew tools. These files are still present in the most recent update, and must've been there for some time already. Note how the application window is labeled "IWDPST" - this is because PST was bundled with Icewind Dale as a 2-in-1 title. This also makes it possible to run Beamdog's internal engine mode for the Switch port on PC (labelled "IWDPST" and running mode 3; this is in engine.lua), though this is of little use to modders, I imagine. The executable lacks any DRM and is immediately playable upon extraction; indeed, its structure largely mirrors how the PC copy looks.

Here is how to get the PC version out of the Switch's files:

1. Your Switch must be hacked, obviously.

2a. If you have not already, use LockpickRCM to dump your keys.
2b. If you don't know what this means, download LockpickRCM from here - https://github.com/shchmue/Lockpick_RCM/releases - power down your Switch, put it in RCM mode, and inject LockpickRCM as a payload. Follow the on-screen directions to dump your keys, which will be copied to the \switch\ directory on your SD card.

3. Copy prod.keys from the \switch\ folder on your SD card to your computer. Create a new folder on your desktop, call it PST, and copy prod.keys to this folder. Then rename prod.keys to keys.ini

4. Download and install the homebrew tool nxdumptool from here: https://github.com/DarkMatterCore/nxdumptool/releases

5a. Open PST/IWD in nxdumptool, select "Nintendo Submission File (NSP) dump", then "Dump base application NSP". It'll be saved in switch\nxdumptool - copy it over to your PC, and put in your PST folder.
5b. If your SD card is using fat32, the NSP will be broken into 2 files, and you'll need to use NSC_Builder to merge them: https://github.com/julesontheroad/NSC_BUILDER/releases

6. Download this extractor tool and put it in your PST folder: https://gbatemp.net/threads/extract-nsp-nca-xci-update-all-in-one-tool-for-layeredfs.511156/

7. Open NCA-NSP-XCI_TO_LayeredFS.bat and enter 2 (eShop NSP), then enter 1 (Extract Eshop NSP). Then drag and drop your NSP into the cmd window and hit enter. It will take a few minutes to extract all the files. After it's done, quit out of the program.

8. There will be a new folder in your PST folder called Extracted_NSP. Open NCA-NSP-XCI_TO_LayeredFS.bat again, enter 1 (NCA), then enter 2 (Extract Encrypted NCA), then enter 2 again (Romfs folder).

9. The program will ask you to drop your biggest NCA in, but ignore this. In the new Extracted_NSP folder, grab your second-biggest NCA - 9be0fae3033f019baa8966cf3d77751a.nca - and drop it into the cmd window.

10. The program will ask you for your title key. To find this, go to the Extracted_NSP folder and open 010030b00c3160000000000000000008.tik in a hex editor, like HxD (google "HxD" to download it; it's free). In HxD, at the line labelled 00000180, note the alphanumeric string of numbers and letters. This is your title key. Enter this line, without spaces, into the extractor tool, and hit enter. Here's a screenshot showing where the line is (with my Switch's info blurred out using glorious MSPaint, of course): https://i.imgur.com/vdElf7q.png

11. There will be a new Extracted_NCA folder in your PST folder. Enter it, and go into the romfs folder. Inside is a fully-working copy of PST that you can play immediately - just click the executable!

 

[Cirosan]

To clarify why we can't just use nxdumptool to dump PST directly, PST is contained in a separate .nca entirely - nxdumptool only reads the one which contains IWD, d1c43deccb5096702a0f76e134504a24.nca. PST is in 9be0fae3033f019baa8966cf3d77751a.nca. However, DarkMatterCore contacted me before I made this post to help him test a fix that would make nxdumptool dump PST directly, so a more convenient solution is hopefully around the corner.

 

[anhminh]

So can we use this to make PC game run on switch?

 

[Cirosan]

So can we use this to make PC game run on switch?

Probably not; see my edit at the bottom. Also, since you can already run Windows 95 on a hacked Switch, there's probably not much point. But I suppose there's still a chance this could be used by more knowledgeable folks for something cool, hence why I wanted to come forward with it.

 

[masagrator]

PST titleid is 010030B00C316001
IWD Has 000 at the end
And this is not only game that has leftovers from PC - Dies Irae after installing OpenAL Has exe for debugging that can run whole game. But for correct encoding you need to change locale to Japanese.
Amnesia Collection also contains exe iirc, but it has steam DRM.

Only game that we know is emulating x86 code is Final Fantasy VIII - but it's not using exe.
Definitely no current game emulates Windows exe entirely.

 

[MAN-biker]

...since you can already run Windows 95 on a hacked Switch...

I have no luck with Win95 on Switch. Yes, the Win95 boots and "works" (with sound and 256\16&32bit colors), but I can't run any real game (tested Jazz JackRabbit2 and DropMania) because of some errors.
Can anybody help me with that?
Sorry for offtopic and my broken English.

 

[Mythical]

PST titleid is 010030B00C316001
IWD Has 000 at the end
And this is not only game that has leftovers from PC - Dies Irae after installing OpenAL Has exe for debugging that can run whole game. But for correct encoding you need to change locale to Japanese.
Amnesia Collection also contains exe iirc, but it has steam DRM.

Only game that we know is emulating x86 code is Final Fantasy VIII - but it's not using exe.
Definitely no current game emulates Windows exe entirely.

You can get a copy of the amnesia games and penumbra games from humble bundles trove. They're all drm free also

 

[RHOPKINS13]

I'm sure the .exe file is just sitting there, and not actually being used as an executable on the Switch, although it's possible that they're pulling other resources from it.

But perhaps we can use the Switch executable to run other Infinity Engine games just by swapping out the assets. That would be interesting.

 

[cearp]

I'm sure the .exe file is just sitting there, and not actually being used as an executable on the Switch, although it's possible that they're pulling other resources from it.

But perhaps we can use the Switch executable to run other Infinity Engine games just by swapping out the assets. That would be interesting.

an easy way to check - delete it/replace it with a blank file as a game patch, and see if the game still works
i'd be surprised if the exe was actually being used too

 

[chartube12]

Wouldn’t this be the case for the other two d&d games as well as the xbox and playstation versions? They were all ported by one company

 

[Jiehfeng]

Impressive find.

 

[Cirosan]

an easy way to check - delete it/replace it with a blank file as a game patch, and see if the game still works
i'd be surprised if the exe was actually being used too

Thanks to DarkMatterCore's insights, I've checked this now and can confirm that the .exe doesn't appear to be used. It's likely a leftover from development, but that's just bizarre to me since 1. it's in the damn root folder 2. it's been there since release and none of the three updates since have removed it.

Silver lining, though: this game's files were what helped DarkMatterCore figure out what the IDOffset field in the cmnt .xml was for, and they'll be updating nxdumptool to extract these kinds of multi-NCA games.

 

[Mythical]

Thanks to DarkMatterCore's insights, I've checked this now and can confirm that the .exe doesn't appear to be used. It's likely a leftover from development, but that's just bizarre to me since 1. it's in the damn root folder 2. it's been there since release and none of the three updates since have removed it.

Silver lining, though: this game's files were what helped DarkMatterCore figure out what the IDOffset field in the cmnt .xml was for, and they'll be updating nxdumptool to extract these kinds of multi-NCA games.

They should probably remove the .exe then. I hope they don't though

 

[lordelan]

https://i.imgur.com/oJxHIZ2.png

Nice song you're listening there my friend.

 

[DarkMatterCore]

I have already implemented the necessary changes to make nxdumptool be able to deal with titles with multiple programs, but they need to be tested. If anyone owns the game and wishes to help me out, please feel free to get in touch with me. Thanks in advance.