ROM Hack 3DSExplorer

[elisherer]

nice program! thanks, hope you succeed

Thanks,


v0.9
* Now checks for update on startup (can be disabled)
* Added link to the Google-code site
* CIA: Can replace icons with any picture you want (Saving enabled)
* More bug fixes

 

[Ris312]

In v0.90 (and v0.89), the Filelist on the very bottom left will always show ExeFS0 and RomFS0
even if different partition is selected (e.g NCCH 2) using the window above the filelist.

In v0.88, the filelist used to change with the partition you had highlighted in the window above the filelist.
e.g If you clicked NCCH 2 the filelist would show ExeFS2 and RomFS2. If you clicked NCCH 1, the filelist would show ExeFS1 and RomFS1.

Not sure if it was made to do this or if its a small bug.

edit: also in the filelist, can you change the 'open' option to show 'extract' when right clicking on the ExeFS and RomFS.
Having 'Open' seems a bit confusing, you aren't really opening it, you are extracting it

edit2: in AES-CTR toolbox, the IV is pre-filled with sixteen 0's which is 8 bytes, The IV should be thirty-two 0's (or 16 bytes)
or maybe have leave the IV box empty like the Key box above it?.

Other then that, the AES-CTR toolbox works fine at decrypting data from my tests.

 

[elisherer]

In v0.90 (and v0.89), the Filelist on the very bottom left will always show ExeFS0 and RomFS0
even if different partition is selected (e.g NCCH 2) using the window above the filelist.

In v0.88, the filelist used to change with the partition you had highlighted in the window above the filelist.
e.g If you clicked NCCH 2 the filelist would show ExeFS2 and RomFS2. If you clicked NCCH 1, the filelist would show ExeFS1 and RomFS1.

Not sure if it was made to do this or if its a small bug.

This is intentional (to simplify the code).
Now every RomFS or ExeFs (if exists) show in the file list.

edit: also in the filelist, can you change the 'open' option to show 'extract' when right clicking on the ExeFS and RomFS.
Having 'Open' seems a bit confusing, you aren't really opening it, you are extracting it

I changed it in v0.9 to Open as 'default' command, again, to simplify the code. This context menu works for CCI, SRAM & CIA
So the Open command is the same as double clicking a file. (I didn't find a collective word for this action).

edit2: in AES-CTR toolbox, the IV is pre-filled with sixteen 0's which is 8 bytes, The IV should be thirty-two 0's (or 16 bytes)
or maybe have leave the IV box empty like the Key box above it?.

Other then that, the AES-CTR toolbox works fine at decrypting data from my tests.

The IV is pre-filled so you could paste an 8byte hexstring which is the title_id.
The iv is rumored to be the title_id padded with 8 bytes. so this is just for comfort testing.

 

[Ris312]

This is intentional (to simplify the code).
Now every RomFS or ExeFs (if exists) show in the file list.

Ok, I just noticed that now, I opened a file and it showed RomFS1, but it doesn't show the RomFS2 from NCCH2.
edit: Line #188 of frmExplorer.cs:

                        for (var i = 0; i < 2; i++)

Only does NCCH0 and NCCH1, you need to change "i < 2" to be "i < 3" or "i

 

[elisherer]

About the ncch..thanks I havnt noticed that...i'll fix it next version...
Do you extract the files with a key? or just extracting encrypted files?

 

[Ris312]

About the ncch..thanks I havnt noticed that...i'll fix it next version...
Do you extract the files with a key? or just extracting encrypted files?

I'm extracting without a key (leaving the box blank)

Quick way to check is to do this:
- click NCCH0 in the upper tree view then extract RomFS0 to a file. (e.g Test0.bin)
- click NCCH1 in the upper tree view then extract RomFS0 to a file. (e.g Test1.bin)
- click NCCH2 in the upper tree view then extract RomFS0 to a file. (e.g Test2.bin)

Then open all three files in a hex-editor, or get the CRC32 / MD5 checksums of the files
the files you get will all be different because the starting offset is wrong.

You need to get the same CRC/MD5 for file no matter which page you are viewing when extracting.

"cxt.currentNcch" needs to be changed to use the number at the end of the file. e.g:
When extracting Exe/RomFS0, the program should see the 0 at the end of the name and use "cxt.cci.FirstNCCHOffset"
When extracting Exe/RomFS1, the program should see the 1 at the end of the name and use "cxt.cci.SecondNCCHOffset"
When extracting Exe/RomFS2, the program should see the 2 at the end of the name and use "cxt.cci.ThirdNCCHOffset"
Not too sure how to do that in code as I'm not a programmer (but I can read and understand some code)

I've added some details in my post above.

 

[elisherer]

Thanks I already understood what was wrong from your first post

btw. if there's only one romfs or exefs it's because in the other ncch the size of the exefs or romfs is 0 meaning there is none in them.

 

[elisherer]

v1.0

• Better late then ever...update to v1.0 so I can continue with the regular

version giving.

• Added MPO support (3D Images taken by the 3ds camera)
• 3D Video Conversion tool to convert youtube 3d videos to 3DS-3D MJPG videos...
• more bug fixes (as always)

Funny application boom were getting here...lol

 

[Ris312]

I've made a change to v0.9.6, thought I'd post it here so you can add it to the new version.

It adds RomFS2 to the Filelist and it changes the offsets to show from start of the file instead of the current partition.
(I'm still very new to coding (still learning) but I'm happy that its working )

Replacing this at end of 'Modules\mdlRom.cs' (I am using 0.9.6 source)

        public TreeNode GetFileSystemTopNode()
{
var tNode = new TreeNode("Rom", 1, 1);
uint poffset;
for (var i = 0; i  0)
{
tNode.Nodes.Add(new TreeNode(
TreeListView.TreeListViewControl.CreateMultiColumnNodeText(
"ExeFS" + i + ".bin",
(cxis[i].ExeFSSize * 0x200).ToString(),
StringUtil.ToHexString(8, poffset * 0x200+cxis[i].ExeFSOffset * 0x200)
)) { Tag = cxis[i] });
}

if (cxis[i].RomFSSize > 0)
{   
tNode.Nodes.Add(new TreeNode(
TreeListView.TreeListViewControl.CreateMultiColumnNodeText(
"RomFS" + i + ".bin",
(cxis[i].RomFSSize * 0x200).ToString(),
StringUtil.ToHexString(8, poffset * 0x200+cxis[i].RomFSOffset * 0x200)
)) { Tag = cxis[i] });
}
}

Changes: (My 0.9.6 change on the left, the latest v1.0 on the right)

 

[elisherer]

Nicely done. will be fixed on 1.01 and be commented with your nick

 

[elisherer]

I have a few things i'm going to change in the next version:

1. change back SRAM to SaveFlash because the Save chip is Flash and not RAM.
2. change Rom -> CCI and make a new context called CXI so it can open independent CXI files..
3. ffmpeg will split automaticly the files to 10 minute videos.
4. ffmpeg will use 2 cores for faster processing.

 

[Ris312]

'NCSD' Offset 0x328 could be the System Update required to start the game...
(Its the unknown value at offset 0x320 on the 'Rom' part of the file tree. (One level above NCCH 0)

Partition (NCCH2) contains the update data for the 3DS.
I've noticed that when the NCCH2 RomFS Superblock Hash is a
certain value that offset 0x328 in the 3DS file is the same as well.

Games that have different NCCH2 RomFS Superblock Hashes have different update data.
(The Superblock is like a hash of the update data, if the hash is different then the data is different)

I think the 3DS uses the value at offset 0x328 to check what update is required to play the game.

The problem is I don't know which updates that each of these games have...
I only know that Super Mario 3D Land and Mario Kart 7 update your 3DS to v2.2.0-4.

Does anyone know the update versions of these games?
Once we know which version is which, we can try to figure out how this value is stored.

System Software = ? (Possibly v1.0.0-0? or v1.1.0-0?)

0x0320   0x324    0x328      = NCCH 2 RomFS Superblock Hash
02710100 DB000400 [00040000] = 9F2431565DD5B6853A40BF0C6A422F58528CA2FB5C4B05D3587A7B4F757A069B

List of Games:
Tom Clancy's Ghost Recon - Shadow Wars
Super Monkey Ball 3D
LEGO Star Wars III - The Clone Wars
Pilotwings Resort
Resident Evil - The Mercenaries 3D
Puzzle Bobble Universe
Rayman 3D
Super Street Fighter IV 3D Edition
Dead or Alive - Dimensions
Ridge Racer 3D
Tom Clancy's Splinter Cell 3D
Cubic Ninja

System Software = ?

0x0320   0x324    0x328      = NCCH 2 RomFS Superblock Hash
02710100 DB000400 [15040000] = AC35E25DBE307730532C6DC5511B34174DF09EE7177B05518047F0A2671EA2F4

List of Games:
Legend of Zelda, The - Ocarina of Time 3D

System Software = ?

0x0320   0x324    0x328      = NCCH 2 RomFS Superblock Hash
02710100 DB000400 [15080000] = D7960FA723E218FFD25289DD6A1265A07173D9B5C93F4DC561ABC4D90EF78DC3

List of Games:
StarFox 64 3D
Doctor Lautrec and The Forgotten Knights

System Software = 2.2.0-4

0x0320   0x324    0x328      = NCCH 2 RomFS Superblock Hash
02710100 DB000400 [28080000] = C8EF9E3FB6647DE2E5CB45C3B7685E9723BD29C99FC78B2FEF472D3F91C4F32A

List of Games:
Super Mario 3D Land
Mario Kart 7

List of all Updates released so far.
1.0.0-0
1.1.0-0
1.1.0-1
2.0.0-2
2.1.0-1
2.1.0-3
2.1.0-4
2.2.0-4
3.0.0-5


Offset 0x328 Hex and Binary Values and possible update version.
00040000 = 0000 0000 0000 0100 0000 0000 0000 0000 = ?
15040000 = 0001 0101 0000 0100 0000 0000 0000 0000 = ?
15080000 = 0001 0101 0000 1000 0000 0000 0000 0000 = ?
28080000 = 0010 1000 0000 1000 0000 0000 0000 0000 = v2.2.0-4

 

[elisherer]

just noticed...

0x0320 02710100 --- it's 1 in all the EUR games...

in CTR-P-ARRJ (Ridge Racer 3D (J)) it's 2 !! maybe that's the region flag...

 

[elisherer]

I just got my MK7 from canada and I noticed something strange...



Uploaded with ImageShack.us
The cart is in canadian region (has english and french languages only)
So are there more differences between geographical regions??

 

[elisherer]

v1.1 - Happy Holidays
* New opens CXI files
* New opens CSU files (CTR System update - same as CCI)
* New opens ICN files (CTR Icons)
* Added QuickCRC32 tool to check for authenticity (also added CRC32 to hash tool)
* Generalized the explorer (the source code of the explorer is general, now it would be easier to add more file formats)
* 3D Video converter: Progress is working, fixed a lot, now works almost flawlessly.
* CCI: added more information to the header.

 

[elisherer]

Apparently there's a bug in 1.1 that files can't be clicked or saved.
a fix will come out soon (v1.1.1)

 

[Milesgboy]

Is it possible to make it view the files from the .3ds files themselves to see the contents in there? Or is that not yet possible to do? Like that package files that hold the contents for the game?

 

[elisherer]

it's not possible because it's encrypted.

 

[elisherer]

v1.1.1

• fixed file tree activation bugs
• fixed some typos
• CCI: added an option to save cxi file (right click the CXI node in the file tree)

 

[Fyrus]

Hello, I have a slight problem with this program.

As soon as I try to open the Video option, an error message pops up.

Spoiler

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.
************** Exception Text **************
System.IO.FileNotFoundException: Could not load file or assembly 'System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. Le fichier spécifié est introuvable.
File name: 'System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
at _3DSExplorer.frm3DVideo.CheckForYouTubeString(String text)
at System.Windows.Forms.Form.set_Active(Boolean value)
at System.Windows.Forms.Form.WmActivate(Message& m)
at System.Windows.Forms.Form.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
WRN: Assembly binding logging is turned OFF.
To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.
Note: There is some performance penalty associated with assembly bind failure logging.
To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].

************** Loaded Assemblies **************
mscorlib
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.239 (RTMGDR.030319-2300)
CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v4.0.30319/mscorlib.dll
----------------------------------------
3DSExplorer
Assembly Version: 1.0.0.0
Win32 Version: 1.1.1.0
CodeBase: file:///C:/Users/Fyrus/Downloads/3DSExplorer-v1.1.1/3DSExplorer.exe
----------------------------------------
System.Windows.Forms
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.235 built by: RTMGDR
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 built by: RTMRel
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.236 built by: RTMGDR
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Core
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.233 built by: RTMGDR
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll
----------------------------------------
System.Configuration
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 (RTMRel.030319-0100)
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
----------------------------------------
System.Xml
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.233 built by: RTMGDR
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll
----------------------------------------
Accessibility
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 built by: RTMRel
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/Accessibility/v4.0_4.0.0.0__b03f5f7f11d50a3a/Accessibility.dll
----------------------------------------
************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.
For example:



When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.

How can I fix this up ? OS used is Windows 7 64 Bits.

Thanks in advance.