What difference does it make? Is there a special hidden forum or is it just your title changes from member to dev?
Hacking Discussion Info on SHA-256 hashes on FS patches
- Thread starter crckd
- Start date
- Views 204,706
- Replies 526
- Likes 17
FYI, wildcard overrides code is now complete - this is a power feature and saves me updating the app as much, because when search patterns change instead of the app needing updated, you just need the wildcard value :-), which is easy to find and will be posted if you don't know how to find it.......I'll probably do a tutorial on this feature.
Here's a screenshot:
Finally I'm on the last feature of this app and that's just the database page to store the wildcard entries, then the app is complete as far as I am concerned, I'll then put the code on github so you can mess about with it. Probably I'll be done this week if I get the time.
Here's a screenshot:
Finally I'm on the last feature of this app and that's just the database page to store the wildcard entries, then the app is complete as far as I am concerned, I'll then put the code on github so you can mess about with it. Probably I'll be done this week if I get the time.
That's because I deleted it, it was only meant for dogty to see the code in c# instead of python. It will be uploaded and linked when I am finished the code.
FYI, WCO tab added - WILD CARD OVERRIDE.
This feature is only for SDKVersion:14.3.0.0 firmware and above as we don't need it for anything below that, so even if you try and use wilcard searches for anything below this it will be ignored....
Now what are wild card over rides? Well they are hex patterns in the decrypted firmware file, so if you uncheck "Autoclean Decrypted Files" in ES/FS/NFIM you will have the files you need to find wildcard patterns, these are the patterns that this program uses to search for when creating ips patches, If you look at the debug output from the latest firmware in ES, for example you will see this: Wildcard search pattern found at offset: 0x000663D6.
If you open the decrypted file with a hex editor and go to that address you will see we find a hex pattern like this:
FF 97 60 7E 40 92 F4 4F 52 A9 FC 8B 40 F9 FD 7B 50 A9 FF C3
We can use a wildcard to find this pattern: FF97......52A9........FFC3
Notice that we can just replace some bytes (a 2 digit hex value) with a period (.), Also notice we want to use a differnet address for our patch: 0x000663D8 - 2 bytes difference.... This is the address we want to patch out and the instruction: 60 7E 40 92 at this address with our ES patch instruction : E0031FAA.
Now while this might seem complex for some to understand, for others it's easy and when I add the database page (not implemented yet), you will be able to update it with new wildcards + patches when they are needed. I might even add a download link where you can can just replace the database with a new one :-). But if ninty block this - you can just add the data manually.
I didn't put wilcards for ES2 patches - as these are superseded now, I only put the ES2 tab in the event ES patches failed, but generally you won't need to use those.
Anyway, for those that like to mess about with hex editors/ida etc, you will understand why this new override feature is pretty good. For the noobs - probably you should stay away from the tab unless you are told what to put in it by someone else more experienced.
This feature is only for SDKVersion:14.3.0.0 firmware and above as we don't need it for anything below that, so even if you try and use wilcard searches for anything below this it will be ignored....
Now what are wild card over rides? Well they are hex patterns in the decrypted firmware file, so if you uncheck "Autoclean Decrypted Files" in ES/FS/NFIM you will have the files you need to find wildcard patterns, these are the patterns that this program uses to search for when creating ips patches, If you look at the debug output from the latest firmware in ES, for example you will see this: Wildcard search pattern found at offset: 0x000663D6.
If you open the decrypted file with a hex editor and go to that address you will see we find a hex pattern like this:
FF 97 60 7E 40 92 F4 4F 52 A9 FC 8B 40 F9 FD 7B 50 A9 FF C3
We can use a wildcard to find this pattern: FF97......52A9........FFC3
Notice that we can just replace some bytes (a 2 digit hex value) with a period (.), Also notice we want to use a differnet address for our patch: 0x000663D8 - 2 bytes difference.... This is the address we want to patch out and the instruction: 60 7E 40 92 at this address with our ES patch instruction : E0031FAA.
Now while this might seem complex for some to understand, for others it's easy and when I add the database page (not implemented yet), you will be able to update it with new wildcards + patches when they are needed. I might even add a download link where you can can just replace the database with a new one :-). But if ninty block this - you can just add the data manually.
I didn't put wilcards for ES2 patches - as these are superseded now, I only put the ES2 tab in the event ES patches failed, but generally you won't need to use those.
Anyway, for those that like to mess about with hex editors/ida etc, you will understand why this new override feature is pretty good. For the noobs - probably you should stay away from the tab unless you are told what to put in it by someone else more experienced.
the last update is literally right above your post. Or you need the python scripts to use it on <other than Windows>?
@mrdude my windows defender just updated a few minutes ago and it flags the hactool.exe in v1.4...
Just did a manual scan on hactool from 1.3 and it doesn't get flagged.
EDIT: After telling my machine to keep it, a manual flag doesn't complain about anything (and neither the file nor the type are in my exceptions). Weird stuff...
Attachments
Last edited by urherenow,
There's still one there... I linked to it a day or two ago... thought it was weird to be so early on in the thread, then thought maybe the same old post was getting updated. Because... I used it and my nsp stuff is working fine for me, yet I hadn't seen an attachment on any "update" post after that.
https://gbatemp.net/threads/info-on-sha-256-hashes-on-fs-patches.581550/post-9913800
Pg 19.
https://gbatemp.net/threads/info-on-sha-256-hashes-on-fs-patches.581550/post-9913800
Pg 19.
Similar threads
-
- Article
-
-
@
Psionic Roshambo:
Chang you have been warned!!! I will cancel my 20 dollar electronics order next month!!! lol -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
