Hacking How to create your own Sky3DS template entries?

[JimBonza]

I'm trying to figure out how the titleID and SHA1 information is gathered for the roms to put into the template file.

I ask this mainly because I have EUR Alpha Sapphire but there's no template entry from the Sky3DS team yet.

Here's an example of the entry used for Smash Bros EUR.

** : CTR-P-AXCP

SHA1: E5E9D4CA3B94F8674153DDCDBF65D6ADA00640B8
00 00 00 00 C2 F8 02 90 C2 22 13 00 F2 1E 0D E1
43 54 52 49 4D 41 47 45 00 00 00 00 00 00 00 00
6B CF 8D 12 A7 F4 93 B0 12 00 59 A7 3D 9E D8 35
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
D5 0E CC 10 73 EA 9B 99 09 E5 FF C9 7D 98 73 65
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
43 54 52 2D 50 2D 41 58 43 50 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 3B C9

and

** : CTR-P-AXCP

SHA1: E5E9D4CA3B94F8674153DDCDBF65D6ADA00640B8
00 00 00 00 C2 F8 02 90 C2 22 13 00 F2 1E 0D E1
43 54 52 49 4D 41 47 45 00 00 00 00 00 00 00 00
6B CF 8D 12 A7 F4 93 B0 12 00 59 A7 3D 9E D8 35
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
D5 0E CC 10 73 EA 9B 99 09 E5 FF C9 7D 98 73 65
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
43 54 52 2D 50 2D 41 58 43 50 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 3B C9

Can't figure it out for the life of me, even the SHA1 checksum I get doesn't match what they have, however it wrote and plays just fine on the Sky3DS.

Any tips guys?

 

[piratesephiroth]

Some info

If someone is interested in how the template works, here some info, most of this was easy to understand from decompiling diskwritter, but there is one 16 byte value that diskwritter doesn't use.

Sha1 hash: from 0x1000 - 0x11FF of rom
 
template structure: (convert from hex-string to byte array first, simply use HxD and copy/paste it...)
 
4 byte = Cartridge Crypto //always 0x0 ?
4 byte = Cartridge ID
4 byte = EEPROM ID //0xFFFFFFFF on nand save, most cards use 0xC22211, 0xC22212, 0xC22213
2 byte = crc16 xor 0xFFFF // from 0x1000 - 0x11FF of rom
2 byte = crc16 // from 0x1000 - 0x11FF of rom
16 byte = "CTRIMAGE" + zeroes
16 byte = ??? hash or id // is not used by disk writter directly, so unknown for now
16 byte = zeroes
16 byte = unique id // used for online play
48 byte = 0xFF
256 byte = Game Serial + zeroes //the updated disk writter allows real name instead of serial
126 byte = zeroes/reserved
2 byte = crc16 from 0x0 - 0x1FD //from this template structure, not rom
 
//Cartridge ID:
example1: C2 FE 00 90
example2: C2 F8 00 98
this value tells us some stuff about the cartrige, like nand saving (id & 0x8 == nand save)

 

[JimBonza]

Falo I generally understood everything else but what do you mean exactly that the Sha1 hash is from 0x1000 - 0x11FF

Taking the example of AXCP (Smash)

00 E0 0E 00 00 00 04 00 00 00 00 00 00 00 00 00 BE 2B 0F 79 2A 09 F2 1D 4B F0 70 2D 4C 3B F9 AE 89 EA 7E A6 B7 3E A8 66 DB 31 65 6D 02 AD AA D8 ED 5F 5B 62 2A 86 C5 D8 59 1F 62 C7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4E 43 43 48 F8 56 29 00 00 E0 0E 00 00 00 04 00 30 30 02 00 00 00 00 00 00 E0 0E 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 98 C4 9D 91 9E 25 4E 15 DC 21 3C AB 47 A8 00 ED 63 B2 48 DC D4 31 19 E8 FB 82 D9 E6 2A E5 1C 43 54 52 2D 50 2D 41 58 43 50 00 00 00 00 00 00 B5 08 D3 64 CC B2 A3 BF BB BB C7 4D 43 5D C8 E6 F2 C8 34 E5 EA B6 AE 7A 28 B8 FA BC C3 92 78 5C 00 04 00 00 00 00 00 00 00 00 00 01 01 03 00 00 15 00 00 00 02 00 00 00 05 00 00 00 10 00 00 00 17 00 00 00 A7 33 00 00 01 00 00 00 00 00 00 00 C0 33 00 00 38 23 29 00 02 00 00 00 00 00 00 00 AF FA BF 11 64 9A E4 CA B0 36 4E 63 41 E4 99 71 7B 05 E0 0A 22 11 66 72 BB AC 12 F6 8A B7 37 F5 35 4C A4 7D 61 4E 4D F9 A8 0F DC 92 3C 84 83 D2 22 37 B2 7B 30 5C 4F FB E5 45 38 DE 11 FE 09 6C

This is the data copied from 0x1000 to 0x11FF, how does that then become either:
SHA1: E5E9D4CA3B94F8674153DDCDBF65D6ADA00640B8

 

[gamesquest1]

Falo I generally understood everything else but what do you mean exactly that the Sha1 hash is from 0x1000 - 0x11FF

Taking the example of AXCP (Smash)




This is the data copied from 0x1000 to 0x11FF, how does that then become either:
SHA1: E5E9D4CA3B94F8674153DDCDBF65D6ADA00640B8

E5E9D4CA3B94F8674153DDCDBF65D6ADA00640B8 is the sha1 of that data

 

[JimBonza]

Would you mind explaining how you figured that out? I'm definitely doing something wrong as my SHA1 is completely different to what it should be.

 

[gamesquest1]

in hex workshop select the area and generate the sha1

 

[JimBonza]

Aaaah I'm an idiot, thanks for that. Now on to disecting the the template x_x

 

[Falo]

Here a quick and dirty written tool to make templates, including source code (C# VS2010).



Download:
https://www.dropbox.com/s/wtt7s30k1rk4phg/SkyTemplateMaker.7z?dl=0
https://www.dropbox.com/s/i9zkshaz3gzi2rr/SkyTemplateMakerEndianBugFix.7z?dl=0

 

[JimBonza]

That's pretty badass man! I'll give it a shot and see how it goes.

 

[JimBonza]

Hmm any idea what's up ?


Using the quick example of Smash. Your tool returns:

** : CTR-P-AXCP

SHA1: E5E9D4CA3B94F8674153DDCDBF65D6ADA00640B8
00 00 00 00 C2 F8 02 90 13 22 C2 00 1E F2 E1 0D
43 54 52 49 4D 41 47 45 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
43 54 52 2D 50 2D 41 58 43 50 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 EB C2

However the Sky3DS team used this data, compare and contrast:

** : CTR-P-AXCP

SHA1: E5E9D4CA3B94F8674153DDCDBF65D6ADA00640B8
00 00 00 00 C2 F8 00 90 C2 22 13 00 F2 1E 0D E1
43 54 52 49 4D 41 47 45 00 00 00 00 00 00 00 00
6B CF 8D 12 A7 F4 93 B0 12 00 59 A7 3D 9E D8 35
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
43 54 52 2D 50 2D 41 58 43 50 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 20

and

** : CTR-P-AXCP

SHA1: E5E9D4CA3B94F8674153DDCDBF65D6ADA00640B8
00 00 00 00 C2 F8 02 90 C2 22 13 00 F2 1E 0D E1
43 54 52 49 4D 41 47 45 00 00 00 00 00 00 00 00
6B CF 8D 12 A7 F4 93 B0 12 00 59 A7 3D 9E D8 35
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
D5 0E CC 10 73 EA 9B 99 09 E5 FF C9 7D 98 73 65
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
43 54 52 2D 50 2D 41 58 43 50 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 3B C9

 

[JimBonza]

I noticed some hex numbers are the wrong way round and C2 for EEPROM is in the wrong place in the first line too.

 

[Falo]

You can't use my tool to generate a 100% accurate template!

Cartridge ID -> must be dumped from REAL cartridge
EEPROM ID -> can be guessed or dumped from real cartridge
Unknown ID -> i have no idea what this id is, but my guess is it can only be dumped from a real cartridge
Unique ID -> leave it as 0xFF and you have no online, use a public 3DZ header or dump your own from a real cartridge!

I guess i made a mistake on some values by using the wrong endian.

Here a fix for the endian bug:
https://www.dropbox.com/s/i9zkshaz3gzi2rr/SkyTemplateMakerEndianBugFix.7z?dl=0

 

[JimBonza]

Ah fair enough, I can get some of those values anyway like the Unknown ID, EEPROM

 

[JimBonza]

Just a heads up Falo after some tinkering as discussed above with getting the hex digits the right way round, it is now finally writing the EUR Alpha Sapphire to the Sky3DS

Going to test it out now and see if the game works.

 

[gamesquest1]

anyone with a sky3ds know if they allow you to switch headers once you have locked in your 10 games? or is the header info also logged, if it is that could be a fairly easy way for nintendo to blacklist the card obviously having another sky 3ds and using un-blacklisted headers would make it easy to bypass....but unless everyone can dump their own headers who use sky3ds, that would be a pretty big deterrent having to get a new sky3ds every time nintendo updates and blacklists sky3ds's uniqueID DB

 

[ChrisRX]

From the Sky3DS FAQ

Q: What happens to this limit if someone put a rom (by error) from a different region into the MicroSD? Does it still count as 1 used slot even if the rom cannot be launched?
A: It doesn't matter if put the wrong region games into your microSD card, SKY3DS won't count it in total, you can even copy more than 10 games into microSD card, anyway SKY3DS still only remember those 10 games in the first place.

That does seem to imply that the SKY3DS's internal 10 game database is created from the game's header and not its hash as different regions would generate different SHA1 hashes.
I wonder whether then importing the header from a game that was previously copied to the sky3ds would allow you to play more than 10 games.

Unfortunately I don't feel like filling up a rather expensive card with 10 games to test this theory, maybe someone with a full card can help us test this theory.

 

[Falo]

anyone with a sky3ds know if they allow you to switch headers once you have locked in your 10 games? or is the header info also logged, if it is that could be a fairly easy way for nintendo to blacklist the card obviously having another sky 3ds and using un-blacklisted headers would make it easy to bypass....but unless everyone can dump their own headers who use sky3ds, that would be a pretty big deterrent having to get a new sky3ds every time nintendo updates and blacklists sky3ds's uniqueID DB

This template is not just used to identify roms, it is written to 0x1400 in the rom file after transfering.
The Unknown ID could be used by this flashcard to identify used roms, maybe i made a 10 games bypass ? XD, can't test it.

Unique ID will most likely not be blocked by Nintendo, i think you could sue them if your real game is blocked from online,
the flashcard will be blocked by identifying how it works.

 

[gamesquest1]

This template is not just used to identify roms, it is written to 0x1400 in the rom file after transfering.
The Unknown ID could be used by this flashcard to identify used roms, maybe i made a 10 games bypass ? XD, can't test it.

Unique ID will most likely not be blocked by Nintendo, i think you could sue them if your real game is blocked from online,
the flashcard will be blocked by identifying how it works.

truth is i doubt you could sue them....if your cards uniqueID was dumped and added to a list used to pirate games, im pretty sure they have something in their T&C which say they can prevent the use of games used in this manner, and really i doubt any court would hold up any lawsuit.....basically the card used to get the unique ID are in the possession of the sky3ds team.....i doubt they will be giving nintendo their details for a banned game ....and even if they sold the game that would be a dumb move if someone does get banned and then they trace back where it was bought and then who sold it to the store, they would be leaving a tail for nintendo to track them down

basically if banning the used unique ID's was the only way to block the card im sure they wouldn't think twice....no big deal if they have to swap a few games for people who pick up a banned cart....it would just help them in tracking down the sky3ds team

all in all it just depends on how well sky3ds actually emulate the retail card, if there is any flaws it will be blocked at a low level, if its near perfect they would just have to take what they can get.

 

[piratesephiroth]

From the Sky3DS FAQ


That does seem to imply that the SKY3DS's internal 10 game database is created from the game's header and not its hash as different regions would generate different SHA1 hashes.
I wonder whether then importing the header from a game that was previously copied to the sky3ds would allow you to play more than 10 games.

Unfortunately I don't feel like filling up a rather expensive card with 10 games to test this theory, maybe someone with a full card can help us test this theory.

It seems Sky3DS owners are either too rare or too ashamed to come here and say they got one.

 

[JimBonza]

So I used the diskwriter to write it somewhat successfully, problem is when it cycles to the game on the 3DS it's a blank icon that won't load. On top of that in diskwriter under EEPROM it says "NO" instead of YES like all the other roms. Weird. :S