1. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    I can't get this script to work, for some reason it's not finding my keys "keys.dat" file, I edited your script and replaced prod.keys with keys.dat, but it was still saying: Invalid NCA header! Are keys correct?
     
  2. crckd

    OP crckd Member
    Newcomer

    Joined:
    Dec 3, 2020
    Messages:
    13
    Country:
    Philippines
    I had the same issue.
    just change "-k keys.txt" to "--keyset=keys.txt". there should be no spaces on the argument.

    [​IMG]
     
    Last edited by crckd, Jan 29, 2021
    LyuboA likes this.
  3. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    I'm still getting an error - I have hactool and the keys in the same folder as I am using the py script in, and it's not finding the keys, which is weird as it obviously finds and runs hactool. It's a mystery.
     
  4. crckd

    OP crckd Member
    Newcomer

    Joined:
    Dec 3, 2020
    Messages:
    13
    Country:
    Philippines
    At which part do you get the nca header error?
     
  5. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    This is what I m doing - see pictures for folder content, command line, and output + modded py script.

    [​IMG]
    [​IMG]

    Ignore the double quotes round the keyset line - it's the same error using single quotes.
     
    Last edited by mrdude, Jan 29, 2021
  6. crckd

    OP crckd Member
    Newcomer

    Joined:
    Dec 3, 2020
    Messages:
    13
    Country:
    Philippines
    try to replace line 25 with this and use single quotes
    subprocess.run(['hactool','--intype=nca','--exefsdir=.','--disablekeywarns', FIRMWARE_DIR + '/' + filename], stdout=subprocess.DEVNULL)
     
    Last edited by crckd, Jan 29, 2021
  7. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    Same error. (reason it's only showing 1 error - is because I just have the one file you posted above in the firmware folder, to speed things up).
     
    Last edited by mrdude, Jan 29, 2021
  8. crckd

    OP crckd Member
    Newcomer

    Joined:
    Dec 3, 2020
    Messages:
    13
    Country:
    Philippines
    how about at line 16? did you add
    your keys there?

    i have my prod.keys at %USERPROFILE%\.switch so i don't need to add it as an argument on hactool.
    i forgot to add it also on some lines of the script
     

    Attached Files:

    • es.zip
      File size:
      686 bytes
      Views:
      34
    Last edited by crckd, Jan 29, 2021
    Tyvar1, mrdude and ShadowOne333 like this.
  9. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    Yep I tried that before, I think it was line 25 which was causing the issues - and the keyfile being missing from the original script. Here the modded script which is now working. (use keys.dat).

    [​IMG]
     

    Attached Files:

    • es.zip
      File size:
      702 bytes
      Views:
      37
    Last edited by mrdude, Jan 29, 2021
    Tyvar1, LyuboA and ShadowOne333 like this.
  10. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    Slightly modded the script to add another argument as people are using different named keyfiles.

    Usage: python es.py firmware prod.keys

    Firmware: is the name of the folder the firmware files are in.
    prod.keys can be changed to whatever key file you are using - example: python es.py 11.0.0 keys.txt

    Batch file code to dump + cleanup
    Code:
    rem SET VAR="C:\python3.9\python"
    cls
    mkdir dumped
    %VAR% es.py firmware keys.dat
    del main.* /Q
    move main_dec dumped
    )
    
    @crckd
    Your script doesn't seem find the files on firmware Firmware 10.1.0 or Firmware 10.0.4, firmware newer is ok though (10.2.0 & 11.x.x) Maybe this will affect newer firmware's in future. Do you know what's different in these older firmware's and why the script isn't finding the anything in those?

    EDIT: OK, found it - change line to this: (this then finds the build id in nca files as well)
    Code:
    if line.startswith("TitleID:0100000000000033") and not filename.endswith("*.nca"):
    
    Although this is what happens on 10.0.4:
    There's no extraction of files.......even though it has the correct title id:
    [​IMG]

    So removing that file, and running the script again - it finds this also has the same id
    Code:
    e006abf2423022702fa4839be9825ebc.nca
    
    and this is the output: (which seems correct)
    Found! Filename : e006abf2423022702fa4839be9825ebc.nca
    Using hactool to extract exefsdir
    Using hactool to uncompress main
    Found Build ID : 03E4EB5556B98B327D1353E8AA2C7ADF2C544470
    
    Running this:
    Code:
    hactool --keyset=keys.dat --intype=nca --exefsdir=dumped --disablekeywarns firmware/e006abf2423022702fa4839be9825ebc.nca
    
    Dumps main + main.npdm - so maybe we need to put a check as well to check for:
    "ContentType: Program" because the other file's content type is "meta" (no space before program - but forum is turning it into a smiley)
     

    Attached Files:

    • es.zip
      File size:
      733 bytes
      Views:
      32
    Last edited by mrdude, Jan 29, 2021
  11. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    Ok here's the updated python file with the for loop modded, this finds the correct files now in all firmware I checked down to 10.0.0.4
     

    Attached Files:

    • es.zip
      File size:
      750 bytes
      Views:
      43
    Tyvar1, LyuboA, peteruk and 1 other person like this.
  12. ShadowOne333

    ShadowOne333 QVID PRO QVO
    Developer

    Joined:
    Jan 17, 2013
    Messages:
    10,396
    Country:
    Mexico
    Oh wow! This is coming along amazingly!
    With these documentation and scripts, now the creation of the sigpatches is no longer hidden and everyone can attempt it.
    This is just lovely!
     
    LyuboA, mrdude and peteruk like this.
  13. crckd

    OP crckd Member
    Newcomer

    Joined:
    Dec 3, 2020
    Messages:
    13
    Country:
    Philippines
    I'm looking at the 3rd patch of 11.0.0. It would be much simpler if we can patch previous versions like the 11.0.0

    [​IMG]
     
    mrdude likes this.
  14. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    We should be able to find the hex patterns if we use some wildcards, it shouldn't be a problem to do that - I just checked the first patch on each firmware, can can't see an issue doing it that way.
     
  15. crckd

    OP crckd Member
    Newcomer

    Joined:
    Dec 3, 2020
    Messages:
    13
    Country:
    Philippines
    patch 3 pattern for 11.0.0 below can be used also.
    but 11.0.0 we cannot be sure if it will change on new updates.

    on patch 1, we can use "patch = int((0x14 << 24) | ((inst >> 5) & 0x7FFFF))" to convert that cbz to b (credit to anon user)

    [​IMG]
     
    LyuboA and mrdude like this.
  16. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    Not sure if this is any help but for patch 3 search for this text in ida: "escertificate"
    [​IMG]
    See pic 1, scroll to the top of the function where you see the branch:
    [​IMG]
    Click on that so you can go to the branch address, You will then be in the function that needs patched.
    [​IMG]

    Now I know that's not ideal - and it may need done manually - but it's better than nothing :-)

    Patch 3 in older firmware was doing a NOP, now it's doing a branch to address:
    [​IMG]

    It could be possible that we can just (change the patch) nop the call to branch to address as shown in the 2nd picture - I didn't try this, but it might work and make patch 3 easier to automatically do.
     
    Last edited by mrdude, Jan 29, 2021
    LyuboA and ShadowOne333 like this.
  17. crckd

    OP crckd Member
    Newcomer

    Joined:
    Dec 3, 2020
    Messages:
    13
    Country:
    Philippines
    I was thinking the same thing. cbz-to-b on patch 3. It would change the existing es patches of versions below 11 but it would be much easier and more consistent.

    off-topic:
    Which OS/python/IDA version do you use? i'll try to install IDA to see the disassemble code easier. last debugger i used was ollydbg and it was 8 years ago.
     
    ShadowOne333 likes this.
  18. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    Check your pm's, I'm using python 3.9.1/Windows 10 (64bit), IDA 7.5 (64 bit).
     
    Last edited by mrdude, Jan 29, 2021
    ShadowOne333 likes this.
  19. mrdude

    mrdude GBAtemp Maniac
    Member

    Joined:
    Dec 11, 2015
    Messages:
    1,064
    Country:
    @crckd, as you probably have never used IDA, it's a bit of a learning curve - but here's how to work out the patch for patch 3.

    The pictures should explain better than me drivelling on.
    View from IDA of unpatched file..
    [​IMG]

    Arm2hex website, how to get the branch address patch:
    [​IMG]

    Now using that info for: Alternative Branch Patches
    Firmware 9.1.0 - patch 3 (tested - works fine)
    Alternative Patch would look like this: offset: 2d3a0 - patch: 04000014

    Firmware 10.0.4 - patch 3 (tested - works fine)
    Alternative Patch would look like this: offset: 2dc50 - patch: 09000014

    Firmware 10.1.0/10.2.0 - patch 3 (tested - works fine)
    Alternative Patch would look like this: offset: 2dc64 - patch: 09000014

    Firmware 11.x.x - patch 3 (tested - works fine)
    offset: 2d0f4 - patch: 06000014
     

    Attached Files:

    Last edited by mrdude, Jan 30, 2021
  20. LyuboA

    LyuboA Unknown Entity
    Member

    Joined:
    Jun 1, 2018
    Messages:
    478
    Country:
    Bulgaria
    @mrdude i tested the patches for 10.2.0 they work
    now that you know how to make them what does this mean for script
    or a guide so everyone can make them
     
    Last edited by LyuboA, Jan 30, 2021
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - patches, hashes,