Hacking Editing Ticket.db

[Xenosaiga]

@Madridi im perfectly aware of the differences between ticket and ticket.db.

People are just not looking underneath the underneath and understanding what was meant.

 

[Madridi]

@Madridi im perfectly aware of the differences between ticket and ticket.db.

People are just not looking underneath the underneath and understanding what was meant.

lol I know you know what he meant and he probably know what you meant. I just meant that the terminologies were mixed up and that caused the confusion

 

[MelonGx]

Sorry I don't know what he meant.
I just considered what he described was multiple ticket sharing a title thing.

 

[MelonGx]

To everyone:
Homebrew CIAs and pirate CIAs are theoretically not as safe as you imagined, until the ticket.db editor is developed.

They install fake tickets to ticket.db, which cannot be removed even you format NAND.
This causes:
- Unable to purchase the same title on e-shop after uninstalled that CIA, even it's a patch or freeware
- If Nintendo want , they can ban consoles having fake ticket installed (though they haven't banned anything currently)

Fake tickets have the following properties:
- Console ID 00000000 with type eShopApp / UpdatePatch / DLC
This can be the same property as Legit CIAs. But Legit CIAs have correct signs while fake ticket providers Homebrew/Pirated CIAs not.

Before the ticket.db editor developed, there're
only two methods able to remove fake ticket:
- System Transfer fake ticket installed NAND to another NAND
- If your SysNAND is clean, abandon current emuNAND and re-create a brand new emuNAND

BTW, System Transfer to a fake ticket installed console can move those fake tickets from target NAND to your source NAND!
So before doing System Transfer, please always dump and browse your target NAND's ticket.db.

BTW2, 000400000F980000 with console ID 00000000 is not a fake ticket.
It's installed and removed by Nintendo factory.

 

[FenrirWolf]

Isn't that about how things worked on the Wii as well? WAD tickets (or bits of them at least) hung around even after you uninstalled stuff, and nothing ever really came of it.

 

[srwgin]

I unlink systemnand and emunand
I have NNID in emunand so I can dump some eshop game and dlc myself
I also install cia game and dlc in emunand so I have fake id in ticket.db
if I initialize emunand then relogin NNID is fake id in ticket.db？

 

[Bu2d85]

I have a semi-off topic question.

I have a region swapped N3DS from JPN to US and cannot enter the eshop because it came with a title from the JPN store pre-installed and I get an out of region error.

If I did a system transfer and cleared the ticket.db would that allow access to the eshop again?

 

[MelonGx]

I unlink systemnand and emunand
I have NNID in emunand so I can dump some eshop game and dlc myself
I also install cia game and dlc in emunand so I have fake id in ticket.db
if I initialize emunand then relogin NNID is fake id in ticket.db？

Installed fake tickets will never be wiped out by just initializing NAND.
You can re-create a brand new emuNAND from a clean SysNAND backup, then log-in your NNID, go to e-shop to DL your purchased items to ticket.db.

 

[YyAoMmIi]

I heard that if you want to buy an eshop of am cia you already installed, if you just go to eshop, it will causes problems due to the fake ticket existing in ticket.dbs alread.

And that the solution to that is to remove ticket.dbs, go to eshop and install, then put ticket.dbs back in
As your system would then have the real ticket when the fake ticket in ticket.dbs get put back in
Correct or no?

 

[Redferne]

Installed fake tickets will never be wiped out by just initializing NAND.
You can re-create a brand new emuNAND from a clean SysNAND backup, then log-in your NNID, go to e-shop to DL your purchased items to ticket.db.

All right so a simple format with tiny format won't help.
What if I format my EmuNAND with tiny format and create a new NNID. Will that clear the ticket.db? If so I could format again and re-link my previous NNID. That would be faster and easier than recreate your NAND.

 

[MelonGx]

All right so a simple format with tiny format won't help.
What if I format my EmuNAND with tiny format and create a new NNID. Will that clear the ticket.db? If so I could format again and re-link my previous NNID. That would be faster and easier than recreate your NAND.

No, it doesn't.
Dismiss an NNID will only delete e-shop tickets.
But those fake tickets are considered as pre-installed-title tickets.

 

[Redferne]

Ah well, I almost had a good idea

I have a N3DS and I really don't want to swap SD cards. On the "clean" EmuNAND, after your purchase do you need to download the game at least once or can I just exit eshop, cancel the download, turn off the console and put my "dirty" EmuNAND back to download it?

I guess I could also setup a multi EMuNAND, that would do the trick too?

 

[Ekaitz]

@MelonGx : Small question because it seems that you've got some knowledge about that.

Let's say I install things in sysnand (A9LH + AuReiNand to patch sign), such as DLC.
This DLC, obviously, is not properly signed.

I want to remove it to recover a fully "clean" system.
Can I just restore my clean nand backup to erase the non-legit ticket.db?

 

[Redferne]

I just had another "good" idea (come on guys stop laughing...).
Would it be possible to extract the ticket.db from SysNAND to inject it in EmuNAND?

 

[MelonGx]

I just had another "good" idea (come on guys stop laughing...).
Would it be possible to extract the ticket.db from SysNAND to inject it in EmuNAND?

Only available when they linked.

 

[Redferne]

Only available when they linked.

All right, I give up
I'll setup a new EmuNAND on the 4GB sd card. I hope it works without having to download the game at least once from the "clean" EmuNAND.

 

[Nephiel]

Suppose I have a dump of the sysNAND of my N3DS, taken just after setting it up (NNID transferred from an Old XL, but no content bought from the eShop and no CIAs installed).

Assume this sysNAND dump is still linked to my current emuNAND. Could I extract ticket.db from this sysNAND dump and inject it into my current emuNAND?

This would clear all tickets from any content installed since that sysNAND was dumped, including any fake tickets from CIAs. Right?

 

[Xenosaiga]

Suppose I have a dump of the sysNAND of my N3DS, taken just after setting it up (NNID transferred from an Old XL, but no content bought from the eShop and no CIAs installed).

Assume this sysNAND dump is still linked to my current emuNAND. Could I extract ticket.db from this sysNAND dump and inject it into my current emuNAND?

This would clear all tickets from any content installed since that sysNAND was dumped, including any fake tickets from CIAs. Right?

Theoretically. Let's test it.

1. Dump ticket.db from current emunand.
2. Dump a backup of current emunand.
3. Restore emunand from sysnand backup.
4. Dump ticket.db from replaced emunand.
5. Restore emunand from emunand backup.
6. Replace emunand ticket.db with dumped sysnand ticket.db.
7. See what happens.
8. When done replace ticket.db with backed up emunand ticket.db.

(I'm not responsible for anything that may be messed up if you try this)

 

[Nephiel]

I'm on it. Already dumped ticket.db for both old sysNAND and current emuNAND.

Before going ahead and injecting, is there any tool that I could use to see the contents of each ticket.db? Even just showing how many tickets they contain would be enough. I tried extdata_tool from CTR toolkit, but it just says the file is corrupt or not a ticket database.

 

[Xenosaiga]

I'm on it. Already dumped ticket.db for both old sysNAND and current emuNAND.

Before going ahead and injecting, is there any tool that I could use to see the contents of each ticket.db? Even just showing how many tickets they contain would be enough. I tried extdata_tool from CTR toolkit, but it just says the file is corrupt or not a ticket database.

https://gbatemp.net/threads/wip-groovycia.414004/

GroovyCIA works. It shows any games/title that are in the Ticket.db