Hacking OK I've figured out the encryption sakura 1.34

Styles420 · Jan 23, 2009

I'll check it out in a bit - I admit that the thought crossed my mind but I've been dismissing it so far because the beta is contained in one .nds file... but I just thought of something, using dslazy to extract the contents of the nds, maybe I'll find matching functions in the arm7 and arm9 files... Thanks for the inspiration!

deviant.zero · Jan 23, 2009

Thanks for that D3! Heres the 1.34 2nd Edition version of the messages.936.

http://sharebee.com/63c5ef73

Oh and btw, do you mean how the firmware comes in a single .exe? I had one of those from handheldsources, but now I download my firmware from http://www.linfoxdomain.com/nintendo/ds/ which leaves it as a zipped folder. But yea, I think it releases abit slower than handheldsources.

Densetsu · Jan 23, 2009

deviant.zero said:
Thanks for that D3! Heres the 1.34 2nd Edition version of the messages.936.

http://sharebee.com/63c5ef73

Oh and btw, do you mean how the firmware comes in a single .exe? I had one of those from handheldsources, but now I download my firmware from http://www.linfoxdomain.com/nintendo/ds/ which leaves it as a zipped folder. But yea, I think it releases abit slower than handheldsources.

Cool, thanks for the file

And yeah, that's exactly what I was talking about with the .exe file. But thanks for the tip about Linfox Domain, I'll check there next time I need any Sakura-related files.

I'll see if I can't fix the messages.936 problem, then I'll have you test it out on your card. If everything checks out OK, I'll post it. Be back in a few minutes

*EDIT*
Sorry, got sidetracked. Finally added HD service to our satellite today in preparation for the complete switchover from analog to HDTV here in the US next month, and I was mesmerized by the picture on my TV for a few minutes

Well, more than a few

Ahem. Here's the file. deviant.zero, could you please check it on your cart for me? Thanks!

Styles420 · Jan 23, 2009

To those of you daring enough to mess with hex code, I'm stuck on something - It's become clear that 0x00d0 - 0x00df in the headers of every region file (*.jp etc.) have unique values. I believe they are offsets of some type, but haven't been able to identify any pattern. They could also be encoded values, but if so then they don't follow the same XOR pattern. If anyone has any ideas, please share.

deviant.zero · Jan 23, 2009

Interesting result D3! I just tried with that file and once I tried to access the start menu, the top screen turned black and the bottom screen is now frozen. In other words, I can't access that menu with 1/2 Toggle, Restore Wallpaper etc. Btw, I can still access the app launcher.

Densetsu · Jan 23, 2009

Whoops, I just noticed that the file is twice as large as the original message.936 file you sent me! I think I may have inadvertently pasted all of the lines into the file twice! I'll be back after I open them both and see what I did wrong. Sorry about that!

*EDIT*
Nope, I was wrong about pasting the lines twice. It turns out that I saved the file as Unicode when I should've saved it as UTF-8. Anyway, I think this should work now. If you still have problems, let me know.

deviant.zero · Jan 23, 2009

Yup, works this time. But it still says Simplified Chinese, Traditional Chinese and Korean as the three language options. Did you forget to change that?

Densetsu · Jan 23, 2009

deviant.zero said:
Yup, works this time. But it still says Simplified Chinese, Traditional Chinese and Korean as the three language options. Did you forget to change that?

What happens when you select each one?

deviant.zero · Jan 23, 2009

Very interesting... I had my language set on simp chinese originally, then I replaced it with the file you game me D3, then it was still on simp chinese. So I tried chaning to trad chinese, which changed to trad chinese, to korean, changed to korean properly, but then when I tried to change back to simp chinese, it just froze. Bottom screen frozen and top screen black.

EDIT: Just tried restarting my DS. Turned it on, and it was set to Korean, so i changed it to simp chinese, and now its back to English. Weird

BTW!! Has anyone noticed that the skin also changes when you change language?! I never realized until just then haha.

Densetsu · Jan 23, 2009

deviant.zero said:
Very interesting... I had my language set on simp chinese originally, then I replaced it with the file you game me D3, then it was still on simp chinese. So I tried chaning to trad chinese, which changed to trad chinese, to korean, changed to korean properly, but then when I tried to change back to simp chinese, it just froze. Bottom screen frozen and top screen black.

EDIT: Just tried restarting my DS. Turned it on, and it was set to Korean, so i changed it to simp chinese, and now its back to English. Weird

BTW!! Has anyone noticed that the skin also changes when you change language?! I never realized until just then haha.

I'll PM you so as to not hijack this thread. I think I've derailed this topic

Let's bring this thread back to talking about removing the region lock, sorry for the digression!

Styles420 · Jan 23, 2009

I just noticed this - the first part of the old (1.12) g6dsload.jp has been moved to homebrew.jp in 1.34 (which probably eliminates homebrew.jp from the region locked list, I will compare 1.12 jp to 1.12 eng to confirm)

I'm going to continue to look for parts of other files to try to determine just what has been moved where - it may turn out that most of the code itself is unchanged, just relocated. If that's the case, then it should allow me to rule out parts of the new code in order to isolate the parts we need. Fingers crossed!

(I will edit this post with the addresses and filenames of matching sections as I find them, so check back - I will also make new posts periodically to let you all know that I've added info)

LD560 · Jan 24, 2009

Amazing how much work you guys are putting into this I

to your abilites, and hope you succeed.

Sumea · Jan 24, 2009

i m looking into this, even though my way to boicot M3 now is borrowing it to friend, use CycloDS, and forget it for some time, my revenge on what happened to moonlight

Anywaves, if i get my friend who is not Flashcart savvy somehow install it (i think i need to make a flow chart for it though) i will make him test it out.

idc · Jan 24, 2009

JereTHEend said:
my revenge on what happened to moonlight

Please forgive me for living under a rock for quite some time, but what actually happened with Moonlight and M3?

gosp · Jan 24, 2009

idc said:
JereTHEend said:

my revenge on what happened to moonlight

Click to expand...

Please forgive me for living under a rock for quite some time, but what actually happened with Moonlight and M3?

Moonlight developed Sakura and M3 didn't pay him.

Styles420 · Jan 24, 2009

I thought we'd determined that we don't know that for sure

Anyway, I've been taking a bit of a break (and I had to work), but I think I might be on to something again... finally getting a bit of disassembly that seems to make sense, and uses the header as I would expect it should. I'm taking my time so as not to lose sanity from staring at the code so much, but I think I'm getting closer to tracking down the pieces of this puzzle... More to come, I hope

Frederica Bernkastel · Jan 24, 2009

Styles420 said:
I thought we'd determined that we don't know that for sure

Anyway, I've been taking a bit of a break (and I had to work), but I think I might be on to something again... finally getting a bit of disassembly that seems to make sense, and uses the header as I would expect it should. I'm taking my time so as not to lose sanity from staring at the code so much, but I think I'm getting closer to tracking down the pieces of this puzzle... More to come, I hope

You deserve to be on the M3 Sakura english credits!

Thanks for finding ths, I'm going to look into it over the rest of the weekend. Maybe I'll be helpful, maybe not...

Styles420 · Jan 24, 2009

Antoligy said:
Styles420 said:

I thought we'd determined that we don't know that for sure

Anyway, I've been taking a bit of a break (and I had to work), but I think I might be on to something again... finally getting a bit of disassembly that seems to make sense, and uses the header as I would expect it should. I'm taking my time so as not to lose sanity from staring at the code so much, but I think I'm getting closer to tracking down the pieces of this puzzle... More to come, I hope

Click to expand...

You deserve to be on the M3 Sakura english credits!

Thanks for finding ths, I'm going to look into it over the rest of the weekend. Maybe I'll be helpful, maybe not...

Thanks Ant, but I don't think I've earned it yet - definitely in the running, but not yet at the finish...

I'm feeling more confident about my current disassembly effort, but there is a lot of code to go through before I can determine what part is affected by region. With my luck, the official release will come out on the day I succeed, but I guess that won't be so bad - at least we'll have the new Sakura

*Just had another idea* - has anyone tried comparing the first version of 1.34 to the update with the newer touchpod firmware? As long as the same region is used for both, the differences should be the same as the differences between the two versions of touchpod - which may help to isolate the parts that aren't Sakura, helping us to focus on the parts that are... I don't want to keep jumping from one thought to another, so I won't try this until my current effort runs its course, so if anyone else wants to give it a try, keep us all posted. If no one else gets to it, I'll be sure to share anything I find when I do try it.

cory1492 · Jan 24, 2009

Styles420 said:
Just confirmed the g6dsload.1 is identical between Asian Sakura and touchpod...

Don't be quick to rule out anything due to identical code unless you have access to a debug DS and the PC clients it works with to spot the halts; for instance - the bootstrap that comes in the flash chip of the m3 should be identical for all hardware, setting a hardware jumper in the M3 determines which xor key is used to decrypt the boot file's header which the code in the boot rom checks (I assume the same region check posted as asm before is used in the boot rom) and uses. At some point a bit of data could easily be entered into memory (ie: the ds game header memory are during chainload of the next portion's binary) when changing executables that causes blocks/bytes/whatever of other files to decrypt differently based on the current region response - and that is just a simple way to use memory to compound the region lock when switching binaries (though I'd still start with the assumption some kind of xor is used by M3 coders, they like xor apparently.) Then there are those 4M files they include, which could also be memory dumps or just some type of DAT/munge... anyhoo

Suggestion...? : has anyone tried running this on an emulator that has debug features and supports a virtual file system of some kind? Even if it is ideas with a plugin in combo with something like emuhaste or even just a PC memory dumper? It should get you more to disassemble, at any rate, along with live in mem vars. I imagine there is emu detection code, but that should become apparent and simple enough to nullify on a trace. Since iamanobody hasn't replied, I suspect either this method or just long sessions with IDA and manual code creation was used previously (though again, m3 may have gotten a tad spiteful/devious yet again as they did when a region hack was done on m3perfect.)

Good luck Styles420 and any helpers; if it's needed I have a m3real I can change regions on at will, just not enough time (or incentive on my part) in a day to pursue a hack beyond the few (wasted) hours I put into it already.

edit:/ oh, before I forget: remember, m3team wasting their time (and ours as it does take cycles on the DS processor) on region locking thier hardware as well as software is exactly what you paid them for. GBAMP illustrated this problem, M3perfect proved it, why would it be different now.

Styles420 · Jan 25, 2009

Good point... I just don't know enough about assembly - all of my training was in C and C++, so my assembly "knowledge" is all based on experimentation, and is both incomplete and prone to false guesses. (I'm not giving up though, damnit

)

I've decided to break off from the g6dsload files for a bit to take a fresh look at some of the other files with my new-found understanding of some of the hex code. Has anyone else determined anything definite about, for example, the menu.* files? I've found a lot of text strings in them that seem to pertain more to the areas I had thought should be in the g6dsload file, and if we assume that the files' names mean anything, then it seems logical to me that the menu file would have the code for the menu... (Though I've learned from experience in the real world that a lot of times, if logic seems to apply, it doesn't

)

@SeaofTea, haven't heard from you in a while - been busy with real life? No worries, just wondering if you're having any luck, since all I've been able to find are a bunch of small patterns, still working on how they relate to each other.

EDIT: Went back to a post from Densetsu3000, and he was able to get to the Sakura menu with just the g6dsload.jp and .1 files on his card, so maybe I need to start looking into .1 again... in fact, I should try to look for cross references between the two as well...

UPDATE: I think I have a nearly complete disassembly of g6dsload.1 from JP Sakura 1.34 2nd Edition. Still looking for links to the region lock, but I did see something interesting (which I might have already posted about, forgive me if this is a repeat) - g6dsload.1 contains many strings of text about many functions, but what's interesting is that there are sections in each language - not just JP, Chinese and Eng, but all others as well. I recognized Spanish, French, and references to Turkish, and what I think was German.

I need to figure out whether the JP and GB versions use english fonts for these messages, or their native alphabet. If they don't use english, then that means that some of the other bits of code that were detected as possible strings could be JIS unicode etc. - Which means I may need to isolate them and send them to Densetsu for a translation...

So that's the update at this point... on to more tests...

Hacking OK I've figured out the encryption sakura 1.34

Well-Known Member

Active Member

Pubic Ninja

Well-Known Member

Active Member

Pubic Ninja

Active Member

Pubic Ninja

Active Member

Pubic Ninja

Well-Known Member

Well-Known Member

Disco Ninja Frog

Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum