Hacking [Release] PlaiCDN: Download and create installable CIAs (or .3ds) with just a title ID and titlekey

cearp

瓜老外
Developer
Joined
May 26, 2008
Messages
8,725
Trophies
2
XP
8,510
Country
Tuvalu
Figured as much, so both methods (converting 3DS>CIA and CDN with this tool) would create a dirty ticket. However this can be rectified by deleting the ticket for said application?
fbi can delete tickets, but i'm not sure if they remnants of the nonlegit data will truly be wiped out eventually... i haven't tested.
but without a ticket, content will not work. (i never tested but... i assume so!)
 

demon77

Well-Known Member
Newcomer
Joined
May 4, 2015
Messages
62
Trophies
0
Age
54
XP
169
Country
Belgium
So is there a way to make a seeddb.bin file using the title ID and the seed? Because that seems like all you should need, and yet I have no idea how to make it. Trying to reverse seedconv right now because the process seems so simple

Here you can download the latest one : https://gbatemp.net/threads/release...-6-ncch-encryption.399809/page-5#post-6253547

And here was a script for downloading the seedb.bin : https://gbatemp.net/threads/release...-6-ncch-encryption.399809/page-4#post-6141823
 

cearp

瓜老外
Developer
Joined
May 26, 2008
Messages
8,725
Trophies
2
XP
8,510
Country
Tuvalu
also, another big problem in this, the decrypted keys which people use with this tool will be incorrect if they are from 'bad' cias.
and this program creates those 'bad' cias, so this program is just cycling round this incorrectness, the more people who use this, the more people who will be sharing incorrect title keys.
does anyone see what i mean?
 

gamesquest1

Nabnut
Former Staff
Joined
Sep 23, 2013
Messages
15,153
Trophies
2
XP
12,247
yeah it would ake more sense to make a fake ticket maker script and share the encrypted title keys, iirc there is already a ticket installer so it would mean people could simply install all the tickets they want, then go raid the eshop on their system and retrieve the booty, no decryption, no repacking, you could even just make a full ticket DB package like the update packs what has every ticket for every game of each region allowing people to just bulk install all tickets at one time and then have free reign of the eshop as and when they feel with no PC requirement
 

demon77

Well-Known Member
Newcomer
Joined
May 4, 2015
Messages
62
Trophies
0
Age
54
XP
169
Country
Belgium
also, another big problem in this, the decrypted keys which people use with this tool will be incorrect if they are from 'bad' cias.
and this program creates those 'bad' cias, so this program is just cycling round this incorrectness, the more people who use this, the more people who will be sharing incorrect title keys.
does anyone see what i mean?

Yes that is right, but when you use PlaiCDN.exe -checkbin or -check , then you only will see if the titlekey is good.

-check : checks if title id matches key
-checkbin : checks titlekeys from decTitleKeys.bin
 

redunka

Well-Known Member
Member
Joined
Nov 26, 2014
Messages
432
Trophies
0
Age
29
XP
2,554
Country
Russia
also, another big problem in this, the decrypted keys which people use with this tool will be incorrect if they are from 'bad' cias.
and this program creates those 'bad' cias, so this program is just cycling round this incorrectness, the more people who use this, the more people who will be sharing incorrect title keys.
does anyone see what i mean?
Yup, it will be hard to know if shared cia has good title key or not.
Using tickets with proper (and encrypted) title keys for making cia is much better.
Less decryption=less sig breaking=clearer output.
 
  • Like
Reactions: cearp

cearp

瓜老外
Developer
Joined
May 26, 2008
Messages
8,725
Trophies
2
XP
8,510
Country
Tuvalu
yeah it would ake more sense to make a fake ticket maker script and share the encrypted title keys, iirc there is already a ticket installer so it would mean people could simply install all the tickets they want, then go raid the eshop on their system and retrieve the booty, no decryption, no repacking, you could even just make a full ticket DB package like the update packs what has every ticket for every game of each region allowing people to just bulk install all tickets at one time and then have free reign of the eshop as and when they feel with no PC requirement
yes, if plai had made this script, this would be worthwhile.
it's really not difficult - have a ticket template. fill in the title id, and the encrypted title key. (notice the encrypted title key, from the ticket, no decryption necessary)
add a little more stuff, i forget, it has been a while :) then just do what FunkyCIA does.
these CIAs would be fine, redownloadable, much better than this method. i won't add it because i'm lazy to code it but really i want people to hare the cias rather than the keys.
not trying to pick a fight, but it seems the OP doesn't really know what is going on and understand the whole thing, i saw on 3dsiso he was sharing title keys for legit cias...
come on... how useless is that? the thing that is legit about those preinstalled cias is the ticket lol. i find it hard to take this seriously after i saw that :D
it just comes off as a noob who had an idea, thought it was a good idea, took someone else's script and changed it a bit :(

the metadata from cdn IS a cool feature, but similar to what relys said, it doesn't warrant a separate entity.
 
Last edited by cearp,

gamesquest1

Nabnut
Former Staff
Joined
Sep 23, 2013
Messages
15,153
Trophies
2
XP
12,247
yeah the decrypted title key does serve some purpose as checking the legitimacy of the key before downloading anything is cool.....but then if people hadn't been sharing bad keys in the first place then there wouldn't really have been any bad keys floating about, tbh not that i have looked but i read there is a huge decrypted titlekey db on certain sites....ultimately the best setup would be a decrypted and encrypted key pair, the decrypted titlekey to use if the user wants to pull metadata, generate a .3ds file and to verify the key pair
and the encrypted for generating a "authentic" cia or dummy ticket

basically the best of both worlds
 
Last edited by gamesquest1,
  • Like
Reactions: redunka and cearp

cearp

瓜老外
Developer
Joined
May 26, 2008
Messages
8,725
Trophies
2
XP
8,510
Country
Tuvalu
yeah the decrypted title key does serve some purpose as checking the legitimacy of the key before downloading anything is cool.....but then if people hadn't been sharing bad keys in the first place then there wouldn't really have been any bad keys floating about, tbh not that i have looked but i read there is a huge decrypted titlekey db on certain sites....ultimately the best setup would be a decrypted and encrypted key pair, the decrypted titlekey to use if the user wants to pull metadata, generate a .3ds file and to verify the key pair
and the encrypted for generating a "authentic" cia or dummy ticket

basically the best of both worlds
when making FunkyCIA i should have added some (optional) code to upload the keys/tickets to my server.
but then i would have to worry about people attacking my server, sending fake data, i'm sure some people would lol. just to spoil the fun. too late now.
actually, what we need is a 3ds tool to upload the keys, very easy for the user.
 

pikatsu

Well-Known Member
Member
Joined
Apr 16, 2014
Messages
845
Trophies
0
Age
39
XP
1,163
Country
Argentina
The whole story will be recycled over and over again untill ticket.db will be fully cracked

--------------------- MERGED ---------------------------

when making FunkyCIA i should have added some (optional) code to upload the keys/tickets to my server.
but then i would have to worry about people attacking my server, sending fake data, i'm sure some people would lol. just to spoil the fun. too late now.
actually, what we need is a 3ds tool to upload the keys, very easy for the user.

Or some sort of filter on the database to discart the fake data (maybe complicated in terms of resources)
 

Ptrk25

Well-Known Member
Member
Joined
Sep 6, 2015
Messages
524
Trophies
0
Location
::1
XP
1,181
Country
Germany
when making FunkyCIA i should have added some (optional) code to upload the keys/tickets to my server.
but then i would have to worry about people attacking my server, sending fake data, i'm sure some people would lol. just to spoil the fun. too late now.
actually, what we need is a 3ds tool to upload the keys, very easy for the user.

I was planning something similar for GroovyCIA2 too :P
But only for CIA decryption.
 

Plailect

Well-Known Member
OP
Member
Joined
Jan 30, 2016
Messages
546
Trophies
1
XP
1,502
Country
United States
ooh yeah i just realized when i looked at the code on gitbhub... the cias this makes will not be good...
because the contents are decrypted in order to make the cia.
so, if you then want to get the same thing from the eshop, you will have problems because you will have a dirty ticket.
i think you will get that 99% error, because the stuff you download from eshop will be trying to be decrypted with the incorrect key.
if you guys really want to use keys and not share full tickets... then why aren't you sharing the encrypted key and using this to build the cia?
let the 3ds do the decryption... don't do it on the computer.
it's faster, cleaner, shorter... you will build a cleaner cia that will have the same hash each time (unlike the cias from makerom lol)

this is why i made FunkyCIA, so that we could have and share 'perfect'/'nearly perfect' cias, that won't cause any problems. you can redownload them from eshop.. etc. but your cias... no :( it's not good for the community i believe. noobs don't really understand and just use the shiny new tool.

@Plailect - why did you choose to do it this way?

That's not even close to how that works....

All content files (the 000000 etc files) from the eshop are encrypted twice. First is the NCCH that's the inner layer of encryption, encrypted with multiple different methods depending on version, including bootrom keys and seeddb on some titles, and then there's the outer layer of encryption on the entire thing as it is on the CDN, which can only be decrypted with a titlekey (one per game) that has been decrypted with keys we don't have.

The process for getting a usable NCCH (still encrypted though) is to get the encrypted titlekey from the ticket, decrypt the titlekey with the ticket common-key keyslot (keyY is selected from an index into a plaintext array of 6 keys stored in Process9; more info on 3dbrew), then use the decrypted titlekey to decrypt the contents from the CDN, then decrypt the NCCH on device.

What the hell does "the cias this makes will not be good" even mean?
The ticket obviously won't be signed because Nintendo didn't sign it, so we will need signature checks patched out, but that applies to literally ALL non "legit" CIAs (ones signed for all devices in cetk form from a preloaded console).

"ideally we would have dumped eshop games, but that means someone has to buy it and dump it."
This line alone gives away to me that you're not understanding how any of this works...

--------------------- MERGED ---------------------------

yes, if plai had made this script, this would be worthwhile.
it's really not difficult - have a ticket template. fill in the title id, and the encrypted title key. (notice the encrypted title key, from the ticket, no decryption necessary)
add a little more stuff, i forget, it has been a while :) then just do what FunkyCIA does.
these CIAs would be fine, redownloadable, much better than this method. i won't add it because i'm lazy to code it but really i want people to hare the cias rather than the keys.
not trying to pick a fight, but it seems the OP doesn't really know what is going on and understand the whole thing, i saw on 3dsiso he was sharing title keys for legit cias...
come on... how useless is that? the thing that is legit about those preinstalled cias is the ticket lol. i find it hard to take this seriously after i saw that :D
it just comes off as a noob who had an idea, thought it was a good idea, took someone else's script and changed it a bit :(

the metadata from cdn IS a cool feature, but similar to what relys said, it doesn't warrant a separate entity.

"it's really not difficult - have a ticket template. fill in the title id, and the encrypted title key. (notice the encrypted title key, from the ticket, no decryption necessary)"

That's exactly what makerom does....

A CIA is nothing but an NCCH container and a (in this case fake because it's not signed) ticket, which is made by makerom when it's packaging things together...
 

dankzegriefer

Banned!
Banned
Joined
Aug 19, 2015
Messages
896
Trophies
0
Age
40
XP
560
Country
United States
also, another big problem in this, the decrypted keys which people use with this tool will be incorrect if they are from 'bad' cias.
and this program creates those 'bad' cias, so this program is just cycling round this incorrectness, the more people who use this, the more people who will be sharing incorrect title keys.
does anyone see what i mean?
If it created bad CIAs then how the hell do they work on my machine(tm)?
 

Kev63

Member
Newcomer
Joined
Oct 30, 2010
Messages
22
Trophies
0
Age
36
Location
Lyon (69)
XP
558
Country
France
Sorry if I bother you guys but I'm wondering why some games aren't downloadable. I try to download MGS Snake Eater 3D (EUR) but when I put titlekey and titleid but I get this error:
Code:
Content ID:  00000000
Content Index: 0000
Content Size:  3331162112
Content Hash:  c0a70f3b98dce1289c17e6186f3f7303366633df615d36a7816b8ab688c04d06
Traceback (most recent call last):
  File "<string>", line 429, in <module>
  File "urllib\request.py", line 162, in urlopen
  File "urllib\request.py", line 471, in open
  File "urllib\request.py", line 581, in http_response
  File "urllib\request.py", line 509, in error
  File "urllib\request.py", line 443, in _call_chain
  File "urllib\request.py", line 589, in http_error_default
urllib.error.HTTPError: HTTP Error 403: Forbidden
PlaiCDN returned -1

Any idea?

When I use the command -check, I get this:
Code:
Content ID:  00000000
Content Index: 0000
Content Size:  3331162112
Content Hash:  c0a70f3b98dce1289c17e6186f3f7303366633df615d36a7816b8ab688c04d06

Downloading and decrypting the first 272 bytes of 00000000 for key check

ERROR: Possibly wrong container?

Content ID:  00000001
Content Index: 0001
Content Size:  3801088
Content Hash:  76ef409afbae88aaf3efa3c287157ebd33a83908e6a339a6b52ca574b8564ac2

Downloading and decrypting the first 272 bytes of 00000001 for key check

Title Name: Metal Gear Solid: Snake Eater 3D
Region: ALL
Product Code: CTR-P-AMGP

Titlekey successfully verified to match title ID 0004000000082400

Is it a problem with PlaiCDN, with the titlekey or the Nintendo servers?


EDIT: I'm stupid, I thought I already got the latest version! Sorry :-(...
 
Last edited by Kev63,

dankzegriefer

Banned!
Banned
Joined
Aug 19, 2015
Messages
896
Trophies
0
Age
40
XP
560
Country
United States
It doesn't make *bad* CIAs, just ones that aren't signed by Nintendo.

They work because your CFW patches out the signature checks.
So then it's not stupid? And anyone who complains is dumb, because if you don't have CFW how the hell did you get correct titlekeys that would work anyway?
 

Plailect

Well-Known Member
OP
Member
Joined
Jan 30, 2016
Messages
546
Trophies
1
XP
1,502
Country
United States
Sorry if I bother you guys but I'm wondering why some games aren't downloadable. I try to download MGS Snake Eater 3D (EUR) but when I put titlekey and titleid but I get this error:
Code:
Content ID:  00000000
Content Index: 0000
Content Size:  3331162112
Content Hash:  c0a70f3b98dce1289c17e6186f3f7303366633df615d36a7816b8ab688c04d06
Traceback (most recent call last):
  File "<string>", line 429, in <module>
  File "urllib\request.py", line 162, in urlopen
  File "urllib\request.py", line 471, in open
  File "urllib\request.py", line 581, in http_response
  File "urllib\request.py", line 509, in error
  File "urllib\request.py", line 443, in _call_chain
  File "urllib\request.py", line 589, in http_error_default
urllib.error.HTTPError: HTTP Error 403: Forbidden
PlaiCDN returned -1

Any idea?

When I use the command -check, I get this:
Code:
Content ID:  00000000
Content Index: 0000
Content Size:  3331162112
Content Hash:  c0a70f3b98dce1289c17e6186f3f7303366633df615d36a7816b8ab688c04d06

Downloading and decrypting the first 272 bytes of 00000000 for key check

ERROR: Possibly wrong container?

Content ID:  00000001
Content Index: 0001
Content Size:  3801088
Content Hash:  76ef409afbae88aaf3efa3c287157ebd33a83908e6a339a6b52ca574b8564ac2

Downloading and decrypting the first 272 bytes of 00000001 for key check

Title Name: Metal Gear Solid: Snake Eater 3D
Region: ALL
Product Code: CTR-P-AMGP

Titlekey successfully verified to match title ID 0004000000082400

Is it a problem with PlaiCDN, with the titlekey or the Nintendo servers?
Use the latest version.

--------------------- MERGED ---------------------------

So then it's not stupid? And anyone who complains is dumb, because if you don't have CFW how the hell did you get correct titlekeys that would work anyway?
Correct.
 
  • Like
Reactions: Kev63

Xenosaiga

Time to switch it up
Member
Joined
Oct 9, 2015
Messages
1,501
Trophies
0
Age
33
Location
The Shadows
XP
1,070
Country
United States
The TL;DR edition. This takes titlekeys, and uses this "Password" to download the game. Then you place the .Dec files on SD to be decrypted by the 3DS.

This means the game is "Unsigned and unlocked". Meaning the game does not have a "Purchased by ID" and is "as close to a purchased game as possible" meaning it can be used on any CFW.

@Plailect correct me if I'm wrong but isn't that pretty much the "Dumbed down" answer?

(not implying anybody is dumb. Just looking for an easier to understand way of explaining)
 

Plailect

Well-Known Member
OP
Member
Joined
Jan 30, 2016
Messages
546
Trophies
1
XP
1,502
Country
United States
The TL;DR edition. This takes titlekeys, and uses this "Password" to download the game. Then you place the .Dec files on SD to be decrypted by the 3DS.

This means the game is "Unsigned and unlocked". Meaning the game does not have a "Purchased by ID" and is "as close to a purchased game as possible" meaning it can be used on any CFW.

@Plailect correct me if I'm wrong but isn't that pretty much the "Dumbed down" answer?

(not implying anybody is dumb. Just looking for an easier to understand way of explaining)

Barring some oversimplifications, yes that's a decent analogy, but the main thing is that there isn't so much a password to download the games (they're publicly available to anyone) but there is a password to decrypt the game into usable format, which is only given to legit customers.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Maximumbeans @ Maximumbeans: butte