Tutorial Edit OFW clean Switch save data from NAND backup/restoring via Fusee Gelee payloads

radiocaf

Member
Newcomer
Joined
Sep 12, 2009
Messages
5
Trophies
0
XP
39
Country
United States
Nothing is installed onto the Switch using this method. You're only booting into its recovery mode and running a payload (then backing up and restoring your switch's NAND).
Thank you for your reply, I feel more at ease taking advantage of this method now, time to bend some paperclips.
 

ricky3817

New Member
Newbie
Joined
Sep 15, 2019
Messages
1
Trophies
0
Age
31
XP
21
Country
United States
Hey guys, I've spent too much time trying to figure this out at this point I need to ask for help. I extracted the save file for shield but I'm not sure what file I'm supposed to use for PKHEX and the the raid plugin. I noticed the CMAC signature failed so I'm not sure if it extracted properly. Any help is appreciated. Thank you.



C:\Users\rinnn\Desktop\try 1>hactoolnet.exe -k prod.keys -t save sav/00000000000000bc --outdir out/00000000000000bc
Failed to match key rsa_oaep_kek_generation_source
Failed to match key rsa_private_kek_generation_source
save:/directories/1609/files/1609_luxuryball
save:/directories/1609/files.meta
save:/directories/0113/files/0113_ballguy3
save:/directories/0113/files.meta
save:/directories/0112/files/0112_ballguy2
save:/directories/0112/files.meta
save:/directories/0111/files/0111_ballguy1
save:/directories/0111/files.meta
save:/directories/0107/files/0107_G_kabigon
save:/directories/0107/files.meta
save:/directories/0106/files/0106_pokeball_100
save:/directories/0106/files.meta
save:/directories/0105/files/0105_dress_kakukoro
save:/directories/0105/files.meta
save:/directories/0104/files/0104_BP10
save:/directories/0104/files.meta
save:/directories/0102/files/0102_birthday_ev
save:/directories/0102/files.meta
save:/directories/0101/files/0101_birthday_pika
save:/directories/0101/files.meta
save:/directories/2001/files/2001_palma_myu
save:/directories/2001/files.meta
save:/directories/1606/files/1606_dress_goldbag
save:/directories/1606/files.meta
save:/directories/1605/files/1605_dress_sports_set
save:/directories/1605/files.meta
save:/directories/1604/files/1604_G_crystal_yoogirasu
save:/directories/1604/files.meta
save:/directories/1603/files/1603_G_crystal_jarako
save:/directories/1603/files.meta
save:/directories/1602/files/1602_quickball
save:/directories/1602/files.meta
save:/directories/tournament/files/Galar_Beginnings_BP50
save:/directories/tournament/files.meta
save:/directories/rank/files.meta
save:/directories/gpoke/files/normal_encount
save:/directories/gpoke/files/drop_rewards
save:/directories/gpoke/files/dai_encount
save:/directories/gpoke/files/bonus_rewards
save:/directories/gpoke/files.meta
save:/directories/normal/files/distribution_internet
save:/directories/normal/files.meta
save:/list.msgpack
save:/directories.meta
save:/na_required
save:/etag.bin
save:/passphrase.bin

Savefile:
CMAC Signature (FAIL): 163CA3E80EAF04F750E58407CFAF7B67
Title ID: 01008db008c2c000
User ID: 00000000-0000-0000-0000-000000000000
Save ID: 0000000000000000
Save Type: BcatDeliveryCacheStorage
Owner ID: 010000000000000c
Timestamp: 2019-12-20 07:40:51 UTC
Save Data Size: 0x0000000004000000 (64 MB)
Journal Size: 0x0000000000200000 (2 MB)
Free Space: 0x0000000003f1c000 (63.109 MB)
Header Hash (GOOD): 072DA6776A3A55CBD23078BB65E2A7A3E6DB91FB9626B07238A53EE3E532B128
Number of Files: 47
Magic: IVFC
Version: 2
Salt Seed: FB7A5789C0E2B15C34F9A407B018F7A414CAD62411FD7257A0ECF2EB83A2FD49
Level 0:
Data Offset: 0x2000000000000000
Data Size: 0x0000000000004000
Hash Offset: 0x0000000000000000
Hash BlockSize: 0x00004000
Level 1:
Data Offset: 0x2800000000000000
Data Size: 0x0000000000004000
Hash Offset: 0x2000000000000000
Hash BlockSize: 0x00004000
Level 2:
Data Offset: 0x3000000000000000
Data Size: 0x0000000000020000
Hash Offset: 0x2800000000000000
Hash BlockSize: 0x00004000
Level 3:
Data Offset: 0x0000000000000000
Data Size: 0x0000000004000000
Hash Offset: 0x3000000000000000
Hash BlockSize: 0x00004000


C:\Users\rinnn\Desktop\try 1>pause
Press any key to continue . . .




























 

Max89

Well-Known Member
Newcomer
Joined
Oct 18, 2012
Messages
88
Trophies
0
XP
212
Country
Italy
tell me if im wrong but with this method i can edit the save files with pkhex withou installing custom firmware right?
i have un unpatched switch, i might try..
 
  • Like
Reactions: MSco

Max89

Well-Known Member
Newcomer
Joined
Oct 18, 2012
Messages
88
Trophies
0
XP
212
Country
Italy
hi,
h have some problems with hactoonet.
The software is not recognized by windows if i use your script.
However If i use the run.bat inside the download of hactoolnet i can extract the save data.
THe problem now is how to inject the save file... How can i solve?
 

Max89

Well-Known Member
Newcomer
Joined
Oct 18, 2012
Messages
88
Trophies
0
XP
212
Country
Italy
maybe i solved runing the bat file from cmd as administrator.
i got an error
i dont jnow why the bat file dont recognize the pause at the end .
I had to delete it because it was attached to the name of the save file
 
Last edited by Max89,

Max89

Well-Known Member
Newcomer
Joined
Oct 18, 2012
Messages
88
Trophies
0
XP
212
Country
Italy
Got it to work - the step that I missed was to make sure the sept folder from atmosphere was in the SD before I dumped my keys to make sure I got the master key up to 09.

Many thanks for your guide Kimbra !
my signature fails the first time and is good the others but the game wont load.
i have extracted the key file with the sept folder in the root of the sd but it generated 2 file prod.keys 10kb and title keys 2kb
i use the first for the signature with the inject.bat
i did everything right?

EDIT:
Solved, the problem was the file hactool.exe v0.7 that is not working correctly. there is another version 0.8.
See here for more information:
https://github.com/Thealexbarney/LibHac/issues/102
 
Last edited by Max89,

dude179

Member
Newcomer
Joined
Nov 2, 2019
Messages
6
Trophies
0
XP
60
Country
Canada
Ick my bad, not hactool but HakDiskMount can mount the partition and read/write to the partition, instead of having to backup the nand, mount it, etc you can just mount the user partition on the device.

--------------------- MERGED ---------------------------

Basically open TegraRCMGUI under tools theres a "Memloader v3/UMS Tool (by rajkosto)" if you drop down the box and hit "eMMC rawNAND (DANGEROUS)" and click the USB icon it will allow mounting the devices partitions on your PC, all you need to do at that point is open HacDiskMount and click "File > Open Physical Device" and select the device that's something like "Linux UMS", it will present you with a list of partitions and yeah normal procedures from there, make sure to unmount when you're done moving stuff around and boom, no need for nand backup.

I just wanted to say thank you telling us this. This has saved me so much time, because I save edit A LOT for Pokemon SnS.

I highly recommend this method to everyone. I've been doing this for months now, and as long as the only thing you touch is the save file, you'll be fine.
 

slapmeone

New Member
Newbie
Joined
Jan 24, 2020
Messages
3
Trophies
0
Age
52
XP
30
Country
Canada
How would I edit my inject.bat files to inject two files at once? So close to completing this I'm just not great with code
 

Scried

Active Member
Newcomer
Joined
May 3, 2017
Messages
33
Trophies
0
XP
754
Country
Netherlands
How would I edit my inject.bat files to inject two files at once? So close to completing this I'm just not great with code
You could just run the .bat file once for the first file; then edit it; change the name of the file to the second save file and run the .bat file again. You could also just duplicate the first line in the .bat file, for example I did the following to inject both the main and backup file of my Pokémon Sword save:
Code:
hactoolnet.exe -k prod.keys -t save sav/000000000000004c --replacefile /main out/000000000000004c/main
hactoolnet.exe -k prod.keys -t save sav/000000000000004c --replacefile /backup out/000000000000004c/backup
pause
But before you copy this code, please change the id number to the one that matches yours!
 
Last edited by Scried,

slapmeone

New Member
Newbie
Joined
Jan 24, 2020
Messages
3
Trophies
0
Age
52
XP
30
Country
Canada
You could just run the .bat file once for the first file; then edit it; change the name of the file to the second save file and run the .bat file again. You could also just duplicate the first line in the .bat file, for example I did the following to inject both the main and backup file of my Pokémon Sword save:
Code:
hactoolnet.exe -k prod.keys -t save sav/000000000000004c --replacefile /main out/000000000000004c/main
hactoolnet.exe -k prod.keys -t save sav/000000000000004c --replacefile /backup out/000000000000004c/backup
pause
But before you copy this code, please change the id number to the one that matches yours!
I was overthinking it big time. Tysm for the help and fast response!
 
  • Like
Reactions: Scried

aarti

Killua Zoldyck
Member
Joined
Jul 24, 2017
Messages
518
Trophies
0
XP
644
Country
Germany
Notice the out and sav folders, the extract.bat and inject.bat, and the prod.keys files. These are all required for this to work properly if you follow my method. Everything else should come with the hactoolnet download in the What you'll need section.
Am I god damn stupid or why can't I find these? I only get hactoolnet.exe
 

Scried

Active Member
Newcomer
Joined
May 3, 2017
Messages
33
Trophies
0
XP
754
Country
Netherlands
Am I god damn stupid or why can't I find these? I only get hactoolnet.exe
Do you mean you're missing the .dll files? They probably got embedded in the .exe in the most recent release(s) of hactoolnet. You can just ignore it. If you're talking about the other files, you have to create or provide them yourself as the guide mentions.
 
  • Like
Reactions: aarti

MSco

Well-Known Member
Member
Joined
Nov 2, 2016
Messages
284
Trophies
0
XP
511
Country
Germany
Still, I'd love it if someone came out with a save manager that worked from RCM, so you could backup and restore game saves without booting into CFW or going through these tedious steps.

That would be great. Is this technically realistic? Or is there anything new to this? Did anyone publish something like that?

Edit:

Well, I saw this here:
Ick my bad, not hactool but HakDiskMount can mount the partition and read/write to the partition, instead of having to backup the nand, mount it, etc you can just mount the user partition on the device.

--------------------- MERGED ---------------------------

Basically open TegraRCMGUI under tools theres a "Memloader v3/UMS Tool (by rajkosto)" if you drop down the box and hit "eMMC rawNAND (DANGEROUS)" and click the USB icon it will allow mounting the devices partitions on your PC, all you need to do at that point is open HacDiskMount and click "File > Open Physical Device" and select the device that's something like "Linux UMS", it will present you with a list of partitions and yeah normal procedures from there, make sure to unmount when you're done moving stuff around and boom, no need for nand backup.

Nice, this would be an extreme time saver! Did anyone do this method (mounting and editing the NAND directly with tegraRCMgui)?

My method would be: Do a NAND backup once and save it to a HDD. Everytime I mount the NAND and edit it, I would only do a backup of my savegame (using that tegrarcm mount) without doing a full backup of my NAND everytime. If something goes wrong and my NAND gets fried, I could restore my NAND (the backup would be a bit older, with an older savegame) and inject the latest backup of my savegame. Using this method, I would be quite save, right?
 
Last edited by MSco,

RHOPKINS13

Geek
Member
Joined
Jan 31, 2009
Messages
1,275
Trophies
0
XP
1,998
Country
United States
Is this technically realistic?

I don't see why not. Either way you're editing the NAND. People have already used HacDiskMount to backup, restore, and transfer saves. Being able to do it from RCM would make things much easier, and would allow you to inject saves in an otherwise clean SysNAND without running CFW.
 
  • Like
Reactions: MSco

kimbra

Well-Known Member
OP
Newcomer
Joined
Jun 6, 2019
Messages
48
Trophies
0
Age
27
Location
United States
XP
1,034
Country
United States
That would be great. Is this technically realistic? Or is there anything new to this? Did anyone publish something like that?

Edit:

Well, I saw this here:


Nice, this would be an extreme time saver! Did anyone do this method (mounting and editing the NAND directly with tegraRCMgui)?

My method would be: Do a NAND backup once and save it to a HDD. Everytime I mount the NAND and edit it, I would only do a backup of my savegame (using that tegrarcm mount) without doing a full backup of my NAND everytime. If something goes wrong and my NAND gets fried, I could restore my NAND (the backup would be a bit older, with an older savegame) and inject the latest backup of my savegame. Using this method, I would be quite save, right?
I have been utilizing this method lately. I run the TegraRcmGUI as Mount “eMMC rawNAND (DANGEROUS)” under the Tools tab. I’m thinking of adding it to the guide soon for clarification and ease.
 
  • Like
Reactions: RHOPKINS13 and MSco

lpdg001

New Member
Newbie
Joined
Feb 4, 2020
Messages
1
Trophies
0
Age
22
XP
28
Country
China
how to edit splatoon2?i wont edit foods i cant inject~~~HELP CFW 9.1
hactoolnet is new version
F:\Downloads\Compressed\extract nand gamesave\extract nand gamesave>hactoolnet.exe -k prod.keys -t save save/00000000000000c3 --outdir out/00000000000000c3
Failed to match key device_key_4x
Failed to match key rsa_oaep_kek_generation_source
Failed to match key rsa_private_kek_generation_source
save:/save.dat

F:\Downloads\Compressed\extract nand gamesave\extract nand gamesave\out\00000000000000c3\save.dat

but i cnat inject
hactoolnet.exe -k prod.keys -t save save/00000000000000c3 --replacefile / out/00000000000000c3

Failed to match key device_key_4x
Failed to match key rsa_oaep_kek_generation_source
Failed to match key rsa_private_kek_generation_source

ERROR: ResultFsTargetLocked (2002-0007)

Additional information:
at LibHac.ThrowHelper.ThrowResult(Result) + 0x2c
at LibHac.FsSystem.LocalFile..ctor(String, OpenMode) + 0x8e
at hactoolnet.ProcessSave.Process(Context) + 0x36c
at hactoolnet.Program.Run(String[]) + 0x2d1
at hactoolnet.Program.Main(String[]) + 0x1a
 
Last edited by lpdg001,
General chit-chat
Help Users
  • No one is chatting at the moment.
    SacredMilkOG @ SacredMilkOG: :P