Hacking Official Corbenik - Another CFW for advanced users (with bytecode patches!)

[mathieulh]

Damn, people not reading the README/OP/thread posts make me so happy :^)



Although this is true, it still falls under the DMCA exception as part of "security research" ( ͡° ͜ʖ ͡°).

I think than even distributing completely decrypted firmware files is a grey area (and not completely illegal) - one could argue that given a Nintendo 3DS system, one could obtain the decrypted firmware with ease (literally all systems are capable of running D9, given enough resources like hardmod if 11.0)

This is not to say pirated CIAs are OK, since those require a titlekey to be decrypted, and this is obtained illegally. On the other hand, native system titles (like *_FIRM) use the cetk which can be legally obtained from the CDN, as well as the firmware itself, with the only thing between an encrypted and a decrypted firmware is the AES engine and the various undumped keyslots.

A good thing the DMCA is only valid within the US of A and holds no jurisdiction over other parts of the world (such as the European Union where I happen to live)

P.S. a Firmware file is copyrighted materials, the copyright owner (Nintendo) did not give you explicit rights to distribute it, therefore distributing it yourself, in any form whatsoever is illegal in most countries as per international copyright treaties.

 

[Wolfvak]

A good thing the DMCA is only valid within the US of A and holds no jurisdiction over other parts of the world (such as the European Union where I happen to live)

P.S. a Firmware file is copyrighted materials, the copyright owner (Nintendo) did not give you explicit rights to distribute it, therefore distributing it yourself, in any form whatsoever is illegal in most countries as per international copyright treaties.

Well, there it goes then. I'm also not under the DMCAs tyranny, although GitHub is which complicates this whole deal...
Overall, it's just a shitty law which makes no difference other than annoy us, at least in this case.

 

[DjoeN]

compiled corbenic custom firmware successfully at windows 10. my computer has installed devkitpro and mingw-w64. so make sure you have installed those SDK.

simple script for compilation.

@echo off
title Sample Script For Corbenik Custom Firmware
echo ************Menu************
echo [0] : Build corbenik cfw
echo [1] : Clean build
echo [2] : exit
set /p NUM="inout number>"
if "%NUM%"=="1" goto 1
if "%NUM%"=="2" goto 2

:0
mingw32-make

:1
mingw32-make clean

:2
exit

Here's a full batch script to compile corbenik (using mingw32-make) with the 2 options described below (you can remove the REM lines, it's just to explain the command above)

Spoiler

@echo off
cls
%~d0
cd %~dp0
IF "%PATH:C:\Python27=%" == "%PATH%" PATH=%PATH%;C:\Python27
REM Safety check to see if Python is in your PATH
REM Adapt to your settings c:\Python27 or c:\Python35 or whatver folder you have your python installed to
REM this will check if Python is in your path, if not it will add it temporary
REM and remove it when this command window closes

IF "%PATH:c:\MinGW\bin=%" == "%PATH%" PATH=%PATH%;c:\MinGW\bin
REM Safety check to see if MinGW is in your PATH
REM Adapt to your settings c:\MinGW\bin or whatver folder you have your MinGW installed to
REM this will check if c:\MinGW\bin is in your path, if not it will add it temporary
REM and remove it when this command window closes

Title = corbenik build menu ^(Release^)...
ECHO ................................................................
ECHO . Corbenik CFW Menu. Which option do you want to compile with? .
ECHO ................................................................
ECHO.
ECHO 1 - Build Corbenik with option ALL
ECHO 2 - Build Corbenik with option FULL
ECHO 3 - Exit
ECHO.
choice /C 123 /M "Enter the number of your choice:"
IF ERRORLEVEL 3 exit
IF ERRORLEVEL 2 GOTO FULL
IF ERRORLEVEL 1 GOTO ALL

:ALL
Title = Building corbenik...
if exist "Corbenik" (
    echo Making a backup of your current corbenik folder
    xcopy "Corbenik\*" "Backups_Compiles\Backup_Corbenik" /e /i /y >nul
    cls
    cd corbenik
    Title = Building corbenik ^(Update^)...
    echo Updating repo...
    git pull origin master
    git submodule update --init --recursive
) else (
    Title = Building corbenik ^(Clone^)...
    echo Cloning repo...
    git clone --recursive https://github.com/chaoskagami/corbenik.git
    cd corbenik
)
echo Building corbenik...
echo Building...
Title = Building Corbenik ^(Clean^)...
mingw32-make clean
Title = Building Corbenik ^(Release^)
mingw32-make all
Title = Building Corbenik ^(Done^)
echo.
echo ############################################
cd %~dp0
color A
echo Done. Files are in the "Corbenik/out" folder.
echo Press any key to continue ...
Pause >nul
exit

:FULL
Title = Building corbenik FULL...
if exist "Corbenik" (
    echo Making a backup of your current corbenik folder
    xcopy "Corbenik\*" "Backups_Compiles\Backup_Corbenik" /e /i /y >nul
    cls
    cd corbenik
    Title = Building corbenik FULL ^(Update^)...
    echo Updating repo...
    git pull origin master
    git submodule update --init --recursive
) else (
    Title = Building corbenik FULL ^(Clone^)...
    echo Cloning repo...
    git clone --recursive https://github.com/chaoskagami/corbenik.git
    cd corbenik
)
echo Building corbenik FULL...
echo Building...
Title = Building Corbenik FULL ^(Clean^)...
mingw32-make clean
Title = Building Corbenik FULL ^(Release^)
mingw32-make full
Title = Building Corbenik FULL ^(Done^)
echo.
echo ############################################
cd %~dp0
color A
echo Done. Files are in the "Corbenik/out" folder.
echo Press any key to continue ...
Pause >nul
exit

All:
Build your standard release

Full:
Build your standard release
+ contrib folder (Patches contributed by other people)
+ locales folder (for out of region games etc...)
+ All zipped up in one file (release.zip)
+ sha512 security check for your zipped file (Only for linux?, just ignore the error)

That aside,
If you have installed sygwin with develop options it also compiles fine

 

[Kirtai]

I've tried like 4 versions of what is supposed to be the 'firmkey', nothing works.

I extracted the keys directly from the cetk files for each of the firmwares. I believe I mentioned how I did this earlier in the thread.

After 8 different firmware keys, several of my own decrypted, rearranging the files in every possible configuration, and enlisting 2 other people to follow the exact same process, I can say that we're all thoroughly convinced this is vaporware.

I managed to get it running though it did take a bit of work.

Incidentally, the SHA1 hashes of the N3DS keys are also in this thread so you could check them from that.

Edit: The N3DS also requires the Slot0x11Key96.bin which has to be renamed as 11.key in the keys folder.

 

[The Catboy]

Except that I followed every single thing in it, asked two other security researchers to check I'm not crazy, they followed it, and I asked other's I known who've tried it, and it's still failing.

I think at this point it's more than just the usual 'git gud' tripe, and more along the lines of 'The readme isn't fucking helping anyone'

The 3DS scene has too many rude people, and too much half-assed/dangerous software for me, I think. The guides all contradict each other, people are too scared to share numbers with each other, and half the time the software either bricks your console, doesn't work at all, or has been taken offline, and now we're at the point where everyone's gotta have their own personal CFW, regardless of it works or not.

After 8 different firmware keys, several of my own decrypted, rearranging the files in every possible configuration, and enlisting 2 other people to follow the exact same process, I can say that we're all thoroughly convinced this is vaporware. Nothing, I mean NOTHING fixes the 'FAILED TO LOAD NATIVE_FIRM' shit. I've had enough of the in-joke, or April-Fools that people are playing here, pretending this works, I'm done. Even Luma isn't safe from it. Crippling the ability to play GBA or VC games, crashing the console every time, like, it's just not worth this.


I'd say 'see you later', but I think I'm done here. If you see the n3DS and Freakyforms on eBay in the next 30 mins, that's mine.

I feel like you might be doing something wrong. I was able to get mine working with the same firmware and keys from CakesFW.
You can actually find a pre-made nightly build of CakesFW on that iso site, with the same firmware/keys that I am using now.
Did you make sure you named them properly? Firmware.bin needs to be renamed to NATIVE and the keys need to be named "native.key" then put into their respective folders.

 

[Kirtai]

Actually, here's the SHA1 hashes of all the key and firmware files I'm currently running on my N3DS right this moment so you can check you have the right files.

Spoiler

2e08002a594b2fa1eab75e31600a61ab938222c7 *N3DS_corbenik_files\firmware\agb
2d5849f7ade03e586ff90045429fe2fc53526cd1 *N3DS_corbenik_files\firmware\native
70b15fd651263ba1a8ea8cb6d735fbc25c8f4741 *N3DS_corbenik_files\firmware\twl
1e6ef27104ed769766fb65259f719a0712baa5fb *N3DS_corbenik_files\keys\11.key
9ff90dc848b81e5c91a4e1e01c915db0f24d487f *N3DS_corbenik_files\keys\agb.key
daafdb699a48877dd6b33d92c48e37632c8928bf *N3DS_corbenik_files\keys\native.key
7b8597cce5b817346f9c9e5dfc071b6156d80af3 *N3DS_corbenik_files\keys\twl.key

And just for good measure, the SHA1 hashes for the O3DS I just installed. This time the keys were obtained via softbooting from Luma3DS system options to Corbenik.

Spoiler

1139987e414f835651e1853f0249fd49219dc2e3 *O3DS_corbenik_files\firmware\agb
ccad36af0934dd94160c93f61e7d86e9c5a9e859 *O3DS_corbenik_files\firmware\native
af3f832d1e60b66e2f7dc2b6920d473a68053b27 *O3DS_corbenik_files\firmware\twl
a9e6d7dab0d813973abfc2768d20a8bd4625d936 *O3DS_corbenik_files\keys\agb.key
9fc07590adfb2c9fc8ab6e0e0f654233dbf3a02f *O3DS_corbenik_files\keys\native.key
94166dd59502416699ed77e12f1a010ba15af0e6 *O3DS_corbenik_files\keys\twl.key

 

[3xkrazy]

@chaoskagami

Suggestion: Just a minor annoyance, but can you have make all, full, or whatever, also mkdir -p according to

Spoiler: corbenik/source/patch_format.h

#ifndef __PATCH_FORMAT_H
#define __PATCH_FORMAT_H

// The following are titleids which are handled specially for one reason or
// another.
// We use titleIDs to be generic; it ensures that patches can share the same
// format
// regardless of whether they're intended for loader or not. Simple logistics.
#define NATIVE_FIRM_TITLEID 0x0004013800000002llu      // NATIVE_FIRM
#define NATIVE_FIRM_N3DS_TITLEID 0x0004013820000002llu // NATIVE_FIRM, n3ds

#define TWL_FIRM_TITLEID 0x0004013000000102llu      // TWL_FIRM (DSi Firmware)
#define TWL_FIRM_N3DS_TITLEID 0x0004013020000102llu // TWL_FIRM, n3ds (DSi Firmware)

#define AGB_FIRM_TITLEID 0x0004013000000202llu      // AGB_FIRM (GBA firmware)
#define AGB_FIRM_N3DS_TITLEID 0x0004013020000202llu // AGB_FIRM (GBA firmware)

#define LOADER_TITLEID 0x0004013000001302llu // Loader is handled specially.

#define PATCH_MANDATORY (1 << 0)  // Patch must be applied for successful boot.
#define PATCH_FAIL_ABORT (1 << 1) // If patch fails to apply, abort and show an error.
#define PATCH_DISABLED (1 << 2)   // Do not allow changing this patch's status. With PATCH_MANDATORY,
                                  // this prevents disabling it.

// You can redefine this in the Makefile, if you'd like.
// Recommended names for being silly:
//   Windows
//   system
#ifndef PATH_CFW
#define PATH_CFW "/corbenik" // CFW root directory.
#endif

#define PATH_CONFIG_DIR PATH_CFW "/config"       // Config file directory.
#define PATH_CONFIG PATH_CONFIG_DIR "/main.conf" // Config file.
#define PATH_CPU_CFG PATH_CONFIG_DIR "/cpu.conf" // CPU settings config

#define PATH_LOCEMU PATH_CFW "/locale"    // Locale emulation config

#define PATH_PATCHES PATH_CFW "/patch"      // Patch binary folder.
#define PATH_FIRMWARES PATH_CFW "/firmware" // Firmware folder.
#define PATH_MODULES PATH_CFW "/module"     // Sysmodule location
#define PATH_SVC PATH_CFW "/svc"            // Svc code location.

#define PATH_TEMP PATH_CFW "/cache"           // Files that are transient and used to speed operation
#define PATH_LOADER_CACHE PATH_TEMP "/loader" // Cached patch bytecode for loader.

#define PATH_NATIVE_P PATH_TEMP "/p_native"
#define PATH_AGB_P PATH_TEMP "/p_agb"
#define PATH_TWL_P PATH_TEMP "/p_twl"

#define PATH_KEYS PATH_CFW "/keys" // Keyfiles will be loaded from this dir, and
                                   // additionally the root if not found.

#define PATH_EXEFS PATH_CFW "/exe"         // ExeFS overrides/dumps, named by titleid
#define PATH_EXEFS_TEXT PATH_EXEFS "/text" // Text segment overrides/dumps, named by titleid
#define PATH_EXEFS_RO PATH_EXEFS "/ro"     // RO segment overrides/dumps, named by titleid
#define PATH_EXEFS_DATA PATH_EXEFS "/data" // Data segment overrides/dumps, named by titleid

#define PATH_BITS PATH_CFW "/bits" // Path to misc bits we need (emunand code, reboot code, etc)

#define PATH_EMUNAND_CODE PATH_BITS "/emunand.bin"       // Emunand hook.
#define PATH_SCREENINIT_CODE PATH_BITS "/screeninit.bin" // Screeninit code (ARM11)
#define PATH_BACKDOOR PATH_BITS "/backdoor.bin"   // svcBackdoor
#define PATH_REBOOT_HOOK PATH_BITS "/reboot_hook.bin"   // Reboot hook
#define PATH_REBOOT_CODE PATH_BITS "/reboot_code.bin"   // Reboot entry code

#define PATH_NATIVE_F PATH_FIRMWARES "/native"
#define PATH_AGB_F PATH_FIRMWARES "/agb"
#define PATH_TWL_F PATH_FIRMWARES "/twl"

#define PATH_NATIVE_CETK PATH_KEYS "/native.cetk"
#define PATH_TWL_CETK PATH_KEYS "/twl.cetk"
#define PATH_AGB_CETK PATH_KEYS "/agb.cetk"

#define PATH_NATIVE_FIRMKEY PATH_KEYS "/native.key"
#define PATH_TWL_FIRMKEY PATH_KEYS "/twl.key"
#define PATH_AGB_FIRMKEY PATH_KEYS "/agb.key"

#define PATH_SLOT0X11KEY96 PATH_KEYS "/11.key"

#define PATH_ALT_SLOT0X11KEY96 "/slot0x11key96.bin" // Hey, your perrogative, buddy. I like cleaned up
                                                    // paths.

#define PATCH_FLAG_REQUIRE (1 << 0) // Force enable patch unless 'Unsafe Options' is checked.
#define PATCH_FLAG_DEVMODE (1 << 1) // Require 'Developer Options' to be checked.
#define PATCH_FLAG_NOABORT (1 << 2) // Don't abort on error.

// Structure of a patch file.
struct system_patch
{
    char magic[4];   // "AIDA" for shits and giggles and because we like .hack.
    uint8_t version; // Version of the patch itself.

    // NOTE - This metadata stuff is temporary, I eventually plan to move it down
    // to the same 'variable' width section as tids.
    char name[64];   // User-readable name for patch in menu.
    char desc[256];  // User-readable description for patch in menu.

    uint64_t uuid;  // Unique ID for patch. Each unique patch should provide
                    // a unique ID.

    uint32_t flags; // Extra flags for patch.

    uint32_t titles; // How many titles this patch should be applied to (listed later)

    uint32_t depends; // How many deps there are.

    uint32_t size; // Size of the patch bytecode in bytes.

    // This stuff needs to be read not as part of the struct, but is technically part of it.

    // uint64_t tids[titles]     // TitleIDs.
    // uint64_t deps[depends]    // Dependencies as uuid refs.
    // uint8_t  patch_data[size] // Patch data.
} __attribute__((packed));

#endif

also, I am curious as to why you deviated from scene standards by renaming slot0x11key96.bin to 11.key? I know that it can be placed at root, but I too like cleaned up paths. I know you probably have good reason, but it seems like an unnecessary change just for the hell of it.

 

[3xkrazy]

1 more question: I know I asked you before and you replied that it's not one of the project's goal, but could corbenik support chainloading if someone decides to contribute code for corbenik/contrib/?

 

[chaoskagami]

Well, there it goes then. I'm also not under the DMCAs tyranny, although GitHub is which complicates this whole deal...
Overall, it's just a shitty law which makes no difference other than annoy us, at least in this case.

Well, I happen to be in the US where we have a psycho crazy bastard (pardon my french) running for president and breaking DMCA will land you in jail longer than theft.

So, point stands, really.

@chaoskagami

Suggestion: Just a minor annoyance, but can you have make all, full, or whatever, also mkdir -p according to

I'm not sure why I wasn't doing so in the first place, sorry. The other folders really should be using proper paths in the makefile.

also, I am curious as to why you deviated from scene standards by renaming slot0x11key96.bin to 11.key? I know that it can be placed at root, but I too like cleaned up paths. I know you probably have good reason, but it seems like an unnecessary change just for the hell of it.

Some scene standards are crap, and I'm not afraid to try flipping them on their head for experimentation. I also hate root path clutter.

No real reason for the rename aside from not using file extensions here, I guess. It's not like the 3DS uses FAT16 where it would actually be an issue. It'd probably be better to just read the D9 keydb.

--------------------- MERGED ---------------------------

1 more question: I know I asked you before and you replied that it's not one of the project's goal, but could corbenik support chainloading if someone decides to contribute code for corbenik/contrib/?

Contrib is solely for bytecode patches. That would go in external. Also, I'm not sure chainloading should be a part of corbenik, but if enough people ask, I'll make it a compile-time thing to enable/disable. I have a chainloader already written that isn't terribly hard to repurpose.

 

[3xkrazy]

Contrib is solely for bytecode patches. That would go in external. Also, I'm not sure chainloading should be a part of corbenik, but if enough people ask, I'll make it a compile-time thing to enable/disable. I have a chainloader already written that isn't terribly hard to repurpose.

Please do .

 

[shawn_]

Please do .

I would also enjoy a chainloader implemented into your CFW. Thanks for your consideration


Sent from my iPhone using Tapatalk

 

[HenryLeonheart]

Contrib is solely for bytecode patches. That would go in external. Also, I'm not sure chainloading should be a part of corbenik, but if enough people ask, I'll make it a compile-time thing to enable/disable. I have a chainloader already written that isn't terribly hard to repurpose.

Yes, please. A chainloader would be perfect.

 

[chaoskagami]

Near done on chainloader menu. Cleaning up the code, then I push to github.

As an FYI, this will only load raw binary files, not dat files. I don't intend to change this. It's also a submenu, not button combos like other CFW, and I also have no intentions to change this.

Put your ARM9 payloads under /corbenik/chain. Doesn't even need to have the bin extension.

 

[Wolfvak]

Near done on chainloader menu. Cleaning up the code, then I push to github.

As an FYI, this will only load raw binary files, not dat files. I don't intend to change this. It's also a submenu, not button combos like other CFW, and I also have no intentions to change this.

Put your ARM9 payloads under /corbenik/chain. Doesn't even need to have the bin extension.

A dat file is literally the same as a raw arm9 binary, except the 0x12000 offset (and you know, CakeHax)

 

[chaoskagami]

A dat file is literally the same as a raw arm9 binary, except the 0x12000 offset (and you know, CakeHax)

I don't intend to implement support for CakeHax payloads. Mainly, because I'd need a reliable way to detect them (aside from the extension.) AFAIK there's no magic easy way to detect CakeHax.

This is owing to the fact that CakeHax is an ARM11 chainloader. Unless mid-kid puts a magic constant after the branch to main / die, there's no reliable way to detect them aside from disassembly.

 

[Chelsea_Fantasy]

@chaoskagami I found an error on the credits spoiler on the OP.
Check the @Dark-samus reference

 

[chaoskagami]

@chaoskagami I found an error on the credits spoiler on the OP.
Check the @Dark-samus reference

You know, I could have sworn I fixed that, but gbatemp messed up the formatting again. Thanks.

EDIT: Okay, actually, what's dark-samus' username on GBATemp? The readme is based on github. I'm assuming he's @dark_samus3, right? If I'm wrong, correct me. >_<

--------------------- MERGED ---------------------------

Chainloader is in git now. Payloads (bin only) go in /corbenik/chain. The new menu 'Chainload' will list the payloads and allow booting them.

You can compile with `make EXTRA=` if you don't want the chainloader and the code will be cut out during compile. The implementation is pretty lightweight, though (and it's not based on other chainloaders, either.)

 

[Temptress Cerise]

You know, I could have sworn I fixed that, but gbatemp messed up the formatting again. Thanks.

EDIT: Okay, actually, what's dark-samus' username on GBATemp? The readme is based on github. I'm assuming he's @dark_samus3, right? If I'm wrong, correct me. >_<

--------------------- MERGED ---------------------------

Chainloader is in git now. Payloads (bin only) go in /corbenik/chain. The new menu 'Chainload' will list the payloads and allow booting them.

You can compile with `make EXTRA=` if you don't want the chainloader and the code will be cut out during compile. The implementation is pretty lightweight, though (and it's not based on other chainloaders, either.)

You workaholic you~ <3 Anyways, wish I could test this, but delete my linux distros VMs in a purge to try out new ones, and so it'll be a while before I can compile.

Though the people who requested this should be the ones testing it.

 

[The Catboy]

You know, I could have sworn I fixed that, but gbatemp messed up the formatting again. Thanks.

EDIT: Okay, actually, what's dark-samus' username on GBATemp? The readme is based on github. I'm assuming he's @dark_samus3, right? If I'm wrong, correct me. >_<

--------------------- MERGED ---------------------------

Chainloader is in git now. Payloads (bin only) go in /corbenik/chain. The new menu 'Chainload' will list the payloads and allow booting them.

You can compile with `make EXTRA=` if you don't want the chainloader and the code will be cut out during compile. The implementation is pretty lightweight, though (and it's not based on other chainloaders, either.)

Damn! I can't wait to abuse the shit out of that feature!

 

[chaoskagami]

You workaholic you~ <3 Anyways, wish I could test this, but delete my linux distros VMs in a purge to try out new ones, and so it'll be a while before I can compile.

Though the people who requested this should be the ones testing it.

Hey, that's fine. Now that I think of it, I should be flushing the D/I Cache here. I'm not encountering any issues with payloads, but...

(Anime...withdrawal...)

Damn! I can't wait to abuse the shit out of that feature!

o_o