Converting .3DS to .CIA for Hackers!

Hello, and welcome to the great guide on how to convert your games to work on CFW/Gateway yourself, without ever having to read a "user-friendly" script to ever know what the hell went wrong.
At the end of this tutorial you will know how to convert your games by using tools made by others, and if you're going to repeat this process often, you will probably want to hack a script together yourself to automate this (Protip: it's actually not that difficult to copypasta some commands into your favorite text editor).
This guide is geared towards linux users, but in contrast to pre-made scripts, these commands can be used almost anywhere as long as you have the tools on said platform.
Some games are really big, and because they are stored about 2 or 3 times their size in ram during some operations, you may need a 64bit computer and/or some swap space.

So, without further ado, let's begin:

First, we need the tools. Create a directory somewhere to put them.
Let's make a list:

* The game you want to convert
* On linux, you will compile the tools yourself, as there are no prebuilt binaries. You need at least gcc, g++ and make (search in your repositories), though installing the development tools package of your distribution isn't a bad idea.
* Python 2.7 (Again, search your repositories)
* A 3DS on 4.x with the mset exploit, or a 9.0-9.2.

* slot0x25KeyX.bin (Search the interwebz, because rulez disallow me from linking)
Put the hex number you found on the webz in a file called slot0x25KeyX.bin with your favorite hex editor. Copy the file to the tools directory.

* 3DS_Multi_Decryptor (or Decrypt9 if you're on 9.x) [thread]
The former contains prebuilt binaries in the github repo, the latter has a download link for prebuilt binaries in the thread.
To compile any of both yourself, grab devkitPRO (Just grab the perl updater and set variable, it's not difficult to install), and run "make" in the source directory.
Copy Launcher.dat and ctrKeyGen.py (or ncchinfo_gen.py if using Decrypt9) to your tools directory.
Optional (For firmware >=7.x roms): Copy MEX.py from 3DS_Multi_Decryptor to your tools directory.

* ctrtool and makerom (There are several versions on github, this is the most recently updated)
On linux, for makerom comment line 130 in ncch.c as it causes a segfault (details).
Run "make" in both directories, copy the binaries (named the same as their respective directories) to your tools directory.

* padxorer
Run "gcc -O3 padxorer.c -o padxorer" and copy the binary to the tools directory.

* Optional (for manual and download play): rom_tool [thread]
Just run "make" in the rom_tool directory and copy the resulting binary to the tools directory.

* Optional (If you don't want to create the rsf file yourself): rsfgen [post]
Also get dummy.rsf.
Just put rsfgen.py and dummy.rsf in the tools directory.
NOTE: It's inportant for dummy.rsf to use dos line endings. If you copy/pasted it instead of downloading it you may have problems. If the generated file by rsfgen.py looks weird, this may be the problem.

* Optional (To reinject the original headers into the rom): ExInjector [post]
Just put the file in the tools directory.


Now you should be ready for the action.
Create a new directory, place the tools directory inside and put your game there.

First, create ncchinfo.bin (Use ncchinfo_gen.py instead if you're using Decrypt9):
Code:
python2 tools/ctrKeyGen.py game.3ds && mv tools/ncchinfo.bin .

Now, grab a working Fat32-partitioned SD card (At least 2gb, but depends on game size).
Make sure slot0x25KeyX.bin has the right contents. If it doesn't, no program will tell you about it, and will continue generating your .cia happily.
Copy tools/Launcher.dat, tools/slot0x25KeyX.bin and ncchinfo.bin to the root of your SD card.
Pop it into your 3DS and launch the mset exploit (Or go to http://dukesrg.no-ip.org/3ds/go with the browser if using Decrypt9).
Choose "NCCH padgen" from the menu (I'm not sure about Decrypt9), and wait. This should take a while.
Pop the SD back into your PC, and copy all the *.Main.*.xorpad to some directory (I'll use "xorpads").

Now, extract the encrypted contents of your game:
Code:
tools/ctrtool -p --exheader=exheader.bin --romfs=romfs.bin --exefs=exefs.bin game.3ds
It may complain about the exheader hash, but you shouldn't care.

Optional: If you have a *.Main.exefs_7x.xorpad, the game is for formware 7.x or higher. You need to merge dem xorpads.
Code:
python2 tools/MEX.py exefs.bin xorpads/*.Main.exefs_norm.xorpad xorpads/*.Main.exefs_7x.xorpad xorpads/Main.exefs_norm.xorpad && rm xorpads/*.Main.exefs*.xorpad
NOTE: I haven't tested this, because I haven't encountered a 7.x game, yet.

Now, we have to decrypt the contents of the game:
Code:
array=(exheader exefs romfs); for item in ${array[@]}; do tools/padxorer $item.bin xorpads/*Main.$item*.xorpad; done
rm *.bin
rename .bin.out .bin *.out

Now, extract the exefs to obtain the icon and banner:
Code:
tools/ctrtool --exefsdir=exefs --decompresscode -t exefs exefs.bin

Now, create the rsf:
Code:
cp tools/dummy.rsf game.rsf
python2 tools/rsfgen.py --rsf game.rsf --rom game.3ds --exheader exheader.bin --regionfree exefs/icon.bin --spoof
The --spoof option is optional if you want to enable firmware spoofing.
The --regionfree option is optional if you want to patch regionfree.
NOTE: Check the generated game.rsf file. If it looks weird, your dummy.rsf probably doesn't use dos line endings. Download it with git (or zip download), or convert it with unix2dos or similar.

Optional: If you want the manual/download play, you need to extract the .cfa:
Code:
tools/rom_tool --extract=. game.3ds
rm -f *APPDATA.cxi *UPDATEDATA.cfa

Now, create the cxi:
Code:
tools/makerom -f cxi -o game.cxi -target t -rsf game.rsf -icon exefs/icon.bin -banner exefs/banner.bin -exefslogo -code exefs/code.bin -exheader exheader.bin -romfs romfs.bin

Optional: Inject original exheader
Code:
python2 tools/ExInjector.py -rom game.cxi -exheader exheader.bin -sd -fwspoof
The -fwspoof option is optional if you want to enable firmware spoofing.
NOTE: I've tried to use this with two roms, and it stuck on the 3ds logo. You may have a different experience, though.

Now, create the final cia:
Code:
tools/makerom -f cia -o game.cia -content game.cxi:0:0 -content $(echo *MANUAL.cfa):1:1 -content $(echo *DLP.cfa):2:2
You can remove any of the -content if your game doesn't have it, or you don't want it.
It may warn you about the cia not going to be encrypted, but we want it unencrypted.

That's it! Copy, install, and play!

If you're having problems, or there's something wrong with this guide, please post it in this thread.

Appendix

How to use rxTools to make this process a bit faster when bulking:
Okay, so recently, this thing got released, called rxTools.
It's a toolkit with a lot of different functions, and one of them is bulk-decrypting .3ds games, thus making it unnecessary to screw around with xorpads.
I'm going to explain how to bulk this stuff, my style.

First of all, you're going to need all the requirements of the original tutorial, except for 3DS_Multi_Decryptor, MEX.py and padxorer.

Now, get rxTools from here, and put rxTools.dat on the root of your SD card, along with slot0x25KeyX.bin, and copy your 3ds games anywhere except inside the "Nintendo 3DS" directory.
Launch rxTools with the web exploit, and press the "Decrypt CTR Titles" option. This can take a while.
Turn off your 3DS, and copy the (now decrypted) .3ds file(s) to your working directory.

Now, follow the appendix on how to convert decrypted .3ds files.

The next step would be throwing a script together to bulk the conversion.
How to convert decrypted .3ds files:
These kinds of files can be aquired in multiple ways, like rxTools, or converted CIAs you want to edit it's romfs. It's useful to be able to convert them.

You're going to need all the requirements of the original tutorial, except for 3DS_Multi_Decryptor, MEX.py and padxorer.

To convert a game, extract the (now decrypted) contents of your game like in the original tutorial (IMPORTANT: don't use the -p flag, this won't work), and follow the rest of it from the step where I show how to extract the exefs.
Common problems:
Problem: When you get this error when trying to build a cxi:
Code:
[EXHEADER ERROR] ExtSaveDataId is unavailable if AccessibleSaveDataIds is specified.
[EXHEADER ERROR] Failed to create ExHeader
Solution: Comment ExtSaveDataId in game.rsf

Like, subscribe, comment, share, shill, give it as a present to your mom and feed it to your dog!
 

mid-kid

GBAtemp spamBOT
OP
Member
Joined
Aug 2, 2012
Messages
879
Trophies
0
Age
25
XP
1,163
Country
I tried rebuilding the CIA using the Windows batch file. It would not produce a CIA until I tried "alternative 3" in the 3DS to CIA converters menu. I uninstalled the old CIA using BBM. This CIA installs and gave saves are working. Perhaps it is a hint as to what the problem was: it appended (SDK 5) to the CIA file name? I'm not at all familiar with this stuff. Don't even know how many SDKs versions there have been.

Could you tell me what "alternative 3" is? The custom RSF option?
Also, can you try building the .cxi with the "-desc app:5" option? (And see if the generated .cia works?)
EDIT: Nvm, app:5 specifies the firmware, not the SDK version.
 

romanaOne

Well-Known Member
Member
Joined
Apr 18, 2014
Messages
453
Trophies
0
Age
49
Location
where the potential goes to zero
XP
1,024
Country
United States
Could you tell me what "alternative 3" is? The custom RSF option?
Also, can you try building the .cxi with the "-desc app:5" option? (And see if the generated .cia works?)
EDIT: Nvm, app:5 specifies the firmware, not the SDK version.


"Alternative 3" can be found in that batch file "3DS to CIA Converter.bat." It's in the "3DS to CIA Converter v3.8.rar" located in over at the maxconsole forums in the Official Gateway Support section. It's pretty long and I was more in the mood to test out Animal Crossing than wade through a huge batch file.

Either run the batch or just search it for "Alternative 3" if you don't have windows handy and want to figure out what it does.

Code:
echo Did Your Previous Attempt Fail?
echo If So Try An Alternative Method
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo  1 - Continue Normally
echo  2 - Alternative 1
echo  3 - Alternative 2
echo  4 - Alternative 3
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
set /p M1=Please Type 1, 2, 3 or 4:
IF %M1%==1 goto cia6
IF %M1%==2 goto cia7
IF %M1%==3 set alt=1& goto cia6
IF %M1%==4 goto cianew
IF %M1%=="" goto cia4


It definitely is doing something different because the final CIA file is a bit smaller than the one I made with the Linux instructions. (I chose to include the manual both times, so it isn't that.)

I glanced at the :cianew section of the batch and there are some differences from the process described above. I wish I knew what was failing when I tried the previous "alternatives."
Code:
files\ctrtool -t exheader exheader.bin > exheaderinfo.txt
cls
echo Please Wait..
echo.
files\makerom3 -f cxi -o rom.cxi -rsf RSF.rsf -target t -desc ecapp:5 -exheader exheader.bin -exefslogo -code exefs\code.bin -romfs decrypted\romfs.bin -icon exefs\icon.bin -banner exefs\banner.bin
cls
echo Please Wait..
echo.
files\exinjector -rom rom.cxi -exheader exheader.bin -sd
 

mid-kid

GBAtemp spamBOT
OP
Member
Joined
Aug 2, 2012
Messages
879
Trophies
0
Age
25
XP
1,163
Country

Ugh, batch files are the exact definition of what is wrong with gotos when improperly used. It makes proper flow-control look like some sacred thing from the heavens.
Anyway, the only difference I notice from "Alternative 3" is the usage of '-desc ecapp:"%sdk%"'. While where it says "%sdk%" it's completely wrong, because that's the firmware version (And nobody actually knows if that version is parallel to that of the SDK), you could try to use that option when generating the .cxi.

...And those repeated "cls; echo Please wait; echo." to try to look fancy while obfuscating the code some more.
 

romanaOne

Well-Known Member
Member
Joined
Apr 18, 2014
Messages
453
Trophies
0
Age
49
Location
where the potential goes to zero
XP
1,024
Country
United States
A link between worlds does not work for me, crashes on the "3ds" screen.

Works ok for me, saves/restores, the whole shebang.

Could be this is the problem? I did not use the -fwspoof option:

python2 tools/ExInjector.py -rom game.cxi -exheader exheader.bin -sd -fwspoof

The -fwspoof option is optional if you want to enable firmware spoofing.
NOTE: I've tried to use this with two roms, and it stuck on the 3ds logo. You may have a different experience, though.
 

romanaOne

Well-Known Member
Member
Joined
Apr 18, 2014
Messages
453
Trophies
0
Age
49
Location
where the potential goes to zero
XP
1,024
Country
United States
I was trying to make a cia of Ocarina of Time and I'm not sure what I'm doing wrong. There are no unusual errors, the cia installs, but when you try to start the game, the black error screen appears saying you have to hold down the power key to shut down.

I did not use the -fwspoof option. Never messed with it on any other games and all seem fine.
I know I dumped it properly because the 3ds file works fine loaded from the red card.

Over at maxconsole, it is in the list of supported games. Once again, I am wondering what is different about their tools. I don't have a windows computer handy, at the moment. Hmm, can you run a BAT file in wine?

btw, it might be a good idea to always check that the slotwhatchamacallit.bin file is not all zero. I accidentally clobbered mine on the SD card with a blank one and made several dud .cias before noticing. Doh! After that, you can go through all the steps from xorpads to create a (invalid) .cia without any errors or warnings. Such fun!
 

mid-kid

GBAtemp spamBOT
OP
Member
Joined
Aug 2, 2012
Messages
879
Trophies
0
Age
25
XP
1,163
Country
I was trying to make a cia of Ocarina of Time and I'm not sure what I'm doing wrong. There are no unusual errors, the cia installs, but when you try to start the game, the black error screen appears saying you have to hold down the power key to shut down.

I did not use the -fwspoof option. Never messed with it on any other games and all seem fine.
I know I dumped it properly because the 3ds file works fine loaded from the red card.

Over at maxconsole, it is in the list of supported games. Once again, I am wondering what is different about their tools. I don't have a windows computer handy, at the moment. Hmm, can you run a BAT file in wine?

Try not using ExInjector, maybe that works?

btw, it might be a good idea to always check that the slotwhatchamacallit.bin file is not all zero. I accidentally clobbered mine on the SD card with a blank one and made several dud .cias before noticing. Doh! After that, you can go through all the steps from xorpads to create a (invalid) .cia without any errors or warnings. Such fun!

Fixed the tutorial to warn about this. Thanks.
 

romanaOne

Well-Known Member
Member
Joined
Apr 18, 2014
Messages
453
Trophies
0
Age
49
Location
where the potential goes to zero
XP
1,024
Country
United States
Try not using ExInjector, maybe that works?

Actually, I've never used it. My standard 3DS to CIA conversion procedure which admittedly works perfect for my 5 games, doesn't do anything marked OPTIONAL above .

In my post above, I mistakenly cut and pasted the line with Exinjector.py.

I'd meant to post about leaving -spoof off of this line:

Code:
python2 tools/rsfgen.py game.3ds exheader.bin game.rsf

I'll try using my friend's windows computer and the BAT file/tools from maxconsole.
 

romanaOne

Well-Known Member
Member
Joined
Apr 18, 2014
Messages
453
Trophies
0
Age
49
Location
where the potential goes to zero
XP
1,024
Country
United States
Try not using ExInjector, maybe that works?

I tried the 3DS to CIA batch file, now ver 4.0 . I used the same ncchinfo I'd extracted with the ctrKeyGen.py in linux and used the same xorpads as before.

The final "alternative 3" made a working ocarina CIA. The "Continue Normally" and Alternatives 1,2 all failed.
By "failed," I mean ctrtool failed to extract the .bins:

Code:
:check4
cls 
if not exist decrypted\exefs.bin goto check2 
if not exist decrypted\exheader.bin goto check2 
if not exist decrypted\romfs.bin goto check2 
if not exist exefs\banner.bin goto check2 
if not exist exefs\code.bin goto check2 
if not exist exefs\icon.bin goto check2

It is so hard to figure out what is going on:

1. There are several ctrtools: ctrtool.exe, ctrtool1.exe, and ctrtool-a.exe.
2. There are 6 different RSF files. I think it is using Alternative 3 is using auto6.rsf.
3. There are three makerom exes: makerom.exe, makerom2.exe, and makerom3.exe. Alternative 3 uses makrom3.exe.
4. I don't know what this makerom option means : -desc ecapp:5


"Alternative 3" is using exinjector, but so many other things are uncertain, I don't know what it is the crucial difference.

Code:
files\ctrtool1 -p --exheader=exheaderEncrypted.bin --romfs=romfsEncrypted.bin --exefs=exefsEncrypted.bin --logo=logo.bin "%rom%"
 
.
.
.
 
files\makerom3 -f cxi -o rom.cxi -rsf RSF.rsf -target t -desc ecapp:5 -exheader exheader.bin -exefslogo -code exefs\code.bin -romfs decrypted\romfs.bin -icon exefs\icon.bin -banner exefs\banner.bin 
cls 
echo Please Wait.. 
echo. 
files\exinjector -rom rom.cxi -exheader exheader.bin -sd

So now I have made CIAs of all of my games. Of 8 games, 6 worked manually and 2 required some kind of voodoo from the windows batch converter/tools.
 

Kwartel

The fairest in all the land
Member
Joined
Apr 11, 2009
Messages
1,298
Trophies
0
Age
30
XP
449
Country
Netherlands
I tried to make a CIA with these commands with decrypted ROMs, which I decrypted with tbe newly released rxTools2. I skipped the xorpath steps and started with extracting the exefs. Results vary between black screen after 3DS logo, stuck at 3DS logo and raising a generic 3DS fatal error 3 seconds in the game.
 

mid-kid

GBAtemp spamBOT
OP
Member
Joined
Aug 2, 2012
Messages
879
Trophies
0
Age
25
XP
1,163
Country
I tried to make a CIA with these commands with decrypted ROMs, which I decrypted with tbe newly released rxTools2. I skipped the xorpath steps and started with extracting the exefs. Results vary between black screen after 3DS logo, stuck at 3DS logo and raising a generic 3DS fatal error 3 seconds in the game.

It'd be nice to know which optional steps you did. I'm planning on updating the OP for rxTools (Still keeping the old method documented)
 
  • Like
Reactions: Margen67

mid-kid

GBAtemp spamBOT
OP
Member
Joined
Aug 2, 2012
Messages
879
Trophies
0
Age
25
XP
1,163
Country
*shilling intensifies*

No.
Go away from my thread. The only thing you may advertise in my thread is my thread.

P.S. I never said it was "noob-friendly". there's another thread of which this thread was meant as a parody from (but utterly failed) with almost the same name. Go "help" "noobs" there.
 

DarkFlare69

Well-Known Member
Member
Joined
Dec 8, 2014
Messages
5,147
Trophies
2
Location
Chicago
XP
4,750
Country
United States
No.
Go away from my thread. The only thing you may advertise in my thread is my thread.

P.S. I never said it was "noob-friendly". there's another thread of which this thread was meant as a parody from (but utterly failed) with almost the same name. Go "help" "noobs" there.
Okay, jesus, calm down.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • BakerMan @ BakerMan:
    at least with them, it was because of the DDOS attacks, ubisoft was just scummy
  • BakerMan @ BakerMan:
    fuck ubisoft, and fuck activision
    +1
  • realtimesave @ realtimesave:
    Nintendo needs to release a new console, switch is getting such shitty little games lately lol it's pathetic
  • Purple_Heart @ Purple_Heart:
    Lmao a new flashcart... The Unlock Switch... I knew it's not fake xD
    +1
  • NinStar @ NinStar:
    A new consoles won't solve that problem
  • NinStar @ NinStar:
    It will actually make it worse
  • The Real Jdbye @ The Real Jdbye:
    well actually
    a new console won't do anything right now, because the games are still in development, that's why there are few games being released
  • The Real Jdbye @ The Real Jdbye:
    it won't make the games finish any faster
  • Veho @ Veho:
    2/3rds of launch titles for the Switch 2 will just be lazy ports of Switch games anyway.
  • The Real Jdbye @ The Real Jdbye:
    probably
  • The Real Jdbye @ The Real Jdbye:
    maybe mario kart 9 will be a launch title
  • The Real Jdbye @ The Real Jdbye:
    i really want a new mario kart
  • Veho @ Veho:
    What, you mean the endless stream of DLCs doesn't count?
  • Veho @ Veho:
    Why develop a new game when you can just sell season passes forever?
  • Veho @ Veho:
    I'm still on MKDS so I'm not bothered :tpi:
  • The Real Jdbye @ The Real Jdbye:
    i like the dlc tbh, i'd like a new game more
  • ZeroT21 @ ZeroT21:
    but the current version is still selling fine at full price
  • SylverReZ @ SylverReZ:
    Hello
  • ZeroT21 @ ZeroT21:
    sup
    +1
  • SylverReZ @ SylverReZ:
    @realtimesave, You seen the Unlock Switch flashcart yet?
  • K3Nv2 @ K3Nv2:
    I'll see the 19.0 update that blocks use ability to it
    +1
  • K3Nv2 @ K3Nv2:
    Lol newegg+
    Screenshot-20240423-053504-Gmail.jpg
  • S @ salazarcosplay:
    does update 19 really block it
    SylverReZ @ SylverReZ: @salazarcosplay, Dunno.