[howto] Download and install Ironfall on system versions 9.0-9.2 using PastaCFW

Discussion in '3DS - Tutorials' started by neobrain, Aug 1, 2015.

Thread Status:
Not open for further replies.
  1. neobrain
    OP

    neobrain -

    Member
    306
    472
    Apr 25, 2014
    Hi,

    I spent almost two hours on this earlier today, so I figured I'd spare others the effort and provide some pointers for people in a similar situation like me.

    Background: smea will release a new way to run ARM11 userland homebrew on the 3DS using a game called Ironfall ( https://twitter.com/smealum/status/627282448343171072 ), which is available for free on the eshop. This new approach will still require Cubic Ninja, but only once for installation instead of each time the system is booted. This is useful for a number of reasons, one being that it will probably make it easier to obtain a CN cartridge for one-time use. A drawback is that accessing the eshop normally requires being on the latest system version, and as most of you will know so far no total-control exploits are publicly known for system versions more recent than 9.2.

    IMPORTANT NOTES:
    - The exploit is not yet public, but chances are Ironfall might be taken down from the eshop before the exploit goes live, so you should get the game ASAP.
    - Don't get rid of your Cubic Ninja cartridge yet, because it will be required for the installation of the exploit.
    - Any of the "facts" I'm presenting about the yet-unpublished exploit may as well be humbug. I don't have any "insider-information", but you can see for yourself how likely any of them are by reading smea's tweets. In particular, it's not clear whether Ironhax will be supported on anything earlier than 9.9. There's no harm in getting the game before it gets taken down anyway, though, even if Ironhax ends up not being compatible with your system version.

    How to:
    - Get Cubic Ninja if you haven't already. You'll eventually need it for the exploit installation anyway. Install Ninjhax (any version).
    - Get the "CFW" PastaCFW (it's not really a CFW, but whatever, it'll be useful regardless)
    - Get the FBI CIA installer
    - Get the Free multi patcher
    - Copy Pasta, FBI and FMP to your 3DS SD card. Alternatively to physically accessing the SD card, you can use ftbrony to transfer the files over network to your 3DS.
    - Run Ninjhax and start PastaCFW. This will reboot the system with patched out signature-checks.
    - Re-run Ninjhax (without rebooting the system manually!) and start FBI. Navigate to the FMP CIA on your SD card and install it. There should be no error message. Return to hbmenu by pressing START.
    - Run PastaCFW again to reboot the system while keeping the signature checks disabled.
    - Your home menu should now have a new icon for FMP. Select and run FMP to enable eshop spoofing.
    - Return to the home menu, start the eshop. Download Ironfall.

    Hint: Once installation is complete, you can dump and decrypt the Ironfall title from your 3DS:
    - Downloading Decrypt9 (TODO: link)
    - Downloading Brahma (TODO: link)
    - Start Brahma through Ninjhax. Start Decrypt9 through Brahma. Press R to "Dump NAND" (to save some SD space, you can also just dump the "NAND partition", but all offsets given in the following will refer to "Dump NAND").
    - Transfer the resulting NAND.bin to your computer.
    - Use Decrypt9 to create a FAT16 xorpad. Apply it to your NAND.bin dump and extract the file "nand:/private/movable.sed".
    - Dump the SD card's "Nintendo 3DS" folder to your 3ds (from the title subdirectory, only the 00040000/0015b100 (EUR!) subsubfolder is needed
    - Run Decrypt9's sdinfo_gen.py on the Nintendo 3DS folder. Start Decrypt9 and select "SD padgen". This will generate a number of xorpads on your SD card. Copy all the ones starting with "title.00040000.0015b100." to your computer (should be 5 files in total).
    - Apply the xorpads to the corresponding encrypted files. In particular, 00000000.app should be interesting.
    - Run ncchinfo_gen.py on the decrypted game, copy ncchinfo.bin to your 3DS's SD card and generate xorpads on it via Decrypt9.
    - Apply the resulting xorpads to decrypt the second encryption layer.
    - Congratulations, you've got a decrypted Ironfall dump now!

    My hope is to find a way to find a way to install an Ironfall dump on a 3DS even without signature patching and stuff. This would allow to install it on any 3DS even if it ever gets removed from the eshop.

    Hope this helps some people get started.
     
    Last edited by neobrain, Aug 3, 2015
    cvskid and marc00077 like this.


  2. Intronaut

    Intronaut An star maker

    Member
    726
    432
    Nov 18, 2014
    Cote d'Ivoire
    but Ironfall cant be launched in sysnand 9.2 without firmware spoof
     
    SLiV3R, Fishaman P and marc00077 like this.
  3. neobrain
    OP

    neobrain -

    Member
    306
    472
    Apr 25, 2014
    Derp. I suppose that makes this whole thing a fair amount less useful :P
     
  4. Pecrow

    Pecrow GBAtemp Maniac

    Member
    1,137
    417
    Jun 23, 2015
    United States
    how do you dump the title? Im on n3ds 9.2 pasta and gateway
     
  5. DjoeN

    DjoeN Captain Haddock!

    Member
    5,136
    1,478
    Oct 21, 2005
    Belgium
    Somewhere in this potatoland!
    You could have also spoofed the eshop in sysnand 9.0/9.2 and installed Ironfall from the eshop
    Much easier, just going to an url (or scan a qr-code) wait till dat file is downloaded, wait a few seconds, close browser, look at crash error, enter eshop, download.
     
    InsaneNutter likes this.
  6. neobrain
    OP

    neobrain -

    Member
    306
    472
    Apr 25, 2014
    You can use Decrypt9 to dump the NAND, decrypt the NAND, extract the title NCCH in the encrypted dump, and decrypt the title.

    — Posts automatically merged - Please don't double post! —

    .. that is the whole point of this post. Are you saying there is an easier way to do this with Cubic Ninja than what I explained?
     
    Last edited by neobrain, Aug 1, 2015
    Pecrow likes this.
  7. JoostinOnline

    JoostinOnline Certified Crash Test Dummy

    Member
    10,953
    3,732
    Apr 2, 2011
    United States
    The Twilight Zone
    You just described how to download anything from the eShop. Sorry, but we've all been doing that for months.
     
  8. neobrain
    OP

    neobrain -

    Member
    306
    472
    Apr 25, 2014
    Good for you, I guess. But yeah, that's exactly what I've described.
     
  9. tivu100

    tivu100 GBAtemp Advanced Maniac

    Member
    1,989
    431
    Jun 6, 2015
    United States
    Me think, you still need firm-launch to run Ironfall on 9.0 and 9.2?! If so, you still need CN even after ironhax release, to first launch firmlaunch on Pasta CFW then launch ironhax?! It's like you need a (higher right & kernel-exploit) homebrew launcher to launch another homebrew launcher.

    I guess it's good for homebrew developers who don't want to update their <= 9.2 consoles but have access to Smealum latest exploit to work on homebrews. However, for average user, it's not freehax on 9.0 & 9.2 (yet?). This is regarding Pasta CFW, not rxTools with Pasta (which's still waiting for N3DS support release).
     
    Last edited by tivu100, Aug 1, 2015
  10. marc00077

    marc00077 GBAtemp Regular

    Member
    125
    35
    May 21, 2014
    Netherlands Antilles
    Catalunya
    I can confirm ironfall doesn't boot because its not compatible with 9.2. The Nintendo 3DS logo with the backgroud red "waves" animation keeps running indefinitely. The tutorial does what it says btw I have Ironfall downloaded and installed on sysnand :P
     
  11. neobrain
    OP

    neobrain -

    Member
    306
    472
    Apr 25, 2014
    Thanks for confirming, marc00077 ;)

    To clarify: the original goal of this tutorial is to be able to obtain a CIA file from the downloaded title that can be used once/if Nintendo takes down Ironfall from the eshop. It's not quite there yet, and I overestimated the potential for other uses by not bothering to check whether Ironfall even works on 9.2. Anyway, I'm hoping to figure out how to achieve the original goal (or at least figure out why it's not possible, if it isn't).
     
  12. duffmmann

    duffmmann GBAtemp Psycho!

    Member
    3,621
    1,467
    Mar 11, 2009
    United States
    It doesn't even matter though, the new Ironfall hack will still block cfw loading like Ninjhax 2.0. It'd be awesome to have access to pasta without having a specific game in your New 3DS' game slot (so you can free it up for something such as a DS flash cart), but Ironfall does not actually look to be that answer.
     
  13. neobrain
    OP

    neobrain -

    Member
    306
    472
    Apr 25, 2014
    If that's a concern to you, this thread is not for you.
     
  14. Vappy

    Vappy GBAtemp Advanced Maniac

    Member
    1,507
    1,154
    May 23, 2012
    Would that even work? Surely you'd need sig checks patched out if it was installed as a .cia? I know there are 'legit' .cias that work without sig checks patched, but those are only the preinstalled bundle games.
     
  15. neobrain
    OP

    neobrain -

    Member
    306
    472
    Apr 25, 2014
    That's part of what I'm still trying to figure out ;)
     
    Vappy likes this.
  16. duffmmann

    duffmmann GBAtemp Psycho!

    Member
    3,621
    1,467
    Mar 11, 2009
    United States
    I guess that makes me curious then why you make a thread explaining how to not update and download the game. The only reason not to update beyond 9.5 at this point are piracy related purposes such as CFWs. Otherwise, you can update to the latest fw and download this title if you're legit only interested in homebrew purposes unless i missed something about this new hack being restricted up to a certain fw.
     
  17. Mr. Prince

    Mr. Prince GBAtemp Advanced Fan

    Member
    534
    87
    Oct 29, 2011
    Saudi Arabia
    All Blue
  18. gamefan5

    gamefan5 Kid Icarus Uprising connoiseur

    Member
    4,943
    2,064
    Aug 29, 2010
    Canada
    Somewhere in this Earth
    Since ironhax does the exact same thing as Ninjhax, it is implied that CN will not be needed.
     
  19. Vappy

    Vappy GBAtemp Advanced Maniac

    Member
    1,507
    1,154
    May 23, 2012
    Only if Ironfall has some way of importing an exploited save file, which I'm pretty sure it doesn't. Smealum could turn around with a surprise method of doing so, but going by what we know for sure, it seems that CN/OoT are still going to be needed.
    I'm still interested to know if there's a way to install Ironfall and have it loadable from unpatched sysNAND without needing to download it from the eShop, because if so then after it inevitably gets pulled and the exploit patched, having a way to install it to new systems would be plenty valuable.
     
  20. gamefan5

    gamefan5 Kid Icarus Uprising connoiseur

    Member
    4,943
    2,064
    Aug 29, 2010
    Canada
    Somewhere in this Earth
    I honestly think it is another method, but we'll see at the end of the week. I hinestly think using either OoT or CN would defeat the purpose of making it "free".

    EDIT: Check twitter. Smealum confirmed CN or OoT will NOT be needed for this.
     
Thread Status:
Not open for further replies.