Hacking (4.x only) CIA CFW Complete Guide

[Arnold0]

EDIT : Sorry double post (Used quote instead of edit...)

 

[CalebW]

Does anyone know how to compile the sources of the xorpad tool intoo an launcher.dat. I got one by MP but I'm pretty sure it doesn't have 7.x keyx in it because when I try to use the tool to make the exefs.xorpad from the norm and 7.x crypto it says me this :

https://gbatemp.net/threads/release-3ds_ctr_decryptor-void.370684/
Download the sources. Then in main.c replace with the 7.X key

 

[Arnold0]

Yep I know that but not how to compile it. I don't think visual studio will do this, (Even if it did the 3DS could not run it) and I don't know what compilator I need to use or anything.

EDIT : I may have found a tutorial will folow it and report results.

RE-EDIT :

.............

 

[CalebW]

I posted a (mostly) complete package for generating .rsf and converting .3ds to .cia here http://gbatemp.net/threads/4-x-only-cia-cfw-complete-guide.373532/page-31#post-5147322 Should make everything in working format

Might I suggest that you automatically select the right -desc value in your script using python?

 

[intermet]

Yep I know that but not how to compile it. I don't think visual studio will do this, (Even if it did the 3DS could not run it) and I don't know what compilator I need to use or anything.

EDIT : I may have found a tutorial will folow it and report results.

RE-EDIT :

.............

you have to add devkitarm to windows path

 

[intermet]

fail edit

 

[daxtsu]

Oh man, does it run without problems? I can't get it even to start.

It freezes the console sometimes when I hit the home button, but it seems to load and save okay.

Google, 3dsexplorer, hexeditor...



This is really strange...I can compile a cia with makerom.exe version .13, but I can't compile when I compile version .13 on linux...

Thanks, I'll try 3dsxplorer.

-desc:4

Thanks. I used 4 for ALBW as well. I'll try Pokémon Y next.

 

[Queno138]

I'll try Pokémon Y next.

This.

I'm curious to how it will work.

Let us know what settings you used ><

 

[CalebW]

Is anybody currently working on the CFW loading 100%?(Or close to it)

 

[djalmafreestyler]

Does anyone can help me explaining this with more details?

1. Launch the "Rop Multiloader" from your DS cart again. This time select "Homebrew 4x".
2. Finally launch the exploit the usual way, and make sure to hold down the L Button. it may take as many as 10 tries to work, but don't give up. You will know it worked when the screen flashes white then black for a second.

 

[Gadorach]

Welp, I might as well do my own write-up of the steps if everyone else is:

-----------------------------------------------------------
How To Install Palantine CFW
-----------------------------------------------------------

Requirements:

1) 4.5.0 or lower firmware Nintendo 3DS/XL/LL console with a 2GB or larger internal SD card
2) A DS mode Flashcart, like the DSTWO
3) Windows Vista or a newer version of Windows
4) These files: http://www.mediafire.com/download/i790kmos1zvv478/Palantine_CFW_Files.rar
5) Gateway's latest Launcher.dat (Google it, as we can't link it here)
6) For installing anything, you'll need the DevMenu.cia (you can get if from Govanify's CFW package hosted on his site, if you're brave enough to trek there)
7) Patience and a working brain

Step 1)

Before you do anything, you need to set up your 3DS network settings so it can connect to your network successfully with a static IP. To do this, follow the picture guide I've laid out on imgur (to save space in this guide, of course).

[Initial Setup Picture Guide]

http://imgur.com/a/jZnPC

Step 2)

You're going to need a DS-Mode flashcart to continue from here on out.

[Picture guide incoming]

Download the files package from the link further up in this thread, and extract it using WinRAR.
Inside this package, I've included everything I legally can to get you set up.

This includes:

- Palantine CFW 1.0
- EmuNAND Tool 1.0.1
(note, this may be detected as a virus by your antivirus software. I can assure you that it isn't, but you can do this manually with a hex editor of your choice if you are too skeptical of using this software. Many on this forum use it, so if it was a virus, it would have been removed long ago.)
- EmuNAND to CFW-NAND batch file
- ROP Multi-loader
- blank database files

From the archive, open "EmuNAND Setup", and in there, locate "For DS Flashcart".
You'll find the file "rop_multiloader.nds" in there. Copy that file to the root of your DS Flashcart's MicroSD card. Then, put that MicroSD card into your DS Flashcart, insert it into your 3DS, and start it up. From the flashcart's menu, browse to the root of your MicroSD card and launch the "rop_multiloader.nds" file. In here, select "Gateway 4x" and then press the home button when it finishes.

Step 3)

Pull the big SD card from your 3DS and put it into your computer. You now need the Gateway 3DS launcher, which you can acquire from the downloads section of their website.

Before you continue, I recommend backing up all of the contents of your big SD card. This next step will, unfortunately, cause all data on the big SD to be lost otherwise.

Locate the "Launcher.dat" within the Gateway firmware package and copy it to the root of the big SD card. Next, insert the big SD card back into your 3DS.

You can now start the MSET profile exploit. To do this, open the system settings app, go to "Other Settings", then open "Profile", and follow that with holding down the "L" bumper, located on the back, left hand side of your 3DS (from the front of the unit). While continuing to hold the "L" bumper, with your other hand, open the "Nintendo DS Profile". This will trigger the exploit, and open the Gateway configuration menu. In here, you're going to want to first make a NAND backup. I'd advise that you plug in your 3DS to a power source from here on out. To do this, use the D-Pad of your 3DS to go over to "BACKUP SYSTEM NAND", then press the "A" button on that, and when the next menu comes up, press the "Start" button. This will give you a complete NAND backup, so if something goes wrong, you can have it restored to that backup at any time through the use of a hardware eMMC NAND programmer. Once that backup has completed, just hold the power button on your console until it turns off, and remove the big SD card. Put the big SD card into your computer and copy the "NAND.bin" file off of the big SD card, and put the backup in a safe place.

Next, start up the Gateway menu the same way as before, but this time, go all the way over to the option that says "FORMAT EMUNAND". Press the "A" button on this option, and when it loads up, press the "Start" button. This will take some time to complete, about as much as the original NAND backup, so go take a break while your 3DS does it's work. Once it's done, hold the power button until it turns off again, and you'll be ready for the next step.

Step 4)

Take the big SD card out of your 3DS again, and put it in to your computer. You're going to need to use EmuNAND Tool 1.0.1 now, so, although it pains me to say this, but if you have an antivirus software that isn't fond of this program, you will need to disable it until we're done this step.

Start up EmuNAND tool, and, with your big SD still plugged in, click on the "Extract emuNAND" button. Direct the emuNAND tool to the "EmuNAND Setup" folder of the extracted archive included in this tutorial, and save the backup as "EmuNAND.bin". Next, once it has completed, drag and drop the EmuNAND.bin file you created onto the "drag_emunand_here.bat", and wait for it to finish. It will create a CFW_NAND.bin for you to work with. Once it's done generating the CFW_NAND.bin, go back into EmuNAND Tool 1.0.1 and click on the "Inject NAND to emuNAND" button, and open the CFW_NAND.bin file that was created. This will take some time as well. Once it's complete, remove and reinsert your big SD card into your computer, and then open it again. You'll notice that you have no data there, except for a "LAUNCHER.DAT" file, left by the Gateway EmuNAND creator tool. You can delete this now, as you will no longer need it.

Step 5)

take your big SD out of your computer, and put it back into your 3DS. Power on your 3DS and accept the prompt for the 3DS to create new SD card data. If it prompts you to update, of course, cancel the update and never accept it. If you do, you'll have to put that NAND.bin backup you made earlier to use in order to restore the console to a working/exploitable condition.

Once the 3DS finishes making the SD card data, remove it from the 3DS once more and put it into your computer. You should now find a "Nintendo 3DS" folder on your big SD. Open it, and open the two subsequent folders that are inside that folder. They will have seemingly randomized names, but they are part of your console's ID numbers. As a result, they will be different for everyone.

This folder should be empty, or it might have the following folders in it:

- dbs
- exdata
- title

Any folders that are missing of these three, I recommend you create. The priority one, however, is the "dbs" folder. Create it if it doesn't yet exist. Open it, and delete anything inside it if there is anything. There shouldn't be, so you will not have to do this most likely. Navigate to the included archive for this tutorial, and open up the "Database Files" folder. Inside this folder, you'll find two files. They are "import.db" and "title.db". copy both of them to your big SD card's "dbs" folder. Now put the big SD card back into your 3DS.

Step 6)

Open the "System Settings" app again, and navigate to "Data Management", in there, open "Nintendo 3DS", and then open "Software". This should launch a prompt that says "The SD Card software management information is corrupted. Reset it now? This will delete all software and save data.".
Select "Reset", and wait for it to complete.

Now, take your big SD card out of the 3DS once more, and insert it into your computer. Navigate to the included archive for this tutorial and open the "SD Card" folder. Copy all of the files in here to the root of the big SD card except for "Launcher.dat". Once copied, rename the "Launcher_GW.dat" to "Launcher.dat" on the big SD card. Finally, put the big SD card back onto your 3DS. You can now launch the custom firmware.

Step 7)

This CFW is yet buggy, so it may not actually start the first time... or the third... or the seventh. Don't worry, it will start eventually, but it can take a good number of tries. To get started, with your big SD card inside your 3DS console and your console powered on, open the "System Settings" app again. Now, open "Other Settings", then "Profile", and then, while holding down the "L" bumper like before, open the "Nintendo DS Profile". This may result in one of three situations.

1) The top screen turns blue, and the bottom screen goes from black, to white, and back to black again.
- This means it worked, and the custom firmware will launch in a moment.

2) The top screen turns blue, and the bottom screen goes black, nothing happens after this.
- This means something went wrong with the exploit, and you'll need to try again. Hold the power button until the 3DS shuts off, then turn it back on, and follow from the start of Step 7 again.

3) The top screen turns blue, and the bottom screen goes black, then white, and nothing happens after this.
- This means something went wrong with the exploit, and you'll need to try again. Hold the power button until the 3DS shuts off, then turn it back on, and follow from the start of Step 7 again.

If you got the CFW to start, congratulations, on to the next step!

Step 8)

Open the archive included with this tutorial again, and in there, you'll find at the root, a batch file named "run.bat". Right-click it, and select "Edit". It should now open in Notepad. At the part where it says "192.168.2.237", replace that with the static IP address you assigned to your 3DS console during Step 1. As mine was "192.168.2.237", I have left that in there for those who decided to use the same IP. Now, simply click on the "File" drop-down menu and click on "Save". You can now close the Notepad window.

To install, for example, the DevMenu.cia that you, for example, acquired from Govanify's CFW package on his website, simply rename the .cia file to "ciatoinstall.cia" and make sure it is in the same folder as the "run.bat" file. Now, with the 3DS running the CFW and your computer ready, run the "run.bat" file and wait for the installer to complete. You want it to return an "error code index 0", which means that it worked. Next, press the power button on your 3DS. Don't power the console off, just wait for the power off menu to open, and then press the "Home" button on your 3DS to re-load the home menu. A new Present should appear on your home screen. Open it, and you'll find the application has been installed successfully.

If you've converted a game into a .cia file, you'll find that only games with a correctly formatted .rsf file will properly launch from here though, and do not have firmware dependencies from higher than firmware 4.5.0.

You can install CIA files over your network, or through the DevMenu, if you install it.

Thus concludes the CFW installation guide, I hope this helps some of you out, and I'll try to update it as new developments come about.

 

[Arnold0]

you have to add devkitarm to windows path

I didn't even took the good compilator (There is two to compile ARM9 and I took the wrong one, then I had to do what you said.)

Will try to see if it works and if yes if I can get the xorpad for exefs from a 7.x rom

 

[CalebW]

You don't.

You can't change out the .sav in the respective folder?

 

[Queno138]

You can't change out the .sav in the respective folder?

I made an error and made my saving required 128MB instead of KB.

I intend to do a check.

I'm going to go out of a limb and say there might be encryption issues somewhere,
but we don't test, we won't know.


EDIT:
I took a look at the sav created by the 3ds in the folder.
It's encrypted.

 

[asesin22]

Welp, I might as well do my own write-up of the steps if everyone else is:

-----------------------------------------------------------
How To Install Palantine CFW
-----------------------------------------------------------

Requirements:

1) 4.5.0 or lower firmware Nintendo 3DS/XL/LL console with a 2GB or larger internal SD card
2) A DS mode Flashcart, like the DSTWO
3) Windows Vista or a newer version of Windows
4) These files: http://www.mediafire.com/download/i790kmos1zvv478/Palantine_CFW_Files.rar
5) Gateway's latest Launcher.dat (Google it, as we can't link it here)
6) For installing anything, you'll need the DevMenu.cia (you can get if from Govanify's CFW package hosted on his site, if you're brave enough to trek there)
7) Patience and a working brain

Step 1)

Before you do anything, you need to set up your 3DS network settings so it can connect to your network successfully with a static IP. To do this, follow the picture guide I've laid out on imgur (to save space in this guide, of course).

[Initial Setup Picture Guide]

http://imgur.com/a/jZnPC

Step 2)

You're going to need a DS-Mode flashcart to continue from here on out.

[Picture guide incoming]

Download the files package from the link further up in this thread, and extract it using WinRAR.
Inside this package, I've included everything I legally can to get you set up.

This includes:

- Palantine CFW 1.0
- EmuNAND Tool 1.0.1
(note, this may be detected as a virus by your antivirus software. I can assure you that it isn't, but you can do this manually with a hex editor of your choice if you are too skeptical of using this software. Many on this forum use it, so if it was a virus, it would have been removed long ago.)
- EmuNAND to CFW-NAND batch file
- ROP Multi-loader
- blank database files

From the archive, open "EmuNAND Setup", and in there, locate "For DS Flashcart".
You'll find the file "rop_multiloader.nds" in there. Copy that file to the root of your DS Flashcart's MicroSD card. Then, put that MicroSD card into your DS Flashcart, insert it into your 3DS, and start it up. From the flashcart's menu, browse to the root of your MicroSD card and launch the "rop_multiloader.nds" file. In here, select "Gateway 4x" and then press the home button when it finishes.

Step 3)

Pull the big SD card from your 3DS and put it into your computer. You now need the Gateway 3DS launcher, which you can acquire from the downloads section of their website.

Before you continue, I recommend backing up all of the contents of your big SD card. This next step will, unfortunately, cause all data on the big SD to be lost otherwise.

Locate the "Launcher.dat" within the Gateway firmware package and copy it to the root of the big SD card. Next, insert the big SD card back into your 3DS.

You can now start the MSET profile exploit. To do this, open the system settings app, go to "Other Settings", then open "Profile", and follow that with holding down the "L" bumper, located on the back, left hand side of your 3DS (from the front of the unit). While continuing to hold the "L" bumper, with your other hand, open the "Nintendo DS Profile". This will trigger the exploit, and open the Gateway configuration menu. In here, you're going to want to first make a NAND backup. I'd advise that you plug in your 3DS to a power source from here on out. To do this, use the D-Pad of your 3DS to go over to "BACKUP SYSTEM NAND", then press the "A" button on that, and when the next menu comes up, press the "Start" button. This will give you a complete NAND backup, so if something goes wrong, you can have it restored to that backup at any time through the use of a hardware eMMC NAND programmer. Once that backup has completed, just hold the power button on your console until it turns off, and remove the big SD card. Put the big SD card into your computer and copy the "NAND.bin" file off of the big SD card, and put the backup in a safe place.

Next, start up the Gateway menu the same way as before, but this time, go all the way over to the option that says "FORMAT EMUNAND". Press the "A" button on this option, and when it loads up, press the "Start" button. This will take some time to complete, about as much as the original NAND backup, so go take a break while your 3DS does it's work. Once it's done, hold the power button until it turns off again, and you'll be ready for the next step.

Step 4)

Take the big SD card out of your 3DS again, and put it in to your computer. You're going to need to use EmuNAND Tool 1.0.1 now, so, although it pains me to say this, but if you have an antivirus software that isn't fond of this program, you will need to disable it until we're done this step.

Start up EmuNAND tool, and, with your big SD still plugged in, click on the "Extract emuNAND" button. Direct the emuNAND tool to the "EmuNAND Setup" folder of the extracted archive included in this tutorial, and save the backup as "EmuNAND.bin". Next, once it has completed, drag and drop the EmuNAND.bin file you created onto the "drag_emunand_here.bat", and wait for it to finish. It will create a CFW_NAND.bin for you to work with. Once it's done generating the CFW_NAND.bin, go back into EmuNAND Tool 1.0.1 and click on the "Inject NAND to emuNAND" button, and open the CFW_NAND.bin file that was created. This will take some time as well. Once it's complete, remove and reinsert your big SD card into your computer, and then open it again. You'll notice that you have no data there, except for a "LAUNCHER.DAT" file, left by the Gateway EmuNAND creator tool. You can delete this now, as you will no longer need it.

Step 5)

take your big SD out of your computer, and put it back into your 3DS. Power on your 3DS and accept the prompt for the 3DS to create new SD card data. If it prompts you to update, of course, cancel the update and never accept it. If you do, you'll have to put that NAND.bin backup you made earlier to use in order to restore the console to a working/exploitable condition.

Once the 3DS finishes making the SD card data, remove it from the 3DS once more and put it into your computer. You should now find a "Nintendo 3DS" folder on your big SD. Open it, and open the two subsequent folders that are inside that folder. They will have seemingly randomized names, but they are part of your console's ID numbers. As a result, they will be different for everyone.

This folder should be empty, or it might have the following folders in it:

- dbs
- exdata
- title

Any folders that are missing of these three, I recommend you create. The priority one, however, is the "dbs" folder. Create it if it doesn't yet exist. Open it, and delete anything inside it if there is anything. There shouldn't be, so you will not have to do this most likely. Navigate to the included archive for this tutorial, and open up the "Database Files" folder. Inside this folder, you'll find two files. They are "import.db" and "title.db". copy both of them to your big SD card's "dbs" folder. Now put the big SD card back into your 3DS.

Step 6)

Open the "System Settings" app again, and navigate to "Data Management", in there, open "Nintendo 3DS", and then open "Software". This should launch a prompt that says "The SD Card software management information is corrupted. Reset it now? This will delete all software and save data.".
Select "Reset", and wait for it to complete.

Now, take your big SD card out of the 3DS once more, and insert it into your computer. Navigate to the included archive for this tutorial and open the "SD Card" folder. Copy all of the files in here to the root of the big SD card except for "Launcher.dat". Once copied, rename the "Launcher_GW.dat" to "Launcher.dat" on the big SD card. Finally, put the big SD card back onto your 3DS. You can now launch the custom firmware.

Step 7)

This CFW is yet buggy, so it may not actually start the first time... or the third... or the seventh. Don't worry, it will start eventually, but it can take a good number of tries. To get started, with your big SD card inside your 3DS console and your console powered on, open the "System Settings" app again. Now, open "Other Settings", then "Profile", and then, while holding down the "L" bumper like before, open the "Nintendo DS Profile". This may result in one of three situations.

1) The top screen turns blue, and the bottom screen goes from black, to white, and back to black again.
- This means it worked, and the custom firmware will launch in a moment.

2) The top screen turns blue, and the bottom screen goes black, nothing happens after this.
- This means something went wrong with the exploit, and you'll need to try again. Hold the power button until the 3DS shuts off, then turn it back on, and follow from the start of Step 7 again.

3) The top screen turns blue, and the bottom screen goes black, then white, and nothing happens after this.
- This means something went wrong with the exploit, and you'll need to try again. Hold the power button until the 3DS shuts off, then turn it back on, and follow from the start of Step 7 again.

If you got the CFW to start, congratulations, on to the next step!

Step 8)

Open the archive included with this tutorial again, and in there, you'll find at the root, a batch file named "run.bat". Right-click it, and select "Edit". It should now open in Notepad. At the part where it says "192.168.2.237", replace that with the static IP address you assigned to your 3DS console during Step 1. As mine was "192.168.2.237", I have left that in there for those who decided to use the same IP. Now, simply click on the "File" drop-down menu and click on "Save". You can now close the Notepad window.

To install, for example, the DevMenu.cia that you, for example, acquired from Govanify's CFW package on his website, simply rename the .cia file to "ciatoinstall.cia" and make sure it is in the same folder as the "run.bat" file. Now, with the 3DS running the CFW and your computer ready, run the "run.bat" file and wait for the installer to complete. You want it to return an "error code index 0", which means that it worked. Next, press the power button on your 3DS. Don't power the console off, just wait for the power off menu to open, and then press the "Home" button on your 3DS to re-load the home menu. A new Present should appear on your home screen. Open it, and you'll find the application has been installed successfully.

If you've converted a game into a .cia file, you'll find that only games with a correctly formatted .rsf file will properly launch from here though, and do not have firmware dependencies from higher than firmware 4.5.0.

You can install CIA files over your network, or through the DevMenu, if you install it.

Thus concludes the CFW installation guide, I hope this helps some of you out, and I'll try to update it as new developments come about.

failed to conect

 

[asesin22]

failed to conect

and thx

 

[CalebW]

Does anyone know if we can play online with cia roms?

 

[intermet]

Does anyone know if we can play online with cia roms?

we don't have up to date firmware so we play online (not related to cia).

 

[Gadorach]

Does anyone know if we can play online with cia roms?

The main issues I can see would be that we haven't included any sort of header into the CIA, so it has no ID data. Past that, we can't install DLC yet, so games that need it won't connect. Plus, I was under the impression that we needed higher firmwares running to connect to NN now, so it would fail regardless.

 

[intermet]

I install zelda a link between world with success , but when i launch the game 3ds logo appears but just after i get an error (reboot system etc )