UPDATE: This thread is slightly outdated, there is an easier method which is to use the tool Every File Explorer.
The purpose of this thread is to collect all of the information from this thread which is difficult to find due to there being so many pages and to provide my own additional findings of how to extract models and textures from the decrypted file system.
For this example, I will be extracting the "Barrel" model of Super Mario 3D Land.
Here's what the final result will be:
For a bonus, here's the model extracted from AssistItem.szs, and the model extracted from FireFlower.szs:
First, you need to extract the ROMFS (ROM File System) partition of the 3DS ROM. Do NOT use 3DSExplorer, there is a bug with this software which causes it to the extract from the wrong offset, so you won't be able to decrypt correctly. Use this tool:
http://gbatemp.net/threads/release-3ds_ctr_decryptor-void.370684/page-5#post-5085243
You should now have EncryptedRomFS.bin in the same directory. The next step is to decrypt the ROMFS. Use this tool to generate an XOR pad (instructions are in the thread):
http://gbatemp.net/threads/release-3ds_ctr_decryptor-void.370684/
Note: There is a bug which means that the XOR pad is not the same size as the ROMFS file! Most XOR tools support decryption with a differently sized XOR pad, however if not, you will need to delete the end of the XOR pad until it is the same size as the EncryptedRomFS.bin file.
Now that you have your XOR pad, you can decrypt the EncryptedRomFS.bin into DecryptedRomFS.bin. For this tutorial, we will use 3DSExplorer which you can download here:
http://3dsexplorer.googlecode.com/files/3dsexplorer_v1.5.3.zip
Go to Tools->XOR Tool
First File: CTR-P-AREP0.romfs.xorpad
Second File: EncryptedRomFS.bin
Then hit Save, and chose the name of the decrypted file.
Now you have your DecryptedRomFS.bin!
To extract files from it, we will need the 3DSHax fork of ctrtool available here:
https://github.com/3dshax/ctr/tree/master/ctrtool
If you don't want to compile it from source, there is a compiled version available here:
https://dl.dropboxusercontent.com/u/35197530/zip/ctrtool.zip
Once extracted, use this command line to extract files from the DecryptedRomFS.bin:
This will make a new directory called "Mario" where you should see more directories such as "StageData" which contains several .SZS files.
In this tutorial, I will be decompressing the file "Mario\ObjectData\Barrel.szs" but this should work for other SZS files as well.
Thankfully, 3DS SZS files are the same format as SZS files found in Wii games, and are compatible with Wii hacking tools! So, download and install this tool:
http://szs.wiimm.de/wszst/
Once installed, you can use this command line:
Which will produce a file named Barrel.bin.
Barrel.bin is actually a .narc file, so just rename it to Barrel.narc.
To extract files from a .narc file, you can use several DS hacking tools. The one which I managed to get working is Mario Kart DS Course Modifier, download here:
http://gbatemp.net/threads/mkds-course-modifier.299444/
Open Mario Kart DS Course modifier, and then open Barrel.narc. Select the files from the treeview and click extract.
We now have these files:
- ActorHitByReactionCtrl.byml
- Barrel.bcmdl
- InitActor.byml
- InitClipping.byml
- InitLight.byml
- InitSensor.byml
- InitShadow.byml
The one which contains the model and textures is Barrel.bcmdl. This is a CGFX file.
To extract models and textures from a CGFX file we use Smealum's tool cgfx2obj.py which you can download here:
https://gist.github.com/smealum/8807124
In addition to this, you also need Python installed (I tested with version 2.7):
https://www.python.org/downloads/
PIL which can be downloaded here:
http://www.pythonware.com/products/pil/
and "etc.exe". If you want to build etc.exe from source, you will need these files:
https://gist.github.com/smealum/8897237
https://code.google.com/p/rg-etc1/source/browse/#svn/trunk
And you can compile it with the following Makefile which I wrote:
If you don't want to compile etc.exe yourself, here is my compiled etc.exe file (all credit to Smealum, I just compiled it):
http://filetrip.net/3ds-downloads/development-tools/download-etc-exe-1-0-f32920.html
Now you may be trying this command:
And notice that it writes the obj to stdout, we need to redirect stdout to a file, the correct command is this:
Congratulations! You now have these files:
- Barrel.obj,
- tex_0x9a00.png,
- tex_0xc480.png,
Once again, here's what the finished result looks like:
The purpose of this thread is to collect all of the information from this thread which is difficult to find due to there being so many pages and to provide my own additional findings of how to extract models and textures from the decrypted file system.
For this example, I will be extracting the "Barrel" model of Super Mario 3D Land.
Here's what the final result will be:

For a bonus, here's the model extracted from AssistItem.szs, and the model extracted from FireFlower.szs:


First, you need to extract the ROMFS (ROM File System) partition of the 3DS ROM. Do NOT use 3DSExplorer, there is a bug with this software which causes it to the extract from the wrong offset, so you won't be able to decrypt correctly. Use this tool:
http://gbatemp.net/threads/release-3ds_ctr_decryptor-void.370684/page-5#post-5085243
Click and drag your ROM into getromfs.exe and it will extract the encrypted romfs for the rom as EncryptedRomFS.bin. Don't close the cmd window. It will close on its own when it's done. It will take a couple minutes.
You should now have EncryptedRomFS.bin in the same directory. The next step is to decrypt the ROMFS. Use this tool to generate an XOR pad (instructions are in the thread):
http://gbatemp.net/threads/release-3ds_ctr_decryptor-void.370684/
Note: There is a bug which means that the XOR pad is not the same size as the ROMFS file! Most XOR tools support decryption with a differently sized XOR pad, however if not, you will need to delete the end of the XOR pad until it is the same size as the EncryptedRomFS.bin file.
Now that you have your XOR pad, you can decrypt the EncryptedRomFS.bin into DecryptedRomFS.bin. For this tutorial, we will use 3DSExplorer which you can download here:
http://3dsexplorer.googlecode.com/files/3dsexplorer_v1.5.3.zip
Go to Tools->XOR Tool
First File: CTR-P-AREP0.romfs.xorpad
Second File: EncryptedRomFS.bin
Then hit Save, and chose the name of the decrypted file.
Now you have your DecryptedRomFS.bin!
To extract files from it, we will need the 3DSHax fork of ctrtool available here:
https://github.com/3dshax/ctr/tree/master/ctrtool
If you don't want to compile it from source, there is a compiled version available here:
https://dl.dropboxusercontent.com/u/35197530/zip/ctrtool.zip
Once extracted, use this command line to extract files from the DecryptedRomFS.bin:
Code:
ctrtool.exe -t romfs --romfsdir=Mario DecryptedRomFS.bin
This will make a new directory called "Mario" where you should see more directories such as "StageData" which contains several .SZS files.
In this tutorial, I will be decompressing the file "Mario\ObjectData\Barrel.szs" but this should work for other SZS files as well.
Thankfully, 3DS SZS files are the same format as SZS files found in Wii games, and are compatible with Wii hacking tools! So, download and install this tool:
http://szs.wiimm.de/wszst/
Once installed, you can use this command line:
Code:
wszst DECOMPRESS Barrel.szs
Which will produce a file named Barrel.bin.
Barrel.bin is actually a .narc file, so just rename it to Barrel.narc.
To extract files from a .narc file, you can use several DS hacking tools. The one which I managed to get working is Mario Kart DS Course Modifier, download here:
http://gbatemp.net/threads/mkds-course-modifier.299444/
Open Mario Kart DS Course modifier, and then open Barrel.narc. Select the files from the treeview and click extract.
We now have these files:
- ActorHitByReactionCtrl.byml
- Barrel.bcmdl
- InitActor.byml
- InitClipping.byml
- InitLight.byml
- InitSensor.byml
- InitShadow.byml
The one which contains the model and textures is Barrel.bcmdl. This is a CGFX file.
To extract models and textures from a CGFX file we use Smealum's tool cgfx2obj.py which you can download here:
https://gist.github.com/smealum/8807124
In addition to this, you also need Python installed (I tested with version 2.7):
https://www.python.org/downloads/
PIL which can be downloaded here:
http://www.pythonware.com/products/pil/
and "etc.exe". If you want to build etc.exe from source, you will need these files:
https://gist.github.com/smealum/8897237
https://code.google.com/p/rg-etc1/source/browse/#svn/trunk
And you can compile it with the following Makefile which I wrote:
Code:
etc.exe: main.c rg_etc1.cpp
g++ main.c rg_etc1.cpp -o etc.exe -Wall
If you don't want to compile etc.exe yourself, here is my compiled etc.exe file (all credit to Smealum, I just compiled it):
http://filetrip.net/3ds-downloads/development-tools/download-etc-exe-1-0-f32920.html
Now you may be trying this command:
Code:
cgfx2obj.py Barrel.bcmdl
And notice that it writes the obj to stdout, we need to redirect stdout to a file, the correct command is this:
Code:
cgfx2obj.py Barrel.bcmdl > Barrel.obj
Congratulations! You now have these files:
- Barrel.obj,
- tex_0x9a00.png,
- tex_0xc480.png,
Once again, here's what the finished result looks like:
