Hacking r4decrypt

iamwhoiam · May 16, 2007

Just in case anyone missed it from this thread

chishm has released his R4 decryption program to decrypt the dat files (cheat.dat and the firmware file, _DS_MENU.DAT)

You can also use it to encrypt back the files, so e.g... you can use this program to encrypt usrcheat.dat into cheat.dat so you don't need to use a blank cheat.dat

You can find it here

Original thread at gbadev

Usage:

QUOTE(D-Trogh @ May 16 2007 said:
Noo.. You don't need to execute the file !

Go to Start - Run , cmd and hit OK go to the folder where the .exe and your .bat are..
First go to your homedirectory with 'cd\' and then use 'cd foldername' to go to your folders.. for example: cd Desktop
(For long foldernames you can do this too: cd Desk*)
Ones you're in the folder use these commands to de- and encrypt:
- Decrypt: r4crypt.exe -d _DS_MENU.DAT OUTPUT.DAT
- Encrypt: r4crypt.exe -e OUTPUT.DAT _DS_MENU.DAT
HEX-Edit the OUTPUT.DAT file or use TileMolester for the pictures..

Batch file for easier usage:

QUOTE(D-Trogh @ May 16 2007 said:

For some of you that don't know how to work with cmd I made this .BAT file.
Just copy and paste this in NotePad and save under 'All Files' as: NameOfYourChoose.BAT

QUOTE(bugmenot52 @ May 17 2007 said:

The obvious update to the batch file. Can now convert between CHEAT.DAT and USRCHEAT.DAT

Code:

@echo off cls :menu echo --------------------- echo Â Â Action Menu echo --------------------- echo [1] Decrypt Firmware echo [2] Encrypt Firmware echo [3] Decrypt Cheats echo [4] Encrypt Cheats echo [5] Close echo --------------------- echo. set INPUT= Set /P INPUT= Action: if "%input%" =="" goto menu if "%input%" =="1" goto decryptf if "%input%" =="2" goto encryptf if "%input%" =="3" goto decryptc if "%input%" =="4" goto encryptc if "%input%" =="5" goto close :decryptf r4crypt.exe -d _DS_MENU.DAT OUTPUT.DAT goto close :encryptf r4crypt.exe -e OUTPUT.DAT _DS_MENU.DAT goto close :decryptc r4crypt.exe -d CHEAT.DAT USRCHEAT.DAT goto close :encryptc r4crypt.exe -e USRCHEAT.DAT CHEAT.DAT goto close :close cls

Click to expand...

Like this you don't need to work with cmd, just make sure you put _DS_MENU.DAT, r4crypt.exe and this .BAT file in the same folder !
Then execute the .BAT file !

For you guys who want to see the images in TileMolester:
View - Codec - 16bpp ABGR
View - Mode - 2-Dimensional

Click to expand...

MaHe · May 16, 2007

This tool is _AMAZING_. I encrypted the FlashME binary to _DS_MENU.DAT and it worked perfectly (booted with FlashME v8's recovery mode). Also, DSOrganize can now be used as a bootloader and since de-encrypted _DS_MENU.DAT is just a .NDS binary, you can still keep it on the card.

Hats off to you chishm, you never fail to amaze us.

.TakaM · May 16, 2007

I still get the same error

edit-
got it working I think, put the _DS_MENU.dat in the same directory
now to figure out how to use this

edit-
can someone prnt screen what they see when they open the decrypted _DS_MENU.DAT in tilemolester?

iamwhoiam · May 16, 2007

How on earth did he figure it out? How did he get the output from the R4?

D-Trogh · May 16, 2007

For some of you that don't know how to work with cmd I made this .BAT file.
Just copy and paste this in NotePad and save under 'All Files' as: NameOfYourChoose.BAT

QUOTE said:
@echo off
cls
:menu
echo -------------
echoÂ Action Menu
echo -------------
echo [1] Decrypt
echo [2] Encrypt
echo [3] Close
echo -------------
echo.
set INPUT=
Set /P INPUT= Action:

if "%input%" =="" goto menu
if "%input%" =="1" goto decrypt
if "%input%" =="2" goto encrypt
if "%input%" =="3" goto close

:decrypt
r4crypt.exe -d _DS_MENU.DAT OUTPUT.DAT
goto close

:encrypt
r4crypt.exe -e OUTPUT.DAT _DS_MENU.DAT
goto close

:close
cls

Like this you don't need to work with cmd, just make sure you put _DS_MENU.DAT, r4crypt.exe and this .BAT file in the same folder !
Then execute the .BAT file !

For you guys who want to see the images in TileMolester:
View - Codec - 16bpp ABGR
View - Mode - 2-Dimensional

.TakaM · May 16, 2007

aha, 16bpp ABGR, thanks

edit
AHA, found the soft reset and sun icons

D-Trogh · May 16, 2007

QUOTE(iamwhoiam @ May 16 2007 said:
How on earth did he figure it out? How did he get the output from the R4?

I wish I knew !

But.. You can check the source.. so maybe you'll get it then

QUOTE(.TakaM @ May 16 2007 said:

aha, 16bpp ABGR, thanks

edit
AHA, found the soft reset and sun iconsÂ

Click to expand...

No problem

Now.. let's edit those damn icons

khan · May 16, 2007

After I de-encrypt _MENU_.DAT, Which app do I need to use to get rid of those ugly Brightness/Reset buttons?

Pedro UK · May 16, 2007

Sorry for my ignorance but what is the point of this? Does it have any uses for us ordinary folk or is it something for coders? Maybe for custom firmwares etc?

.TakaM · May 16, 2007

I'm gonna upload some _DS_MENU.DAT's tommorrow with new icons n stuff.. I've got the hang of how all this works now

and I bet eventually, the R4DS team will come out with a new firmware where you can just replace .bmps's

-EX- · May 16, 2007

Can you remove the hardware check with this? In order to run Chinese firmware and M3DSS firmware? Or vice versa.

iamwhoiam · May 16, 2007

I should think so...

QUOTE(chishm @ Tue May 15 said:
They are identical except for the hardware check, brand name, and menu graphics.

iamwhoiam · May 16, 2007

...or not:

chishm said:
The entire dumper is needed to bring the DS card to its "normal" state. To be honest, I'm a little tired of holding back the DS card code to prevent its evil uses. I'll try it out when I have the time and if I can bring the R4 to a usable state upon reinsertion then I'll seriously consider releasing the DS card code.

iamwhoiam · May 17, 2007

QUOTE(.TakaM @ May 16 2007 said:
I'm gonna upload some _DS_MENU.DAT's tommorrow with new icons n stuff.. I've got the hang of how all this works now

and I bet eventually, the R4DS team will come out with a new firmware where you can just replace .bmps's

How's this going TakaM?

This could potentially be a way to customise the entire system. Although moving the icons will take some time to figure out

.TakaM · May 17, 2007

yeah, I thought I would have done something lol.
the thing is, I'm sitting here, staring at the icons and I can't think of what I would rather have..

not that I like the current icons, I just can't think of anything I'd rather have

edit
oh and btw, the default skin is in there, so for the few people that can't get fan-made skins displaying on their R4, they can change it with this.
I kinda want to change everything, for like a specific skin...

maybe for my first one I will...

D-Trogh · May 17, 2007

QUOTE(.TakaM @ May 17 2007 said:
oh and btw, the default skin is in there, so for the few people that can't get fan-made skins displaying on their R4, they can change it with this.
I kinda want to change everything, for like a specific skin...

Yeah.. I thought of that before.. but I think this will cost pallete editing..

And that's hard..

Well.. ones you know where the colors are stored it isn't.. but.. you know

lafleche · May 17, 2007

Perhaps some clever guy or girl will
- find out to make POR running on every micro sd-card?
- find out to make also the latest 'problem' games running on the R4 (even before the R4 team does)?

and also hope that some idiot won't release a version which bricks the DS....'cause that is my greatest fear... unless this forum 'installs' some kind of QA on private firmware for the time being I will stay far away from non official firmware

iq_132 · May 17, 2007

QUOTE(-EX- @ May 16 2007 said:
Can you remove the hardware check with this? In order to run Chinese firmware and M3DSS firmware? Or vice versa.

Most definitely.
M3 software hacked to run on R4 hardware (tested)
R4 Chinese hacked to run on R4 English hardware (tested)
R4 software hacked to run on M3 hardware (untested)
btw, you must delete _DS_MENU.sys it contains a partial backup of this file.

Please, someone with an M3 test the second one.
Also, I'll try and see if I can come up with a generic way of patching out the hardware lock-out & fixing the file loading, also, I'll try and see what I can do with the chinese builds too. ^^

btw, if this breaks any rules, sorry :S

iamwhoiam · May 17, 2007

Where did they originate from?

iq_132 · May 17, 2007

Me. You can decrypt them and check the diffs if you'd like. There's ~12 bytes changed from the original files.

Hacking r4decrypt

Honorary R4 Fanboy

one lazy schmo

.II

Honorary R4 Fanboy

Well-Known Member

.II

Well-Known Member

Well-Known Member

Well-Known Member

.II

Racer

Honorary R4 Fanboy

Honorary R4 Fanboy

Honorary R4 Fanboy

.II

Well-Known Member

Well-Known Member

Well-Known Member

Honorary R4 Fanboy

Well-Known Member

Similar threads

Popular threads in this forum