ROM Hack Dumping Super Mario 3D Land Beta

[Nic333]

Could those keys be used to decrypt the CIAs from the SDK? I wonder how I would go about doing that. Of coarse googling has yet to find the dev keys.

Open ctr_makecia32.exe from the leaked SDK in a hex editor, go to 0x6017, in that offset you can find the CIA dev Common key, the key starts with 0x55 and ends with 0x15 0x3B and have the SHA1 of 637422C5B34BAF7206AE1B86B556C390DB8EEDB1.
To decrypt the dev .CIA, use ctrtool, here is how: ctrtool --commonkey=*insert commonkey here* --contents=out *insert cia name here*
But this is useless, since the .csu and the .cia shares the same CXI.
Also, you can't decrypt DevMenu and Config, the key will give you the CXI, but the CXI uses some weird crypto that uses some devunit keyslot.

 

[YamiHoshi.nl]

I've never used Uncart before, but I'm looking through the source code and it looks like it prints out some data about the cart before dumping.

For example, main.c:95 we see:

Debug("Cart id is %08x", Cart_GetID());​

Can you post this information? Perhaps it will give us insight into the state of Uncart before it begins dumping.

Thanks!

-palantine

Is this sufficient Information?

How did the hex editor "prove" that the dump was corrupted?

Was it filled with FFs from beginning to end?

I ask because it's highly likely that any existing ROM tools aren't designed to work with dumps made from Dev units. So I don't think that the dump not being recognised by ROM tools is necessarily proof that the dump is corrupt.

Nope, no FF's.
Since there's no "NCSD" mentioned anywhere, while viewing in the Hex Editor, I assumed it's Corrupted, until I realised, it can simply be Encrypted.

 

[Apache Thunder]

Cool. I was able to install TwlNandFiler. (this is a DSiWare system title) However TWL rejects it. Most likely because it's not signed. TWL has it's own sig checks. Perhaps TWL from dev inits don't have have sig checks or use different sig keys/method for the dev software much like the stuff on the 3DS side.

 

[Normmatt]

Is this sufficient Information?
Nope, no FF's.
Since there's no "NCSD" mentioned anywhere, while viewing in the Hex Editor, I assumed it's Corrupted, until I realised, it can simply be Encrypted.

Yes that tells me that it gets the cartid and the header fine its the cart command crypto thats the issue and I mentioned before that its different on devunits vs retail (hence why uncart is failing).

EDIT: I modded uncart to work the same as native firm on devunits but can't test.

EDIT2: Can you test this build of uncart.

 

[YamiHoshi.nl]

Good News: It went passed 00190000.
Bad News: It got stuck on 00350000.

In case Photos are needed:

(For some reason, some Values regarding the exact same Cartridge are different.)

 

[Normmatt]

Crypto is still failing for some reason... guess i must have missed something

EDIT: can you try this one and take a picture of the first screen like above.

 

[YamiHoshi.nl]

It's still stuck on 00350000, but I assume, you only made that one, to Debug the thing before the Dumping begins, right?

 

[YamiHoshi.nl]

Exactly before the E3 starts, I can Announce, that I've successfully Dumped the ROM!
I'm not allowed to Link to ROMs here, but since there are no Rules on Hinting its Location: You can find it in the Hack Store, at DSHack.org.

 

[Xenon Hacks]

Exactly before the E3 starts, I can Announce, that I've successfully Dumped the ROM!
I'm not allowed to Link to ROMs here, but since there are no Rules on Hinting its Location: You can find it in the Hack Store, at DSHack.org.

lol thats the same thing your telling people where to get it.

 

[Codename]

How long is the beta version anyways? Also, you only provided the .cia files. Wouldn't providing a .3ds file be more useful?

 

[zoogie]

Exactly before the E3 starts, I can Announce, that I've successfully Dumped the ROM!
I'm not allowed to Link to ROMs here, but since there are no Rules on Hinting its Location: You can find it in the Hack Store, at DSHack.org.

Nice! Can they work on retail?

lol thats the same thing your telling people where to get it.

People link to gateway's domain all the time as a hint to the launcher location. Only direct links are no no.

How long is the beta version anyways? Also, you only provided the .cia files. Wouldn't providing a .3ds file be more useful?

Cia's work on all hack platforms, flashcard and cfw.

 

[YamiHoshi.nl]

How long is the beta version anyways? Also, you only provided the .cia files. Wouldn't providing a .3ds file be more useful?

You mean, Play Time?
7-15 Minutes on average, depending on how quickly you get through it.
No, as I already Described there, the .3DS File was 2 GB, and only works on expensive Debuggers, only available through Nintendo (or eBay).

Nice! Can they work on retail?

Yes, and it's called, "sm_retail.cia".

 

[gamesquest1]

well im very glad to hear you got it figured out, beta builds are pretty rare for mario games, nintendo normally does their damn finest in collecting/destroying/burying all beta/alpha copies after they are finished with them, so the fact this one is out there and publicly shared rather than just horded with like many beta's/alpha's in existence is great, thanks a bunch for your time and effort put into providing this freely

PS if the tools to do this where shared too it might help others in future who need to dump dev content....save someone the uphill struggle you had with it

 

[zoogie]

well im very glad to hear you got it figured out, beta builds are pretty rare for mario games, nintendo normally does their damn finest in collecting/destroying/burying all beta/alpha copies after they are finished with them, so the fact this one is out there and publicly shared rather than just horded with like many beta's/alpha's in existence is great, thanks a bunch for your time and effort put into providing this freely

PS if the tools to do this where shared too it might help others in future who need to dump dev content....save someone the uphill struggle you had with it

I assume the last custom uncart normmatt linked above worked for dumping this demo flashcard. (decrypt-on-the-fly I hope)
Hopefully @YamiHoshi.nl can confirm this or upload the uncart version that did work.

How long is the beta version anyways? Also, you only provided the .cia files. Wouldn't providing a .3ds file be more useful?

If you want a 3ds version you can dump the ncch from the .cia and rebuild it with makerom. I've attached a handy program that will extract the ncch's from any type of file (assuming the ncch header is decrypted).

 

[YamiHoshi.nl]

I assume the last custom uncart normmatt linked above worked for dumping this demo flashcard. (decrypt-on-the-fly I hope)
Hopefully @YamiHoshi.nl can confirm this or upload the uncart version that did work.

No, it isn't.
If Normmatt wants, he or I can share it, but I'm not sure, it will work on Retail Hardware, though.

 

[gamesquest1]

No, it isn't.
If Normmatt wants, he or I can share it, but I'm not sure, it will work on Retail Hardware, though.

oh yeah i just meant if anyone else finds themselves in a similar situation with access to a dev console and dev cart

 

[Nic333]

Can i ask a thing?
The original .CXI that was extracted from the original dump, had any kind of encryption that required xorpad generation?

 

[YamiHoshi.nl]

No, it came already Decrypted, so all I had to do, was Rename it to .CCI, use ctr_MakeCia32.exe, to Convert it to .CIA, Extract the CIA File, and Repack it as a .CIA File, that can be Imported on Retail Hardware.

 

[Apache Thunder]

No, it isn't.
If Normmatt wants, he or I can share it, but I'm not sure, it will work on Retail Hardware, though.

Any chance you'd be able to dump TWL_FIRM from a dev unit if you have one? I want to try and run TwlNandFiler, but won't boot on retail TWL.

EDIT: It should be available from a CXI (.app files in the title folder) assuming you are able to decrypt ctr_nand to get to it. If Xorpad generation for NAND on devunits work for you.

0004013800000102 is the title id so it will be found in NAND:/title/000401380/0000102

Thanks to rxMode, I can boot custom TWL/AGB from emunand without messing with sysnand.

 

[YamiHoshi.nl]

I never did anything with any DSi stuff, so I'm not sure if I can.