Homebrew Official [Download] Decrypt9 - Open Source Decryption Tools (WIP)

[Asia81]

1) Do you know if it's possible to extract a key from a legit CIA/Game and inject it in another CIA/Game? Like that we can make all CIA legit xD

2) NAND for O3DS and N3DS haven't the same size!

3) Add the possibility to use Decrypt9 while we are in EmuNand (can be useful sometimes).

 

[d0k3]

1) Do you know if it's possible to extract a key from a legit CIA/Game and inject it in another CIA/Game? Like that we can make all CIA legit xD
2) NAND for O3DS and N3DS haven't the same size!
3) Add the possibility to use Decrypt9 while we are in EmuNand (can be useful sometimes).

1. Most likely: no. I don't know enough about what makes legit CIAs legit so far, but if it would as easy as just injecting a legit key, someone would have already done it.
2. Of course they are different. The N3DS uses a different NAND memory than the O3DS. For now that's only more room to install stuff to, but in the future, the N3DS FW might become considerably bigger than the O3DS FW.
3. Well, your EmuNAND is above 9.2, normally, correct? So, no way of running Decrypt9 from that. I'll do a specialized Decrypt9 version that decrypts stuff from EmuNAND instead of SysNAND, though.

 

[Shadowtrance]

I know, all-in-one solutions are convenient, but as zoogie said, you can just use uncart or the GW launcher (GW card not needed). Shadowtrance tried at one point to just copy the uncart code into Decrypt9, but that didn't work for one reason or the other. I might take a short look at merging the uncart code into Decrypt9 at a later point, but don't get your hopes too high up.

So, can rxTools dump stuff from Gateways EmuNAND and does EmuNAND work the same on O3DS and N3DS? Is the raw NAND image always in the same place and has the same name for each solution (and where is it)? If so, I'll make a specialized Decrypt9 version that uses EmuNAND instead of SysNAND. Including that functionality (via some switch functionality) into main Decrypt9 is not a good idea right now, as it would require some critical changes that could backfire at a later point.

Uncart integrated into D9 worked fine EXCEPT the UI would bug out after it had finished and i hit B to return to the menu and i wouldn't have control over the menu, don't know what caused it tbh. Might try it again and see how i go.

Last i checked rxTools could dump files from emunand (ticket.db, moveable.sed and a couple of others), i haven't looked at the source in a while so i don't know if the option is still there or not, i assume it is though. They work the same on o3ds and n3ds i believe, just different sizes. And i believe they're always in the same place on both. As for where they are, they start at sector 0 on the sd card if i remember right...
I don't consider the emunand dumping stuff a huge deal myself, was just pointing out that it isn't some super secret gateway proprietary setup.

 

[d0k3]

Okay, here's finally something new (attached to this post). This is a specialized Decrypt9 version that uses the EmuNAND instead of the SysNAND. This can be installed alongside the regular version. The actual changes are very little vs. my main version, but I still doubt that I will include this in the main release.

Use at your own risk. It will not check if there actually is an EmuNAND on your SD card and injection / NAND restore will mess up your SD card if there is no EmuNAND present. It is also completely untested as of now. That means: I can also not guarantee (although very, very unlikely) that the SysNAND may not be affected by stuff.

However, unless you unlock the dangerous NAND restore / injection features, you are as safe as with the main version.

The binaries are inside the putput subfolder, by the way.

Help with testing the title decryptor and / or my broken N3DS would still be greatly appreciated (see here).

EDIT: Download removed, was broken.

 

[Asia81]

It's for use IN EmuNand (from a CubicNinja CIA or other) or from SysNand like usually and he read the EmuNand?

 

[d0k3]

It's for use IN EmuNand (from a CubicNinja CIA or other) or from SysNand like usually and he read the EmuNand?

If you use the regular version in EmuNAND, it should also use the EmuNAND for all operations, I guess. But this one can be used from anywhere, and it will use the EmuNAND instead of the SysNAND.

 

[d0k3]

Okay, here's finally something new. This is a specialized Decrypt9 version that uses the EmuNAND instead of the SysNAND. This can be installed alongside the regular version. The actual changes are very little vs. my main version, but I still doubt that I will include this in the main release.

Use at your own risk. It will not check if there actually is an EmuNAND on your SD card and injection / NAND restore will mess up your SD card if there is no EmuNAND present. It is also completely untested as of now. That means: I can also not guarantee (although very, very unlikely) that the SysNAND may not be affected by stuff.

However, unless you unlock the dangerous NAND restore / injection features, you are as safe as with the main version.

Help with testing the title decryptor and / or my broken N3DS would still be greatly appreciated (see here).

... the binaries are inside the output subfolder, by the way.

 

[key1340]

Okay, here's finally something new (attached to this post). This is a specialized Decrypt9 version that uses the EmuNAND instead of the SysNAND. This can be installed alongside the regular version. The actual changes are very little vs. my main version, but I still doubt that I will include this in the main release.

Use at your own risk. It will not check if there actually is an EmuNAND on your SD card and injection / NAND restore will mess up your SD card if there is no EmuNAND present. It is also completely untested as of now. That means: I can also not guarantee (although very, very unlikely) that the SysNAND may not be affected by stuff.

However, unless you unlock the dangerous NAND restore / injection features, you are as safe as with the main version.

The binaries are inside the putput subfolder, by the way.

Help with testing the title decryptor and / or my broken N3DS would still be greatly appreciated (see here).

I have just tested it on o3ds 9.2 fw with ninjhax.And it doesn't work it will reboot to system nand or crash the 3ds.

I don't have an emunand on my n3ds to test.

And d0k3 if you won't to test emunand on your n3ds you can use GATEWAY Launcher.dat to make the emunand and ReiNand Cfw to launch it.

EDIT

Just set up an emunand on a spare sd card on the n3ds,Same results doesn't work.

 

[d0k3]

I have just tested it on o3ds 9.2 fw with ninjhax.And it doesn't work it will reboot to system nand or crash the 3ds.

I don't have an emunand on my n3ds to test.

And d0k3 if you won't to test emunand on your n3ds you can use GATEWAY Launcher.dat to make the emunand and ReiNand Cfw to launch it.

EDIT

Just set up an emunand on a spare sd card on the n3ds,Same results doesn't work.

Thanks for testing! So, it reboots to SysNAND immediately or only after starting a feature? I'll see what I can do about that...

 

[key1340]

Thanks for testing! So, it reboots to SysNAND immediately or only after starting a feature? I'll see what I can do about that...

It only rebooted the first time.Had a blank screen for about 5 seconds then rebooted the system nand.

Every other time it just blank screen forever.

I have never got the app to load once.

 

[d0k3]

Okay, second try. That's the same source code as before, but with a different Brahma loader. I somehow messed up the Brahma Loader in the last release.

The precautions / usage instructions for this are the same as above, so, quoted from above:

This is a specialized Decrypt9 version that uses the EmuNAND instead of the SysNAND. This can be installed alongside the regular version.

Use at your own risk. It will not check if there actually is an EmuNAND on your SD card and injection / NAND restore will mess up your SD card if there is no EmuNAND present. It is also completely untested as of now. That means: I can also not guarantee (although very, very unlikely) that the SysNAND may not be affected by stuff.

Danger Zone stuff is unlocked - don't inject or restore NAND without a hardmod and a backup of your SD card. Binaries only this time, source code is still the same as above.

 

[MichiS97]

Haven't read through this thread in a while....this still cannot be launched with MSET on a N3DS right?

 

[Shadowtrance]

Haven't read through this thread in a while....this still cannot be launched with MSET on a N3DS right?

Not that I'm aware of no.
Now if CakeHax had n3ds support (i don't think it does), it could be launched from MSET that way, but everytime I've tried to get it to work with it, it just fails to load. So i guess n3ds support isn't there yet.

So yeah, just spider/ninjhax for o3ds and just ninjhax for n3ds atm.

 

[key1340]

Okay, second try. That's the same source code as before, but with a different Brahma loader. I somehow messed up the Brahma Loader in the last release.

The precautions / usage instructions for this are the same as above, so, quoted from above:


Danger Zone stuff is unlocked - don't inject or restore NAND without a hardmod and a backup of your SD card. Binaries only this time, source code is still the same as above.

I have tested this version with o3ds 9.2 fw + 9.9 emunand + ninjhax.

Dump decTitleKeys.bin it loaded up fine with print_ticket_keys.py and i could see all the tickets.

Dump ticket.db is fine it crc matched one i had from an emunand back up with emuNANDTool.

Dump nand is fine i was able the decrypt it with my nand.fat16.xorpad.And the ctrnand crc matched the ctrnand i had from an emunand back up with emuNANDTool.

Dump nand partitions it dumped the partitions and i could mount them with OSFMount.With the ctrnand i tried out some of the files and some are good some are bad.The ticket.db doesn't crc match the other ones and comes up as corrupt
with FunkyCIA2.

I didn't try the inject options i didn't know if they would mess up my 3ds.

 

[usernametaken]

Figure it's better to ask, just to be on the safe side. Rather than assume and be screwed.

So.. I see that you're able to backup the Nand & Restore via Homebrew Channel.. Right? xD
If that's the case, would this eliminate the absolute need for a hardmod if you say backed up your Nand file, then accidentally upgraded the Sysnand? You'd just be able to launch Ninjhax 2.0 & restore the previous Nand file, right?

 

[d0k3]

I have tested this version with o3ds 9.2 fw + 9.9 emunand + ninjhax.

Dump decTitleKeys.bin it loaded up fine with print_ticket_keys.py and i could see all the tickets.

Dump ticket.db is fine it crc matched one i had from an emunand back up with emuNANDTool.

Dump nand is fine i was able the decrypt it with my nand.fat16.xorpad.And the ctrnand crc matched the ctrnand i had from an emunand back up with emuNANDTool.

Thank you!

Dump nand partitions it dumped the partitions and i could mount them with OSFMount.With the ctrnand i tried out some of the files and some are good some are bad.The ticket.db doesn't crc match the other ones and comes up as corrupt with FunkyCIA2.

I didn't try the inject options i didn't know if they would mess up my 3ds.

That's a strange problem. If dumping the ticket.db works directly from Decrypt9, then it should also work from the CTRNAND.bin. Both, OSFmount and Decrypt9 use the FAT image file structure to locate those files. Also, Decrypt9 + FAT16Tool does nothing else than if you let Decrypt9 handle everything. Maybe there is something changed in the 9.9 NAND memory? Does anyone know something?

And, testing the injection / restore options: only do that if you have a NAND backup, a hardmod and a backup of your SD card.

--------------------- MERGED ---------------------------

Figure it's better to ask, just to be on the safe side. Rather than assume and be screwed.

So.. I see that you're able to backup the Nand & Restore via Homebrew Channel.. Right? xD
If that's the case, would this eliminate the absolute need for a hardmod if you say backed up your Nand file, then accidentally upgraded the Sysnand? You'd just be able to launch Ninjhax 2.0 & restore the previous Nand file, right?

Absolutely no. Decrypt9 only works via Ninjhax v1.x and the GW launcher.dat browser exploit on O3DS. You have no software way of restoring a NAND backup on any 3DS FW > 9.2.

 

[key1340]

Thank you!




That's a strange problem. If dumping the ticket.db works directly from Decrypt9, then it should also work from the CTRNAND.bin. Both, OSFmount and Decrypt9 use the FAT image file structure to locate those files. Also, Decrypt9 + FAT16Tool does nothing else than if you let Decrypt9 handle everything. Maybe there is something changed in the 9.9 NAND memory? Does anyone know something?

And, testing the injection / restore options: only do that if you have a NAND backup, a hardmod and a backup of your SD card.

Dump ticket.db is fine and dump nand extract ctrnand then load ctrnand in OSFmount and dump ticket.db is fine.

Only dump partitions load ctrnand in OSFmount and dump ticket.db is broken.

I will try to dump it again and see if any different.

EDIT 1

@d0k3

Used dump partitions a second time and the ticket.db crc match now.

I don't know if it will dump fine every time or if it was a one time bad dump.

EDIT 2

Tried some more files from dump partitions.

AGBSAVE.bin,FIRM0.bin,FIRM1.bin and TWLN.bin all crc match in dump 1 and dump 2.But TWLP.bin both have different crc.

I also dump partitions from sysnand and AGBSAVE.bin,TWLN.bin and TWLP.bin all crc match to dump 1.

So in dump 1 ctrnand.bin is bad and in dump 2 TWLP.bin doesn't match dump 1 or sysnand dump so that must be bad.

EDIT 3

Dumped partitions of emunand a 3rd time and all seems good this time.

So dump1 ctrnand.bin is bad

Dump 2 TWLP.bin is bad

Dump 3 all seems fine

 

[d0k3]

Okay, thanks a ton for all the testing. Normally, you either get good dumps every time, or never. So, strange. Maybe there is something I need to do different when accessing the SD (ie. EmuNAND) instead of the SysNAND. I'll look after it.

 

[key1340]

Okay, thanks a ton for all the testing. Normally, you either get good dumps every time, or never. So, strange. Maybe there is something I need to do different when accessing the SD (ie. EmuNAND) instead of the SysNAND. I'll look after it.

I have also test with n3ds 9.2 fw + 9.2 emunand. And everything dumped fine.

 

[d0k3]

I have also test with n3ds 9.2 fw + 9.2 emunand. And everything dumped fine.

It still seems unreliable. No idea if that is due to differences between O3DS / N3DS. rxTools, btw, doesn't do it differently, either, but it uses a much lower cache size (which also means slower NAND dumping / injection). By the way, there were never problems with NAND dumping in the regular version, correct?