Hacking (4.x only) CIA CFW Complete Guide

[VerseHell]

I've already tried that and it also didn't work. I also changed the ip to the one you used so I didn't have to edit the bat, but then it failed to connect.
http://i.imgur.com/mRbqgTt.png

Do you see your 3ds with this : http://www.nirsoft.net/utils/wireless_network_watcher.html ?

 

[ilollo360]

Gadorach Can you help me? I tried to convert Animal Crossing. It works but it doesn't save. This is my RSF file:

BasicInfo:
Title : "Animal Crossing" #edit
CompanyCode : "01"
ProductCode : "CTR-P-EGDP" #edit
ContentType : Application
Logo : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem

Rom:
# Specifies the root path of the file system to include in the ROM.
HostRoot : "decrypted/romfs"


TitleInfo:
UniqueId : 0x0864 #edit
Category : Application

CardInfo:
MediaSize : 1GB # 128MB / 256MB / 512MB / 1GB / 2GB / 4GB #edit
MediaType : Card2 # Card1 / Card2
CardDevice : None # NorFlash(Pick this if you use savedata) / None #Choose None if it's a card2 game

Option:
UseOnSD : true # true if App is to be installed to SD
FreeProductCode : true # Removes limitations on ProductCode
MediaFootPadding : true # If true CCI files are created with padding
EnableCrypt : false # Enables encryption for NCCH and CIA
EnableCompress : true # Compresses exefs code

ExeFs: # these are the program segments from the ELF, check your elf for the appropriate segment names
ReadOnly:
- .rodata
- RO
ReadWrite:
- .data
- RO
Text:
- .init
- .text
- STUP_ENTRY

PlainRegion: # only used with SDK ELFs
- .module_id

AccessControlInfo:
UseExtSaveData : true
ExtSaveDataId: 0x0864 #edit, same as UniqueId
SystemSaveDataId1: 0x00000000 # plaintext exheader
SystemSaveDataId2: 0x00000000 # plaintext exheader
OtherUserSaveDataId1: 0x00000 # plaintext exheader
OtherUserSaveDataId2: 0x00000 # plaintext exheader
OtherUserSaveDataId3: 0x00000 # plaintext exheader
UseOtherVariationSaveData : false

SystemControlInfo:
SaveDataSize: 1MB
RemasterVersion: 0
StackSize: 0x40000

# DO NOT EDIT BELOW HERE OR PROGRAMS WILL NOT LAUNCH (most likely)

AccessControlInfo:
FileSystemAccess:
- Debug
- DirectSdmc
- DirectSdmcWrite

IdealProcessor : 0
AffinityMask : 1

Priority : 16

MaxCpu : 0x9E # Default

CoreVersion : 2
DescVersion : 2

ReleaseKernelMajor : "02"
ReleaseKernelMinor : "33"
MemoryType : Application
HandleTableSize: 512
IORegisterMapping:
- 1ff50000-1ff57fff
- 1ff70000-1ff77fff
MemoryMapping:
- 1f000000-1f5fffff:r
SystemCallAccess:
ArbitrateAddress: 34
Break: 60
CancelTimer: 28
ClearEvent: 25
ClearTimer: 29
CloseHandle: 35
ConnectToPort: 45
ControlMemory: 1
CreateAddressArbiter: 33
CreateEvent: 23
CreateMemoryBlock: 30
CreateMutex: 19
CreateSemaphore: 21
CreateThread: 8
CreateTimer: 26
DuplicateHandle: 39
ExitProcess: 3
ExitThread: 9
GetCurrentProcessorNumber: 17
GetHandleInfo: 41
GetProcessId: 53
GetProcessIdOfThread: 54
GetProcessIdealProcessor: 6
GetProcessInfo: 43
GetResourceLimit: 56
GetResourceLimitCurrentValues: 58
GetResourceLimitLimitValues: 57
GetSystemInfo: 42
GetSystemTick: 40
GetThreadContext: 59
GetThreadId: 55
GetThreadIdealProcessor: 15
GetThreadInfo: 44
GetThreadPriority: 11
MapMemoryBlock: 31
OutputDebugString: 61
QueryMemory: 2
ReleaseMutex: 20
ReleaseSemaphore: 22
SendSyncRequest1: 46
SendSyncRequest2: 47
SendSyncRequest3: 48
SendSyncRequest4: 49
SendSyncRequest: 50
SetThreadPriority: 12
SetTimer: 27
SignalEvent: 24
SleepThread: 10
UnmapMemoryBlock: 32
WaitSynchronization1: 36
WaitSynchronizationN: 37
InterruptNumbers:
ServiceAccessControl:
- APT:U
- $hioFIO
- $hostio0
- $hostio1
- ac:u
- boss:U
- cam:u
- cecd:u
- cfg:u
- dlp:FKCL
- dlp:SRVR
- dsp:SP
- frd:u
- fs:USER
- gsp::Gpu
- hid:USER
- http:C
- mic:u
- ndm:u
- news:u
- nwm::UDS
- ptm:u
- pxi:dev
- soc:U
- ssl:C
- y2r:u
- ldr:ro
- ir:USER


SystemControlInfo:
Dependency:
ac: 0x0004013000002402L
am: 0x0004013000001502L
boss: 0x0004013000003402L
camera: 0x0004013000001602L
cecd: 0x0004013000002602L
cfg: 0x0004013000001702L
codec: 0x0004013000001802L
csnd: 0x0004013000002702L
dlp: 0x0004013000002802L
dsp: 0x0004013000001a02L
friends: 0x0004013000003202L
gpio: 0x0004013000001b02L
gsp: 0x0004013000001c02L
hid: 0x0004013000001d02L
http: 0x0004013000002902L
i2c: 0x0004013000001e02L
ir: 0x0004013000003302L
mcu: 0x0004013000001f02L
mic: 0x0004013000002002L
ndm: 0x0004013000002b02L
news: 0x0004013000003502L
nim: 0x0004013000002c02L
nwm: 0x0004013000002d02L
pdn: 0x0004013000002102L
ps: 0x0004013000003102L
ptm: 0x0004013000002202L
ro: 0x0004013000003702L
socket: 0x0004013000002e02L
spi: 0x0004013000002302L
ssl: 0x0004013000002f02L
CommonHeaderKey:
D: |
jL2yO86eUQnYbXIrzgFVMm7FVze0LglZ2f5g+c42hWoEdnb5BOotaMQPBfqt
aUyAEmzQPaoi/4l4V+hTJRXQfthVRqIEx27B84l8LA6Tl5Fy9PaQaQ+4yRfP
g6ylH2l0EikrIVjy2uMlFgl0QJCrG+QGKHftxhaGCifdAwFNmiZuyJ/TmktZ
0RCb66lYcr2h/p2G7SnpKUliS9h9KnpmG+UEgVYQUK+4SCfByUa9PxYGpT0E
nw1UcRz0gsBmdOqcgzwnAd9vVqgb42hVn6uQZyAl+j1RKiMWywZarazIR/k5
Lmr4+groimSEa+3ajyoIho9WaWTDmFU3mkhA2tUDIQ==
Exponent: |
AQAB
Modulus: |
zwCcsyCgMkdlieCgQMVXA6X2jmb1ICjup0Q+jk/AydPkOgsx7I/MjUymFEkU
vgXBtCKtzh3NKXtFFuW51tJ60GPOabLKuG0Qm5li+UXALrWhzWuvd5vv2FZI
dTQCbrq/MFS/M02xNtwqzWiBjE/LwqIdbrDAAvX4HGy0ydaQJ1DKYeQeph5D
lAGBw2nQ4izXhhuLaU3w8VQkIJHdhxIKI5gJY/20AGkG0vHD553Mh5kBINrWp
CRYmmJS8DCYbAiQtKbkeUfzHViGTZuj6PwaY8Mv39PGO47a++pt45IUyCEs4/
LjMS72cyfo8tU4twRGp76SFGYejYj3wGC1f/POQw==
Signature: |
BOPR0jL0BOV5Zx502BuPbOvi/hvOq5ID8Dz1MQfOjkey6FKP/6cb4f9YXpm6c
ZCHAZLo0GduKdMepiKPUq1rsbbAxkRdQdjOOusEWoxNA58x3E4373tCAhlqM2
DvuQERrIIQ/XnYLV9C3uw4efZwhFqog1jvVyoEHpuvs8xnYtGbsKQ8FrgLwXv
pOZYy9cSgq+jqLy2D9IxiowPcbq2cRlbW9d2xlUfpq0AohyuXQhpxn7d9RUor
9veoARRAdxRJK12EpcSoEM1LhTRYdJnSRCY3x3p6YIV3c+l1sWvaQwKt0sZ/U
8TTDx2gb9g7r/+U9icneu/zlqUpSkexCS009Q==
Descriptor: |
AP///wAABAACAAAAAAAFGJ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiIAAAAAAAABBUFQ6VQAAACRo
aW9GSU8AJGhvc3RpbzAkaG9zdGlvMWFjOnUAAAAAYm9zczpVAABjYW06dQAA
AGNlY2Q6dQAAY2ZnOnUAAABkbHA6RktDTGRscDpTUlZSZHNwOjpEU1BmcmQ6
dQAAAGZzOlVTRVIAZ3NwOjpHcHVoaWQ6VVNFUmh0dHA6QwAAbWljOnUAAABu
ZG06dQAAAG5ld3M6dQAAbndtOjpVRFNwdG06dQAAAHB4aTpkZXYAc29jOlUA
AABzc2w6QwAAAHkycjp1AAAAbGRyOnJvAABpcjpVU0VSAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAABOn/rw/7//8ec/APIA8JH/APaR/1D/gf9Y/4H/cP+B/3j/gf8B
AQD/AAIA/iECAPz/////////////////////////////////////////////
////////////////////////////////////////AAAAAAAAAAAAAAAAAAAA
AAADAAAAAAAAAAAAAAAAAAI=

 

[descac]

Oh finally I can do thing's what I like.

Here we go. Got any other games in mind?

 

[cooroxd]

Here we go. Got any other games in mind?

Please do pokemon x/y with a save file.

 

[GibWaffles]

Do you see your 3ds with this : http://www.nirsoft.net/utils/wireless_network_watcher.html ?

I see it until the exploit runs. Then it stops. And the 3ds doesn't display "internet" in the top left corner, but "streetpass" instead.

 

[VerseHell]

I see it until the exploit runs. Then it stops. And the 3ds doesn't display "internet" in the top left corner, but "streetpass" instead.

Launch the exploit without holding L, then try to set up you internet connection again.

 

[kamo]

REGION FREE WORKING!

Do the stuff I said to do, exactly.

I'm using VerseHell's package to create the cia. Is there a way to incorporate this?

 

[Gadorach]

For anyone who needs the "Hatsune Miku - Project Mirai 2" cia.rsf, here you go:

BasicInfo:
  Title                  : "Hatsune Miku - Project Mirai 2"
  CompanyCode            : "01"
  ProductCode            : "CTR-P-AHNJ"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x0cc4
  Category                : Application
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
AccessControlInfo:
  ExtSaveDataId: 0xb0cc4 # same as UniqueId
  SystemSaveDataId1: 0x000cc400 # plaintext exheader
  SystemSaveDataId2: 0x000cc400 # plaintext exheader
  OtherUserSaveDataId1: 0xcc400 # plaintext exheader
  OtherUserSaveDataId2: 0xcc400 # plaintext exheader
  OtherUserSaveDataId3: 0xcc400 # plaintext exheader
  UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00040000 # plaintext exheader
  JumpId: 0x00040000000cc400L # plaintext exheader (<full UniqueID>L)

For region free, open your "icon.bin" in a hex editor, find offset "0x2018", and replace the "0X 00 00 00" with "7F FF FF FF".

Also, expect a few SD card errors when you start it. I'm not sure how to correct them, but saving works just fine and everything's working in-game. The game itself is just bitching about something I don't yet understand. Anyway, it's fine, just press "A" and keep going.

 

[CalebW]

Has anybody gotton Fire emblem to work on CFW 4.X?

 

[ernilos]

Here we go. Got any other games in mind?

I'm open to everything
Fate/Kaleid it's preatty easy as it uses a LUA interpreter.

 

[misterb98]

Has anybody gotton Fire emblem to work on CFW 4.X?

Going to try, already built a cia, but network web filter blocks the CFW download.

Would anyone mind mirroring it to sendspace or filetrip?

 

[Gadorach]

Has anybody gotton Fire emblem to work on CFW 4.X?

Totally forgot about that, I'll check it out.

Going to try, already built a cia, but network web filter blocks the CFW download.

Would anyone mind mirroring it to sendspace or filetrip?

It's in my 3DS Palantine CFW Setup Guide's file package, link in signature.

 

[VerseHell]

I'm using VerseHell's package to create the cia. Is there a way to incorporate this?

You should can if you separate the unpack and makerom in 2 differents .bat. I'll do it later if you can't.

 

[GibWaffles]

Launch the exploit without holding L, then try to set up you internet connection again.

Didn't work. I went to settings and set up the connection again, but after I exited, I think it's not running the exploited firmware anymore. I can see the cartridge icon again. Also, that program sees the 3ds again, but the bat fails to connect anyway.

 

[kamo]

You should can if you separate the unpack and makerom in 2 differents .bat. I'll do it later if you can't.

Thanks. If I knew at which line I should separate the batch I think I could do it on my own.

edit
Or maybe not, I'm not sure, lol.

 

[VerseHell]

Thanks. If I knew at which line I should separate the batch I think I could do it on my own.

edit
Or maybe not, I'm not sure, lol.

Just before th "building cia", but you must copy the 2 firsts lines too, or else your cia will be named ".cia"

 

[descac]

I'm open to everything
Fate/Kaleid it's preatty easy as it uses a LUA interpreter.

I'd suggest Medarot, but that probably won't be as easy.

 

[pLaYeR^^]

What do im wrong? Mario Kart 7 hangs, when i boot it...

 

[kamo]

Just before th "building cia", but you must copy the 2 firsts lines too, or else your cia will be named ".cia"

The first two lines of the whole batch?

[USER=325063]Echo[/USER] off
set /p dsfile=Enter the filename (without 3ds extension):

This one?

 

[VerseHell]

The first two lines of the whole batch?

[USER=325063]Echo[/USER] off
set /p dsfile=Enter the filename (without 3ds extension):

This one?

Yes that,it asks you your rom name then put it on the %dsfile% variable.