Hacking RELEASE CertNXtractionPack - Get your Switch cert from a NAND dump!

SocraticBliss

SocraticBliss

Well-Known Member
Member
Level 3
Joined
Jun 3, 2017
Messages
130
Trophies
0
Age
36
XP
273
Country
United States
luk_pop said:
Which key is which?

Code: 
rsa_private_kek_generation_source = uhx('EF2CXXXXXXXXXXXXXXXXXXXXXXXXXXXX')
master_key_00 = uhx('C2CAAXXXXXXXXXXXXXXXXXXXXXXXXXXXX')
key_x = uhx('7F5BXXXXXXXXXXXXXXXXXXXXXXXXXXXX')
key_y = uhx('9A38XXXXXXXXXXXXXXXXXXXXXXXXXXXX')

rsa_private_kek_generation_source = aes_kek_generation_source ??
master_key_00 = master_key_00 ??
key_x = ??
key_y = ??

In file keys.txt by hekate_ctcaer_4.0

Code: 
secure_boot_key =
tsec_key =
keyblob_mac_key_source =
keyblob_key_source_00 =
master_key_source =
keyblob_key_source_01 =
keyblob_key_source_02 =
keyblob_key_source_03 =
keyblob_key_source_04 =
keyblob_key_00 =
keyblob_key_01 =
keyblob_key_02 =
keyblob_key_03 =
keyblob_key_04 =
keyblob_mac_key_00 =
keyblob_mac_key_01 =
keyblob_mac_key_02 =
keyblob_mac_key_03 =
keyblob_mac_key_04 =
keyblob_00 =
keyblob_01 =
keyblob_02 =
keyblob_04 =
master_key_00 =
master_key_01 =
master_key_02 =
master_key_03 =
master_key_04 =
package1_key_00 =
package1_key_01 =
package1_key_02 =
package1_key_03 =
package1_key_04 =
package2_key_source =
aes_kek_generation_source =
titlekek_source =
package2_key_00 =
package2_key_01 =
package2_key_02 =
package2_key_03 =
package2_key_04 =
titlekek_00 =
titlekek_01 =
titlekek_02 =
titlekek_03 =
titlekek_04 =
aes_key_generation_source =
key_area_key_application_source =
key_area_key_ocean_source =
key_area_key_system_source =
sd_card_kek_source =
sd_card_save_key_source =
sd_card_nca_key_source =
header_kek_source =
header_key_source =
encrypted_header_key =
header_key =
key_area_key_application_00 =
key_area_key_application_01 =
key_area_key_application_02 =
key_area_key_application_03 =
key_area_key_application_04 =
key_area_key_ocean_00 =
key_area_key_ocean_01 =
key_area_key_ocean_02 =
key_area_key_ocean_03 =
key_area_key_ocean_04 =
key_area_key_system_00 =
key_area_key_system_01 =
key_area_key_system_02 =
key_area_key_system_03 =
key_area_key_system_04 =
Click to expand...

Only master_key_00 is in that list

The others aren't in that list, google the names of the keys for a hint...
 
shchmue

shchmue

Developer
Developer
Level 11
Joined
Dec 23, 2013
Messages
791
Trophies
1
XP
2,367
Country
United States
Rikikoo said:
Well I assume inputted keys are correct, so I don't need to check hashes.
Although come to think of it, one could probably use the built-in INI-file parser.
Click to expand...
it has the hashes because it actually extracts the keys from the binaries where they reside. it scans the whole file, hashing everything until it finds them. just saying it also uses dicts.
 
J

joe rawket

Member
Newcomer
Level 1
Joined
Jan 4, 2016
Messages
5
Trophies
0
Age
44
XP
81
Country
United States
This is all great work!

I used your latest scripts and have 3 files: certificate.pem, privatekey.pem and nx_tls_client_cert.pfx.

So how do I get nx_tls_client_cert.pem from this? Do I just rename one of these files?
 
SocraticBliss

SocraticBliss

Well-Known Member
Member
Level 3
Joined
Jun 3, 2017
Messages
130
Trophies
0
Age
36
XP
273
Country
United States
joe rawket said:
This is all great work!

I used your latest scripts and have 3 files: certificate.pem, privatekey.pem and nx_tls_client_cert.pfx.

So how do I get nx_tls_client_cert.pem from this? Do I just rename one of these files?
Click to expand...

Crap... maybe I should not delete that file... okay, just edit the .cmd and remove the line that deletes that file at the end :)
 
X

xzena

New Member
Newbie
Level 1
Joined
Sep 21, 2018
Messages
2
Trophies
0
Age
25
XP
48
Country
Indonesia
i've been trying for whole night and always got same error "master_key_00 was not found in keys.txt!" can u make cert file for me? i will send you my PRODINFO.bin
 
SocraticBliss

SocraticBliss

Well-Known Member
Member
Level 3
Joined
Jun 3, 2017
Messages
130
Trophies
0
Age
36
XP
273
Country
United States
xzena said:
i've been trying for whole night and always got same error "master_key_00 was not found in keys.txt!" can u make cert file for me? i will send you my PRODINFO.bin
Click to expand...

Did you replace the 32 F's with the proper master_key_00? You have to do that before running the script...
 
L

Laja X

Active Member
Newcomer
Level 2
Joined
Sep 17, 2016
Messages
27
Trophies
0
Age
43
XP
208
Country
Hungary
Hi guys. I try to figure this out, using the latest package, that is need only keys.txt and prodinfo.bin.
I got keys.txt from latest kezplez on fw ver 6.0, and a prodinfo from nand with the latest Hekate CTCaer.
Im stuck in first, when Im need editing keys.txt with my keys... :/
Looks like my latest dumps not enough to generate my certification.cert. :(
 
SocraticBliss

SocraticBliss

Well-Known Member
Member
Level 3
Joined
Jun 3, 2017
Messages
130
Trophies
0
Age
36
XP
273
Country
United States
Laja X said:
Hi guys. I try to figure this out, using the latest package, that is need only keys.txt and prodinfo.bin.
I got keys.txt from latest kezplez on fw ver 6.0, and a prodinfo from nand with the latest Hekate CTCaer.
Im stuck in first, when Im need editing keys.txt with my keys... :/
Looks like my latest dumps not enough to generate my certification.cert. :(
Click to expand...

kezplez doesn't generate these keys, you would have to get it from somewhere else, I would suggest google...

Otherwise, maybe I could create another version that generates these keys if you provide the required seeds... it's something I could think about
 
L

Laja X

Active Member
Newcomer
Level 2
Joined
Sep 17, 2016
Messages
27
Trophies
0
Age
43
XP
208
Country
Hungary
SocraticBliss said:
kezplez doesn't generate these keys, you would have to get it from somewhere else, I would suggest google...

Otherwise, maybe I could create another version that generates these keys if you provide the required seeds... it's something I could think about
Click to expand...

I will follow your tutorial, how to dump my keys with bisdump. My prodinfo dump is usable from Hekate?
Thanks in advance. :)
 
SocraticBliss

SocraticBliss

Well-Known Member
Member
Level 3
Joined
Jun 3, 2017
Messages
130
Trophies
0
Age
36
XP
273
Country
United States
Laja X said:
I will follow your tutorial, how to dump my keys with bisdump. My prodinfo dump is usable from Hekate?
Thanks in advance. :)
Click to expand...

  1. Dump your NAND with Hekate.
  2. Open your NAND backup in HacDiskMount.
  3. Double-click on PRODINFO.
  4. Input your BIS Keys.
  5. Click Save then Test.
  6. Dump to File the PRODINFO.bin to your working directory (where the python script and cmd script is).
  7. Ensure your keys.txt file is updated.
  8. Double-click on the cmd script.
 
1

13javier

New Member
Newbie
Level 2
Joined
Sep 27, 2018
Messages
1
Trophies
0
Age
49
XP
128
Country
Spain
I just finish to create my file, but the result when I tried to use it is a need a new certificate. How is that possible?

Thanks in advance.
 
L

Laja X

Active Member
Newcomer
Level 2
Joined
Sep 17, 2016
Messages
27
Trophies
0
Age
43
XP
208
Country
Hungary
I spend more of 6 hour to read this 15 page, over and over again.
Im got the proper PRODINFO.bin, all the bis keys, but how to hell obtain proper keys.txt to finaly run down the -cmd?
Some sort of 32 binary Hactool output, but the corresponding exe just run down, and closing.
Any help please? :(
 
SocraticBliss

SocraticBliss

Well-Known Member
Member
Level 3
Joined
Jun 3, 2017
Messages
130
Trophies
0
Age
36
XP
273
Country
United States
Last edited by SocraticBliss,

Site & Scene News

Go to forum More news

Popular threads in this forum

Emulation Homebrew  duckstation for Switch

Can you trade in a banned switch for an unbanned one?

Why is Atmosphere so dominant?

Hacking Misc Tutorial  Eiyuden Chronicle Hundred Heroes save editing

Hacking  Weird findings from that DQ trilogy switch port

Migswitch backups without certificate files

switch change sd card, but android start fail

Emulation Misc  Is a totk memory editor possible? If so why has no one made one yet?

General chit-chat
Help Users
  • BakerMan
    I rather enjoy a life of taking it easy. I haven't reached that life yet though.
  • Xdqwerty
    what are you looking at?
  • AncientBoi @ AncientBoi:
    Both of mine are i5's lol
  • AncientBoi @ AncientBoi:
    All right! Who stole my right sock? :angry:
  • SylverReZ @ SylverReZ:
    @RedColoredStars, Lol
     +1
  • RedColoredStars @ RedColoredStars:
    At least someone other than myself thought it was funny :rofl:
     +2
  • BakerMan @ BakerMan:
    DNDBD (DND×DBD) IS A REAL THING
  • Xdqwerty @ Xdqwerty:
    I didnt have school today
  • Xdqwerty @ Xdqwerty:
    Cuz it's some kind of holiday related to the town I live in
  • Xdqwerty @ Xdqwerty:
    Am I [R WORD]?
  • Xdqwerty @ Xdqwerty:
    https://youtu.be/M0QMD9Ja8VI?si=oCc50NRR7JttfVtH
  • SylverReZ @ SylverReZ:
    @Xdqwerty, People who create revival services for the Wii end up in disaster, same goes for Pretendo lol.
     +1
  • Xdqwerty @ Xdqwerty:
    @SylverReZ, atleast wiimmfii went fine although people only use it for Mario kart Wii
  • SylverReZ @ SylverReZ:
    At least if they ban you for cheating, get another Wii. They're cheap as chips.
     +1
  • SylverReZ @ SylverReZ:
    Remember when RiiShop was a thing?
  • BakerMan @ BakerMan:
    not really
  • SylverReZ @ SylverReZ:
    It got shutdown because somebody "accidentally" leaked the database for the amount of people using the beta.
  • SylverReZ @ SylverReZ:
    RiiShop is the laziest way of downloading Wii games. Did somebody not think of this through?
  • BakerMan @ BakerMan:
    although i ended up accidentally changing my nand with no way of going back bc i didn't know you needed a gamecube controller to restore it (i have a wii minus/1.1, which doesn't have gamecube controller support)
  • SylverReZ @ SylverReZ:
    @BakerMan, I think you're talking about the recovery mode that the SaveMii used, and also was to restore softbricked systems.
  • SylverReZ @ SylverReZ:
    If your NAND was hardbricked, then just buy another Wii. Or go with the dirty NAND flasher method.
  • BakerMan @ BakerMan:
    and if i find the sd card i have my NAND backed up on, i can not only restore the NAND if i solder the right part in, but i can also put my NAND on dolphin, then i can play dolphin online, like PMEX Remix or MKWii Riibalanced
  • Xdqwerty @ Xdqwerty:
    Brb
  • SylverReZ @ SylverReZ:
    @BakerMan, Oh yeah, that was a thing too. Dolphin does support Wiimmfi.
  • BakerMan @ BakerMan:
    yeah you just need to put your NAND backup with wiimmfi on it
  • BakerMan @ BakerMan:
    ngl i feel like if a bunch of my friends have wiis and know how to get wiimmfi and back up their NAND, then we could do a PMEX Remix tournament
  • BakerMan @ BakerMan:
    maybe even add UMVC3/DBFZ and make it a biathlon/triathlon
    BakerMan @ BakerMan: maybe even add UMVC3/DBFZ and make it a biathlon/triathlon