1. SliverSrufer

    SliverSrufer Member
    Newcomer

    Joined:
    Jun 18, 2018
    Messages:
    40
    Country:
    United States
    I've managed to dump the game and patch it. Here is what I did.
    First you need to get the keys to dump everything, so just follow this guide how-to-get-switch-keys-for-hactool-xci-decrypting
    1. dumping the game from sd (skip this if you dump it from nand) I don't have a sd card reader on my pc but I was able to get around that.
    Now you need to get the sdseed key.
    Download a hex editor I downloaded HxD
    Download hacdiskmount if you haven't already.
    Download memloader.
    Download tegrarcmsmash
    Extract memloader files to the tegrarcmsmash folder.
    Put switch in RCM mode and in cmd cd to the tegrarcmsmash folder and run TegraRcmSmash.exe memloader.bin --dataini=ums_emmc.ini
    Run and open hacdiskmount. Open physical drive - linux ums
    Double click on the system partition and a new window will pop up. Enter the BIS keys it asks for. Hit save system.bin and save it to your PC. (this will take 15 mins).
    Turn off the switch and boot it back into RCM and run in cmd TegraRcmSmash.exe memloader.bin --dataini=ums_sd.ini
    Windows should pop up with a external usb drive and you can browse the sd card on the switch from explorer. Browse to /nintendo/contents/ and copy the private file to your computer.
    Open the hex editor and open the private file in it. Highlight and copy all the bytes in the file.
    Open the system.bin file you dumped earlier in the hex editor and do a search->find and in the find window click on the hex values tab and paste the bytes you copied before into the search and hit ok.
    It will find the values you pasted and the line of hex below that is your sdseed, so highlight and copy that and paste it into a text file and save it somewhere.
    Go back to the sd card on the switch and go to /nintendo/contents/registered folder and look for a folder with a file in it with a size of 1.7gb named f5983d8f4951458e8f1413be7579e3f9.nca mine was 000000CB.
    Edit: sorry I forgot to mention copy f5983d8f4951458e8f1413be7579e3f9.nca to your hactool folder. It will take about 10 mins.
    In the cmd prompt cd to the folder with hactool.
    Run this command hactool -t nax0 -k keys.ini --sdseed=your sd key here --sdpath=/registered/000000CB/f5983d8f4951458e8f1413be7579e3f9.nca f5983d8f4951458e8f1413be7579e3f9.nca --plaintext=out.nca

    2. Now you need to get the titlekey for the game.
    Search for and download get_ticketbins.py and get_titlekeys.py and release-python-script-to-generate-the-rsa_kek.
    Download and install python 2.7 if you havent already.
    In cmd prompt run pip install asn1
    next run py -2 -m pip install pycrypto
    Follow the guide on how to generate the rsa-kek, once you have that key right click on get_titlekeys.py and hit edit and find the line where it says rsa_kek=('XXXXXXXXX'), and replace the X's with the rsa-kek.
    Now you need prodinfo.bin and 80000000000000e2 file.
    Now you need to boot your switch back into rcm mode and load TegraRcmSmash.exe memloader.bin --dataini=ums_emmc.ini
    Open up hacdiskmount and double click on prodinfo enter the keys it asks for and click save prodinfo.bin put it in your hactool folder.
    Now double click on system. Enter the BIS keys it asks for. install driver for mounting. check read only. click mount.
    Browse the new drive in windows and under the save folder copy 80000000000000e2 to your hactool dir.
    In cmd cd to your hactool folder.
    run py -2 get_ticketbins.py 80000000000000e2 it should dump a personal_ticketsblob.bin
    now run py -2 get_titlekeys.py PRODINFO.bin personal_ticketblob.bin it will display some titleid's and title keys that go along with them. The titlekey we want is under the 010096000b3ea000 titleid. Copy that key.
    now run hactool -k keys.ini --titlekey=titlekeyyoujustcopied out.nca --exefsdir=C:\temp\decrypted\ make sure you have a c:\temp\decrypted folder (or change it to what you want).
    Now download nso2elf and elf2nso.
    run nso2elf C:\temp\decrypted\main it should put out a main.elf in the same dir.
    open the hex editor and open the main.elf file.
    go to search and goto... and enter 8F9D0
    It will jump to that location it should look like 08 00 00 12 change it to this 08 00 80 52
    hit save.
    in cmd run elf2nso C:\temp\decrypted\main.elf C:\temp\decrypted\main2
    Either delete the original main or rename it to something else and rename main2 to main.
    reboot switch to rcm mode and run TegraRcmSmash.exe memloader.bin --dataini=ums_sd.ini to mount the sd card in windows.
    copy main to \atmosphere\titles\010096000B3EA000\exefs\ on the sd drive. (create the folders if they don't exist).

    I haven't tested if this actually works yet but I'll let you know in a few hours. I might need layeredfs.

    I forgot if you get a lot of errors installing pycrypto google Microsoft Visual C++ Compiler for Python 2.7 and install that.
     
    Last edited: Jun 18, 2018
    gnilwob, shchmue, Skyer and 4 others like this.
  2. SleepyPrince

    SleepyPrince GBAtemp Regular
    Member

    Joined:
    Aug 9, 2007
    Messages:
    270
    Country:
    Hong Kong
    For anyone who don't want to mess with the main file
    you can edit your play time in the save file, look for the string PlaySecond and +24h

    Hope the EdiZon save editing feature will come soon so we can edit the save file directly
     
    Last edited: Jun 18, 2018
    mangotowel likes this.
  3. SovietKitKat

    SovietKitKat Newbie
    Newcomer

    Joined:
    Apr 29, 2017
    Messages:
    4
    Country:
    United States
    I've followed along to this point, but I keep getting the error "Input path appears to be neither a NAX0, nor a NAX0 directory".
    I'm using my sd seed and the location of the game for me was identical to yours. Here's the command I'm running:
    hactool -t nax0 -k keys.ini --sdseed=[REDACTED] --sdpath=/registered/000000CB/f5983d8f4951458e8f1413be7579e3f9.nca f5983d8f4951458e8f1413be7579e3f9.nca --plaintext=out.nca
     
  4. SliverSrufer

    SliverSrufer Member
    Newcomer

    Joined:
    Jun 18, 2018
    Messages:
    40
    Country:
    United States
    Did you download the demo directly to your nand or to your sd? try running hactool -k keys.ini f5983d8f4951458e8f1413be7579e3f9.nca
    and see what it says. make sure the nca folder is in the same dir as hactool.
    Also I found there is a script to get the rsa kek for use in the get_titlekeys.py. just search for:
    release-python-script-to-generate-the-rsa_kek


    Edit: I updated the guide I forgot to write out to copy the nca folder to your hactool folder.
     
    Last edited: Jun 18, 2018
  5. ken28

    ken28 GBAtemp Maniac
    Member

    Joined:
    Oct 21, 2010
    Messages:
    1,136
    Country:
    Germany
    is there a more straight on guide yet?
     
  6. SovietKitKat

    SovietKitKat Newbie
    Newcomer

    Joined:
    Apr 29, 2017
    Messages:
    4
    Country:
    United States
    The demo is on my SD card.
    Running this I get a permission denied error. Running it with the /00 at the end of the filename gets me the error: "Invalid NCA header! Are keys correct?"
    Again running it with -t nax0 and my sd seed I get: Error: NAX0 key derivation failed. Check SD card seed and relative path?
     
  7. SliverSrufer

    SliverSrufer Member
    Newcomer

    Joined:
    Jun 18, 2018
    Messages:
    40
    Country:
    United States
    try hactool -t nax0 -k keys.ini --sdseed=[REDACTED] --sdpath=/registered/000000CB/f5983d8f4951458e8f1413be7579e3f9.nca f5983d8f4951458e8f1413be7579e3f9.nca\00 --plaintext=out.nca

    you could also try using an absolute path to the nca file on your pc. Assuming you have the file located at C:\temp\hactool\. hactool -t nax0 -k keys.ini --sdseed=[REDACTED] --sdpath=/registered/000000CB/f5983d8f4951458e8f1413be7579e3f9.nca C:\temp\hactool\f5983d8f4951458e8f1413be7579e3f9.nca --plaintext=out.nca
     
  8. crediar

    crediar Possiblenator
    Member

    Joined:
    Mar 5, 2006
    Messages:
    342
    Country:
    Antarctica
    I got everything decrypted and extracted successfully but I can't find nso2elf anywhere, the only thing I found was nso.py which only decompresses the sections.
     
  9. SliverSrufer

    SliverSrufer Member
    Newcomer

    Joined:
    Jun 18, 2018
    Messages:
    40
    Country:
    United States
    I found a zip file on this forum with both nso2elf and elf2nso in this thread sxpd-switch-executable-patch-delta-a-new-file-format-for-exe-patching-a-patch-utility. nso_elf_tools.zip is in the thread.
     
    Last edited: Jun 18, 2018
  10. ken28

    ken28 GBAtemp Maniac
    Member

    Joined:
    Oct 21, 2010
    Messages:
    1,136
    Country:
    Germany
    i get
    Error: section 0 is corrupted!

    Error: section 1 is corrupted
     
  11. SliverSrufer

    SliverSrufer Member
    Newcomer

    Joined:
    Jun 18, 2018
    Messages:
    40
    Country:
    United States
    Make sure you are using the right titlekey when you do hactool -k keys.ini --titlekey=titlekeyyoujustcopied out.nca --exefsdir=C:\temp\decrypted\

    Also check your keys.ini to see if you have master keys 1 through 4. I think that script to dump the keys has a bug and doesn’t get all the master keys. There is an updated script floating around I will have to find out where to get it. I don’t have access to my pc or I would post it.
     
    Last edited: Jun 19, 2018
  12. crediar

    crediar Possiblenator
    Member

    Joined:
    Mar 5, 2006
    Messages:
    342
    Country:
    Antarctica
    thanks, with those tools I got it working.
    I am at six hours now :D
     
    cearp and SliverSrufer like this.
  13. mangotowel

    mangotowel Advanced Member
    Newcomer

    Joined:
    Jun 3, 2016
    Messages:
    63
    Country:
    United States
    Thanks! Here are pictures for others.

    https://imgur.com/a/pPR2GOE

    https://imgur.com/a/6SHmC18






    [​IMG]

    [​IMG]Edit: couldn't get imgur to work on here
     
    Last edited: Jun 19, 2018
    Kupie, Esagi, reyouben and 1 other person like this.
  14. ken28

    ken28 GBAtemp Maniac
    Member

    Joined:
    Oct 21, 2010
    Messages:
    1,136
    Country:
    Germany
    seems liek only 0 and 4 are in it
     
  15. SliverSrufer

    SliverSrufer Member
    Newcomer

    Joined:
    Jun 18, 2018
    Messages:
    40
    Country:
    United States
    Try dumping the keys again with this updated script. Or you can search google for the other master keys. Rename the file to a .py
     

    Attached Files:

  16. SovietKitKat

    SovietKitKat Newbie
    Newcomer

    Joined:
    Apr 29, 2017
    Messages:
    4
    Country:
    United States
    Got it to work last night. Switched to a different computer and it worked perfectly. I assume it was something with my keys file messed up.
    EDIT: I also had trouble with the nx2elf program as it kept asking for VS C++ 2015 debug dlls, so I had to compile my own version.
     
    Last edited: Jun 19, 2018
    SliverSrufer likes this.
  17. ken28

    ken28 GBAtemp Maniac
    Member

    Joined:
    Oct 21, 2010
    Messages:
    1,136
    Country:
    Germany
    now i cant find the hex value needed here:

    It will jump to that location it should look like 08 00 00 12 change it to this 08 00 80 52
     
  18. SliverSrufer

    SliverSrufer Member
    Newcomer

    Joined:
    Jun 18, 2018
    Messages:
    40
    Country:
    United States
    Were you able to convert the file to a .elf with nso2elf.exe?
     
  19. godsephiroth91

    Newcomer

    Joined:
    Jun 19, 2018
    Messages:
    4
    Country:
    Italy
    Hi guys...I'm thinking to homebrew my switch only for this patch but I don't really understand what I have to do. I only want to change the hour time. could someone do a step by step guide frome the first step? really a noob here. thanks a lot.
     
  20. reyouben

    reyouben Newbie
    Newcomer

    Joined:
    May 16, 2018
    Messages:
    1
    Country:
    United States
    followed the pictures that mangotowel posted and used HxD to edit the save file. works perfectly.
     
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - Traveler, Octopath, Prologue