Misc Save Data Decrypting Help

[HPR]

Hey all, I've made this account since I've tried to find an answer for my problem, but nothing really works. So, I had an old 3DS that I broke (It was homebrewed with CFW if that makes a difference) and I wanted to import my saves from a game that I put more then a few hours on. I've found out I need to decrypt them somehow, but I don't really know how exactly.

There's a 3ds save tool (cant post the link since I'm a newbie ), I don't know anything about python to run it myself though, and I can't find any other solutions for the problem.
To conclude, any help for my little problem here would be massively appreciated!
P.S, I lost the movable.sed after it broke and since your friend code (your personal one) doesn't sinc with your NNID from what I know, I can't generate a new one...

 

[Kwyjor]

P.S, I lost the movable.sed after it broke and since your friend code (your personal one) doesn't sinc with your NNID from what I know, I can't generate a new one...

If you don't have your movable.sed, then you are SOL. 3ds-save-tool is not going to help you, since 3ds-save-tool either requires your movable.sed or data that is otherwise decrypted.

How exactly did you "lose" your movable.sed? You have your SD card with your save data; is it not on there? You can also extract it from a NAND backup or from essential.exefs, if you have either of those on your SD card. You can also generate it from a Mii QR code created on the system, if you happen to have one.

Otherwise, your only option is to contact someone who has exchanged Friend codes with you before your system broke. The other unit needs to have your Mii in its Friend list; the Friend code alone will not help you.

Also, how broken is your system? If you can still boot into Godmode9, then you can easily get your movable.sed that way.

 

[HPR]

Broken broken.
But yea, I’ll look into what you suggested, it’ll be a few.

 

[HPR]

Well drat, I homebrewed it back in March 2020, I didn’t do much with it, and when it broke recently I don’t have any of the sorts.
No NAND backup, the movable.sed is most probably gone as well, I’ll continue looking but it’s not looking bright for me :/

 

[HPR]

Well drat, I homebrewed it back in March 2020, I didn’t do much with it, and when it broke recently I don’t have any of the sorts.
No NAND backup, the movable.sed is most probably gone as well, I’ll continue looking but it’s not looking bright for me :/

Considering the file was on my PC at some point, I may be able to recover it though.

 

[HPR]

Well, my trail came up cold….
I still have my micro SD card with my ID0 on it, but man.
I put so many hours on that game, kinda sad really…
And I also never friended anyone except that bot I used for the movable.sed.
Which I HIGHLY doubt will help me.
Well, I guess that’s it then :/
It’s kinda sad I have the save file, but it’s just blocking me

 

[HPR]

Well, my trail came up cold….
I still have my micro SD card with my ID0 on it, but man.
I put so many hours on that game, kinda sad really…
And I also never friended anyone except that bot I used for the movable.sed.
Which I HIGHLY doubt will help me.
Well, I guess that’s it then :/

If anyone else from the future has another idea, I’m glad to try it as well!

 

[Kwyjor]

You know, you can wait until you have something meaningful to say rather than making five posts all at once. Or you can just edit your last post to add additional details.

If you followed https://3ds.guide when you installed CFW, you were supposed to make a NAND backup at the end. If you followed a random Youtube video, well, that's why people suggest following https://3ds.guide and not random Youtube videos.

There's really nothing more to say unless you can think of somewhere you might have stored that data. Or unless you want to elaborate on "broken broken".

You can try submitting your ID0 and your Friend code again to https://bfm.nintendohomebrew.com/ . I know in some cases it will tell you that your seed has already been mined and prompt you to download it again, but I don't know how long it keeps data. (Probably not that long.)

 

[HPR]

You know, you can wait until you have something meaningful to say rather than making five posts all at once. Or you can just edit your last post to add additional details.

If you followed https://3ds.guide when you installed CFW, you were supposed to make a NAND backup at the end. If you followed a random Youtube video, well, that's why people suggest following https://3ds.guide and not random Youtube videos.

There's really nothing more to say unless you can think of somewhere you might have stored that data. Or unless you want to elaborate on "broken broken".

You can try submitting your ID0 and your Friend code again to https://bfm.nintendohomebrew.com/ . I know in some cases it will tell you that your seed has already been mined and prompt you to download it again, but I don't know how long it keeps data. (Probably not that long.)

Sorry, I’m new to this thing and I don’t know how it works around here :/
Though yea, I followed a YouTube video, and I never realized how dumb that was until it was too late…

Though, for all intensive purposes I think my friend code is lost.
Unless my friend code on the old system is the same one on this system because I’d NNID (which I’m pretty sure is not the case)
Then it’s game over.
When I tried using the ID0 and the friend code on my current 3ds, it just stalled, so I quit to find other solutions.

 

[Kwyjor]

No, NNID is completely unrelated to Friend code.

You can call up Nintendo, tell them that your old system broke, and that you want to use your NNID on a new system. But that only matters if you bought things on the eShop that you want to download from the eShop again.

 

[HPR]

I already did that, my eshop games are safe, but not their save files unfortunately.

Well, crap.
Thanks for trying but I should of been more careful on how I go about with homebrewing
(Hell this isn’t the first time I’ve done something dumb like that, but oh well)
Lucky I’ve taken precautions this time so it shouldn’t happen again

Though, again thank you for trying to help, really appreciate it!

 

[KleinesSinchen]

Thanks for trying but I should of been more careful on how I go about with homebrewing
(Hell this isn’t the first time I’ve done something dumb like that, but oh well)
Lucky I’ve taken precautions this time so it shouldn’t happen again

Well (save) data loss because of breaking a system isn't exactly related to being careless with homebrew software; unless you broke the system on software side and then there is always a way back with ntrboot (I know of no 3DS malware, but it is possible to bring the console to a point where ntrboot won't work). Hardware damage on a 3DS which has never seen homebrew/CFW is more likely to lead to permanent (save)data loss. Data recovery from encrypted devices (also smartphones) usually means that the broken device has to be revived to the point where it turns on and does the decryption. A 3DS with CFW is actually the easier case as have direct access to the keys – which was never intended.

Or unless you want to elaborate on "broken broken".

This is the important question. Even in case the console got run over by a truck: If GodMode9 was used to embed essentials.exefs into the NAND (and Format System Memory wasn't used after this) it is theoretically enough if the NAND chip survived. It will require some serious skill to read it out if the motherboard is completely shot (no idea where to even start).

If you ever find the movable.sed (or to be more precise KeyY) for decrypting, you can send it to me in PM together with the save – I have 3ds-save-tool set up and should hopefully be able to extract the data then.

I know that my signature looks cynical when replying to threads like this. This is unintentional. My intention is to bring people to the point that they realize the importance of backups. This time is was "just" a savegame with some importance for you. Next time it might be irreplaceable personal memories (some people are attached to photos like those of their children, have thousands of pictures in a phone and get a nervous breakdown when the phone shatters after dropping on concrete and doesn't turn on anymore).

In any case:

Good luck!

 

[Kwyjor]

If GodMode9 was used to embed essentials.exefs into the NAND (and Format System Memory wasn't used after this) it is theoretically enough if the NAND chip survived.

Isn't movable.sed (or movable.bin) just sitting there exposed in the NAND and available for access even if one never used Godmode9?

 

[KleinesSinchen]

Isn't movable.sed (or movable.bin) just sitting there exposed in the NAND and available for access even if one never used Godmode9?

If the device turns on and has B9S (or is ntrboot'ed) into GodMode9 you have full access to everything. The crypto-engine will decrypt(reading) and encrypt(writing) NAND contents on the fly – like it always does in normal operation without any CFW. So yes, if it turns on, movable.sed is right waiting there to be copied. The problem comes when the console doesn't turn on.

One could - with a totally busted motherboard beyond repair – theoretically desolder the NAND and read it with some hardware dumper (no idea how to exactly do this though). The resulting encrypted image should open just fine in ninfs… but only if GodMode9 embedded the OTP into NAND. How should we get the OPT from a non-CFW console that doesn't turn on anymore? The image is just garbage data without the key.

In any case it is more a theoretical possibility. The tools and skills to desolder the NAND without damage probably aren't very common (and the question is if this is worth paying somebody for trying).

 

[HPR]

Well (save) data loss because of breaking a system isn't exactly related to being careless with homebrew software; unless you broke the system on software side and then there is always a way back with ntrboot (I know of no 3DS malware, but it is possible to bring the console to a point where ntrboot won't work). Hardware damage on a 3DS which has never seen homebrew/CFW is more likely to lead to permanent (save)data loss. Data recovery from encrypted devices (also smartphones) usually means that the broken device has to be revived to the point where it turns on and does the decryption. A 3DS with CFW is actually the easier case as have direct access to the keys – which was never intended.


This is the important question. Even in case the console got run over by a truck: If GodMode9 was used to embed essentials.exefs into the NAND (and Format System Memory wasn't used after this) it is theoretically enough if the NAND chip survived. It will require some serious skill to read it out if the motherboard is completely shot (no idea where to even start).

If you ever find the movable.sed (or to be more precise KeyY) for decrypting, you can send it to me in PM together with the save – I have 3ds-save-tool set up and should hopefully be able to extract the data then.

I know that my signature looks cynical when replying to threads like this. This is unintentional. My intention is to bring people to the point that they realize the importance of backups. This time is was "just" a savegame with some importance for you. Next time it might be irreplaceable personal memories (some people are attached to photos like those of their children, have thousands of pictures in a phone and get a nervous breakdown when the phone shatters after dropping on concrete and doesn't turn on anymore).

In any case:

Good luck!

To answer your questions
1. The motherboard is dead, no way to access system memory. Period. The NAND is dead.
2. I honestly did the bare minimum with homebrew, I followed a tutorial that just for home-brew, and not CFW. I Did the CFW on my own, and I didn't realize I should of made a backup, though godmode9 *was* installed, I doubt I launched it sadly... (I found it on the SD card if you're wondering)

Isn't movable.sed (or movable.bin) just sitting there exposed in the NAND and available for access even if one never used Godmode9?

Wait, that might be there then, I can't access my 3DS SD card for a few hours, though when I can I will check for that. If it's there then I might be able to get the movable.bin then.

 

[HPR]

To answer your questions
1. The motherboard is dead, no way to access system memory. Period. The NAND is dead.
2. I honestly did the bare minimum with homebrew, I followed a tutorial that just for home-brew, and not CFW. I Did the CFW on my own, and I didn't realize I should of made a backup, though godmode9 *was* installed, I doubt I launched it sadly... (I found it on the SD card if you're wondering)

Wait, that might be there then, I can't access my 3DS SD card for a few hours, though when I can I will check for that. If it's there then I might be able to get the movable.bin then.

If the device turns on and has B9S (or is ntrboot'ed) into GodMode9 you have full access to everything. The crypto-engine will decrypt(reading) and encrypt(writing) NAND contents on the fly – like it always does in normal operation without any CFW. So yes, if it turns on, movable.sed is right waiting there to be copied. The problem comes when the console doesn't turn on.

One could - with a totally busted motherboard beyond repair – theoretically desolder the NAND and read it with some hardware dumper (no idea how to exactly do this though). The resulting encrypted image should open just fine in ninfs… but only if GodMode9 embedded the OTP into NAND. How should we get the OPT from a non-CFW console that doesn't turn on anymore? The image is just garbage data without the key.

In any case it is more a theoretical possibility. The tools and skills to desolder the NAND without damage probably aren't very common (and the question is if this is worth paying somebody for trying).

Never mind then, well dead end I guess.
I'll still look if I can find my old friend code on some unopened.txt file, but from my searching, I couldn't find the old movable.sed sadly.

The only way I could theoretically retrieve my friend code (if not somewhere on my computer) is through the bot on Brute-force Movable, but that is a very hard "theoretically"

Now that I think about it though, when I searched through my folders on the SD card, I remember finding a "movable.bin.next(?) I think, but from what you've said, that shouldn't do anything :/


I mean, even If I could contact the website hoster of Bruteforce Movable, I'd doubt it keeps a record of all the brute force ID0's and friend codes, though.

Though if I reach a dead end on this, the good news is I've already backed up everything on my "new" 3DS, so there's some good news I assume.

 

[HPR]

Never mind then, well dead end I guess.
I'll still look if I can find my old friend code on some unopened.txt file, but from my searching, I couldn't find the old movable.sed sadly.

The only way I could theoretically retrieve my friend code (if not somewhere on my computer) is through the bot on Brute-force Movable, but that is a very hard "theoretically"

Now that I think about it though, when I searched through my folders on the SD card, I remember finding a "movable.bin.next(?) I think, but from what you've said, that shouldn't do anything :/


I mean, even If I could contact the website hoster of Bruteforce Movable, I'd doubt it keeps a record of all the brute force ID0's and friend codes, though.

Though if I reach a dead end on this, the good news is I've already backed up everything on my "new" 3DS, so there's some good news I assume.

After tugging through my memory about where I might of left my movable.sed, I recall reading something about this where the Bruteforce Moveable prompts the download instead of brute forcing it again with the same friend code/ID0, I will test this myself with my New 3DS, and if I confirm it, I may be able to ask the guy who runs the bots if the bot is still connected to my old friend code, and go from there.

Isn't movable.sed (or movable.bin) just sitting there exposed in the NAND and available for access even if one never used Godmode9?

Though if I manage to solve this with the movable.bin that may or may not be there, and may or may not work, I could manage to tangle my way into recovering my save however.

Anyways, I'll update ya'll when I get the chance to access my SD card again.

 

[HPR]

Update, in the gm9 folder, I have something called a "seddb.bin.here, I don't know if that was a temporary file or not, it might be helpful however, though I can't be sure with my fairly limited knowledge on this subject

Though, in the end this was a worthwhile experience for me, and because of this I backed up alot of stuff, mostly unrelated to my 3DS in general.

 

[HPR]

Also to clarify

Well (save) data loss because of breaking a system isn't exactly related to being careless with homebrew software

Back when I first homebrewed in 2020, I kinda accidentally deleted my Nintendo 3DS folder because of the horrid wording of the tutorial I used (You could of been more clear in your language Mr. "Jack Sorrel") And I lost all my data on my downloaded games, (which is most of my library mind you)
Though, because of that, I rarely used my 3DS, and only put sizeable hours into a single game, which is the one I want to be decrypted. That's a whole 'nother personal can of worms however though, so that's why I have minimal care for a single save.
Even though I did put a few hours into it, it's not comparable to the first "Tragedy" I experienced.

Though to conclude, thank you both for your help if I can't bring this excapade further, and It did help me realize how important backups are.

P.S I don't know why I didn't learn that message back then but oh well...

 

[Kwyjor]

The resulting encrypted image should open just fine in ninfs… but only if GodMode9 embedded the OTP into NAND. How should we get the OPT from a non-CFW console that doesn't turn on anymore? The image is just garbage data without the key.

Are you saying that even though the NAND is encrypted, when Godmode9 embeds stuff into the NAND, then that particular embedded data is decrypted? I've never really been clear on that – it seems so strange, because it's a dead giveaway that Godmode9 was run on the 3DS, and hardly anyone is likely to go through the hassle of reading the NAND from a dead 3DS. Or so I would think.

-----

The only way I could theoretically retrieve my friend code (if not somewhere on my computer) is through the bot on Brute-force Movable, but that is a very hard "theoretically"

If by this you mean trying to get in touch with a human being behind bruteforcemovable, then I don't think I would bother.

Now that I think about it though, when I searched through my folders on the SD card, I remember finding a "movable.bin.next(?) I think, but from what you've said, that shouldn't do anything :/

I don't know what makes you think that? That sounds exactly like the sort of file that might have been produced by bruteforcemovable. I can't imagine what else it would be. Try opening it in Notepad and look for the word "SEED".

I recall reading something about this where the Bruteforce Moveable prompts the download instead of brute forcing it again with the same friend code/ID0

You mean you recall reading that in the other post I made in this thread? ;-)

I have something called a "seddb.bin.here, I don't know if that was a temporary file or not,

That's just something that tells you where to put seeddb.bin, if you need it.

Anyways, I'll update ya'll when I get the chance to access my SD card again.

Like I said: before you write a post, why don't you just stop and wait until you have all the information you need? Making a whole bunch of unnecessary posts just makes it harder to help you.