Hacking (4.x only) CIA CFW Complete Guide

[VerseHell]

Here's my new 3ds to cia conversion guide :
Download this : http://jheberg.net/captcha/3ds-cia-conversion-tools-v7/
1. Put your rom in the folder, run rom_tool info.bat, enter your rom name without the .3ds extension and edit the rsf file with the right informations.
2. Follow the 3 first steps of this tutorial : https://gbatemp.net/threads/tutorial-how-to-decrypt-3ds-roms-for-dummies.372653/page-2#post-5136907

If you want to remove the region lock :
- Run unpack.bat enter your rom name without the .3ds extension
- Follow Gadorach's instructions here : https://gbatemp.net/threads/4-x-only-cia-cfw-complete-guide.373532/page-50#post-5149465 (works with Hex Worshop, just enter 2018 in the search bar)
- Run makerom.bat, enter the filename you want (without extension).

Else
- Just run unpack-makerom.bat, enter your rom name without the .3ds extension.

Edit : You can choose to delete the decrypted files after the conversion.

Added Gadorach's instructions to remove the region lock.

 

[Gadorach]

Update: Built a new, much more in-depth RSF requiring much more editing time. For those interested, here it is:

BasicInfo:
  Title                  : "Fire Emblem - Awakening - RF"
  CompanyCode            : "01"
  ProductCode            : "CTR-P-AFEE"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0x0a05
  Category                : Application
 
CardInfo:
  MediaSize              : 2GB # 128MB / 256MB / 512MB / 1GB / 2GB / 4GB #edit
  MediaType              : Card1 # Card1 / Card2
  CardDevice              : NorFlash # NorFlash(Pick this if you use savedata) / None (Choose None if it's a card2 game)
 
Option:
  UseOnSD                : true # true if App is to be #installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : true # If true CCI files are created with padding
 
ExeFs: # these are the program segments from the ELF, check your elf for the appropriate segment names
  ReadOnly:
  - .rodata
  - RO
  ReadWrite:
  - .data
  - RO
  Text:
  - .init
  - .text
  - STUP_ENTRY
 
PlainRegion: # only used with SDK ELFs
- .module_id
 
AccessControlInfo:
#UseExtSaveData : false
ExtSaveDataId: 0x0a05 # same as UniqueId
SystemSaveDataId1: 0x00040010 # plaintext exheader
SystemSaveDataId2: 0x00040020 # plaintext exheader
OtherUserSaveDataId1: 0x220 # plaintext exheader
OtherUserSaveDataId2: 0x330 # plaintext exheader
OtherUserSaveDataId3: 0x440 # plaintext exheader
#AccessibleSaveDataIds: [0x101, 0x202, 0x303, 0x404, 0x505, 0x606]
UseOtherVariationSaveData : false
 
SystemControlInfo:
  SaveDataSize: 1M # plaintext exheader
  RemasterVersion: 0 # plaintext exheader
  StackSize: 0x00040000 # plaintext exheader
  JumpId: 0x00040000000a0500L # plaintext exheader (<full UniqueID>L)
 
# DO NOT EDIT BELOW HERE OR PROGRAMS WILL NOT LAUNCH (most likely)
 
AccessControlInfo:
  FileSystemAccess:
  - Debug
  - DirectSdmc
  - DirectSdmcWrite
 
  IdealProcessor                : 0
  AffinityMask                  : 1
 
  Priority                      : 48 # Processor Priority, refer to your exheader for this.
 
  MaxCpu                        : 0x9E # Default
 
  CoreVersion                  : 2
  DescVersion                  : 2
 
  ReleaseKernelMajor            : "02"
  ReleaseKernelMinor            : "32"
  MemoryType                    : Application
  HandleTableSize: 512
  IORegisterMapping:
  - 1ff50000-1ff57fff
  - 1ff70000-1ff77fff
  MemoryMapping:
  - 1f000000-1f5fffff:r
  SystemCallAccess: # These are the allowed System Calls, comment out calls your exheader doesn't specify as necessary.
    ControlMemory: 1 # 0x01
    QueryMemory: 2 # 0x02
    ExitProcess: 3 # 0x03
#  GetProcessAffinityMask: 4 # 0x04
#  SetProcessAffinityMask: 5 # 0x05
    GetProcessIdealProcessor: 6 # 0x06
#  SetProcessIdealProcessor: 7 # 0x07
    CreateThread: 8 # 0x08
    ExitThread: 9 # 0x09
    SleepThread: 10 # 0x0A
    GetThreadPriority: 11 # 0x0B
    SetThreadPriority: 12 # 0x0C
#  GetThreadAffinityMask: 13 # 0x0D
#  SetThreadAffinityMask: 14 # 0x0E
    GetThreadIdealProcessor: 15 # 0x0F
#  SetThreadIdealProcessor: 16 # 0x10
    GetCurrentProcessorNumber: 17 # 0x11
#  Run: 18 # 0x12
    CreateMutex: 19 # 0x13
    ReleaseMutex: 20 # 0x14
    CreateSemaphore: 21 # 0x15
    ReleaseSemaphore: 22 # 0x16
    CreateEvent: 23 # 0x17
    SignalEvent: 24 # 0x18
    ClearEvent: 25 # 0x19
    CreateTimer: 26 # 0x1A
    SetTimer: 27 # 0x1B
    CancelTimer: 28 # 0x1C
    ClearTimer: 29 # 0x1D
    CreateMemoryBlock: 30 # 0x1E
    MapMemoryBlock: 31 # 0x1F
    UnmapMemoryBlock: 32 # 0x20
    CreateAddressArbiter: 33 # 0x21
    ArbitrateAddress: 34 # 0x22
    CloseHandle: 35 # 0x23
    WaitSynchronization1: 36 # 0x24
    WaitSynchronizationN: 37 # 0x25
#  SignalAndWait: 38 # 0x26
    DuplicateHandle: 39 # 0x27
    GetSystemTick: 40 # 0x28
    GetHandleInfo: 41 # 0x29
    GetSystemInfo: 42 # 0x2A
    GetProcessInfo: 43 # 0x2B
    GetThreadInfo: 44 # 0x2C
    ConnectToPort: 45 # 0x2D
    SendSyncRequest1: 46 # 0x2E
    SendSyncRequest2: 47 # 0x2F
    SendSyncRequest3: 48 # 0x30
    SendSyncRequest4: 49 # 0x31
    SendSyncRequest: 50 # 0x32
#  OpenProcess: 51 # 0x33
#  OpenThread: 52 # 0x34
    GetProcessId: 53 # 0x35
    GetProcessIdOfThread: 54 # 0x36
    GetThreadId: 55 # 0x37
    GetResourceLimit: 56 # 0x38
    GetResourceLimitLimitValues: 57 # 0x39
    GetResourceLimitCurrentValues: 58 # 0x3A
    GetThreadContext: 59 # 0x3B
    Break: 60 # 0x3C
    OutputDebugString: 61 # 0x3D
#  ControlPerformanceCounter: 62 # 0x3E
#  CreatePort: 71 # 0x47
#  CreateSessionToPort:72 # 0x48
#  CreateSession: 73 # 0x49
#  AcceptSession: 74 # 0x4A
#  ReplyAndReceive1: 75 # 0x4B
#  ReplyAndReceive2: 76 # 0x4C
#  ReplyAndReceive3: 77 # 0x4D
#  ReplyAndReceive4: 78 # 0x4E
#  ReplyAndReceive: 79 # 0x4F
#  BindInterrupt: 80 # 0x50
#  UnbindInterrupt: 81 # 0x51
#  InvalidateProcessDataCache: 82 # 0x52
#  StoreProcessDataCache: 83 # 0x53
#  FlushProcessDataCache: 84 # 0x54
#  StartInterProcessDma: 85 # 0x55
#  StopDma: 86 # 0x56
#  GetDmaState: 87 # 0x57
#  RestartDma: 88 # 0x58
#  DebugActiveProcess: 96 # 0x60
#  BreakDebugProcess: 97 # 0x61
#  TerminateDebugProcess: 98 # 0x62
#  GetProcessDebugEvent: 99 # 0x63
#  ContinueDebugEvent: 100 # 0x64
#  GetProcessList: 101 # 0x65
#  GetThreadList: 102 # 0x66
#  GetDebugThreadContext: 103 # 0x67
#  SetDebugThreadContext: 104 # 0x68
#  QueryDebugProcessMemory: 105 # 0x69
#  ReadProcessMemory: 106 # 0x6A
#  WriteProcessMemory: 107 # 0x6B
#  SetHardwareBreakPoint: 108 # 0x6C
#  GetDebugThreadParam: 109 # 0x6D
#  ControlProcessMemory: 112 # 0x70
#  MapProcessMemory: 113 # 0x71
#  UnmapProcessMemory: 114 # 0x72
#  CreateCodeSet: 115 # 0x73
#  RandomStub: 116 # 0x74
#  CreateProcess: 117 # 0x75
#  TerminateProcess: 118 # 0x76
#  SetProcessResourceLimits: 119 # 0x77
#  CreateResourceLimit: 120 # 0x78
#  SetResourceLimitValues: 121 # 0x79
#  AddCodeSegment: 122 # 0x7A
#  Backdoor: 123 # 0x7B
#  KernelSetState: 124 # 0x7C
#  QueryProcessMemory: 125 # 0x7D
  InterruptNumbers:
  ServiceAccessControl: # These are service permissions, comment out services your exheader doesn't specify as necessary.
  - APT:U
  - $hioFIO
  - $hostio0
  - $hostio1
  - ac:u
  - boss:U
  - cam:u
  - cecd:u
  - cfg:u
  - dlp:FKCL
  - dlp:SRVR
  - dsp::DSP
  - frd:u
  - fs:USER
  - fs:LDR
  - fs:REG
  - gsp::Gpu
  - hid:USER
  - http:C
  - mic:u
  - ndm:u
  - news:u
  - nwm::UDS
  - ptm:u
  - pxi:dev
  - soc:U
  - ssl:C
  - y2r:u
  - ldr:ro
  - ir:USER
  - nim:aoc
  - am:app
# - PxiFS0
# - PxiFS1
# - PxiFSB
# - PxiFSR
# - PxiPM
# - pxi:am9
# - pxi:dev
# - pxi:mc
# - pxi:ps9
# - am:net
# - am:u
# - am:sys
# - am:pipe
# - pm:app
# - pm:dbg
 
SystemControlInfo: # Don't touch these, they're the kernel dependencies.
  Dependency:
    ac: 0x0004013000002402L
    am: 0x0004013000001502L
    boss: 0x0004013000003402L
    camera: 0x0004013000001602L
    cecd: 0x0004013000002602L
    cfg: 0x0004013000001702L
    codec: 0x0004013000001802L
    csnd: 0x0004013000002702L
    dlp: 0x0004013000002802L
    dsp: 0x0004013000001a02L
    friends: 0x0004013000003202L
    gpio: 0x0004013000001b02L
    gsp: 0x0004013000001c02L
    hid: 0x0004013000001d02L
    http: 0x0004013000002902L
    i2c: 0x0004013000001e02L
    ir: 0x0004013000003302L
    mcu: 0x0004013000001f02L
    mic: 0x0004013000002002L
    ndm: 0x0004013000002b02L
    news: 0x0004013000003502L
    nim: 0x0004013000002c02L
    nwm: 0x0004013000002d02L
    pdn: 0x0004013000002102L
    ps: 0x0004013000003102L
    ptm: 0x0004013000002202L
    ro: 0x0004013000003702L
    socket: 0x0004013000002e02L
    spi: 0x0004013000002302L
    ssl: 0x0004013000002f02L
CommonHeaderKey: # Don't touch anything from here on, they're the common crypto keys and settings.
  D: |
    jL2yO86eUQnYbXIrzgFVMm7FVze0LglZ2f5g+c42hWoEdnb5BOotaMQPBfqt
    aUyAEmzQPaoi/4l4V+hTJRXQfthVRqIEx27B84l8LA6Tl5Fy9PaQaQ+4yRfP
    g6ylH2l0EikrIVjy2uMlFgl0QJCrG+QGKHftxhaGCifdAwFNmiZuyJ/TmktZ
    0RCb66lYcr2h/p2G7SnpKUliS9h9KnpmG+UEgVYQUK+4SCfByUa9PxYGpT0E
    nw1UcRz0gsBmdOqcgzwnAd9vVqgb42hVn6uQZyAl+j1RKiMWywZarazIR/k5
    Lmr4+groimSEa+3ajyoIho9WaWTDmFU3mkhA2tUDIQ==
  Exponent: |
    AQAB
  Modulus: |
    zwCcsyCgMkdlieCgQMVXA6X2jmb1ICjup0Q+jk/AydPkOgsx7I/MjUymFEkU
    vgXBtCKtzh3NKXtFFuW51tJ60GPOabLKuG0Qm5li+UXALrWhzWuvd5vv2FZI
    dTQCbrq/MFS/M02xNtwqzWiBjE/LwqIdbrDAAvX4HGy0ydaQJ1DKYeQeph5D
    lAGBw2nQ4izXhhuLaU3w8VQkIJHdhxIKI5gJY/20AGkG0vHD553Mh5kBINrWp
    CRYmmJS8DCYbAiQtKbkeUfzHViGTZuj6PwaY8Mv39PGO47a++pt45IUyCEs4/
    LjMS72cyfo8tU4twRGp76SFGYejYj3wGC1f/POQw==
  Signature: |
    BOPR0jL0BOV5Zx502BuPbOvi/hvOq5ID8Dz1MQfOjkey6FKP/6cb4f9YXpm6c
    ZCHAZLo0GduKdMepiKPUq1rsbbAxkRdQdjOOusEWoxNA58x3E4373tCAhlqM2
    DvuQERrIIQ/XnYLV9C3uw4efZwhFqog1jvVyoEHpuvs8xnYtGbsKQ8FrgLwXv
    pOZYy9cSgq+jqLy2D9IxiowPcbq2cRlbW9d2xlUfpq0AohyuXQhpxn7d9RUor
    9veoARRAdxRJK12EpcSoEM1LhTRYdJnSRCY3x3p6YIV3c+l1sWvaQwKt0sZ/U
    8TTDx2gb9g7r/+U9icneu/zlqUpSkexCS009Q==
  Descriptor: |
    AP///wAABAACAAAAAAAFGJ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiIAAAAAAAABBUFQ6VQAAACRo
    aW9GSU8AJGhvc3RpbzAkaG9zdGlvMWFjOnUAAAAAYm9zczpVAABjYW06dQAA
    AGNlY2Q6dQAAY2ZnOnUAAABkbHA6RktDTGRscDpTUlZSZHNwOjpEU1BmcmQ6
    dQAAAGZzOlVTRVIAZ3NwOjpHcHVoaWQ6VVNFUmh0dHA6QwAAbWljOnUAAABu
    ZG06dQAAAG5ld3M6dQAAbndtOjpVRFNwdG06dQAAAHB4aTpkZXYAc29jOlUA
    AABzc2w6QwAAAHkycjp1AAAAbGRyOnJvAABpcjpVU0VSAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAABOn/rw/7//8ec/APIA8JH/APaR/1D/gf9Y/4H/cP+B/3j/gf8B
    AQD/AAIA/iECAPz/////////////////////////////////////////////
    ////////////////////////////////////////AAAAAAAAAAAAAAAAAAAA
    AAADAAAAAAAAAAAAAAAAAAI=

I'm not sure what will end up being necessary yet though, so bare with me here. I'll confirm if this works to build Fire Emblem - Awakening. For now, it's a placeholder, and representative of a lot of time spent on 3dbrew. I do really love that site, and the unhappy devs that contribute to it, just saying.

Edit: Well, even with all the dependencies set, it still is causing errors. Though this cia.rsf wasn't enough to fix it, I'll keep trying. Soon enough, soon enough.

Edit2: Everything I've tried, which is pretty much everything I can think of right now, has failed. As I'm out of options for now, I'm going to wait on someone with more information to come along. I simply don't have the information obviously required for fixing the generation of this particular CIA. I'll probably play around with extracting and repacking a new RomFS, and see if that works. I'll update again if I figure anything out.

Edit3: Well, even with a freshly packed RomFS, it simply won't work. I've done all I can for the time being until new information comes to light. Hopefully you guys can think of something else that I missed, and figure it out. If nothing else, at least the new cia.rsf I built might be useful to some of you.

 

[klausus]

According to 3dbrew ( http://3dbrew.org/wiki/SMDH )

icon.bin

Offset 0x2018

Regions:

Japan 0x01
North America 0x02
Europe 0x04
Australia 0x08
China 0x10
Korea 0x20
Taiwan 0x40

Edit the bit as desired.

I don't completely understand region free yet though, so you'll have to give me some time to figure out how to patch it out.

Apparently, it's viewed as 0x7fffffff, but I'm not sure if that's starting from 0x2018, or earlier in the configuration bits.

Edit: This is the exact change needed to enable Region Free, tested with Hatsune Miku - Project Mirai 2:

Change this:

to this:

I convert 2 games (3ds to cia) and work fine.

My games works perfect in my EUR 3DS (games shown in the menu too).

But this games (both) in the Offset 0x2018 have "0C" ¿What is this region? o.oU
¿"0C" is free region too?

The games are "New Yoshis island" and "Project X Zone". Thanks.

 

[Gadorach]

I convert 2 games (3ds to cia) and work fine.

My games works perfect in my EUR 3DS (games shown in the menu too).

But this games (both) in the Offset 0x2018 have "0C" ¿What is this region? o.oU
¿"0C" is free region too?

The games are "New Yoshis island" and "Project X Zone". Thanks.

I'm not sure. As it's not listed on 3dbrew, I'm not aware of the meaning of that flag. Perhaps it was patched into the ROM by whoever you downloaded it from, as I'm assuming you didn't dump them yourself in the context you've presented. I'd advise on using confirmed flags for anything you attempt to manually region-patch though.

 

[pLaYeR^^]

Here is my actual cia.rsf file and however, it dont work. I used descapp:4. I hope someone got a solution :/

 

[soopa]

Anyone care to help me out! I followed the tut on the first page and i get everything working loading cfw, but cant install devmenu when i try to install multiple times in a row i get the same error in cmd
C:\Users\Dayna\Desktop\Palantine CFW1.1>installcia 192.168.0.10 1 DevMenu_2x.cia


C:\Users\Dayna\Desktop\Palantine CFW1.1>ctrclient --serveradr=192.168.0.10 --cus
tomcmd="installcia:1,0 DevMenu_2x.cia"
ctrclient: connected to 192.168.0.10
Sending CIA install command...
Sending CIA...
Sending data at offset 0x0 size 0x3ffc0... Waiting for ACK...
Sending data at offset 0x3ffc0 size 0x15200... Waiting for ACK...
Receiving reply...
Command-index: 1
Result-code: c8a0802b
Write pos: 3ffc0

C:\Users\Dayna\Desktop\Palantine CFW1.1>pause
Press any key to continue . . .
but when i restart my cfw I dont have the present to unwrap.

 

[williamcesar2]

i got DevMenu on CFW finally !

works fine !

 

[4gionz]

can anyone point me to the most up to date guide to installing this cfw the op has outdated info and i remeber one post explain how to use emunand tool instead of hex edit, maybe ill wait a little longer till things are a little more updated, also shouldnt it be easy to get multi rom working from sd instead of installing everything directly through dev menu?

 

[williamcesar2]

can anyone point me to the most up to date guide to installing this cfw the op has outdated info and i remeber one post explain how to use emunand tool instead of hex edit, maybe ill wait a little longer till things are a little more updated, also shouldnt it be easy to get multi rom working from sd instead of installing everything directly through dev menu?

3DS Palantine CFW Setup Guide

 

[BerrisFueler]

I got devMenu installed as well! But with a few hiccups.

I tried to make a Cave Story.cia file to install via devMenu, but every time I open devMenu, it crashes 10 seconds in, leaving me no choice but powering off the 3ds.

Does this have to do with the 4.1 firmware in my console?

EDIT: Forgot to add, the Cave Story file shows up as red in devMenu, if that helps at all.

 

[williamcesar2]

I had many problems with beta release GW firmware 2.0b. So I remade the tutorial using the new GW firmware 2.6 '' omega ''

no crashes so far

 

[SMVB64]

I kinda underestimated the size of the rom's and seems like a 2gb SD isn't going to cut it anymore haha. Is it possible to transfer the modified EMUnand over to a new SD? Cause it seems like the EmuNand tool is having trouble recognizing it.

 

[AHP_person]

Does anyone know how to fix a saving problem in Pokemon X? It crashed and won't boot now...

EDIT: I got it to boot, I had to corrupt the save file... I hope it was just a one time error :/

EDIT2: I can't save... If it means anything, I modified the RomFS. I reapplied the IVFC hashes though, and it boot fine, so I don't know...

 

[Riku]

Does anyone know how to fix a saving problem in Pokemon X? It crashed and won't boot now...

EDIT: I got it to boot, I had to corrupt the save file... I hope it was just a one time error :/

EDIT2: I can't save... If it means anything, I modified the RomFS. I reapplied the IVFC hashes though, and it boot fine, so I don't know...

Pokemon X/Y indeed crashing when trying to save (not autosaving, but when try to manually save progress after intro). Most likely because launching under lower kernel, while game actually requires 2.35 kernel (5.0.0-11). Someone with gateway can try building it for 5.x firm and see if it saves.

 

[AHP_person]

Pokemon X/Y indeed crashing when trying to save (not autosaving, but when try to manually save progress after intro). Most likely because launching under lower kernel, while game actually requires 2.35 kernel (5.0.0-11). Someone with gateway can try building it for 5.x firm and see if it saves.

So auto-saving works? Would attempting to connect to Wi-Fi count?

 

[VerseHell]

Pokemon X/Y saving work on Gateway, butnot on the cfw, don't know why.

 

[Showmethemoney]

I convert 2 games (3ds to cia) and work fine.

My games works perfect in my EUR 3DS (games shown in the menu too).

But this games (both) in the Offset 0x2018 have "0C" ¿What is this region? o.oU
¿"0C" is free region too?

The games are "New Yoshis island" and "Project X Zone". Thanks.

0x0C means Europe and Australia region.

Because of 0x0C == 0x04 || 0x08.

 

[enigma85]

I got bravely default on my big SD card, woot! That's ~4gb free on my gateway sd.

 

[kiryu1]

-snip-

I still can't get past the static IP part.. How noob of me

 

[djalmafreestyler]

I installed DevMenu but but when I turn off DevMenu is gone.

How can i have DevMenu installed permanent?