ROM Hack [Tutorial] How to Decrypt, Extract & Rebuild 3DS|CIA|CXI Files

Anton299 · May 14, 2015

Asia81 said:
my bad, i linked you an old makerom.

Try this latest 32 build, very new, just builded :
http://jheberg.net/captcha/makerom-32/

What's so special with all this versions of makerom? Tons of tutorials... and tons of questions.
Why not just share a fully working 32-bit version?

This is 32-bit Makerom by 3DSGuy, v0.13, and it supports -g key for ROM building to be used in Gateway.
(renamed it to makerom_g.exe)
If this is against the rules... well, delete my attachment.

medoli900 · May 15, 2015

I have some trouble rebuilding my Sm4sh rom.
It says :
"[CCi ERROR] Invalid MediaSize: 16GB
[RESULT] Failed to build CCI"

According to gateway rom patcher, Sm4sh does have a memory capacity of 16GB, so I don't know what I am doing wrong.

Edit: Ok, i'm stupid. It worked with 2 GB. Thank you for this tutorial

SinaNgok · May 16, 2015

Could someone tell me how to extract my exheader manually? I'm using the "Without Internet Method" i'm a super noob when it comes to this stuff. Thanks

Asia81 · May 16, 2015

Have you read ?

1) Right-Click ExHeader.bin > Save> Save it to the root of the folder "PackHack" named "EncryptedExHeader.bin" > A message appears, but just click OK.
A "EncryptedExHeader.bin" file is generated.
Don't rename it.

Now open HackingToolkit.bat and enter pad. Read step.

Rename
EncryptedExHeader.bin.out to DecryptedExHeader.bin

done

SinaNgok · May 16, 2015

Asia81 said:
Have you read ?

1) Right-Click ExHeader.bin > Save> Save it to the root of the folder "PackHack" named "EncryptedExHeader.bin" > A message appears, but just click OK.
A "EncryptedExHeader.bin" file is generated.
Don't rename it.

Now open HackingToolkit.bat and enter pad. Read step.

Rename
EncryptedExHeader.bin.out to DecryptedExHeader.bin

done

Sorry, Yea i read, the thing is i'm trying to use SciresM 3dsbuilder, but when i extract the exheader using 3DSexplorer, 3dsbuilder gives me an alert that says "Selected ExHeader is too short. Correct size is 0x800 for ExHeader and AccessDescripter" I was trying to see how to extract the header using ctrtool. Thanks for all your help though

Asia81 · May 16, 2015

Strange, 3DS Builder is working fine for me even with a ExHeader extracted by 3DS Explorer.

but you can extract it with ctrtool with :
ctrtool -x --exheader=EncryptedExHeader.bin Rom.3ds

Deleted User · May 17, 2015

Hi! I'm trying to edit a demo (so it's a CIA, not a 3DS's file). Everything was going well, however now that I have to edit "Other.rsf" I can't find the data that I need to edit the "Other.rsf". What can I do?

(If I open the decrypted CIA with a Hex Editor I can see some useful data, but even like this don't know how to find the data that I need: http://oi61.tinypic.com/fyh8qx.jpg)

Here what I see when I open the CIA with 3DSExplorer: http://oi61.tinypic.com/fkqsty.jpg

Here the exheader.txt:

Code:

Extended header:
Signature:              097BCF327B26B7267A7B94DD8D46470FEC08047A3A87AC7688FEC1F8F0FC1664
                        1878DDC1493AABE5FC80849C5AE964289CB08C5BD4127D158B658D26B7691000
                        5D45ECA8F996D782F8799E41E60B1EEAACF5A795A931BD1B49995DD17AD58E2C
                        8E6E7036F2EA3A76353D830CA18B21C0E3AA75A61F5610A1290C7F1FB99D79C0
                        E15BD222186FEADC6EF18B5F302DA2A0758AAEF34E4D3AFD02286EE0E52E6267
                        B31E3E03FA12EF70BC362DC43AD94426653A780C3334C22D269F67DF89D1FAB8
                        6BF3D7A929399581D9F15A4040AD0358E2BE7DB0F26BBA11C945949BE6DBC604
                        8BE32C9BE489CC2887DDA65C453ABB7A93081671E8230480ECA167680EA9CCF1
 
NCCH Hdr RSA Modulus:  B2C3D4E964C6F4EC2F3279D694354EF2A6731EF284DFB194FEB89B5F2184F454
                        2317647AE04D51BA57E89C22DF83BB1659C72F42A4A1788B583425D56C27A081
                        B166DB8A462320EC098F6F12B15128A8CF892F2386A577F7946F831F6E15B7D6
                        981CC87477F8D4BB2650EA3B927EEFB53888DB7D00C633AEC382D7EB90D16263
                        725EFF8BC5B1DB7FAC7FFE7C8613BDBD6B31BA737D611DA5E6488938AF0278F7
                        9D0DAFBCE647E23FCA7CB6E1CEB2E772096FD9C178C382B316E1878775183927
                        B02673212BD7D59A2218A420654341D83B149D4C5909027D39E3365271BFEADA
                        594F5055EC32F5659D1E43CBC69058761AC907B663278B5DB1388133D68518A5
Name:                  skp2
Flag:                  03 [compressed][sd app]
Remaster version:      0000
Code text address:      0x00100000
Code text size:        0x002A431C
Code text max pages:    0x000002A5 (0x002A5000)
Code ro address:        0x003A5000
Code ro size:          0x000401A0
Code ro max pages:      0x00000041 (0x00041000)
Code data address:      0x003E6000
Code data size:        0x0000FB5C
Code data max pages:    0x00000010 (0x00010000)
Code bss size:          0x0001967C
Code stack size:        0x00004000
Dependency:            0004013000002402
Dependency:            0004013000001502
Dependency:            0004013000003402
Dependency:            0004013000001602
Dependency:            0004013000002602
Dependency:            0004013000001702
Dependency:            0004013000001802
Dependency:            0004013000002702
Dependency:            0004013000002802
Dependency:            0004013000001a02
Dependency:            0004013000003202
Dependency:            0004013000001b02
Dependency:            0004013000001c02
Dependency:            0004013000001d02
Dependency:            0004013000002902
Dependency:            0004013000001e02
Dependency:            0004013000001f02
Dependency:            0004013000002002
Dependency:            0004013000002b02
Dependency:            0004013000003502
Dependency:            0004013000002c02
Dependency:            0004013000002d02
Dependency:            0004013000002102
Dependency:            0004013000003102
Dependency:            0004013000002202
Dependency:            0004013000003702
Dependency:            0004013000002e02
Dependency:            0004013000002302
Dependency:            0004013000002f02
Savedata size:          0x0
Jump id:                00040002000aeb01
Program id:            00040002000aeb01
Core version:          0x2
System mode:            0x0
Ideal processor:        0
Affinity mask:          1
Main thread priority:  48
Ext savedata id:        0x00000000
System savedata id 1:  0x00000000
System savedata id 2:  0x00000000
OtherUserSaveDataId1:  0x00000
OtherUserSaveDataId2:  0x00000
OtherUserSaveDataId3:  0x00000
Accessible Savedata Ids:
Other Variation Saves:  Inaccessible
Access info:            00000000000000
Other attributes:      00
Mapping static address: 0x1FF50000 (RW)
Mapping static address: 0x1FF58000 (RW)
Mapping static address: 0x1FF70000 (RW)
Mapping static address: 0x1FF78000 (RW)
Mapping static address: 0x1F000000 (RO)
Mapping static address: 0x1F600000 (RO)
Kernel flags:       
> Allow debug:        YES
> Force debug:        NO
> Allow non-alphanum:  NO
> Shared page writing: NO
> Privilege priority:  NO
> Allow main() args:  NO
> Shared device mem:  NO
> Runnable on sleep:  NO
> Special memory:      NO
> Memory type:        APPLICATION
Handle table size:      0x200
Kernel release version: 2.30
Allowed systemcalls:    0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08
                        0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10
                        0x11, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19
                        0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21
                        0x22, 0x23, 0x24, 0x25, 0x27, 0x28, 0x29, 0x2A
                        0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32
                        0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C
                        0x3D
Allowed interrupts:    none
ARM9 Desc. version:    0x2
Mount NAND fs:          NO
Mount NAND RO write fs: NO
Mount NAND TWL fs:      NO
Mount NAND W fs:        NO
Mount CARD SPI fs:      NO
Use SDIF3:              NO
Create seed:            NO
Use CARD SPI:          NO
SD Application:        NO
Use Direct SDMC:        NO
Service access:        APT:U
Service access:        $hioFIO
Service access:        $hostio0
Service access:        $hostio1
Service access:        ac:u
Service access:        boss:U
Service access:        cam:u
Service access:        cecd:u
Service access:        cfg:u
Service access:        dlp:FKCL
Service access:        dlp:SRVR
Service access:        dsp::DSP
Service access:        frd:u
Service access:        fs:USER
Service access:        gsp::Gpu
Service access:        hid:USER
Service access:        http:C
Service access:        mic:u
Service access:        ndm:u
Service access:        news:u
Service access:        nwm::UDS
Service access:        ptm:u
Service access:        pxi:dev
Service access:        soc:U
Service access:        ssl:C
Service access:        y2r:u
Service access:        ldr:ro
Reslimit category:      00

Asia81 · May 17, 2015

Here it's not the tutorial about CIA.
And even, i have some troubles for rebuilding CIA, try to use Scire'sM 3DS Builder to rebuild it into a .3ds

Deleted User · May 17, 2015

This tutorial work even with a CIA. Decrypt the CIA with RxTool make everything more easier. The only problem is rebuild the files.
I used this tutorial https://gbatemp.net/threads/how-to-dump-and-backup-eshop-games-and-dlc.375586/ to dump the demo, but to tell the truth I didn't use the file CIA, but the file ".dec" generated in the extraction. So I took the file ".dec", change the extension with ".3ds"and finally use the RxTool to decrypt it.
http://oi58.tinypic.com/20a8knr.jpg

Asia81 said:
Here it's not the tutorial about CIA.
And even, i have some troubles for rebuilding CIA, try to use Scire'sM 3DS Builder to rebuild it into a .3ds

Thanks, but SciresM 3DS Builder didn't work D:

Asia81 · May 19, 2015

Updated

Asia81 · May 19, 2015

Cyan could you rename the thread :

[Tutorial] How to Decrypt, Extract & Rebuild 3DS Roms - Run XY/ORAS Without Update

Thanks, i don't see where i can x)

Cyan · May 20, 2015

Topic title renamed.

Asia81 · May 21, 2015

Thanks

bunny5390 · May 22, 2015

Marvelous work, merci beaucoup!

Would it be possible to have the script use "SciresM's modified RomFS Extractor" mentioned here (sorry, I don't know where the original release thread is) instead of CtrTool to extract the romfs from romfs.bin?

CtrTool breaks files in the romfs if they have unicode characters (like Kanji) in their filenames, so it fails to properly extract the romfs from games like Fire Emblem: Awakening. (CtrTool extracts a romfs.bin file from a dycrypted .3ds perfectly, but breaks when extracting a romfs folder from the romfs.bin file)

Asia81 · May 22, 2015

i will see

bunny5390 · May 22, 2015

Actually, now that I think about it, I'm not sure if the modified romfs extractor accepts command line arguments.

Anyway, here's a guide on repacking Fire Emblem: Awakening for anyone that's interested: http://serenesforest.net/forums/index.php?showtopic=52377&p=3774554

SeanyPooh · May 23, 2015

I need a bit of help when I run rxTools. Whenever I run the website to run rxTools, my web browser crashed and I am returned to the homescreen. I have retried this process countless times. Do I need to be on a specific firmware? I am running 7.2.0-4U. Do I need to have the slot0x25KeyX.bin on my SD card if I am on 7.2.0? I am just so frustrated. If anyone could help me that would be great!

-SeanyPooh

Shin Atomoz · May 23, 2015

I sincerely don't understand how my exheader offset is always 0x400 instead of 0x800...Is there something I'm doing wrong during the whole decryption process?

I am using Asia's guide for this: https://gbatemp.net/threads/tutoria....update.383055/

beester87 · May 24, 2015

Hello, noob here. Would a modified 3DS ROM (of Pokémon ORAS) work with PastaCFW on FW 9.2? Thanks.

Asia81 · May 24, 2015

i don't think, because pasta can only run .cia.
If you can make a CIA of this hackrom, yes, but i don't know how

ROM Hack [Tutorial] How to Decrypt, Extract & Rebuild 3DS|CIA|CXI Files

How is my english?

So bad...

Good, sometimes it's not understandable

Very understandable

Perfect?

Well-Known Member

Attachments

Open the Benzenes;Gate

Member

Yuri Lover ~

Member

Yuri Lover ~

Deleted User

Guest

Yuri Lover ~

Deleted User

Guest

Yuri Lover ~

Yuri Lover ~

GBATemp's lurking knight

Yuri Lover ~

Well-Known Member

Yuri Lover ~

Well-Known Member

Active Member

Member

Active Member

Yuri Lover ~

Similar threads

Popular threads in this forum