ROM Hack [Release] 3DS_CTR_Decryptor-VOiD

[ground]

Isnt it possible to decrypt the nand and reencrypt it partitally and then spoof the nintendo server? If an uodate is downloaded from the server it isnt encrypted yet with console specefic keys, so it has to happen inside the 3ds right after it? ( just speculation, i need to check this for sure, but i dont have the abilities to do so now)

 

[Sabi996]

K so i have a little problem. I got to extract the pokemon models just fine, but i don't know the command line for the textures. Can anyone write an example?

 

[gamesquest1]

anyone figured out any more about the IVFC hash, the first one is easy, but then i cant figure out how level 1 & 2 work.......hmmm back to staring at Chinese i think

anyways see on here the first hash works perfectly, go to 0x1e0f000, select block size 1000, sha256 of that area is the first hash which is stored at 0x60......

EDIT: ok the other ones are that simple too....but it seems the actual content is individually hashed aswell or something, as even content not covered by these hash's still breaks these hashes (im sure at some point i will understand it )......unless im missing yet another something

 

[PewnyPL]

K so i have a little problem. I got to extract the pokemon models just fine, but i don't know the command line for the textures. Can anyone write an example?

For python:
bch2png.py dec_NO.bin

For go:
go run bch2png.go dec_NO.bin

Also, the texture for a model is in a file with a number higher by 2 and 3 (normal and shiny respectively).
So, for Bulbasaur, his model is in dec_4.bin, while his textures are in dec_6.bin and dec_7.bin

 

[Mikecrowfone]

Not exactly. First you generate (on a PC) a key in ncchinfo.bin. Then, CTR decryptor uses it AND the 3DS's AES engine to generate a xorpad.
So, without a key, you won't be able to do anything with CTR tool.

Ok. So let me see if I'm understanding you correctly. The key is in ncchinfo.bin. CTR decrypted uses the 3DS's AES engine to decrypt the rom using this per-generated key. Hence, only if we are able to generate a key for NAND will we be able to decrypt using this method?

 

[PewnyPL]

Ok. So let me see if I'm understanding you correctly. The key is in ncchinfo.bin. CTR decrypted uses the 3DS's AES engine to decrypt the rom using this per-generated key. Hence, only if we are able to generate a key for NAND will we be able to decrypt using this method?

Pretty much. However, it's easy to generate a key for the games, as each game uses it's own key and the console has to extract it. But for the NAND it is hard, as the same method won't work (no need to hide the key anywhere in the ROM, as NAND is only for one specific console) due to the keys not being stored anywhere easy to access.

 

[gamesquest1]

Ok. So let me see if I'm understanding you correctly. The key is in ncchinfo.bin. CTR decrypted uses the 3DS's AES engine to decrypt the rom using this per-generated key. Hence, only if we are able to generate a key for NAND will we be able to decrypt using this method?

carts all need to be decrypted by any console, so its kinda obvious they are using a method that would work whatever console the cart is inserted into

but in the case of the nand they are designed to only be decrypted by the console they came from, iirc they use a console specific key for their encryption

 

[Mikecrowfone]

Pretty much. However, it's easy to generate a key for the games, as each game uses it's own key and the console has to extract it. But for the NAND it is hard, as the same method won't work (no need to hide the key anywhere in the ROM, as NAND is only for one specific console) due to the keys not being stored anywhere easy to access.

carts all need to be decrypted by any console, so its kinda obvious they are using a method that would work whatever console the cart is inserted into
but in the case of the nand they are designed to only be decrypted by the console they came from, iirc they use a console specific key for their encryption

I see. For games, the keys are easily accessibly by the 3DS so that its AES engine can decrypt. Whereas for NAND, the key is not located in the dump? If so where would the key be located?

 

[hippy dave]

In the console. You're not going to be able to encrypt a nand for one console using another console, because it can't get the right keys.

 

[Huntereb]

SciresM Have you looked into items in the game files? Would love to see what the Power Plant event and such is (Ya know, those doors that say you need a card key). My guess is that those are the places you will legitimately obtain Volcanion --- or more.

 

[Kaphotics]

SciresM Have you looked into items in the game files? Would love to see what the Power Plant event and such is (Ya know, those doors that say you need a card key). My guess is that those are the places you will legitimately obtain Volcanion --- or more.

There is nothing; SciresM has had the decrypted files for months.

 

[WannyTiggah]

The only way to check would be using a "walk through walls" code or something. Whenever that would be possible.

 

[Kaphotics]

The only way to check would be using a "walk through walls" code or something. Whenever that would be possible.

No. If there's no text, there is no event. We can check models and map info, and there is nothing. Plus you can't walk through walls to bypass a script warp.

There is no secret event at the power plant, or anywhere else. We would know by now.

 

[ground]

how can i obtain or create .rsf files?

 

[gamesquest1]

the most likely options are either
A. it was planned to be in the game but was cut and they left the door
B.its just a suspicious door with no meaning
or
C. they planned a special event that would work somewhat like DLC and the content wont be there until a patch is released

 

[WannyTiggah]

Wait, which door (single) are you guys talking about? I thought we were talking about the doors (plural) of the closed power plants...

 

[supermalloch]

So I've successfully unpacked and edited some files in Pokemon X. Does anyone know about repacking the GARC files after editing them? Or can I rebuild the romfs without repacking? Kaphotics tools seem to have the ability according to the github, but I have yet it make it work.

Useful tools:
Encounter modifier
Trainer and Pokemon modifier
Garc Unpacker
Github for Garc unpacker

 

[Relys]

cell9 wrote some nice tools to redirect RomFS to the SD card by modifying ExeFS.

https://github.com/44670/patchrom

 

[Huntereb]

There is nothing; SciresM has had the decrypted files for months.

Damn, that sucks. I guess we'll get that stuff in game updates.

But does that pertain to areas as well? No inaccessible locations? If someone were to "walk-through-walls" cheat passed the door, nothing would happen?

 

[Mystie]

I think I may have a problem here.

I'm trying to make an XORPAD of Sonic Lost World, because RTB from The VG Resource really wants to get the models from that game. I made an ncchinfo.bin file out of the ROM, then copied said file (and the Gateway Launcher.dat) onto my SD card. Once I went to DS Profile, the decryptor interface appeared, but it's been stuck at the "Reading info..." part for more than ten minutes now.

Did I do something wrong, or is it supposed to take an extremely long time?