1. schrmh

    OP schrmh Member
    Newcomer

    Joined:
    Jun 5, 2015
    Messages:
    48
    Country:
    Gambia, The
    (10th August 2018: If you are interested in doing this for the Switch you may contact Traiver.)

    Some useful information:

    The first version gbatemp version of this guide was written by Samplasion with information by derberg (Discord names); now derberg is maintaining changes.
    (Click for our Documentation)
    (Click for Discord discussion)

    It is somewhat similar to the Home Menu costumizing process described on dungeonfire.tk (if you want to help the customizing community you can also find a Discord link there).
    Also a note by derberg: (removed now, cause confirmed in post #7)
    Also note that there is still no full customization. You can only change visual parts of what is already there: You can hex edit positions of elements and change their look (after this tutorial you will be able to do something of this by using our linked docs) or replace images with tools like png2bclim or Kuriimu or change Text with e.g. the reloaded MSBT Editor or Kuriimu. But we still don't know how we can replace what elements do on a click and we can't add completly new things.

    Actual start of the tutorial:
    (after setting it up editing & testing a change may take less than a minute (if you use luma), cause you can restart at Macrostep 3 point 6 then)

    DISCLAIMER: I am not responsible if your console bricks. You assume your responsibilities by following this guide.

    This guide is about how to edit the System Settings (mset) app.
    Requirements

    • A 3ds with GodMode9
    • The Low TID of the System Settings app corresponding to your region
    • Asia81's HackingToolkit9DS (curently V11) (If you take Macrostep 1a you don't need it; or if you like it hard take the not fully documented 1b)
    • A Hex editor (Samplasion recommends HxD; derberg uses Hex-Editor MX Hex Workshop; feel free to recommend us better ones)
    • DarcTool3DS 5.5 or DSDecmp(GUI version included in 3DSExplorer) or maybe nlzss (untested yet) or EveryFileExplorer (only for decompression, so you need a plugin for EFE or a second tool for compression)(I recommend DarcTool3DS, but please recommend us a better alternative for those tools; it works, but yeah.. Hope GodMode9 will implement LZ11 decompression and luma will implement LZ11 compression, cause this would save time..)
    • A computer
    • A functional brain (according to DeKay)
    Macrostep 0: enabling Luma's Game Patching

    1. Boot your 3DS while holding Select to open Luma's Config Menu
    2. Enable "Enable game patching"
    3. Press Start to save
    4. Turn your 3DS off
    Macrostep 1: dumping the System Settings app

    1. Boot your device and enter GodMode9 by holding Start
    2. Navigate to [1:] SYSNAND CTRNAND
    3. Navigate to title
    4. Navigate to 00040010
    5. Navigate to the folder corresponding to the System Settings app Low TID you took earlier
    6. Navigate to content
    (this may be moved into another Macrostep in the future, so that's why they are not named 7. and 8. anymore (when 1b is working), but currently you still need to do it: )
    1. Press (A) on the .tmd file → TMD file options... → Build CIA (standard)
    2. Turn your 3DS off and go to Macrostep 2 (or go to Macrostep 1a instead which is faster for Luma users!)
    Exporting a binary directly from the CIA (example with base_LZ)

    Thanks to https://gbatemp.net/threads/title-dumping-and-file-extraction-using-godmode9-1-0.465427/
    1. In GodMode9 navigate to [0:] SYSNAND CTRNAND
    2. Navigate to gm9out
    3. Press (A) on 00040010[LowTID] System Settings (CTRN-HASP) ([REGION]).cia → CIA image options... → Mount image to drive
    4. Go into 0000.000000[XX] (the folder which has much more content; for me XX is 3D, for you it may be something other..)
    5. Get into romfs
    6. Select a binary like base_LZ.bin and press (A) Copy to 0:/gm9out
    7. Skip Macrostep 2 & 2a and go directly to Macrostep 3.
    (WIP:) Decrypting an .app and exporting a binary from that (example with base_LZ)

    1. Press (A) on the smaller .app (XX is variable) named like 000000[XX] NCCH image options... → Decrypt file (...) → Decrypt to (0:/gm9out)
    2. Go into (the folder which has much more content; for me XX is 3D, for you it may be something other..)
    3. In GodMode9 navigate to [0:] SYSNAND CTRNAND
    4. Navigate to gm9out
    5. Press (A) on 00040010[LowTID] .000000[XX] System Settings (CTR...([REGION]).cxi → NCCH image options... → Mount image to drive
    6. Get into romfs
    7. Select a binary like base_LZ.bin and press (A) Copy to 0:/gm9out
    For the rest I don't have a guide, but you can write one for me if you like (log from Eix's Discord):
    Eix's New Years Waifu
    the file is already decrypted in your output directory so copy the edited binary then find where that file begins in the decrypted file aslong as it isnt bigger or smaller than the unedited .bin file you can inject it decrypted .cxi files have 0 fragmentation so its byte to byte in the hex editor just grab the offset and inject the file there or if your feeling like you want to inject a bigger or smaller file you can do it line by line in ctrxplorer
    then ofcourse reencrypt it
    derberg
    So if I get this right after injecting the edited base_LZ.bin back into the .cxi (and maybe reencrypting) do I have to select the modified .cxi then and choose "Build CIA from file"? Btw. the CIA would be much smaller then the original CIA of system settings cause system settings has two .app files.
    Eix's New Years Waifu
    yeah thats right to fix the cia size you can start out by building a decrypted cia from the tmd then following the normal steps

    Eix's New Years Waifu-heute um 21:35 Uhr

    cia files are normally never ment to be edited so the files are just listed inside 0 fragmentation

    Macrostep 2: extracting the RomFS

    1. Insert the SD of the 3ds into your computer
    2. Extract HackingToolkit9DS.zip on your computer
    3. Navigate to gm9/out/
    4. Copy the 00040010[LowTID].cia file to the /PackEnglishV11/PackHack/ folder
    5. Rename the .cia with something short, like mset.cia
    6. Run the SetupUS.exe file
    7. Run the HackingToolkit9DS.exe file
    8. Type CE and press Enter
    9. Type the name you used in step 5 without extention (.cia)
    10. Wait some seconds and press a key
    11. Go to the ExtractedRomFS folder (if you don't have it, go to macrostep 2a)
    Macrostep 2a: encrypting the .cia

    1. Boot your device and enter GodMode9 by holding Start
    2. Navigate to gm9
    3. Navigate to out
    4. Press (A) on the .cia file → CIA file options... → Encrypt CIA...Encrypt Inplace
    5. Turn your 3DS off
    6. Insert the SD of the 3ds into your computer
    7. Run /PackEnglishV11/PackHack/CleanTool9.exe
    8. Copy the .cia file to the /PackEnglishV11/PackHack/ folder
    9. Repeat Macrostep 2 from step 7
    Macrostep 3: editing base_LZ.bin (or any other binary from System Settings)

    (Of course you just need one tool for decompression and one for compression. Just listed a few ones after someone had problems with DarcTool3DS, which is the fastest one of those. Also I have only looked wether the alternative tools change the size of base_LZ.bin to 158KB, so I don't know wether they decompress correctly. So at first try it with DarcTool3DS)
    1. Extract DarkTool3DS.zip on your computer
    2. Copy base_LZ.bin from SD:/gm9out/ (if you took Macrostep 1a) or from /PackEnglishV11/PackHack /ExtractedRomFS (if you did not took Macrostep 1a) into DarcTool3ds/DarcTool3ds/, next to the .bat file
    3. Run DarcTool3DS.bat
    4. Choose option 2 by pressing 2 on your numpad and then the Enter/Return key (it won't give you big feedback, so look wether file size changed; bigger)
    5. Close DarcTool3DS.bat
    1. Extract 3dsexplorer_v1.5.3.zip on your computer
    2. Run 3DSExplorer.exe
    3. Ignore the warning and click the Button that stands for "continue" in your language
    4. Click on "Tools" which you can find in the menu bar
    5. Click on "DSDecmp GUI"
    6. "Browse..." for base_LZ.bin
    7. "Decompress" with Algorithm: "LZ11" and choose a new file name ending .bin
    1. Extract EveryFileExplorer_lwyx2016_Nov-9-2017.rar on your computer
    2. Run EveryFileExplorer.exe
    3. Click on "Tools" which you can find in the menu bar
    4. Click on "Compression" → Common Compressors Plugin → LZ11Decompress...
    5. Open your base_LZ.bin
    6. Save your decompressed binary with the new file dialog which just opened itself
    Edit the decompressed base_LZ.bin with an hex editor. (Click for our Documentation)
    (make a backup before you compress if you want to edit more later, cause multiple compression & decompression of one file may not work)
    1. Run DarcTool3DS.bat
    2. Choose option 4 by pressing 4 on your numpad and then the Enter/Return key (it won't give you big feedback, so look wether file size changed; smaller)
    3. Close DarcTool3DS.bat
    1. Run 3DSExplorer.exe
    2. Ignore the warning and click the Button that stands for "continue" in your language
    3. Click on "Tools" which you can find in the menu bar
    4. Click on "DSDecmp GUI"
    5. "Browse..." for your edited binary
    6. "Compress" with Algorithm: "LZ11" and choose a new file name ending .bin
    Macrostep 4: loading the custom .bin with Luma

    1. Navigate to SD:/luma
    2. Create a new folder called titles
    3. Create a new folder called 00040010[LowTID]
    4. Create a folder called romfs
    5. Copy the base_LZ.bin file to the newly created romfs folder
    6. DONE! Now you can show us your modifications. (I want New Year themed ones, please.)
    Credits

    Feel free to upload images to share your own System Settings customizations!
    Also feel free to recommend me any other method/tool
    (+example, please) which could replace the tools mentioned in this tutorial or which may be helpful for editing things (for real, yesterday I messed with so many (outdated) tools and I don't want to mess with any more without knowing that there is a high success chance with it...).


    [​IMG]

    For historical reasons something which isn't handled in this guide, but I think Kuriimu helps there now. Also you can always ask us.
    Did this back when HANS was completly new at the 3rd of November 2015 after smea wanted "[...] to see my avatar in there somewhere" (he meant in the system settings app) with braindump, BatchLZ77, png2clim (which had a renaming bug), I think with LITTOMA's version of darctool (it had a bug cause of it's recursive path "feature" - System settings app has multiple folders with the same names..) and HANS:
    [​IMG]
     
    Last edited by schrmh, Dec 26, 2018
  2. SirNapkin1334

    SirNapkin1334 Renound Aritst
    Member

    Joined:
    Aug 20, 2017
    Messages:
    1,666
    Country:
    United States
    Interesting.... Could we build a new CIA with the romFS and install that, deleting the System Settings beforehand? I actually tested this-deleting system settings with FBI and installing a system settings from a different region (dumped from my region changed EmuNand), and it worked. I restored a NAND backup made beforehand just in case, but it appeared to have worked. I'd heard of people being bricked by accidentally deleting system settings, but my system worked just fine without it.
     
  3. schrmh

    OP schrmh Member
    Newcomer

    Joined:
    Jun 5, 2015
    Messages:
    48
    Country:
    Gambia, The
    Currently you can't create a CIA with PackHack. Out there may be some other tool out there (ctrtool?). At least the HMRT pack for Home Menu Costumizing can create a CIA for the Home Menu.

    There were people in the past which tried to delete as much system titles as possible. I don't really know for the system settings app atm, but I think I managed to do this back then in EmuNAND.
    Whatever.. Currently with b9s and luma my system settings app doesn't work without the patches from LayeredFS - I think I broke it yesterday by installing a broken cia while I were testing, haha.
     
    Last edited by schrmh, Dec 30, 2017
  4. Deleted User

    Deleted User Newbie

    pretty cool little thing
    but you can do if 3ds side without the need for luma
    just boot to gm9 with your prefeered method
    copy the .app file for mset to somewhere
    decrypt it
    the navigate it with the hex editor to change what you want
    then save&re encrypt
    build a cia
    and make a backup of the origonal mset too
    then install the cia
    then if it doesnt work just encrypt the cia and retry
    if it still doent work then reinstall your backup and repeat
    you can really do it with any title and i find myself doing it alot
    i dont always have my laptop so i use my 3ds or vita for editing stuff (the vita is nicer for editing)
    i tried that recently
    i managed to reduce system titles down to ~20mb and still was functional (idk why i did it on my sysnand)
     
  5. SirNapkin1334

    SirNapkin1334 Renound Aritst
    Member

    Joined:
    Aug 20, 2017
    Messages:
    1,666
    Country:
    United States
    That's literally exactly what I said lol
     
  6. Deleted User

    Deleted User Newbie

    yeah but i attempted to explain-ish how to do it 3ds side
    NASA is the better cia installer
     
  7. schrmh

    OP schrmh Member
    Newcomer

    Joined:
    Jun 5, 2015
    Messages:
    48
    Country:
    Gambia, The
    Yeah, I know, but Packhack V11 can't build one currently. Feel free to share another way and I will mention it in the OP.
    Also step 2a and 3 are really not necessary. Tested that out. (EDIT: In a new edit of the OP you can't see it anymore but in lines 3-5 of the original OP I had written this: ,,Maybe you can skip 2a and 3 by following the mounting part from this tutorial: https://gbatemp.net/threads/title-dumping-and-file-extraction-using-godmode9-1-0.465427/ and then copying the base_LZ.bin from there, but I need confirmation for this." . And with this post I just confirmed my guess.)
     
    Last edited by schrmh, Dec 31, 2017
  8. SirNapkin1334

    SirNapkin1334 Renound Aritst
    Member

    Joined:
    Aug 20, 2017
    Messages:
    1,666
    Country:
    United States
    CTRTool (or 3DSTool, can't remember which one) can rebuild the romFS, I think they can also build CIAs. You can always mount a CIA with GM9, grab the base_LZ.bin, edit it, and then replace it, and if needed rebuild the CIA. You can do a lot of this with GM9, I believe. That's what I love about GM9. It can do almost anything. Hell, if you have GM9, you don't even need Boot9Strap. If there was a contest for the best 3DS homebrew application based on features and not people's opinions, GM9 would win hands-down.
     
    Deleted User likes this.
  9. Samplasion

    Samplasion Newbie
    Newcomer

    Joined:
    Jun 23, 2016
    Messages:
    8
    Country:
    Italy
    You cannot decrypt a file from GodMode9. There isn't the option in the menu, or elsewhere. The last thing you can do with gm9 before going on the computer is extracting the base_LZ.bin.
     
  10. Deleted User

    Deleted User Newbie

    uhh
    please atleast open gm9 before you type
    20171231_084039.jpg
     
  11. Samplasion

    Samplasion Newbie
    Newcomer

    Joined:
    Jun 23, 2016
    Messages:
    8
    Country:
    Italy
    Sorry, I should control better. But I had gm9 open when i sent the message
     
  12. Deleted User

    Deleted User Newbie

    find a app file (cia app 3ds cxi cci etc...) pres a on it and it will give you different options
    in there you get options that are specific to app files

    — Posts automatically merged - Please don't double post! —

    only thing gm9 is missing is text editing
    thats why i prefeer to send my files to my vita and edit in vitashell :P
     
  13. Jacklack3

    Jacklack3 ( ゚ヮ゚) buddie was here
    Member

    Joined:
    Oct 6, 2015
    Messages:
    1,810
    Country:
    Canada
    We've gotten into the stage of homebrew where we're now just editing the OS since we've done everything.
     
  14. Samplasion

    Samplasion Newbie
    Newcomer

    Joined:
    Jun 23, 2016
    Messages:
    8
    Country:
    Italy
    lol it's true
     
  15. SirNapkin1334

    SirNapkin1334 Renound Aritst
    Member

    Joined:
    Aug 20, 2017
    Messages:
    1,666
    Country:
    United States
    You may need support files to do certain things. To decrypt CIA's, I think you need a seeddb.bin and enc/decTitleKeys.bin
     
  16. schrmh

    OP schrmh Member
    Newcomer

    Joined:
    Jun 5, 2015
    Messages:
    48
    Country:
    Gambia, The
    From this I haven't read out that GodMode9 had an option for that. Thanks for showing the pic in #10 now for clarification. I found the option, will look into that and may edit the OP.
    _
    Also this is a good point to clarify that I may won't try anything if I can't come to a success without trying out much if I receive just a mention of a tool without an example (exception may be computer tools which have a easy GUI). This is why I won't mess with ctrtool nor 3dstool anymore just to get something like cia rebilding done.. Also PackHack may receive an update and a cia isn't needed anyways if you use luma. And a cia installation for each single change would just slow down the whole changing & testing process a lot.


    I just wonder why it isn't that popular. I mean there already was some documentation for changing things in the Home Menu. This is basically just the same for the System Settings app.
    Well, whatever. As mentioned in the op we know only how to change the visual look of existing elements (and I think their positions, but that is not documented on our doc yet).
    In the DS era it was easier to change more things than that. I mean people just injected new things into the DS menu, removed elements and changed its look or completly replaced it with e.g. a wireless controller app (CTurt did that, lol.. His github is also a good starting point if you are interested in custom firmware for the old DS. Also there is some other site where you can find some CFW for downloading, but I forgot its name (DS something)).
     
    Last edited by schrmh, Dec 31, 2017
  17. SirNapkin1334

    SirNapkin1334 Renound Aritst
    Member

    Joined:
    Aug 20, 2017
    Messages:
    1,666
    Country:
    United States
    yes, but a cia installation would be a lot easier
     
  18. Jacklack3

    Jacklack3 ( ゚ヮ゚) buddie was here
    Member

    Joined:
    Oct 6, 2015
    Messages:
    1,810
    Country:
    Canada
    I think it's because it looks too complex and risky.If it was just some app where you type in your text and it does it for you then I bet people would be going all over this.
     
  19. Samplasion

    Samplasion Newbie
    Newcomer

    Joined:
    Jun 23, 2016
    Messages:
    8
    Country:
    Italy
    But the first advice before doing something like this is:
    Also, this method is 100% safe
     
  20. Jacklack3

    Jacklack3 ( ゚ヮ゚) buddie was here
    Member

    Joined:
    Oct 6, 2015
    Messages:
    1,810
    Country:
    Canada
    Oh I know that you'll be perfectly fine in the end, it's just for others who are perhaps beginners it looks a bit scary. Wouldn't you be a bit worried if you had to edit a core module of your system using a hex editor? Of course you could simply restore your nand and boom everythings fine but it's still kind of spoopy.
     
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - Customize, Settings, System