1. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    I will show you how to patch a CIA's executable, this will allow you to do things like install SaltySD without NTR.

    Requirements:
    • Ctrtool (in tools.zip)
    • 3dstool (Also in tools.zip)
    • makerom (guess where?)
    • Hex editor
    • CIA you want to patch
    • CFW
    • Decrypt9WIP

    Step 1: Decrypt the CIA
    You may skip this if your CIA is decrypted already!

    Copy your the CIA that you want to decrypt into D9game on the root of your SD card.
    [​IMG]

    Then go into Decrypt9, Game Decryptor Options->CIA Decrypter (deep) and wait.
    [​IMG]
    [​IMG]

    Now copy that back to your PC, it is now decrypted!

    Step 2: Extract the CIA
    Execute "ctrtool --contents=contents [CIA].cia", with [CIA].cia replaced with the proper file.
    [​IMG]

    Take note of the content file names, this will be important while remaking the CIA.

    Next we need to extract the primary content file, this should be called contents.0000.XXXXXXXX, like the Smash 1.1.5 update it is called contents.0000.00000014. Execute "3dstool -xvtf cxi [CONTENTS] --header ncch.header --exh exheader.bin --exefs exefs.bin --romfs romfs.bin --plain plain.bin" with [CONTENTS] replaced with the contents file. This should generate a warning about "logoregion", it is safe to ignore this.
    [​IMG]

    Next we need to extract the exefs, execute "3dstool -xvtf exefs exefs.bin --exefs-dir exefs --header exefs.header".
    [​IMG]

    The final extraction step is to decompress the code, execute "3dstool -uvf exefs/code.bin --compress-type blz --compress-out code-orig.bin"
    [​IMG]

    Step 3: Modify the code
    Copy the code-orig.bin file wherever you need it, modify it, and copy it back as
    code-patched.bin.

    Step 4: Repack the CIA
    First we need to compress the modified code, execute "3dstool -zvf code-patched.bin --compress-type blz --compress-out exefs/code.bin"
    [​IMG]

    Then we need to create the exefs. Execute "3dstool -cvtf exefs exefs2.bin --exefs-dir exefs --header exefs.header"
    [​IMG]

    We need to make the modified CXI, execute "3dstool -cvtf cxi patched.cxi --header ncch.header --exh exheader.bin --exefs exefs2.bin --romfs romfs.bin --plain plain.bin"
    [​IMG]

    Finally we need to create the CIA file, this is where the name of the content files is needed. Execute "makerom -f cia -o [PATCHED].cia -content patched.cxi:0" with all the content files appended to it with "-content contents.xxxx.yyyyyyyy:x" EXCEPT for contents.0000.yyyyyyyy. For my SaltySD patch it would be "makerom -f cia -o SmashUpdate.NaCl.decrypted.cia -content patched.cxi:0 -content contents.0001.0000000f:1"

    Step 5: Fix Versions (optional, but recommended)
    Open the decrypted CIA in a hex editor, and locate the two bytes at offset 0x00002F9C and copy those.
    [​IMG]
    Copy that to the modified CIA at 0x00002F9C.
    [​IMG]

    Step 6: Encrypt The CIA
    Now that the cia has been modified, we need to encrypt it; some things will break if the CIA is not encrypted. Copy the modified CIA to D9game again, launch Decrypt9WIP and goto Game Decryptor Options->CIA Encryptor (NCCH) and wait.
    [​IMG]
    [​IMG]

    Step 7: Profit
    [​IMG]

    If someone has a capture device, I would love some screenshots of D9!
     

    Attached Files:

    Last edited by gudenau, Mar 24, 2016
  2. TR_mahmutpek

    TR_mahmutpek medic
    Member

    Joined:
    Jul 28, 2015
    Messages:
    1,321
    Country:
    Turkey
    Thanks :)
     
  3. lonzodavis

    lonzodavis GBAtemp Regular
    Member

    Joined:
    Aug 24, 2015
    Messages:
    101
    Country:
    United States
    Could this work to add music to a smash update.cia?
     
    Last edited by lonzodavis, Mar 26, 2016
  4. Mazamin

    Mazamin GBAtemp Advanced Maniac
    Member

    Joined:
    Sep 4, 2014
    Messages:
    1,862
    Country:
    Italy
    Will it work for ctgp-7?
     
  5. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    Does it change the ROMFS? If so, then no.
     
  6. Mazamin

    Mazamin GBAtemp Advanced Maniac
    Member

    Joined:
    Sep 4, 2014
    Messages:
    1,862
    Country:
    Italy
    Well, it needs layered fs so I think it will not work.
     
  7. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    Yeah, I will try to make a layeredFS patcher for this method later. It will not work at the moment. :-(
     
    Mazamin likes this.
  8. Lycanroc

    Lycanroc Woof
    Member

    Joined:
    May 11, 2014
    Messages:
    2,097
    Country:
    Germany
    I legit snorted at the screenshot
     
    Last edited by Lycanroc, Mar 24, 2016
  9. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    Thanks!
     
    Lycanroc likes this.
  10. Yudowat

    Yudowat That one guy that shows up occasionally
    Member

    Joined:
    Jun 12, 2015
    Messages:
    552
    Country:
    Australia
    Anybody else getting
    Code:
    [CIA ERROR] Content 0 Is Corrupt (res = -11)
    [RESULT] Failed to build CIA
    when trying to build the CIA at the end of step 4? I get it every single time I try to build a EUR SaltySD and its driving me insane
     
    Last edited by Yudowat, Mar 24, 2016
  11. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    EUR update BTW. I used the US update.
     
    Yudowat likes this.
  12. Red9419

    Red9419 GBAtemp Advanced Fan
    Member

    Joined:
    Apr 17, 2014
    Messages:
    526
    Country:
    Where exactly do i get code-orig.bin? The only file closest to it is code.bin in the exefs folder. On a side note how would i modify it? Hex editor or any dedicated programs?
     
  13. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    When you decompress the code, it will make that file in the working directory.
     
  14. Red9419

    Red9419 GBAtemp Advanced Fan
    Member

    Joined:
    Apr 17, 2014
    Messages:
    526
    Country:
    I extracted the files. Hmm does it matter if im on update 1.1.4?
     
  15. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    Did you execute "3dstool -uvf exefs/code.bin --compress-type blz --compress-out code-orig.bin"?
     
  16. Red9419

    Red9419 GBAtemp Advanced Fan
    Member

    Joined:
    Apr 17, 2014
    Messages:
    526
    Country:
    Yes. It takes about 2 seconds to input a new command afterwards so im certain it went through, but im not seeing any output.
    Edit: I will restart the whole process and see if it fixes anything.

    — Posts automatically merged - Please don't double post! —

    I re-extracted everything and it seems like i got it now. How would i edit this file now?
    EDIT: Just opened it up in a hex editor. Do i just swap out a characters name hex code with the modified hex?
     
    Last edited by Red9419, Mar 28, 2016
  17. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    No idea, depends on the game.
     
  18. Red9419

    Red9419 GBAtemp Advanced Fan
    Member

    Joined:
    Apr 17, 2014
    Messages:
    526
    Country:
    Smash bros. I would like to change the result screen similar to your screenshot
     
  19. gudenau

    OP gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,585
    Country:
    United States
    Ah, you need SaltySD and MSBT Editor Reloaded, edit ui/message/melee.msbt
     
  20. Red9419

    Red9419 GBAtemp Advanced Fan
    Member

    Joined:
    Apr 17, 2014
    Messages:
    526
    Country:
    Since this is repacking the CIA would the loading times be fixed? I had SaltySD before and tbe loading times were so awful for just some image modifications
     
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - Executable, Patching,