Layered FS With Updated exefs

Discussion in '3DS - Tutorials' started by gudenau, Oct 28, 2015.

  1. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,258
    1,225
    Jul 7, 2010
    United States
    /dev/random
    If you want to use NTR CFW's LayeredFS plugin with a game that has had it's code updated; like Super Smash Brothers, you will need to extract the exefs from the update. I will explain how this is done.

    Required Tools:

    Step 1: Find game TID
    Goto 3dsdb and search for the name of your game and copy the titleid of it somewhere, for example the TID of the US version of "Super Smash Brothers" is "00040000000EDF00".

    Step 2: Dump ticket.db
    Now we need to dump the tickets from your 3DS, so launch Decrypt9 WIP. Select "EmuNAND" or "SysNAND" options, depending on where the update is installed. The proceed to "File Dump" and select "ticket.db". Then press A, this might take a few moments to complete. When it is done power off your 3DS and copy "Decrypt9/ticket.db" to where you put FunkyCIA2.

    Step 3: Download the update
    Using the TID we found before, in this case "00040000000EDF00"; we need to change it slightly to get the update from FunkyCIA2. To figure out what the TID of the update is we need to replace the first eight digets of the TID to "0004000E", so Smash would be "0004000E000EDF00". Now open a terminal in the directory of FunkyCIA2 and execute "python FunkyCIA2.py ticket.db -title <TITLE ID>", for smash this would be "python FunkyCIA2.py ticket.db -title 0004000E000EDF00". Since the updates can be large this might take a while.

    Step 4: Decrypt the update
    Now that we have the update downloaded, we need to decrypt it. You need to copy the cia to your SD card, so copy the CIA from the CIA folder that FunkyCIA2 creates to "D9Game/". Then launch Decrypt9 again. Select "game Decryptor Options", then "CIA Decryptor (deep)". Again, this might take a while to complete. Now shutdown your 3DS.

    Step 5: Extract exefs
    Now copy the cia to a working directory on your computer. Then open a shell in the work dir and execute "ctrtool --content=content <TID>.cia", for Smash this would be "ctrtool --content=content 0004000e000edf00.cia". Then execute "ctrtool --exefs=exefs.bin <content>", where content is the larger content file, again for Smash this would be "ctrtool --exefs=exefs.bin content.0000.00000012".

    Step 6: Create plugin
    Replace the CTRTool that it has with the one you downloaded. Copy exefs.bin to "workdir" in the layeredFS directory, and open a shell. Execute "ctrtool --decompresscode -t exefs --exefsdir=workdir/exefs workdir/exefs.bin", then execute "python locate.py workdir/exefs/code.bin" and enter the path you want. If you want a sub-directory just separate the directory names with a forward-slash "/". Then press enter to disable language emulation. Execute "cd plugin", then set your PATH to include DevkitARM. On Windows this would be "set PATH=%PATH%;<devkit arm>", on my computer it is "set PATH=%PATH%;D:\devkitPro\devkitARM\bin". Now execute "python build.py", there should be a file called "layeredfs.plg" in the plugin directory.

    Step 7: Install plugin
    Create a directory in the root of your SD card called "plugin", and in there create a directory with the TID of your application, for Smash this is "00040000000EDF00". Copy layeredfs.plg into the directory with the TID. I recommend creating a text document in the plugin directory that lists the TIDs of the applications that you have plugins for.

    Step 8: Profit


    Please note:
    It is legal to share the layeredFS plugins, since they just use the code to find a few pointers in the exefs; this means that they do not use anything that is in the CIA.
     
    Last edited by gudenau, Jan 15, 2016
    Yudowat, tiduscrying, Helmax and 6 others like this.


  2. Ericjwg

    Ericjwg Good

    Member
    2,851
    688
    Jul 2, 2015
    Canada
    nice guide:yay:
     
  3. LoganK93

    LoganK93 GBAtemp Advanced Fan

    Member
    607
    348
    Dec 5, 2012
    United States
    Aha! My waiting was worth it I see! Will be trying this out. Great work!
     
  4. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,258
    1,225
    Jul 7, 2010
    United States
    /dev/random
    All I did was collect some info and modify some instructions.
     
    Ericjwg likes this.
  5. LoganK93

    LoganK93 GBAtemp Advanced Fan

    Member
    607
    348
    Dec 5, 2012
    United States
    Hey, info collection is half the battle.
     
    gudenau and Ericjwg like this.
  6. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,258
    1,225
    Jul 7, 2010
    United States
    /dev/random
    Just need to get my version working. No offset colloction would be needed.
     
  7. LoganK93

    LoganK93 GBAtemp Advanced Fan

    Member
    607
    348
    Dec 5, 2012
    United States
    If I were to use the plugin from the OP, what should the folder containing the replacement files on the SD be named?

    Edit: Guessing just title id?
     
    Last edited by LoganK93, Oct 29, 2015
  8. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,258
    1,225
    Jul 7, 2010
    United States
    /dev/random
    Oops, fsSmash.
     
  9. LoganK93

    LoganK93 GBAtemp Advanced Fan

    Member
    607
    348
    Dec 5, 2012
    United States
    Thanks! Gonna try it out in a sec here.

    Edit: Works!
     
    Last edited by LoganK93, Oct 29, 2015
  10. pokemoner2500

    pokemoner2500 GBAtemp Advanced Fan

    Member
    846
    276
    Aug 14, 2013
    United States
    I guess this answers my PM, thanks!

    EDIT: I used your plugin and the screen doesn't flash green and nothing custom loads. Is it due to the fact that I'm using an o3ds?
     
    Last edited by pokemoner2500, Oct 29, 2015
  11. LoganK93

    LoganK93 GBAtemp Advanced Fan

    Member
    607
    348
    Dec 5, 2012
    United States
    You're using a cfw right?
     
  12. pokemoner2500

    pokemoner2500 GBAtemp Advanced Fan

    Member
    846
    276
    Aug 14, 2013
    United States
    Yep, rxtools and NTR CFW 3.0, I have a layeredfs.plg working with Fire Emblem If so I know it's not NTR or my CFW, and yes my Smash is on 1.1.2, I think it may be due to the fact I'm on an o3ds and it has to reboot but even then I believe it would still flash green.
     
  13. LoganK93

    LoganK93 GBAtemp Advanced Fan

    Member
    607
    348
    Dec 5, 2012
    United States
    Yeah I can't help much there as I have a N3DS. But I'm running the exact same setup (rxtools and then ntr 3.0) are you sure your smash Bros is the same region as the plugin was created for?
     
  14. pokemoner2500

    pokemoner2500 GBAtemp Advanced Fan

    Member
    846
    276
    Aug 14, 2013
    United States
    Yep, my Smash Bros is US (EDF) as I live there.
     
  15. LoganK93

    LoganK93 GBAtemp Advanced Fan

    Member
    607
    348
    Dec 5, 2012
    United States
    Using the plugin from the download or one you made? Also how are your folders set up?
     
  16. pokemoner2500

    pokemoner2500 GBAtemp Advanced Fan

    Member
    846
    276
    Aug 14, 2013
    United States
    My layeredfs.plg is in sd:/plugin/00040000000EDF00, I used the one from the download.
     
    Last edited by pokemoner2500, Oct 29, 2015
  17. LoganK93

    LoganK93 GBAtemp Advanced Fan

    Member
    607
    348
    Dec 5, 2012
    United States
    Hmm... Idk then. Works fine for me.
     
  18. pokemoner2500

    pokemoner2500 GBAtemp Advanced Fan

    Member
    846
    276
    Aug 14, 2013
    United States
    I have a feeling it's due to the fact I'm using an o3ds, I'll see if anyone else has this problem on their o3ds.
     
  19. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,258
    1,225
    Jul 7, 2010
    United States
    /dev/random
    Yah, smash and monter hunter kill NTR CFW on a 3DS as far as I kniw.
     
  20. Ericjwg

    Ericjwg Good

    Member
    2,851
    688
    Jul 2, 2015
    Canada