ROM Hack Dump xorpad of an installed .cia on RX3D 7.10-16U?

[manpaint]

I know for decrypt9 but apparently is only decrypting game card and i want to decrypt triforce hero demo.

 

[Asia81]

decrypt9 and sdpadgen with sdinfo.bin at the root of your sd card

 

[manpaint]

decrypt9 and sdpadgen with sdinfo.bin at the root of your sd card

I dont find the two other files.

 

[gudenau]

decrypt9 and sdpadgen with sdinfo.bin at the root of your sd card

Could you elaborate on how you generate said files?

 

[Asia81]

Install the Demo in your EmuNand (by dowloading from eShop).
Use Decrypt9, go in EmuNand Tool (not the windows tool, it's in D9), dump the tickets.
Dowload FunkyCIA2. Put the tickets_emu.db here.
Open a CMD here and write:

python FunkyCIA2.py ticket_emu.db -title 0004000000182300

Wait. Go in the cia folder, and take 0004000000182300.cia.
Install it in your SysNand (with Pasta or another CFW in SysNand).
Take the .app from the SysNand folder:
G:\Nintendo 3DS\<ID1>\<ID2>\title\00040000\00182300\content\00000000.app
Now dl my pack: https://gbatemp.net/threads/tutoria...d-3ds-roms-run-xy-oras-without-update.383055/
Open th bat, write: sd -> d9 -> Now enter the path of your SysNand after the two ID folders (Make sure you have Python 2.7.7). For me it's:

G:\Nintendo 3DS\0537bed45e5fa36fb6427f70c2ef5a47\d61400f547802878534c313600035344

Wait.
Now put the sdinfo.bin t the root of your SD Card.
Open Decrypt9 and use SD Padgen.
Wait, a bunch of xorpads will be generated (or not).
Take all xorpads with 0004000000182300 in the name.
Delete all other xorpads
Put .xorpads, .app in the same folder (my pack ?) and use padgen:

padxorer.exe FILENAME.app XORPADNAME.xorpad

Or use my bat and write pad.
Now you got FILENAME.app.out.
Drag&Drop FILENAME.app.out on ctrKeyGen_Decrypt9.py.
Copy the files slot0x25KeyX.bin and ncchinfo.bin at the root of you SD Card.
Open Decrypt9 and use NCCH Padgen.
Wait while creating Xorpads files.
Once all Xorpads are generated, put your SD Card back into your PC, copy all Xorpads with your TitleID and the word in the folder of my pack.
Launch HackingToolkit.bat, write SDK7 and follow.

 

[manpaint]

Install the Demo in your EmuNand (by dowloading from eShop).
Use Decrypt9, go in EmuNand Tool (not the windows tool, it's in D9), dump the tickets.
Dowload FunkyCIA2. Put the tickets_emu.db here.
Open a CMD here and write:

python FunkyCIA2.py ticket_emu.db -title 0004000000182300

Wait. Go in the cia folder, and take 0004000000182300.cia.
.

I get nothing when i do the command (also my .cia is not downloaded from eshop)

Edit: I found another of your tutorial to decrypt cia but i need /movable.sed for use decrypt9

 

[gudenau]

I get nothing when i do the command (also my .cia is not downloaded from eshop)

Edit: I found another of your tutorial to decrypt cia but i need /movable.sed for use decrypt9

I think that is in the nand; so dump the nand, decrypt the fat16 partition, mount the image, then find movable.sed.

 

[The Real Jdbye]

I get nothing when i do the command (also my .cia is not downloaded from eshop)

Edit: I found another of your tutorial to decrypt cia but i need /movable.sed for use decrypt9

I don't think that will work because the Triforce Heroes demo uses seeddb so the decryption process is slightly different.

 

[Shadowtrance]

I think that is in the nand; so dump the nand, decrypt the fat16 partition, mount the image, then find movable.sed.

Yep it's in the nand, and you don't really need to do it that way anymore (unless you want to), Decrypt9 can directly dump moveable.sed from the 3ds (in d0k3's version at least, in my version soon too once i figure out and fix some bugs).

 

[manpaint]

I don't think that will work because the Triforce Heroes demo uses seeddb so the decryption process is slightly different.

What is the process?

 

[gudenau]

What is the process?

The method above, with a seedb file.