(4.x only) CIA CFW Complete Guide

Discussion in '3DS - Flashcards & Custom Firmwares' started by palantine, Nov 2, 2014.

  1. palantine
    OP

    palantine Advanced Member

    Newcomer
    84
    165
    Oct 5, 2014
    Italy
    Special thanks to the BlackFin team and Jenn at Shopify!

    As of now this guide requires a 3ds flashcart that allows eShop access, or an eShop game to already be installed on your SD card. I will assume ownership of a Gateway cart, but the steps should be very similar regardless of what cart you own.

    Disclaimer: I take no responsibility for any damage caused by attempting this mod. Although there have been no reported problems so far, this is cutting edge stuff that has been only lightly tested. Continue at your own risk.

    Downloads
    Rop MultiLoader
    Hex Workshop
    Win32DiskImager
    Palantine CFW v1.0
    DevMenu Cia - not legal to link. Use Google :)


    1. Make sure your 3DS is configured to connect to the internet properly before going any further. Write down the LAN IP of your 3ds for later.
    2. Copy the Rop Multiloader to your DS mode flashcart. Launch the Rop Multiloader rom from your cart and select "Gateway 4x"
    3. Copy the Gateway Launcher.dat to your SD card, and load it with the usual exploit. Select "Nand Backup".
    4. When it finishes, copy the nand.bin from your SD card to your computer.
    5. If you have not already done so, boot the Gateway Launcher and select "Format Emunand". Be careful, as this will erase all the files on your SD card.
    6. On your SD card navigate to "sdmc:/Nintendo 3DS/<id0>/<id1>/dbs/". Create two files in this folder named title.db and import.db . Put the SD card back in your 3ds and go to System Settings, and attempt to manage the SD software. Let the 3DS do its repair process.
    7. Mount your SD card on your computer. Make a backup of the card with Win32DiskImager.
    8. Open Hex Workshop as administrator. Select Disk-> Open Drive. Choose "All" from the drop down menu and select the disk with the size matching your SD card. Once opened, the very beginning should say "GATEWAYNAND"
    9. Choose Disk->Restore Sectors and select your saved nand.bin. Change "Starting Sector" to be "1".
    10. Now that that is finished, your SD is ready to launch the CFW. Copy the contents of the folder "SD Card" folder to your SD card.
    11. Launch the "Rop Multiloader" from your DS cart again. This time select "Homebrew 4x".
    12. Finally launch the exploit the usual way, and make sure to hold down the L Button. it may take as many as 10 tries to work, but don't give up. You will know it worked when the screen flashes white then black for a second.
    13. Download "DevMenu_2x.cia" and put it in the "Palantine CFW" folder.
    14. On your computer, in the CFW files, edit run.bat and replace "IPTOMODIFY" with the IP of your 3DS, and then run it by double clicking it. This will try to install the DevMenu onto your device.
    15. Reboot your 3DS and launch the CFW again. If it worked you will see a present on the homescreen.
    16. Congrats! You have installed a CFW to your 3DS!
    Let me know if I have made any mistakes, or if there is need for clarification.

    Win32DiskImager is used to make a backup of your emunand which you can restore to your SD card to revert back to Gateway. If you have 2 SD cards like I do then this is unnecessary.

    Thanks to idunoe for the db trick!


    ctrclient commands

    I have reverse engineered most of the ctrclient commands and have exposed some very interesting functionality. These commands are for developers only. You run a very real risk of doing permanent damage to your device if you try to play around with these.

    Code:
    ctrclient.exe --serveradr=<3ds ip> --customcmd=“<custom cmd>“
    
    installcia:<cia name>
    
    readmem:<mem type> <offset> <size>    @<optional output file name>
        memtypes: 11kern, 11usr=, 9
        11usr=<process name> (i.e. pxi, pm)
    
    writemem:<mem type> <offset> <size> @<input hex file>
        memtypes: 11kern, 11usr=, 9
        11usr=<process name> (i.e. pxi, pm)
    
    getservhandle <service name> (i.e. ir:u )
    
    sendservicecmd <service handle> <header code> <arg1>,<arg2>…
    
    getprocinfo:addrconv <arm11 procname>  <vaddr>  (i.e. pxi 0x100000)
    getprocinfo:kprocess <arm11 procname>  (i.e. pxi)
    getprocinfo:mmutable <arm11 procname>  (i.e. pxi)
    
    ROM to CIA Guide

    This guide requires makerom and ctrtool.

    Step1: decrypt the .3ds rom.
    I will not explain it in this tutorial, as it is explained a couple of times around the forum. (http://gbatemp.net/threads/release-3ds_ctr_decryptor-void.370684/)

    If you end up with a decrypted romfs.bin, exheader.bin, code.bin (decompressed), icon.bin and banner.bin you did everything correct.

    Step2: creating an .rsf file
    The .rsf file is a little bit different then the one for .3ds roms. Anyway here is the proper one, make sure you fill in the XXXX the right way. Just copy the text in the codebox underneath in a text editor and save it as cia.rsf in the folder with the other stuff.

    • you can open the exheader or original rom in a hex editor to look up the right values for the companycode, producttyp and productcode
    •For the correct UniqueID you can check ctrtool and the official rom. Just remove the last 2 0 and write the 4 digits before that in the .rsf file:

    Code:
    BasicInfo:
      Title                  : "Custom Title"
      CompanyCode            : "00"
      ProductCode            : "CTR-P-DERP"
      ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
      Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
    
    TitleInfo:
      UniqueId                : 0x7850
      Category                : Application
    
    Option:
      UseOnSD                : true # true if App is to be #installed to SD
      EnableCompress          : true # Compresses exefs code
      FreeProductCode        : true # Removes limitations on ProductCode
      EnableCrypt            : true # Enables encryption for NCCH and CIA
      MediaFootPadding        : true # If true CCI files are created with padding
    
    AccessControlInfo:
      ExtSaveDataId: 0xb7850 # same as UniqueId
      SystemSaveDataId1: 0x00000000 # plaintext exheader
      SystemSaveDataId2: 0x00000000 # plaintext exheader
      OtherUserSaveDataId1: 0x00000 # plaintext exheader
      OtherUserSaveDataId2: 0x00000 # plaintext exheader
      OtherUserSaveDataId3: 0x00000 # plaintext exheader
      UseOtherVariationSaveData : false
    
    SystemControlInfo:
      SaveDataSize: 1M # plaintext exheader
      RemasterVersion: 0 # plaintext exheader
      StackSize: 0x00040000 # plaintext exheader
      JumpId: 0x000400000b000000L # plaintext exheader (<full UniqueID>L)
    step 3: creating the .cia
    Open the command window in the folder with the exefs.bin, exheader.bin, romfs.bin, icon.bin, code.bin, banner.bin, cia.rsf and makerom. Now run the following command:

    this will output an .cia file which you can install with the DevMenu and then run.

    If you encounter an error saying "[ROMFS ERROR] Invalid RomFS Binary.", then remove the "-romfs romfs.bin" from the command.
     
    Last edited by palantine, Dec 11, 2015


  2. Ashtonx

    Ashtonx n0l1f3

    Member
    511
    137
    Oct 31, 2013
    Poland
    Now it'd be nice to know what this cfw lets you do atm.
     
    Celice, Margen67 and Queno138 like this.
  3. Lordjontan

    Lordjontan GBAtemp Regular

    Member
    229
    50
    Jun 16, 2013
    Colombia
    Thanks, but ¿what is the point of the Win32DiskImager?
     
  4. Vappy

    Vappy GBAtemp Advanced Maniac

    Member
    1,507
    1,154
    May 23, 2012
    Wonder if there's any way to get the SD card set up for a successful install without needing to download something from the eshop? As it is, that necessity means you currently still need a Gateway cart.
     
  5. einstein95

    einstein95 GBAtemp Regular

    Member
    228
    138
    Aug 31, 2013
    New Zealand
    Install .cia files (such as the NSMB2+10 DLC that BigBlueBox released) and brick your 3DS.
     
    Herobroski, cearp, keyra and 3 others like this.
  6. Queno138

    Queno138 Ravens

    Member
    2,412
    782
    Sep 18, 2010
    Senegal
    Luigi's Dark Mansion
    Dude, I totally love your guide, and know you're being helpful,
    But please don't link the files or sites here.

    Something about gbatemp abiding to DMCA regulations.

    If users can't even do a basic Google for GW3DS, they probably shouldn't meddle with their 3DS.

    Also,
    one can find giovanny's site from his youtube video posted on the first post on this thread, and find the files on their site.

    If one can't make the connection and find the files from there,
    I will give the same advice to as above.

    ;D

    edit:

    It'll be also good for you to add something like this to your post:

    "Hanging, bricking and other kinks might happen,
    As the CFW leaked is an older version, that is not bug free.
    gbatemp and I shall not be held responsible, hence use at your own risk.

    As usual, always have a 4.5 real nand backup on your computer,
    so that in the unlikely unlucky event that there is any brick,
    you have hopes of finding someone to do a hard mod for you,
    in order to restore your nand. (but of course, no guarantees)

    If you do not understand terminology such as:
    nand, brick, bug, hard mod, emunand, cfw, backup, CFW, GW, gateway,
    use at your own risk, 3DS, computer, application, program etc,

    I strongly recommend for you to close this page immediately."
     
    ScarletCrystals and Nightwish like this.
  7. alepman90

    alepman90 GBAtemp Regular

    Member
    228
    118
    Oct 10, 2014
    Is the NSMB2 an eshop version or cart dump?is there a way to transform .3ds to .cia and install them on home menu?
     
  8. Queno138

    Queno138 Ravens

    Member
    2,412
    782
    Sep 18, 2010
    Senegal
    Luigi's Dark Mansion
    I read that this thing called "makerom" wasn't working, so no.
     
  9. mech

    mech ♥️♥️♥️♥️♥️♥️♥️♥️

    Member
    4,742
    3,017
    Oct 26, 2014
    Tuvalu
    Rop multiloader file is down
     
  10. Foxi4

    Foxi4 On the hunt...

    pip Reporter
    23,550
    21,515
    Sep 13, 2009
    Poland
    Gaming Grotto
    Queno138 is correct - GBATemp.net does not permit hosting or linking to any Gateway files whatsoever, as such, I've removed the link from your Downloads list. Users will have to trust in the strength of their Google-fu if they want to fool around with this.
     
    ubergeek77, KingBlank, Celice and 2 others like this.
  11. einstein95

    einstein95 GBAtemp Regular

    Member
    228
    138
    Aug 31, 2013
    New Zealand
    Eshop, that's why it's a CIA file.
     
  12. BobPwnz

    BobPwnz GBAtemp Regular

    Member
    131
    19
    Apr 9, 2014
    United States
    I have a few dlc installed and some money on my emunand. If I install the cfw will all of them disappear? Also will the dev menu installto the emunand or sysnand?
     
  13. migles

    migles Mei the sexiest bae

    Member
    6,899
    4,632
    Sep 19, 2013
    Saint Kitts and Nevis
    my dad works for nintendo.
    my console firmware must be 4.x right? the tutorial doesn't specify the requirements...
     
  14. Queno138

    Queno138 Ravens

    Member
    2,412
    782
    Sep 18, 2010
    Senegal
    Luigi's Dark Mansion
    Number 1: Don't enter your data management on realnand to check, EVER (cause they'll go missing)

    Now that that is out of the way:

    The money should probably be tagged to your eshop account/nnid,
    but it's not like you can use eshop on the cfw.

    Devmenu is installed onto the CFW's emunand (if you read the steps, you'll remember that you need to set a new 4.5 nand in the emunand sector)

    My Pokemon ORAS demo installed on emunand appear on sysnand,
    but that is likely because it's the same SD card inserted into the system. (It won't run though)

    While your DLC content remains on your SD card,
    chances are they might disappear.
    DLC for games on higher firmware won't work/appear anway..

    Yes.
     
  15. sanin6

    sanin6 Advanced Member

    Newcomer
    93
    12
    Aug 20, 2013
    United States
    Oregon
    this is a really good tut. easy. but what do i do when the I get the teal blue screen and the white flashes black for like a milli sec it just hangs. i also sometimes get a teal blue top screen and black bottom screen and it just hangs too.
     
  16. Queno138

    Queno138 Ravens

    Member
    2,412
    782
    Sep 18, 2010
    Senegal
    Luigi's Dark Mansion
    I think the OP is still working out the kinks.

    You can probably keep retrying, as the cfw is buggy.
    Just make sure that no matter what you do, follow the steps.

    And if you have to update, always have an emunand.
     
  17. Lordjontan

    Lordjontan GBAtemp Regular

    Member
    229
    50
    Jun 16, 2013
    Colombia
    I still don't know
     
  18. palantine
    OP

    palantine Advanced Member

    Newcomer
    84
    165
    Oct 5, 2014
    Italy

    If it flashes white then black, it means the exploit worked. It should boot into home menu afterwards.
     
  19. palantine
    OP

    palantine Advanced Member

    Newcomer
    84
    165
    Oct 5, 2014
    Italy
    Added an explanation about Win32DiskImager
     
    Queno138 likes this.
  20. Queno138

    Queno138 Ravens

    Member
    2,412
    782
    Sep 18, 2010
    Senegal
    Luigi's Dark Mansion
    Step 7.

    to backup the whole SD card as an image.