Hacking Discussion Info on SHA-256 hashes on FS patches

[LyuboA]

Great! You can include it on your AutoIPS thread to be more visible to others. I'll be looking on ES patches also

awesome thanks you and mrdude really change the game for the community

 

[DarkMatterCore]

Do you even need ES patches, what are they for?

They skip the eTicket RSA signature verification. FS + Loader patches skip NCA RSA signature verification.

--------------------- MERGED ---------------------------

Great! You can include it on your AutoIPS thread to be more visible to others. I'll be looking on ES patches also

The filename for ES patches comes from the module/build ID found at 0x40 in the ES main NSO. It's a 0x20 byte-long field, but only 0x14 bytes are used - iirc it's a SHA-1 hash calculated over a section from the NSO while it's being built, and not a full file hash unlike FS patches.

Keep in mind NSOs usually use LZ4 compression - you need to use a NSO decompressor before creating/applying IPS patches:

hactool -t nso --disablekeywarns --uncompressed=main_dec main

 

[DarkMatterCore]

By the way, looking for a specific, extracted file/path won't help you in this case because all ExeFS sections hold at least the main NSO and the main.npdm. You'll really need to check the NCA header or the main.npdm file.

If you go down the NCA header route, you can follow my previous instructions. The byte at 0x205 must match 0x00 (Program NCA) and the unsigned 64-bit integer at 0x210 must match 0x0100000000000033 (ES sysmodule).

If you go down the main.npdm route, the NULL-terminated string at 0x20 must match "es".

 

[ShadowOne333]

@mrdude I tried converting your batch script to bash for Linux, but I am having some weird issues with the for loop.
This is what I have right now:

#! /bin/bash

python3 move.py

for f in ./3meg/*.* ; do
   ./hactool -k keys.bat -t nca --romfsdir=dumped/ 3meg/$f
done

./hactool -k keys.dat -t pk21 dumped/nx/package2 --outdir=dumps/
./hactool -k keys.dat -t ini1 dumps/INI1.bin --outdir=files/

mov 3meg/*.* firmware/
rm -r {3meg,dumps,dumped}

./hactool --intype=kip1 --uncompressed=files/FS-dec.kip1 files/FS.kip1

python3 MakeIPS.py
rm -r files/

sleep 1
exit

And this is the output I get when running the 'for' loop:

unable to open 3meg/./3meg/*.*: No such file or directory

I tried with 3meg/*,*, ../3meg/*.* and other variants, but it always looks inside the 3meg folder for some reason :/
I am also having a LOT of errors with the keys.dat file I have:

Spoiler: keys.dat errors

[WARN]: Failed to match key "bis_kek_source", (value "34c1a0c48258f8b4fa9e5e6adafc7e4f")
[WARN]: Failed to match key "bis_key_00", (value "c66259c0cb1e2872b8b195981304eb4465cb372db26f9dcb1565a17413ee63dc")
[WARN]: Failed to match key "bis_key_01", (value "a02faf7706c4c856b1fc8043d2e82a2f247395365b1294d8b44610073e3ada48")
[WARN]: Failed to match key "bis_key_02", (value "39503299db1688abb419cf451c74d46a7c9bbe79f54cc5490dc746a45ed14010")
[WARN]: Failed to match key "bis_key_03", (value "39503299db1688abb419cf451c74d46a7c9bbe79f54cc5490dc746a45ed14010")
[WARN]: Failed to match key "bis_key_source_00", (value "f83f386e2cd2ca32a89ab9aa29bfc7487d92b03aa8bfdee1a74c3b6e35cb7106")
[WARN]: Failed to match key "bis_key_source_01", (value "41003049ddccc065647a7eb41eed9c5f44424edab49dfcd98777249adc9f7ca4")
[WARN]: Failed to match key "bis_key_source_02", (value "52c2e9eb09e3ee2932a10c1fb6a0926c4d12e14b2a474c1c09cb0359f015f4e4")
[WARN]: Failed to match key "device_key", (value "28fd627b28ae45b6d5522c5227f9122a")
[WARN]: Failed to match key "device_key_4x", (value "25236971d0e132936423761878f0c132")
[WARN]: Failed to match key "eticket_rsa_kek", (value "19c8b441d318802bad63a5beda283a84")
[WARN]: Failed to match key "eticket_rsa_kek_source", (value "dba451124ca0a9836814f5ed95e3125b")
[WARN]: Failed to match key "eticket_rsa_kekek_source", (value "466e57b74a447f02f321cde58f2f5535")
[WARN]: Failed to match key "retail_specific_aes_key_source", (value "e2d6b87a119cb880e822888a46fba195")
[WARN]: Failed to match key "rsa_oaep_kek_generation_source", (value "a8ca938434127fda82cc1aa5e807b112")
[WARN]: Failed to match key "rsa_private_kek_generation_source", (value "ef2cb61a56729b9157c38b9316784ddd")
[WARN]: Failed to match key "save_mac_key", (value "f39e58082f5158bbfbc6fed6dc577bfe")
[WARN]: Failed to match key "save_mac_sd_card_kek_source", (value "0489ef5d326e1a59c4b7ab8c367aab17")
[WARN]: Failed to match key "save_mac_sd_card_key_source", (value "6f645947c56146f9ffa045d595332918")
[WARN]: Failed to match key "sd_card_custom_storage_key_source", (value "370c345e12e4cefe21b58e64db52af354f2ca5a3fc999a47c03ee004485b2fd0")
[WARN]: Failed to match key "sd_card_nca_key", (value "2A34D7A63F1F6C87EA8068E8A67DD66F9637EAFF943686D74F5AB43FCBCEC6DA")
[WARN]: Failed to match key "sd_card_save_key", (value "8F696AEED967F492041CD7DACE7BAFB2F20A25AD13108ED9BAB662A09C28CC86")
[WARN]: Failed to match key "capsrv_hmac_key", (value "287AABF9FED34D4E995CC7BE0D914A3221B9822A45524649B0A2CBCDD4B98E4A")
[WARN]: Failed to match key "sd_seed", (value "48481926189964026f8c6d799af2944b")
[WARN]: Failed to match key "ssl_rsa_kek", (value "b011100660d1dccbad1b1b733afa9f95")
[WARN]: Failed to match key "ssl_rsa_kek_source_x", (value "7f5bb0847b25aa67fac84be23d7b6903")
[WARN]: Failed to match key "ssl_rsa_kek_source_y", (value "9a383bf431d0bd8132534ba964397de3")
[WARN]: Failed to match key "tsec_root_key", (value "E21D3F25BBEA7F52F3CDF88B481BDE9E")
unable to open dumped/nx/package2: No such file or directory
[WARN]: Failed to match key "bis_kek_source", (value "34c1a0c48258f8b4fa9e5e6adafc7e4f")
[WARN]: Failed to match key "bis_key_00", (value "c66259c0cb1e2872b8b195981304eb4465cb372db26f9dcb1565a17413ee63dc")
[WARN]: Failed to match key "bis_key_01", (value "a02faf7706c4c856b1fc8043d2e82a2f247395365b1294d8b44610073e3ada48")
[WARN]: Failed to match key "bis_key_02", (value "39503299db1688abb419cf451c74d46a7c9bbe79f54cc5490dc746a45ed14010")
[WARN]: Failed to match key "bis_key_03", (value "39503299db1688abb419cf451c74d46a7c9bbe79f54cc5490dc746a45ed14010")
[WARN]: Failed to match key "bis_key_source_00", (value "f83f386e2cd2ca32a89ab9aa29bfc7487d92b03aa8bfdee1a74c3b6e35cb7106")
[WARN]: Failed to match key "bis_key_source_01", (value "41003049ddccc065647a7eb41eed9c5f44424edab49dfcd98777249adc9f7ca4")
[WARN]: Failed to match key "bis_key_source_02", (value "52c2e9eb09e3ee2932a10c1fb6a0926c4d12e14b2a474c1c09cb0359f015f4e4")
[WARN]: Failed to match key "device_key", (value "28fd627b28ae45b6d5522c5227f9122a")
[WARN]: Failed to match key "device_key_4x", (value "25236971d0e132936423761878f0c132")
[WARN]: Failed to match key "eticket_rsa_kek", (value "19c8b441d318802bad63a5beda283a84")
[WARN]: Failed to match key "eticket_rsa_kek_source", (value "dba451124ca0a9836814f5ed95e3125b")
[WARN]: Failed to match key "eticket_rsa_kekek_source", (value "466e57b74a447f02f321cde58f2f5535")
[WARN]: Failed to match key "retail_specific_aes_key_source", (value "e2d6b87a119cb880e822888a46fba195")
[WARN]: Failed to match key "rsa_oaep_kek_generation_source", (value "a8ca938434127fda82cc1aa5e807b112")
[WARN]: Failed to match key "rsa_private_kek_generation_source", (value "ef2cb61a56729b9157c38b9316784ddd")
[WARN]: Failed to match key "save_mac_key", (value "f39e58082f5158bbfbc6fed6dc577bfe")
[WARN]: Failed to match key "save_mac_sd_card_kek_source", (value "0489ef5d326e1a59c4b7ab8c367aab17")
[WARN]: Failed to match key "save_mac_sd_card_key_source", (value "6f645947c56146f9ffa045d595332918")
[WARN]: Failed to match key "sd_card_custom_storage_key_source", (value "370c345e12e4cefe21b58e64db52af354f2ca5a3fc999a47c03ee004485b2fd0")
[WARN]: Failed to match key "sd_card_nca_key", (value "2A34D7A63F1F6C87EA8068E8A67DD66F9637EAFF943686D74F5AB43FCBCEC6DA")
[WARN]: Failed to match key "sd_card_save_key", (value "8F696AEED967F492041CD7DACE7BAFB2F20A25AD13108ED9BAB662A09C28CC86")
[WARN]: Failed to match key "capsrv_hmac_key", (value "287AABF9FED34D4E995CC7BE0D914A3221B9822A45524649B0A2CBCDD4B98E4A")
[WARN]: Failed to match key "sd_seed", (value "48481926189964026f8c6d799af2944b")
[WARN]: Failed to match key "ssl_rsa_kek", (value "b011100660d1dccbad1b1b733afa9f95")
[WARN]: Failed to match key "ssl_rsa_kek_source_x", (value "7f5bb0847b25aa67fac84be23d7b6903")
[WARN]: Failed to match key "ssl_rsa_kek_source_y", (value "9a383bf431d0bd8132534ba964397de3")
[WARN]: Failed to match key "tsec_root_key", (value "E21D3F25BBEA7F52F3CDF88B481BDE9E")
unable to open dumps/INI1.bin: No such file or directory
./run.sh: line 12: mov: command not found
unable to open files/FS.kip1: No such file or directory
ERROR files/FS-dec.kip1 does not exist.

It seems like the keys from my Switch are bad for some reason?
I don't have firmware 11.0.1 installed though, not sure if that one added new keys.

 

[DarkMatterCore]

for f in ./3meg/*.* ; do
   ./hactool -k keys.bat -t nca --romfsdir=dumped/ 3meg/$f
done

/hactool -k keys.dat -t pk21 dumped/nx/package2 --outdir=dumps/
./hactool -k keys.dat -t ini1 dumps/INI1.bin --outdir=files/

* Change your wildcard into "./3meg/*.nca".
* Rename "keys.bat" to "keys.dat".
* Remove the trailing slashes in "dumped/", "dumps/" and "files/".
* Remove the leading "3meg/" from the last hactool argument. Also, use double quotes to enclose $f.
* The input file should always be the last command line argument for hactool, and just like with the previous point, it should be enclosed within double quotes. Update your script accordingly.

I am also having a LOT of errors with the keys.dat file I have

This is expected behaviour. Lockpick_RCM dumps more keys than what hactool supports. This is exactly why I always use the "--disablekeywarns" argument with hactool.

--------------------- MERGED ---------------------------

@ShadowOne333 Just updated my previous post again.

 

[ShadowOne333]

* Change your wildcard into "./3meg/*.nca".
* Rename "keys.bat" to "keys.dat".
* Remove the trailing slashes in "dumped/", "dumps/" and "files/".
* Remove the leading "3meg/" from the last hactool argument. Also, use double quotes to enclose $f.
* The input file should always be the last command line argument for hactool. Update your script accordingly.


This is expected behaviour. Lockpick_RCM dumps more keys than what hactool supports. This is exactly why I always use the "--disablekeywarns" argument with hactool.

--------------------- MERGED ---------------------------

@ShadowOne333 Just updated my previous post again.

Oh thanks for those corrections.
I idiotically wrote bat instead of dat for one of the keys, damn haha

I corrected those instances, here's how the script looks now:

#! /bin/bash

python3 move.py

for f in "./3meg/*.nca" ; do
   ./hactool --disablekeywarns -k keys.dat --romfsdir=dumped "$f" -t nca
done

./hactool --disablekeywarns -k keys.dat --outdir=dumps -t pk21 "./dumped/nx/package2"
./hactool --disablekeywarns -k keys.dat --outdir=files -t ini1 "./dumps/INI1.bin"

mv 3meg/* firmware/
rm -r {3meg,dumps,dumped}

./hactool --intype=kip1 --uncompressed=files/FS-dec.kip1 "./files/FS.kip1"

python3 MakeIPS.py
rm -r files/

sleep 1
exit

But I am still getting some errors:

unable to open ./3meg/*.nca: No such file or directory
unable to open dumped/nx/package2: No such file or directory
unable to open dumps/INI1.bin: No such file or directory
mv: cannot stat '3meg/*': No such file or directory
unable to open files/FS.kip1: No such file or directory
ERROR files/FS-dec.kip1 does not exist.

 

[DarkMatterCore]

@ShadowOne333 You're still missing some corrections.

Could you please share a screenshot of your directory tree? Maybe there's something else we're missing.

 

[ShadowOne333]

@ShadowOne333 You're still missing some corrections.

Could you please share a screenshot of your directory tree? Maybe there's something else we're missing.

This is the (2nd) updated script:

#! /bin/bash

python3 move.py

for f in "./3meg/*.nca" ; do
   ./hactool --disablekeywarns -k keys.dat --romfsdir=dumped "$f" -t nca
done

./hactool --disablekeywarns -k keys.dat --outdir=dumps -t pk21 "./dumped/nx/package2"
./hactool --disablekeywarns -k keys.dat --outdir=files -t ini1 "./dumps/INI1.bin"

mv 3meg/* firmware/
rm -r {3meg,dumps,dumped}

./hactool --intype=kip1 --uncompressed=files/FS-dec.kip1 "./files/FS.kip1"

python3 MakeIPS.py
rm -r files/

sleep 1
exit

And here's an image of how I have the files:

 

[DarkMatterCore]

@ShadowOne333 Well, that's the issue, you have no "3meg" directory with NCA files in the same directory where the bash script is being executed from.

 

[ShadowOne333]

@ShadowOne333 Well, that's the issue, you have no "3meg" directory with NCA files in the same directory where the bash script is being executed from.

The move.py script is supposed to create those.
I commented out the line that removes all the folders (rm -r {}) just to be sure, and now I still get the same output:

unable to open ./3meg/*.nca: No such file or directory
unable to open ./dumped/nx/package2: No such file or directory
unable to open ./dumps/INI1.bin: No such file or directory
mv: cannot stat '3meg/*.nca': No such file or directory
unable to open ./files/FS.kip1: No such file or directory
ERROR files/FS-dec.kip1 does not exist.

The folders are already there.

It could be that maybe the script isn't doing a thing with the NCA files at all?
Not sure what hactool is supposed to do in that instance.

 

[DarkMatterCore]

@ShadowOne333 I don't really know what the "move.py" script is supposed to do, so it's hard for me to tell if there's anything wrong with it. I updated the script on my own to change some stuff around and temporarily comment out the mv and rm lines. The second line forces the terminal to change the working directory to the one where the bash script is stored.

#! /bin/bash
cd "$(dirname "${BASH_SOURCE[0]}")"

python3 move.py

for f in ./3meg/*.nca; do
    ./hactool -t nca -k keys.dat --disablekeywarns --romfsdir=./dumped "$f"
done

./hactool -t pk21 -k keys.dat --disablekeywarns --outdir=./dumps "./dumped/nx/package2"
./hactool -t ini1 -k keys.dat --disablekeywarns --outdir=./files "./dumps/INI1.bin"

#mv 3meg/* firmware/
#rm -r {3meg,dumps,dumped}

./hactool -t kip1 --uncompressed=./files/FS-dec.kip1 "./files/FS.kip1"

python3 MakeIPS.py
#rm -r files/

read -p "Press any key to finish ..."

The for loop alone works fine for me.

 

[mrdude]

@ShadowOne333 I don't really know what the "move.py" script is supposed to do.

It creates the required folders, then it moves all files that are between 3-4 megabytes from the firmware to the 3meg folder. This speeds up the process of dumping the files as less files are extracted. It works fine on windows, I haven't tried it on Linux, you will need to mod that file as required. You can test it's working by just running it alone - see if it creates the needed folders, and moves the files. It could be this bit:

import os, maybe os commands in the script are different in Linux from what they are in Windows.

 

[DarkMatterCore]

It creates the required folders, then it moves all files that are between 3-4 megabytes from the firmware to the 3meg folder. This speeds up the process of dumping the files as less files are extracted. It works fine on windows, I haven't tried it on Linux, you will need to mod that file as required. You can test it's working by just running it alone - see if it creates the needed folders, and moves the files. It could be this bit:

import os, maybe os commands in the script are different in Linux from what they are in Windows.

mkdir -p 3meg dumped dumps files

for f in ./firmware/*.nca; do
    ncasize="$(wc -c < "$f")"
    ncaname="$(basename "$f")"

    if [[ $ncasize -lt 3145728 ] || [ $ncasize -gt 4194304 ]]; then
        continue
    fi

    mv "$f" "./3meg/$ncaname"
done

That should be enough to replace the move.py script.

 

[mrdude]

mkdir -p 3meg dumped dumps files

for f in ./firmware/*.nca; do
    ncasize="$(wc -c < "$f")"
    ncaname="$(basename "$f")"

    if [[ $ncasize -lt 3145728 ] || [ $ncasize -gt 4194304 ]]; then
        continue
    fi

    mv "$f" "./3meg/$ncaname"
done

That should be enough to replace the move.py script.

Thanks, also changing the sizes to this:
if (3145728 < getsize < 3450000): # set min and max sizes between 3-4 megabytes

This makes if faster, as less files are shifted and extracted. I tested from firmware 10.0.4-11.0.1 and never had any issues. Speed was drastically increased for older fimwares.

 

[ShadowOne333]

I think I got it to run. This is the script I have:

#! /bin/bash
cd "$(dirname "${BASH_SOURCE[0]}")"

mkdir -p 3meg dumped dumps files

for f in ./firmware/*.nca; do
   ncasize="$(wc -c < "$f")"
   ncaname="$(basename "$f")"

   if [ $ncasize -lt 3145728 ] || [ $ncasize -gt 3450000 ]
   then
       continue
   fi

   mv "$f" "./3meg/$ncaname"
done

for f in ./3meg/*.nca; do
   ./hactool -t nca -k keys.dat --disablekeywarns --romfsdir=./dumped "$f"
done

./hactool -t pk21 -k keys.dat --disablekeywarns --outdir=./dumps "./dumped/nx/package2"
./hactool -t ini1 -k keys.dat --disablekeywarns --outdir=./files "./dumps/INI1.bin"

#mv 3meg/* firmware/
#rm -r {3meg,dumps,dumped}

./hactool -t kip1 --uncompressed=./files/FS-dec.kip1 "./files/FS.kip1"

python3 MakeIPS.py
#rm -r files/

read -p "Press any key to finish ..."

Although, I am not sure I got the correct IPS.
First off, I get this message as the first line after running it:

unable to open ./3meg/*.nca: No such file or directory

Is that normal?
After that, it does show each file and process and all, and I get an IPS patch with the name E1EA16B6BD82F185230BBBBE8B01D190946CF5D6B7BF5DF575F28066532E49DC.ips for 11.0.1, which doesn't seem to be included in iTotalJustice's repository.
I checked the latest sigpatches, and I cannot find such an IPS.
I checked and it patches address 0xE3544 with Hex values [1F 20 03 D5]

Is that one correct?

 

[mrdude]

I think I got it to run. This is the script I have:

#! /bin/bash
cd "$(dirname "${BASH_SOURCE[0]}")"

mkdir -p 3meg dumped dumps files

for f in ./firmware/*.nca; do
   ncasize="$(wc -c < "$f")"
   ncaname="$(basename "$f")"

   if [ $ncasize -lt 3145728 ] || [ $ncasize -gt 3450000 ]
   then
       continue
   fi

   mv "$f" "./3meg/$ncaname"
done

for f in ./3meg/*.nca; do
   ./hactool -t nca -k keys.dat --disablekeywarns --romfsdir=./dumped "$f"
done

./hactool -t pk21 -k keys.dat --disablekeywarns --outdir=./dumps "./dumped/nx/package2"
./hactool -t ini1 -k keys.dat --disablekeywarns --outdir=./files "./dumps/INI1.bin"

#mv 3meg/* firmware/
#rm -r {3meg,dumps,dumped}

./hactool -t kip1 --uncompressed=./files/FS-dec.kip1 "./files/FS.kip1"

python3 MakeIPS.py
#rm -r files/

read -p "Press any key to finish ..."

Although, I am not sure I got the correct IPS.
First off, I get this message as the first line after running it:

unable to open ./3meg/*.nca: No such file or directory

Is that normal?
After that, it does show each file and process and all, and I get an IPS patch with the name E1EA16B6BD82F185230BBBBE8B01D190946CF5D6B7BF5DF575F28066532E49DC.ips for 11.0.1, which doesn't seem to be included in iTotalJustice's repository.
I checked the latest sigpatches, and I cannot find such an IPS.
I checked and it patches address 0xE3544 with Hex values [1F 20 03 D5]

Is that one correct?

Latest firmware IPS should be:
E399156E844EB0AA3CC5152979961C879F5E90696C1224A1BBE0FF1BCDBFD7DC.ips

Contents inside it should be:
50 41 54 43 48 0E 30 14 00 04 1F 20 03 D5 45 4F 46

 

[ShadowOne333]

Latest firmware IPS should be:
E399156E844EB0AA3CC5152979961C879F5E90696C1224A1BBE0FF1BCDBFD7DC.ips

Contents inside it should be:
50 41 54 43 48 0E 30 14 00 04 1F 20 03 D5 45 4F 46

There's something weird.
The one you mention is for 11.0.0, yet that one's without exFat.
There's no mention of 11.0.1 at all in neither the patches.ini nor the IPS patches.

I tried running the script I have for the 11.0.0 firmware as well, and I got the patch for the exFat version, which is 0BA15BB304B50563, but I didn't get the one without exFat, which is the one you posted.

Also, I wanted to ask, does it save up the text required for adding it into the patches.ini for Hekate somewhere?

 

[DarkMatterCore]

hactool v1.4.0 segfaults while parsing package2. I had to build the latest commit from source, just in case.

 

[ShadowOne333]

hactool v1.4.0 segfaults while parsing package2. I had to build the latest commit from source, just in case.

I did build my binary from the latest source iirc.

 

[DarkMatterCore]

Latest firmware IPS should be:
E399156E844EB0AA3CC5152979961C879F5E90696C1224A1BBE0FF1BCDBFD7DC.ips

Contents inside it should be:
50 41 54 43 48 0E 30 14 00 04 1F 20 03 D5 45 4F 46

Working fine here. This is the script I'm using atm - I slightly simplified it.

#! /bin/bash
cd "$(dirname "${BASH_SOURCE[0]}")"

mkdir -p dumped dumps files

for f in ./firmware/*.nca; do
    ncasize="$(wc -c < "$f")"
    ncaname="$(basename "$f")"

    if [ $ncasize -lt 3145728 ] || [ $ncasize -gt 3450000 ]; then
        continue
    fi

    echo Found "$ncaname" with size "$ncasize"

    ./hactool -t nca -k ./keys.dat --disablekeywarns --romfsdir=./dumped "$f" &> /dev/null
done

{
    ./hactool -t pk21 -k ./keys.dat --disablekeywarns --outdir=./dumps ./dumped/nx/package2
    ./hactool -t ini1 -k ./keys.dat --disablekeywarns --outdir=./files ./dumps/INI1.bin
    ./hactool -t kip1 -k ./keys.dat --disablekeywarns --uncompressed=./files/FS-dec.kip1 ./files/FS.kip1
} &> /dev/null

#mv 3meg/* firmware/
#rm -r {3meg,dumps,dumped}

python3 MakeIPS.py
#rm -r files/

read -p "Press any key to finish ..."

This is the output from the terminal window:

Found 0fd89afc0d0f1ee7021084df503bcc19.nca with size 3327488
Found 295926145fbd59982228a9c90f28c064.nca with size 3420160
Found 2ce2f151943a80fc719bd4179d7f6270.nca with size 3286528
Found 5c24763e70d04b110b25cddb1ad79c4c.nca with size 3430912
Found e399b2e4b955c41a211176371478e728.nca with size 3268608

IPS Offset patch address: 0xE3014
Press any key to finish ...