Hacking GATEWAY PUBLIC RELEASE 2.6

[Belmondo]

Why is it that everyone wants to install games to their 3DS SD card? They work fine from the Gateway card. Plus, you're still required to have your Gateway card plugged in to launch your Emunand, so what reason is there?

isn't the redcard only required for emunand 8.0.0+, if you revert to 7.0.0 emunand wouldn't you be able to use it without the redcard?

 

[Reecey]

The game I made as CIA was using SDK 5.x, min FW 6.x so no it's not games from 4.5 FW max. I would like to try some 7.x games to see if it works (Dunno if the version of the xorpad generating tool have the key on it, so it might not even works at all) but I'm not sure which ones are. I think Tamadochi Life is one but I'm not sure, can someone confirm ?

Yeah tom life is 7.x and SSB also try for a small file, Pokemon Art Academy

 

[Huntereb]

isn't the card only required for emunand 8.0.0+, if you revert to 7.0.0 emunand wouldn't you be able to use it without the redcard?

Only for classic mode, but yes. You'd still need a Gateway card to install the Dev Menu, though.

 

[Arnold0]

Okey so I'll try to see if the tool for generating xorpads will works with tom life then as it's 512Mbyte as was the other one I made.

 

[Huntereb]

The game I made as CIA was using SDK 5.x, min FW 6.x so no it's not games from 4.5 FW max. I would like to try some 7.x games to see if it works (Dunno if the version of the xorpad generating tool have the key on it, so it might not even works at all) but I'm not sure which ones are. I think Tamadochi Life is one but I'm not sure, can someone confirm ?

It doesn't matter what firmware the game comes with, what matters is the SDK version it was compiled with. 7.x games will not install with this version of Dev Menu.

 

[hippy dave]

Haha, brilliant. Gateway did their best to lock everything down tight to start with, but they are always ready to adapt to a new situation, which works out well for us.
This whole cia thing is nice timing for me actually, my Gateway card has just started getting temperamental, keeps saying it's ejected or the micro sd is not ready. Going to try the old tape trick and whatever, but it'll be nice to have certain things installed so they're not dependent on the card.

 

[Doran754]

Well I finally managed to get this working, and to make this day even more awesome, Majoras Mask 3D !

 

[BobPwnz]

Well I finally managed to get this working, and to make this day even more awesome, Majoras Mask 3D !

How did you find the 3ds devmenu file?

 

[CIH137]

How did you find the 3ds devmenu file?

google it, i think this is what everyone is using, check eariler posts to be sure maybe
SDK.DevKit.Tools.3DSWare.3DS.INTERNAL-BigBlueBox

 

[Reecey]

Do you think someone in the know how could please make a thread on step by step guide on how to change a .3ds file game to .cia to install via the devmenu, that would be good but its got to be easy and straight forward and including download links etc. not the hard way thats explained in the other thread or PM me if you cant

 

[Vappy]

http://gbatemp.net/threads/4-x-only-cia-cfw-complete-guide.373532/page-31#post-5147322 Includes everything except the tools to generate the xorpads.

 

[DarkSeele]

So are game patches .cia? Does this solve the "not being able to get patches from out of region"? Assuming someone dumps the updates. Or are updates a different format?

^^This

Can someone PLEASE answer this question?

 

[Queno138]

Do you think someone in the know how could please make a thread on step by step guide on how to change a .3ds file game to .cia to install via the devmenu, that would be good but its got to be easy and straight forward.

Thing is, it is not that straightforward.

This page has a tutorial,
which took me over an hour to slowly follow step by step,
but guess what, I got it done, first try.

Anyhow,

Step 1,
Decrypt your 3DS rom:

Spoiler

http://gbatemp.net/threads/tutorial-how-to-decrypt-3ds-roms-for-dummies.372653/

Also required for .cia conversion,
besides dealing with romfs.bin,
you also need to decrypt the following, with similar steps:
exheader.bin, exefs.bin.

To quote:
If you end up with a decrypted romfs.bin, exheader.bin, code.bin (decompressed), icon.bin and banner.bin you did everything correct.

EDIT:
Regarding decryption,
I was using this set of tools, and this was in the readme.

Spoiler

Applicable steps:
1- As usual, use ctrKeyGen to extract extract your ncchinfo.bin and generate your xorpads.
Use 3DS explorer to extract ExHeader.bin, ExeFS.bin and RomFS.bin

2- Put all the files (.bin and .xorpad) inside the 'workdir' folder.
Make sure your xorpads have the same name as their respective counterparts
(exefs.bin & exefs.xorpad, for example);

3- Run the batch files to decrypt and extract the game's files;

Package is called "Cia by osmos.rar"

I'm trying to retrieve my history for the link.

Next:
Follow the rest of this guide:
http://gbatemp.net/threads/4-x-only-cia-cfw-complete-guide.373532/

Which is also conveniently here:

Spoiler

Step2: creating an .rsf file
The .rsf file is a little bit different then the one for .3ds roms. Anyway here is the proper one, make sure you fill in the XXXX the right way. Just copy the text in the codebox underneath in a text editor and save it as cia.rsf in the folder with the other stuff.

• you can open the exheader or original rom in a hex editor to look up the right values for the companycode, producttyp and productcode
•For the correct UniqueID you can check ctrtool and the official rom. Just remove the last 2 0 and write the 4 digits before that in the .rsf file:
Code:
BasicInfo:
Title : "Custom Title"
CompanyCode : "00"
ProductCode : "CTR-P-DERP"
ContentType : Application # Application / SystemUpdate / Manual / Child / Trial
Logo : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem

TitleInfo:
UniqueId : 0x7850
Category : Application

Option:
UseOnSD : true # true if App is to be #installed to SD
EnableCompress : true # Compresses exefs code
FreeProductCode : true # Removes limitations on ProductCode
EnableCrypt : true # Enables encryption for NCCH and CIA
MediaFootPadding : true # If true CCI files are created with padding

AccessControlInfo:
ExtSaveDataId: 0xb7850 # same as UniqueId
SystemSaveDataId1: 0x00000000 # plaintext exheader
SystemSaveDataId2: 0x00000000 # plaintext exheader
OtherUserSaveDataId1: 0x00000 # plaintext exheader
OtherUserSaveDataId2: 0x00000 # plaintext exheader
OtherUserSaveDataId3: 0x00000 # plaintext exheader
UseOtherVariationSaveData : false

SystemControlInfo:
SaveDataSize: 1M # plaintext exheader
RemasterVersion: 0 # plaintext exheader
StackSize: 0x00040000 # plaintext exheader
JumpId: 0x000400000b000000L # plaintext exheader (<full UniqueID>L)
step 3: creating the .cia
Open the command window in the folder with the exefs.bin, exheader.bin, romfs.bin, icon.bin, code.bin, banner.bin, cia.rsf and makerom. Now run the following command:

makerom -f cia -target t -desc app:1 -icon icon.bin -banner banner.bin -exefslogo -code code.bin -exheader exh.bin -romfs romfs.bin -rsf cia.rsf -o Install.cia​

this will output an .cia file which you can install with the DevMenu and then run.

If you encounter an error saying "[ROMFS ERROR] Invalid RomFS Binary.", then remove the "-romfs romfs.bin" from the command.

 

[Reecey]

Thing is, it is not that straightforward.

This page has a tutorial,
which took me over an hour to slowly follow step by step,
but guess what, I got it done, first try.

Anyhow,

Step 1,
Decrypt your 3DS rom:

Spoiler

http://gbatemp.net/threads/tutorial-how-to-decrypt-3ds-roms-for-dummies.372653/

Also required for .cia conversion,
besides dealing with romfs.bin,
you also need to decrypt the following, with similar steps:
exheader.bin, exefs.bin.

To quote:
If you end up with a decrypted romfs.bin, exheader.bin, code.bin (decompressed), icon.bin and banner.bin you did everything correct.

Next:
Follow the rest of this guide:
http://gbatemp.net/threads/4-x-only-cia-cfw-complete-guide.373532/

Which is also conveniently here:

Thanks but yes that guide is to confusing for me Ive found a package that does it all but how do you do this bit:
1.Run PadGen on 3DS to generate xorpads
2.Place xorpads and .3ds file in root directory
3.Run EXTRACT.bat
4.Edit template.rsf entries, should only need to change SaveDataSize
and maybe remaster version
5.Run BUILD.bat

Does not matter, its still to confusing. Surely cant someone create an easy program where you put your .3ds file in a folder, run .bat and it generates a .cia file?

 

[einstein95]

So are game patches .cia? Does this solve the "not being able to get patches from out of region"? Assuming someone dumps the updates. Or are updates a different format?

Not quite sure, but judging from what I've seen, patches are downloaded as cia, as seen in the update releases from BBB.

 

[Queno138]

Thanks but yes that guide is to confusing for me Ive found a package that does it all but how do you do this bit:
1.Run PadGen on 3DS to generate xorpads
2.Place xorpads and .3ds file in root directory
3.Run EXTRACT.bat
4.Edit template.rsf entries, should only need to change SaveDataSize
and maybe remaster version
5.Run BUILD.bat

Does not matter, its still to confusing. Surely cant someone create an easy program where you put your .3ds file in a folder, run .bat and it generates a .cia file?

I didn't use those tools.
What I know has to be done is:

1. Drag rom over ctrgen or ctrkeygen to get this ncchinfo.bin or ncch.bin file (name is something like that)
2. Put the .bin file into root of 3DS SD card, together with the launcher.dat or whatever they named.
3. Execute steps of running the exploit (On 3DS > Settings > DS Profile)
4. Let the program run.

Have you done similar steps yet at this point?

----

^^This

Can someone PLEASE answer this question?

Depends on games.

Games from different region produced/manufactured at different timing may have different ID,
hence the patch may not work.

Only example which contradicts is probably is Pokemon XY.
They hide the rom behind the region lock;
it's effectively the same rom?

Anyone who knows better, feel free to correct me.

 

[misterb98]

Thanks but yes that guide is to confusing for me Ive found a package that does it all but how do you do this bit:
1.Run PadGen on 3DS to generate xorpads
2.Place xorpads and .3ds file in root directory
3.Run EXTRACT.bat
4.Edit template.rsf entries, should only need to change SaveDataSize
and maybe remaster version
5.Run BUILD.bat

Does not matter, its still to confusing. Surely cant someone create an easy program where you put your .3ds file in a folder, run .bat and it generates a .cia file?

Steps 2 through 5, to my knowledge, may at some point be automated. Step one requires illegal stuff (don't know exactly what), and cannot be added. pad_gen can be compiled if you are smarter than me and can use make. Personally, I got lucky and found what is probably the latest version on someones github somewhere.

 

[Lordjontan]

How to use Padgen?

 

[Reecey]

Thanks guys for your help I have not done those steps, really that has beat me, as sad as it seems, I'm just not that good at the techy stuff I know it may seem quite easy to you both but to me its really not, it really needs to be straight forward for me to work my end. My problem is I have not got enough patience to try it all out I get to frustrated to easy and start to get really wound up then I have to go and have a smoke to calm down!

 

[Queno138]

-snip-

Given you have similar programs,
This helps the front part of decryption:

http://gbatemp.net/threads/tutorial-how-to-decrypt-3ds-roms-for-dummies.372653/page-2#post-5136907

He added link to program too!

edit:

Thanks guys for your help I have not done those steps, really that has beat me, as sad as it seems, I'm just not that good at the techy stuff I know it may seem quite easy to you both but to me its really not, it really needs to be straight forward for me to work my end

It's easier with the right set of tools.

The ones Gamesquest1 linked above will suit you better.

Previously, I was scavenging the internet for tools.
and tutorials. gah.

The next hard part for me was to create the proper .rsf file.