Hacking (4.x only) CIA CFW Complete Guide

AHP_person

Well-Known Member
Member
Joined
Nov 2, 2014
Messages
364
Trophies
0
XP
518
Country
United States
Worked just fine, here's the stuff:

.rsf
Code:
BasicInfo:
  Title                  : "Cave Story - USA"
  CompanyCode            : "01"
  ProductCode            : "CTR-P-ACVE"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x04a1
  Category                : Application
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
AccessControlInfo:
  ExtSaveDataId: 0xb04a1 # same as UniqueId
  SystemSaveDataId1: 0x0004a100 # plaintext exheader
  SystemSaveDataId2: 0x0004a100 # plaintext exheader
  OtherUserSaveDataId1: 0x4a100 # plaintext exheader
  OtherUserSaveDataId2: 0x4a100 # plaintext exheader
  OtherUserSaveDataId3: 0x4a100 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00040000 # plaintext exheader
  JumpId: 0x000400000004a100L # plaintext exheader (<full UniqueID>L)

switches

Code:
makerom -f cia -rsf cia.rsf -target t -desc app:2 -icon icon.bin -banner banner.bin -exefslogo -code code.bin -exheader decrypted_exheader.bin -romfs decrypted_romfs.bin -o CaveStory.cia

Interesting, I'll try that right now.

EDIT: It worked! Wow, I have no idea what was causing it to fail. Maybe -desc app:1/4, yours was app:2? I dunno, but thanks a lot!
 

Vappy

Well-Known Member
Member
Joined
May 23, 2012
Messages
1,508
Trophies
2
XP
2,613
Country
Seems like you could remove MediaFootPadding, since it only affects CCI files? And could probably trim down the template a bit more, but I'm too lazy to experiment. :P
 

CraddaPoosta

Sepatown, my damie.
Member
Joined
May 3, 2010
Messages
1,326
Trophies
1
XP
2,664
Country
United States
None of this makes any sense to me. I managed to finally decrypt a ROM, but there was no header, no code.bin, nothing like that. Bunch of folders that I have no idea what to do with. Four hours of failure.
 

Vappy

Well-Known Member
Member
Joined
May 23, 2012
Messages
1,508
Trophies
2
XP
2,613
Country
https://mega.co.nz/#!709SEJrD!5kg83SClvZk6oR-q_XNDhsXiIk6A4s6akgkZxWcHPYI Updated my batch file for building a .cia, now it's a single drag and drop job that's self cleaning. :P (Though obviously you still need to run the NCCH Decryptor to generate the xorpads) I still expect anyone at all experienced in python to look at the rsfgen.py and cringe, but it does the job!
 

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
I feel like I should upload my conversion directory, minus the stuff I can't. If nothing else, we'd all be on the same page then.

You know what, here. It's full of bat files, some written by me, some stolen from others. Enjoy.

http://www.mediafire.com/download/c82sc7gdw2e42zv/3DS_to_CIA_Package.rar

---------------------------------------------------------
Instructions
---------------------------------------------------------

Step 1)

Open the "padgen_v3" folder and drop your .3ds file on "ctrKeyGen.py". It will generate an "ncchinfo.bin".
Put this onto your bigSD card, and use your copy of PadGen v3 to create your xorpads.

Step 2)

Open 3DSExplorer, and right-click -> save to each of the main sectors of your backup ROM.3DS.
Save them as the following:

romfs.bin
exheader.bin
exefs.bin

Copy/move these files to "workdir".

Step 3)

Copy your newly generated xorpads from your bigSD card and place them in "workdir".
Rename them to the following:

romfs.xorpad
exheader.xorpad
exefs.xorpad

Step 4)

Run batch files 1, 3, and 4.

Now, in 3DSExplorer, with your ROM.3ds opened, select "PlainRegion" and look to the right ride window.
You'll see something like this:
e06e32b2df.png


Where it says [SDK+NINTENDO:Firmware-XX_XX], the "XX_XX" is your clue to the required SDK permissions.
As this one says "02_27", that's Firmware 2, so we can safely assume it uses firmware 2 and lower functions.
The SDK is also shown as SDK 1.2.0.200, so it may even run at Firmware 1, but we'll use 2 to be safe.
This will be needed for editing batch file 5.

Also, while still in 3DSExplorer, look at "NCCH (CTR-P-XXXX) 0". The value shown at "CTR-P-XXXX" is your game's product code. Add that to the cia.rsf in the Product code section.

Step 5)

Open the .rsf file.
It will look like this:

Code:
BasicInfo:
  Title                  : "Cave Story - USA"
  CompanyCode            : "01"
  ProductCode            : "CTR-P-ACVE"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x04a1
  Category                : Application
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
AccessControlInfo:
  ExtSaveDataId: 0xb04a1 # same as UniqueId
  SystemSaveDataId1: 0x0004a100 # plaintext exheader
  SystemSaveDataId2: 0x0004a100 # plaintext exheader
  OtherUserSaveDataId1: 0x4a100 # plaintext exheader
  OtherUserSaveDataId2: 0x4a100 # plaintext exheader
  OtherUserSaveDataId3: 0x4a100 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00040000 # plaintext exheader
  JumpId: 0x000400000004a100L # plaintext exheader (<full UniqueID>L)

Now, look inside "workdir" for your exheader.txt.
Open it, and search for the line "Program id: XXXXXXXXXXXXXXXX"
The unique ID is from the 5th last position to the 3rd last position.
If yours says, for example, "Program id: 000400000004a100", which is Cave Story USA, your unique ID would be "4a1".
Simply replace all the entries in the above "cia.rsf" that say "4a1" with your game's unique ID.
Also replace the title and product code information with the ones from your game.
Save and close your cia.rsf file, you're done with it for now.

Step 6)

right-click -> edit the "5-build-cia.bat" file, and look for the part that says "-desc app:2". Edit the "2" to the SDK version hinted at by the earlier check we made. For example, if it's SDK 4, make that say "-desc app:4", which would be used by, for example, LoZ-ALBW.

Save the edited batch file, and then run it. You should be presented with an "Install.cia" file. You can rename that to the name of your game now, and copy it to the root of your SD card.

Step 7)

Install the new "Install.cia" you generated with either DevMenu or over your network.
Done.

--------------------------------------------------------------
To Add a Manual to your CIA File
--------------------------------------------------------------

It's simple really, just open 3DSExplorer, and right-click where it shows in this picture:

40d5985c32.png


Right here:

4cd186e8a2.png


Save it as "manual.cxi" in your "workdir" folder.

9a605f9b01.png


Rename to:

83aef716d5.png


And then save it.

Next, rename it from "manual.cxi" to "manual.cfa":

5f2d891f7d.png


to:

05ff16c6e1.png


Next, you'll have to edit your build batch file (5-build-cia.bat).

Right-click -> edit

Replace the entire contents with the code found at the following link: http://pastebin.com/e8nnr2HD

You'll want to copy the contents of the "RAW Paste Data" Section, as otherwise you'll be presented with a lot of whitespace (spaces) in the editor, which just looks bad.

Then, assuming everything's in the right spot, just save and run your build script (5-build-cia.bat) and you will now have a manual in your compiled CIA.

--------------------------------------------------------------
To Make your CIA Game Region Free
--------------------------------------------------------------

You'll need a Hex editor for this.
I'd suggest a free one, like HxD, found here: http://mh-nexus.de/en/downloads.php?product=HxD
Download the version for your language and install it.

Once it's installed, you'll need to open up your "icon.bin" file with it. You can either drag-and-drop your "icon.bin" file into HxD's main window, or open it through the [File -> Open] drop-down menu.

Once it's open, you should see something like this:

2e1f071b36.png


Now, you're going to want to hold the [Ctrl] button on your keyboard and press "G", so [Ctrl+G].
This window will open:

d050023928.png


Now, You're going to want to type "2018" into the textbox underneath "Offset", so it looks like this:

df777ee45b.png


Then, just click on the "OK" button. You'll find yourself in this location:

cfeed423ca.png


Now, simply type "7FFFFFFF" into your keyboard. You'll end up with something that looks like this:

6afaedb682.png


Now, just hold [Ctrl] again, and press "S", so [Ctrl+S]. You'll know it worked if the red text turned black, like this:

a5d56c8d36.png


Finally, you can close HxD and run your "5-build-cia.bat" file. Your CIA is now Region Free and will show up on any console's home menu!

For a complete list of all of the possible region codes, refer to this:

Code:
0x01 = Japan
 
0x02 = North America
 
0x04 = Europe
 
0x08 = Australia
 
0x10 = China
 
0x20 = Korea
 
0x40 = Taiwan
 
0x7FFFFFFF = Region Free
 

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
Interesting, I'll try that right now.

EDIT: It worked! Wow, I have no idea what was causing it to fail. Maybe -desc app:1/4, yours was app:2? I dunno, but thanks a lot!
No problem, glad I could help you out. Hopefully my slightly more laid-out tutorial will help others as well.
 
  • Like
Reactions: Vappy

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
https://mega.co.nz/#!709SEJrD!5kg83SClvZk6oR-q_XNDhsXiIk6A4s6akgkZxWcHPYI Updated my batch file for building a .cia, now it's a single drag and drop job that's self cleaning. :P (Though obviously you still need to run the NCCH Decryptor to generate the xorpads) I still expect anyone at all experienced in python to look at the rsfgen.py and cringe, but it does the job!
Great, now we have both an auto-mode and a hard mode tutorial all laid out. :P

Great job by the way, bad python or not, it's great to have an automated script already.
 
  • Like
Reactions: Margen67

Vappy

Well-Known Member
Member
Joined
May 23, 2012
Messages
1,508
Trophies
2
XP
2,613
Country
Great, now we have both an auto-mode and a hard mode tutorial all laid out. :P

Great job by the way, bad python or not, it's great to have an automated script already.
Aha, thanks, I'm just hoping it does actually cover at least most games. Either that, or someone else writes a script that's better written and easier to update! :D

hey , this CFW need the red card GATEWAY or not
It does not, but you also cannot update to a new firmware.
 

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
^
a static ip for the 3ds isn't required
True, but it makes it easier to work with, and you don't have to look up your IP address every time you connect it to your network when/if you need to install a .cia over your network. It also makes it much easier to read debug output if you can write your scripts with a static IP to listen to a specific port. There's plenty of advantages, but you're right, it's not "necessary".
 

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
Is it possible to update to 9.2 firmware without having the red Gateway?
Palantine CFW 1.0 is only compatible with 4.1-4.5 firmware at this time. You'll have to wait until the CFW is updated to be compatible with newer 3DS firmwares. There's no ETA on that either, so you'll have to wait it out, or get a Gateway.


[Oops, didn't mean to double-post, sorry! Feel free to merge if you wish, mods.]
 

Misiel

Well-Known Member
Newcomer
Joined
Dec 11, 2013
Messages
60
Trophies
0
Age
30
XP
150
Country
Mexico
Step 4)

Run batch files 1, 3, and 4.

Error, ExeFS section 0 size invalid
Error, ExeFS section 1 size invalid
Error, ExeFS section 2 size invalid
Error, ExeFS section 3 size invalid
Error, ExeFS section 4 size invalid
Error, ExeFS section 5 size invalid
Error, ExeFS section 6 size invalid
Error, ExeFS section 7 size invalid


I get this when i run bat 4.

-----------------------------------------------------------------------------------------------------
Vappy metod created de cia but when i try to run it it get stuck in nintendo 3ds logo.
I got this error "exheader hasg mismatch,wrong key?" when it was creating the cia
 

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
I get this one i run bat 4.
That looks, to me, like you didn't decrypt your ExeFS correctly. My tutorial doesn't cover generating xorpads, unfortunately, as the latest version of crtKeyGen, the file that runs on your 3DS anyway, contains a private key owned by Nintendo. As a result, we can't post it on this forum. You'll have to refer to the original thread for insight on generating your xorpads.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Maximumbeans @ Maximumbeans: butte