Homebrew Official [Download] Decrypt9 - Open Source Decryption Tools (WIP)

[Shadowtrance]

Okay, new binary release with a ton of changes, check post #1.

Decrypt9 can now decrypt the TWLN and TWLP partitions. Alongside that there is a new 'secret' feature (not included in the binary). Also, there is a ton of various source code improvements.

Thanks go to profi200 of 4dsdev.org fame, who helped me a lot to finally figure the TWL decryption out (in fact, that means without him we wouldn't have that feature now).

Using the dump partitions option doesn't seem to work on old 3ds via spider (launcher.dat version), just sits there at 0%, works fine on o3ds and n3ds via brahma/ninjhax though.

@Apache Thunder @zoogie We have TWL decryption!! Rejoice! I know you've been waiting for this. haha

 

[hashcheck1]

Can I run this with Zelda Hack? Tried with current Dat and it white screens but doesn't load. This is on a n3ds xl

 

[Apache Thunder]

Okay, new binary release with a ton of changes, check post #1.

Decrypt9 can now decrypt the TWLN and TWLP partitions. Alongside that there is a new 'secret' feature (not included in the binary). Also, there is a ton of various source code improvements.

Thanks go to profi200 of 4dsdev.org fame, who helped me a lot to finally figure the TWL decryption out (in fact, that means without him we wouldn't have that feature now).

@Shadowtrance and maybe @atkfromabove , I guess you know what to do with that so called 'secret feature' .

I know what you're probably itching to test right now, but alongside, this stuff would also be interesting:

• Can you try corrupting the TWLN and TWLP partitions (just fill them with random data or zeroes) and see if the 3DS still boots? (only possible via source code changes and only for people with hardmods!)
• Is the AGBSAVE correctly decrypted? If it is not, it may make sense to decrypt it as TWL (source code change in GetNandCTR() and PartitionInfo table). Cannot test myself because I don't have any data in there.
  
• The Titlekey Decrypt (NAND) option may need an additional test, checking if the titlekeys still are good. I changed a lot in there.
• Also, it would be a good thing to check if the the other partitions (firm0, firm1, ctrnand) still are correctly decrypted. That I did myself, but it is better more people test.
• Keep in mind I only have a N3DS for testing, so testing options different across the systems (like CTRNAND decryption) on O3DS makes sense.

Very nice I will definitely give this a try. Does this version of Decrypt9 let me name it's launcher Decrypt9 instead of launcher like the old one forced me to?

 

[Shadowtrance]

Can I run this with Zelda Hack? Tried with current Dat and it white screens but doesn't load. This is on a n3ds xl

The launcher.dat version doesn't work on n3ds (no spider, different browser).

Very nice I will definitely give this a try. Does this version of Decrypt9 let me name it's launcher Decrypt9 instead of launcher like the old one forced me to?

I have no idea tbh, probably still locked to launcher.dat, but i guess it can be run with cakehax? i dunno, everytime i tried with cakehax it just crashes
Also in my testing the dumping of partitions doesn't seem to work from spider, no idea why, just sits there at 0%...

 

[Apache Thunder]

Hmm what specifically do I have to enable to allow TWL injection? Is it that single line in main.c or is there other stuff I have to enable?

Also the ability to skip dumping CTR_NAND would be nice. Or making TWL dumping a separate menu.

We should work on merging the new TWL stuff into rxTools.

 

[Shadowtrance]

Hmm what specifically do I have to enable to allow TWL injection? Is it that single line in main.c or is there other stuff I have to enable?

Also the ability to skip dumping CTR_NAND would be nice. Or making TWL dumping a separate menu.

Should just be that one line.
Also it seems it will inject any partitions that are in the decrypt9 folder, so i guess remove all but that one (unless you want to do others at the same time that is). That's how it was when i tested injection earlier at least.

 

[Apache Thunder]

Should just be that one line.
Also it seems it will inject any partitions that are in the decrypt9 folder, so i guess remove all but that one (unless you want to do others at the same time that is). That's how it was when i tested injection earlier at least.

Yeah I would expect it to do that. It works in a manner similar to rxTools as it also will inject all the partitions it finds.

Also, I don't think messing up TWL partition will cause a brick. The worst you'll do is brick TWL mode (simply restoring a nand backup or a valid TWL partition would easily resolve this situation). So injecting TWL partition should be relatively safe as long as Decrypt9 isn't writing data beyond the bounds of the TWL partitions. Perhaps keep CTR_NAND injection disabled, but allow TWL injection for the general public. I've completely uninstalled TWL_FIRM at one point and the console doesn't care unless you attempt to boot a TWL title.

 

[Shadowtrance]

Yeah pretty much, nothing but a simple rename or moving of files won't fix, probably have the sd in the pc beforehand anyway doing stuff to whatever partition.

 

[Apache Thunder]

First thing I'm going to do with this is inject a really old DS Cart White list file (this file is stored on TWL) I used NUS to download the oldest one available for the original DSi. Will see if this makes my old CodeBreaker work. (but most likely not. Might be something TWL itself blocks)

 

[d0k3]

Using the dump partitions option doesn't seem to work on old 3ds via spider (launcher.dat version), just sits there at 0%, works fine on o3ds and n3ds via brahma/ninjhax though.

Dammit! Did it work before (before the TWL decryption was included)? This might be due to Brahma actually having more permissions than the launcher.dat does.

Can I run this with Zelda Hack? Tried with current Dat and it white screens but doesn't load. This is on a n3ds xl

I doubt so. You should use the Brahma version. Also, look above.

Hmm what specifically do I have to enable to allow TWL injection? Is it that single line in main.c or is there other stuff I have to enable?

Single line. Just be careful with it .

Also the ability to skip dumping CTR_NAND would be nice. Or making TWL dumping a separate menu.

Thought about that, too. I'll see what I'll do about this.

Also, I don't think messing up TWL partition will cause a brick. The worst you'll do is brick TWL mode (simply restoring a nand backup or a valid TWL partition would easily resolve this situation). So injecting TWL partition should be relatively safe as long as Decrypt9 isn't writing data beyond the bounds of the TWL partitions. Perhaps keep CTR_NAND injection disabled, but allow TWL injection for the general public. I've completely uninstalled TWL_FIRM at one point and the console doesn't care unless you attempt to boot a TWL title.

That's what I think, too, but unless it is properly tested, this won't go into the binary release version. The #define is still a last line of defense against unsuspecting noobs . Also, it would be interesting to know if there's some way to restore TWLN / TWLP if you don't have a backup (I fear not).


Anyways, looking forward to your testing .

 

[Shadowtrance]

Dammit! Did it work before (before the TWL decryption was included)? This might be due to Brahma actually having more permissions than the launcher.dat does.

Good question, don't remember if i actually tested partition dumping with the spider version before TWL was added or not. I pretty much never use that version now.

Also, i think the solution to the ticket problem is to just dump the whole damn thing. Problem solved? Maybe... (just saw you closed the PR on archshift's repo).

 

[d0k3]

Good question, don't remember if i actually tested partition dumping with the spider version before TWL was added or not. I pretty much never use that version now.

Also, i think the solution to the ticket problem is to just dump the whole damn thing. Problem solved? Maybe... (just saw you closed the PR on archshift's repo).

I already have an idea about what may cause this, fix coming later. I guess we'll also need to test everything via launcher.dat at some point (even the old stuff). Properly dumping the whole ticket.db is nearly impossible without a proper NAND FAT reader, but I guess I'll find a solution. And well, that PR - I just chanegd too much in the meantime. I already opened a new one and will PR tested changes slowly now.

 

[Shadowtrance]

It must be possible because there was an app a while ago that dumped the whole thing, sadly the source wasn't shared so no idea how they did it. This is before rxtools and other stuff existed.
Ah yeah fair, heaps has changed since you opened it.

 

[d0k3]

In fact, rxTools has a proper NAND FAT reader now, and doing it the same way would not take long to implement. However, that would mean mixing crypto stuff with file io stuff, and I'm trying to avoid that. I'll come up with a solution .

If you get a chance, could you also test the TWL corruption thingy and wether the AGBSAVE is correctly decrypted?

 

[Shadowtrance]

TWL Corruption? Why would you want to corrupt it?
As for the agbsave, no idea how to tell if it has been correctly decrypted or not. If its anything like the other partitions where you can see twl fat 16 etc at the start in a hex editor then no i guess it isn't as it doesn't have any of that.

You can probably edit the first post too, my bootstrap branch (not bootstrap-mod) is up to date with your changes whenever they happen, give or take a day i guess, gotta love timezones haha as well as my new menu thingy... And I've added a release with up to the current changes.

TWLN looks like this...

AGBSAVE looks like this...

 

[d0k3]

... Somehow these images do not show.

Anyways, I want to know if it is save to enable TWL injection to everyone, and the question is: What's the worse that could happen? The best way to find that out is to completely corrupt it experimentally and see if everything still works and if we can restore it via software then.

The AGBSAVE is just a GBA savegame. You should see some structure in there, but that's about it. If you have never started AGB FIRM (ie. never run an Ambassador GBA game), there's nothing in there.

 

[Shadowtrance]

The worst that can happen is ds games won't boot as apache thunder said further up the page...
And i don't know why the images don't show, they should...
Anyway, the agbsave dumped from my n3ds which HAS booted gba titles just looks like a garbled mess in the hex editor, nothing readable to make out at all.

Also, I don't think messing up TWL partition will cause a brick. The worst you'll do is brick TWL mode (simply restoring a nand backup or a valid TWL partition would easily resolve this situation). So injecting TWL partition should be relatively safe as long as Decrypt9 isn't writing data beyond the bounds of the TWL partitions. Perhaps keep CTR_NAND injection disabled, but allow TWL injection for the general public. I've completely uninstalled TWL_FIRM at one point and the console doesn't care unless you attempt to boot a TWL title.

 

[zoogie]

... Somehow these images do not show.

Anyways, I want to know if it is save to enable TWL injection to everyone, and the question is: What's the worse that could happen? The best way to find that out is to completely corrupt it experimentally and see if everything still works and if we can restore it via software then.

The AGBSAVE is just a GBA savegame. You should see some structure in there, but that's about it. If you have never started AGB FIRM (ie. never run an Ambassador GBA game), there's nothing in there.

I've already tested this by writing junk to 100% of twln partition and all it does is brick DS mode and crash system setting system reformat. All it takes to fix is restore a healthy nand via GW system restore.

As far as testing decrypt9 goes, spider version seems to hang when partition dump mode starts writing. This is using freshly compiled Launcher.dat from bootstrap branch. The latest release Launcher.dat only boots to grey screen.

 

[Aurora Wright]

Looks like AGBSAVE is decrypted, I can see what looks like to be the savegame of the latest game i booted on AGB_FIRM indeed (Mario & Luigi Superstar Saga). Does it load savegames there when you boot the games (temporarily)? I also saved in Pokemon Fire Red and I can only see the Mario and Luigi one.

 

[zoogie]

Looks like AGBSAVE is decrypted, I can see what looks like to be the savegame of the latest game i booted on AGB_FIRM indeed (Mario & Luigi Superstar Saga). Does it load savegames there when you boot the games (temporarily)? I also saved in Pokemon Fire Red and I can only see the Mario and Luigi one.

Yeah it's a temp location for the current game's save. Individual game saves are loaded from the sd card to AGB SAV when AGB_FIRM is booted and presumably saved back to sd before exiting AGB_FIRM. Not sure about that but it seems most likely.