ROM Hack [Release] 3DS FBI CIA Manager NAND Inject Generator (JPN/USA/EUR/CHN/KOR/TWN)

[LoveKC]

Updating to 9.9 on emunand let me inject fbi. My sysnand is 6.2 and it doesn't stick. Is there any way to fix this? I downgraded from 8.1 to 4.2 with GW Ultra and updated to 6.2 (thinking maybe that would be good enough since 9.9 worked) using a 3ds game cart.

--------------------- MERGED ---------------------------

I should note that I used this tool to inject it into my sysnand, and I tested it by writing it to my emunand and making sure it boots first, but when I try to use GW Ultra to write it to sysNAND I get an error from GW Ultra.


Edit: I wrote the 4.2 with fbi injected as emunand (and it worked fine), then read it with the emunand tool. It came back a bit larger, now I'm restoring it to my sysnand through GW Ultra. Lets see how this goes.

Edit 2: Success.

 

[d0k3]

After seeing how people having problems with FBI injection, I decided to take a look into process to see what can possibly go wrong. Basically, there's two main issues with previous injection methods: the first problem I see is that H&S is an optional app and only gets updated through internet and not card game updates (so even if you running FW9.x there's still possibility your 3DS have old H&S app version). As of now there's 14 different revisions of H&S app and to make things done right you should only use properly encrypted FBI app injected into exactly the same version your 3DS currently using. Second issue that seems to confuse people is TMD file name, it's never constant.

Now, my program designed to resolve both issues. Just drag&drop your original *.tmd file on exe and it generate files specifically for your system.
All regions are supported (JPN/USA/EUR/CHN/KOR/TWN) within 1.0-9.8 firmware range.

Basic instructions on how to inject FBI CIA Manager into Health & Safety SysApp:
1) Make NAND FAT16 XORpad file using rxTools (Decryption Options --> Generate fat16 Xorpad) or Decrypt9
2) Put NAND or emuNAND dump named 'NAND.BIN' and FAT 16 XORpad named 'nand.fat16.xorpad' into folder's root, right next to *.bat files.
3) Launch extract_nand.bat and wait for it to create 'nand_fat16dec.img' file.
4) Download WinImage 9.0, install&launch it, open 'nand_fat16dec.img' and navigate into H&S folder. The path is differs depending on your region:
JPN: title\000400010\00020300\content\
USA: title\000400010\00021300\content\
EUR: title\000400010\00022300\content\
CHN: title\000400010\00026300\content\
KOR: title:000400010\00027300\content\
TWN: title:000400010\00028300\content\

5) Extract *.tmd file using right click command, drag extracted file on '3ds_fbi_injectgen.exe' and you'll get FBI Inject files generated specifically for your system:

Spoiler

6) Inject newly created files using WinImage's Image --> Inject command and overwrite exciting files (no need to delete anything, just overwrite exciting files):

Spoiler

7) Launch 'rebuild_nand.bat' and wait for it to create 'NAND_rebuild.BIN' file.

This is your NAND image with FBI injected. Use your favorite tool to insert emuNAND back into SD card or you can write it into sysNAND (It's a nice thing to have in sysNAND, actually. You can't remove or corrupt it by mistake or after system format, it even launches without SD card inserted and hides when SigPatch disabled. Don't do it unless you're experienced user and know what you're doing, though).

Download links:
http://rghost.net/6pMsvnhFz
https://mega.co.nz/#!01YSiAqb!ApMgqXLkecvNesouuMEGTUWy5VvZsOn_wzxthTG1XiE

I have a (regular, non XL) N3DS v9.0.0.20E, and I don't have the folder called '\\title\000400010\00022300' in my NAND. The other regions folders aren't there as well, of course. Is that normal? :/ Health & Safety is still installed in my SysNAND, I can run it from the home menu.

By the way, any chance we can get the source code?

 

[d0k3]

Alright, I understand. In a N3DS, the Health & Safety app has a different id (20022300 in my case). Also, this tool won't accept my TMD ("Input TMD is not a valid H&S applciation TMD file"). @Riku, any chance you'll add N3DS support? Or, are there any instructions on how to build compatible .tmd / .app ourselves?

EDIT:

New3DS is not (and won't be) supported. Old3DS only.

Okay, I understand. Still, any hint on where to start if we want to generate injection files for N3DS?

 

[MelonGx]

@Riku
bbsniua (a GBAtemp user who can't type English so I report his research instead) found that:
- If a native 4.5.0-10J 3DS has no system update stored inside the NAND, the rxTools enhanced FBI injection reports the TMD version v1024.
- If a native 4.5.0-10J 3DS has downloaded the system update and pops up the upgrading reminder, the rxTools enhanced FBI injection reports the TMD version v2050.
That means, FBI injection's TMD detection can be interfered by the downloaded system update temporary files.
Is it a bug already known?
Will it be fixed in future?

 

[OctopusRift]

@Riku
bbsniua (a GBAtemp user who can't type English so I report his research instead) found that:
- If a native 4.5.0-10J 3DS has no system update stored inside the NAND, the rxTools enhanced FBI injection reports the TMD version v1024.
- If a native 4.5.0-10J 3DS has downloaded the system update and pops up the upgrading reminder, the rxTools enhanced FBI injection reports the TMD version v2050.
That means, FBI injection's TMD detection can be interfered by the downloaded system update temporary files.
Is it a bug already known?
Will it be fixed in future?

That is actually really interesting.

 

[MelonGx]

That is actually really interesting.

Just confirmed it by myself.

1) Make an emuNAND 4.5.0-10J.
2) Go to the rxTools's FBI injection & check emuNAND H&S TMD. It responses v1024.
3) Automatic download the update till the nag pops up.
4) When the automatic download is over, go to the rxTools's FBI injection & check emuNAND H&S TMD again. It responses v2050. Try to install v1024 file and it reports an error.

 

[OctopusRift]

Just confirmed it by myself.

1) Make an emuNAND 4.5.0-10J.
2) Go to the rxTools's FBI injection & check emuNAND H&S TMD. It responses v1024.
3) Automatic download the update till the nag pops up.
4) When the automatic download is over, go to the rxTools's FBI injection & check emuNAND H&S TMD again. It responses v2050. Try to install v1024 file and it reports an error.

AWESOME

 

[MelonGx]

Now it goes like the following:

4.5.0-10J --- (no update nag downloaded) --- H&S TMD is v1024
|
(update nag downloaded)
|
H&S TMD becomes v2050 --- (install v1024 FBI) --- Fail
|
(install v2050 FBI)
|
Succeed but H&S isn't changed
|
(update to 10.2.0-28J)
|
H&S is automatically changed into FBI

 

[mgrev]

Great work! I will try this asap. That's an heavy process but it's way better than nothing

not too heavy actually. it's quite simple, just written very detailed, so no one bricks their 3ds

 

[MelonGx]

http://gbatemp.net/threads/project-injecting-any-app-into-health-and-safety.401697/

Since @d0k3 expands this method to injecting any APP into H&S, we should also notice about the following issue which happens on:
- Gateway DG 4.X
- Update Nag downloaded 4.X
when you're going to make any automatic installation of Non-FBI H&S injection.

4.5.0-10J --- (no update nag downloaded) --- H&S TMD is v1024
|
(update nag downloaded)
|
H&S TMD becomes v2050 --- (install v1024 FBI) --- Fail
|
(install v2050 FBI)
|
Succeed but H&S isn't changed
|
(update to 10.2.0-28J)
|
H&S is automatically changed into FBI

That's to say, if anyone wants to make an automatic installation of Non-FBI H&S injection, he/she should avoid the TMD misjudgment & file recognization on GWDG 4.X / Update Nag DLed 4.X which exists on current FBI injection.

---------------------------------------------

BTW, bbsniua has found out the reason why H&S isn't changed after installed v2050 FBI into GWDG 4.X / Update Nag DLed 4.X.

- When v2050 FBI installed into GWDG 4.X / Update Nag DLed 4.X NAND, it became 00000002.app & 00000002.tmd.
- It doesn't replace the existed H&S - 00000001.app & 00000001.tmd.
- 4.X only recognize 00000001.app & 00000001.tmd. That's why H&S isn't changed.

 

[fischman]

Download is down.

 

[fischman]

Unfortunately get the message "Input XOR pad file is not valid".
What is wrong?

 

[foxtrot08]

Can someone re upload. Link is down

 

[fischman]

Have now found out with the help why me "Input XOR pad file is not valid" is always displayed.

Namely, it is necessary to extract the RXTools the EMUNAND.
And this then rename in NAND.BIN.

By NAND.BIN of Gatway it does not.

 

[vhaines]

can i use this to inject secure info_A on my nand and do a region change?

 

[huuug]

reup please.

 

[Sam_SpadeR]

Guys, I have a question here: I have been done everything and now I have the Nand rebuild bin file. How can I write into my sysnand?

 

[PaiiNSteven]

The .rar wont let me extract to my desktop? It says that the .exe is broken.

 

[amaru007]

Guys, I have a question here: I have been done everything and now I have the Nand rebuild bin file. How can I write into my sysnand?

Same. Injected it into my emuNAND and it worked great.
Tried to write it via Gateway, but keep getting >> NAND.BIN ERROR message.

 

[Fawfulthegreat]

extract_nand.bat doesn't exist... In fact searching my SD card for .bat files yields no results.