Tutorial  Updated

Photo guide to installing DSiWare backups on real hardware and emulator

First, some USEFUL NOTES

Tickets are not actually required by the DSi launcher (this was unknown at the time the above procedure was written), you may skip the related steps

While still incomplete, @MarioMasta64 is working on automating this process for Windows+Python users:
http://gbatemp.net/threads/a-tool-to-make-converting-dsiware-from-3ds-to-dsi-easier.479996/

If you are using an emunand (through Hiya, for example), consider using DSi Title Manager instead; there's no reason it couldn't work on sysnand with minor changes but... it doesn't do that, yet or ever




Steal Acquire some decrypted DSiware apps. You can use Funkeycia, 3DSeStuff, etc the 3DS eShop to legally download them, rip them to cia, then use ctrtool to extract the cia into "contents" = .app (the very newest versions of ctrtool decrypt them during this extraction); alternatively you can use Godmode9 to directly copy the appropriate .app under twln:/title/00030004/* to the SD.
There's also a no-intro catalogue but no romset I know of, officer...

Backup your console's NAND, CID, and ConsoleID using well documented methods (hardmod if you have some DSiware that can be copied to SD, or fwTool+safety mod if you have an usable DSiware exploit - Team Twiizer's original sudokuhax is not suitable #clobberedkeyslots, while fourswordshax and the leaked ugopwn use minitwlpayload).
If you're using NO$GBA with a nand you didn't dump yourself, you can find the CID and the byteswapped ConsoleID by looking at the end of the dump with a hex editor.
1 NOCASHNAND.PNG
(Adding this block is also how you convert a raw backup for use with NO$GBA, just in case you didn't read the manual)

Use TwlTool to decrypt the nand.
2 nand decrypt.PNG

Mount the 1st partition of the decrypted image with OSFMount (Linux equivalent: losetup + mount; Mac equivalent, hdiutil + mount I guess?).
3 osfmount.PNG 4 osfmount.PNG

Pick (any?) ticket from the NAND, preferably from the regular DSiware category = 00030004, and decrypt it with TwlTool. This will be a base for the edited tickets we will make.
5 ticket crypto.PNG

Open the folder with our dumped title. You will find a "content" folder, possibly a "data" folder, and a .ctx file if it came from a 3DS.
Delete it, then go to the content folder.
Remove the "cmd" folder, and the 3DS-format TMD.
6 source.PNG 7 source content.PNG

Search the TMD pack for the full TitleID of the DSiware; copy the TMD to the content folder, renaming it to "title.tmd".
Open title.tmd in a hex editor.
8 tmd.PNG

Find offset 1E7; rename the .app file (better known as .srl or .nds) so that the last 2 digits are the ones written at 1E7.
Find offset 208; delete everything from there to the end of the file. (A small number of tmds are already trimmed).
Save the file.
9 tmd edit.PNG

Open the ticket we decrypted earlier in a hex editor.
Find offset 1DC and replace the next 8 bytes with the TitleID of the app we're installing;
Save the file with a name equal to the TitleID-low of the app.
10 ticket edit.PNG 11 ticket save.PNG

Use TwlTool to encrypt the ticket, and put it into the NAND.
12 ticket crypto.PNG

Copy the title's (content & data) folder to the NAND.
13 app copy.PNG

Unmount the NAND and re-encrypt it.
14 unmount.PNG 15 nand crypt.PNG

If you're using NO$GBA, you will have to re-add the footer since it will have been removed by TwlTool's NAND features.
16 nand footer.PNG

Enjoy your DSiWarez, and if you liked it, BUY THE ORIGINAL... oh wait, they closed the DSi shop
17.PNG 18.PNG
 
Last edited by Ryccardo,

jamezfat

Well-Known Member
Member
Joined
Nov 11, 2016
Messages
223
Trophies
0
Location
Mom's basement
Website
www.rickrolled.fr
XP
787
Country
United States
I'm glad that so much overdue attention is finally being given to the dsi! With two New exploits for opera and flipnote, an understanding on dsiware encryption, and a flipping "cfw" being rocket launcher! I can't say for sure, but I think the dsi has a great road ahead of it!

Ps: major props to all those working on this stuff, this wouldn't happen without you!
 
Last edited by jamezfat,

dpad_5678

Ape weak on own. Ape strong in unity.
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
I'm a little confused. I've seen multiple payload download links and multiple fwTool forks that are supposed to be "safer". Can someone attach the best versions of the payload.dat and fwTool to downgrade to 1.4 and inject 4swordshax/fieldrunnershax/Sudokuhax ? I'd really appreciate it!
 
  • Like
Reactions: siamese

Billy Acuña

Well-Known Member
Member
Joined
Oct 10, 2015
Messages
3,126
Trophies
1
Age
31
XP
3,701
Country
Mexico
I'm a little confused. I've seen multiple payload download links and multiple fwTool forks that are supposed to be "safer". Can someone attach the best versions of the payload.dat and fwTool to downgrade to 1.4 and inject 4swordshax/fieldrunnershax/Sudokuhax ? I'd really appreciate it!
Here the payload you should use with ugopwn, keep in mind it triggers HBMN.NDS instead of BOOT.NDS:
http://gbatemp.net/index.php?posts/7509380

The fork of fwtool with safetly checks:
https://github.com/Nuck-TH/fwTool/releases
 
  • Like
Reactions: Lord_Friky

dpad_5678

Ape weak on own. Ape strong in unity.
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States

Billy Acuña

Well-Known Member
Member
Joined
Oct 10, 2015
Messages
3,126
Trophies
1
Age
31
XP
3,701
Country
Mexico
Ok, awesome, thanks! I noticed, however, the fwTool notes states that it is not compatible with ugopwn. Is that irrelevant because of the use of the "newer" payload (the one that you linked) ?
Yeah, Apache did some changes that the leaked build of the exploit didn't had, but with this payload you can pretty much run newer homebrews hbmenu 0.6.0 and that fork of fwtool.
 

dpad_5678

Ape weak on own. Ape strong in unity.
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
Yeah, Apache did some changes that the leaked build of the exploit didn't had, but with this payload you can pretty much run newer homebrews hbmenu 0.6.0 and that fork of fwtool.
Ok, awesome! Also, which hax game is the best (between fieldrunnershax, Sudokuhax, and 4swordshax)?
 

dpad_5678

Ape weak on own. Ape strong in unity.
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
4swords will be best for boot time, but best homebrew compatibility with a the fastest boot of the rest is compatibility.
I'm most worried about compatibly, more than boot time, as Sudokuhax seems to have pretty decent boot time as well. Would Sudokuhax suffice, compatibly wise?
 

Billy Acuña

Well-Known Member
Member
Joined
Oct 10, 2015
Messages
3,126
Trophies
1
Age
31
XP
3,701
Country
Mexico
Ok, awesome! Also, which hax game is the best (between fieldrunnershax, Sudokuhax, and 4swordshax)?
4swordshax is superior almost un every way since it boots homebrew in ~1 sec, but it does not support nds-bootstrap since this one does not like the minitwlpayload, so for nds-bootstrap usage I recommend fieldrunnershax or sudokuhax. I personally use both sudokuhax and 4swordshax.
 

dpad_5678

Ape weak on own. Ape strong in unity.
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
4swordshax is superior almost un every way since it boots homebrew in ~1 sec, but it does not support nds-bootstrap since this one does not like the minitwlpayload, so for nds-bootstrap usage I recommend fieldrunnershax or sudokuhax. I personally use both sudokuhax and 4swordshax.
Alright so my understanding is:
  • 4swordshax is best for Homebrew because of boot time
  • Sudokuhax is best for running commerical ROMs because of nds-bootstrap compatibly
 

Razor83

Well-Known Member
Member
Joined
Dec 23, 2009
Messages
391
Trophies
1
XP
1,758
Country
If you have a DSi with the updated Sudoku installed plus both the ConsoleID and CID, is it possible to transfer Sudoku to an SD card using Data Management, then copy the bin to a PC, decrypt it, downgrade to the original Sudoku version, install the hacked save, re-encrypt the bin, then finally copy it back to the DSi?
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,432
Country
United States
Got bored and wrote a POC batch file to not have to copy-paste commands and make it easier to keep track of CID and ConsoleID for multiple consoles.
Simply save as a batch file in the same directory as twltool, then place CID.bin and ConsoleID.bin for any console you want in Consoles\*console description*
When the script asks for which console you input the description folder name.
Made life easier when working with two separate consoles. Currently does nand decrypt and encrypt as well as ticket encrypt and decrypt.
Also it is a POC so there may be some bugs and is easily broken by bad user-inputs.
But my testing has shown it to work.
Code:
@echo off

::Get user input for which console, used to pull CID.bin and ConsoleID.bin
cls
echo Which console?
set /p console="input: "

::Nand or ticket encrypt/decrypt
cls
echo NAND or Ticket?
echo   1) NAND
echo   2) Ticket
set /p input="input: "

::Use input to redirect to proper script
if %input%==1 (
    goto nand
) else if %input%==2 (
    goto ticket
) else (
    echo Not a valid input
    goto end
)

::Encrypt/decrypt NAND dump
:nand
cls
set /p infile="input file: "
set /p outfile="output file: "
cls
twltool nandcrypt --cid "%cd%\Consoles\%console%\CID.bin" --consoleid "%cd%\Consoles\%console%\ConsoleID.bin" --in "%cd%\%infile%" --out "%cd%\%outfile%"
goto end

::Encrypt/decrypt ticket
:ticket
cls
echo Decrypt or Encrypt?
echo   1) Decrypt
echo   2) Encrypt
set /p input="input: "

::Use input to determine ticket encrypt or decrypt (separate commands unlike NAND)
cls
if %input%==1 (
    goto decrypt
) else if %input%==2 (
    goto encrypt
) else (
    echo Not a valid input
)

:decrypt
cls
set /p infile="input file: "
set /p outfile="output file: "
twltool syscrypt --consoleid "%cd%\Consoles\%console%\ConsoleID.bin" --in "%cd%\%infile%" --out "%cd%\%outfile%"
goto end

:encrypt
set /p infile="input file: "
set /p outfile="output file: "
twltool syscrypt --consoleid "%cd%\Consoles\%console%\ConsoleID.bin" --in "%cd%\%infile%" --out "%cd%\%outfile%" --encrypt
goto end

:end
echo.
pause
exit
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • SylverReZ @ SylverReZ:
    I did it when the teachers werent looking ofc. I even managed to take in a USB stick that wasn't allowed.
  • Bunjolio @ Bunjolio:
    my school has a chrome extension called light speed filter agent and it legit blocks YouTube pfps since the file cdn(I think aka yt3.ggpht.com) is classed as mature
  • Bunjolio @ Bunjolio:
    mhm
  • Bunjolio @ Bunjolio:
    they have other stuff like goguardian too
  • SylverReZ @ SylverReZ:
    Ours mainly relied on the router, I believe.
  • Bunjolio @ Bunjolio:
    our school network and chrome policies block stuff too
  • Bunjolio @ Bunjolio:
    alot of yt to mp3 sites are blocked by light speed for "Security"
  • SylverReZ @ SylverReZ:
    It was easy to bypass some of the restrictions, as one of the admins left a registry key in the administrative shares drive, which allowed me to get around the blocking of some sites.
  • Bunjolio @ Bunjolio:
    tf does tta mean
  • Bunjolio @ Bunjolio:
    yeah this is chrome os
  • Bunjolio @ Bunjolio:
    cant do shit
  • SylverReZ @ SylverReZ:
    @Bunjolio, Wdym 'TTA'?
  • Bunjolio @ Bunjolio:
    that* as in why yt to mp3 sites are blocked for security
  • SylverReZ @ SylverReZ:
    @Bunjolio, Remember when YouTubetoMP3 was a thing back in the 2010s?
  • SylverReZ @ SylverReZ:
    Until YT updated some stuffs and broke the website.
  • Bunjolio @ Bunjolio:
    I was 2 in 2010
  • SylverReZ @ SylverReZ:
    Oh lol
  • Bunjolio @ Bunjolio:
    lol
  • SylverReZ @ SylverReZ:
    This was in the Minecraft-era.
  • AncientBoi @ AncientBoi:
    lol Bun rockin out at 2 :rofl2:
  • BakerMan @ BakerMan:
    same tbh
  • AncientBoi @ AncientBoi:
    ♫ Mama hully gully, Papa hully gully, Baby hully gully too:rofl2:
    AncientBoi @ AncientBoi: ♫ Mama hully gully, Papa hully gully, Baby hully gully too ♫ :rofl2: