ROM Hack [Release] 3DS_CTR_Decryptor-VOiD

[Huntereb]

So I decided to try to edit shit by hand, and i got all the romfs hashes good, and rexored it with the original xorpad and then injected it into the encrypted rom. I then fixed the super hash block at 0x11E0.. it still boots to a black screen,, what am i missing?

Yeah, that's what I've done as well. Always black screen.

 

[gamesquest1]

well i let makeromfs handle the hashes for me cuz im lazy, and i checked it with ctrtool.. but i did the super hash by hand

yeah i havent been able to use a makerom built romfs with anything other than the VC games, using the original romfs work fine, but its a fairly pointless exercise, th only way i got the pokemon mod to work was by using the original romfs and manually editing the files i wanted to mod and injecting them back into the romfs, then recalculating the IVFC hashes and xor'ing..........i wish makerom would just let us rebuild the romfs into working order on more than just smaller games, would be so much simpler for making mods and stuff

 

[st4rk]

Maybe one day that might come soon to, to decrypt the .cmd .app .tmd .sav files .

Put the flashcard out of business

Also found some think strange with dbs folder import.db / title.db . the demo games where a mess order after delete some missing slots - extracted these files onto my hard drive and Deleted ones of SD card , place the SD card back into the 3DS , No games there, Replace them files back into it folder on SD card, Put SD card back into the 3DS , Game are back but in neat order... But present wrapped once again . - Anyway found a nice way to clean the order up .

With all current public information SD Decrypt is easy, belive me

 

[drwhojan]

With all current public information SD Decrypt is easy, belive me

!lol maybe.

As you know each 3ds to it's own encryption upon downloading , even if formatted memory of 3ds yet new encryption upon download.

meaning no two same game downloaded files are same in hex matching , HexCmp best for viewing this to me.

It would be a long.... time if ever cracked .

 

[st4rk]

!lol maybe.

As you know each 3ds to it's own encryption upon downloading , even if formatted memory of 3ds yet new encryption upon download.

meaning no two same game downloaded files are same in hex matching , HexCmp best for viewing this to me.

It would be a long.... time if ever cracked .

It's the Unique-Key if i am not mistaken , i decrypted the SD Files in one day of work, use 3dbrew is a good source of knowledge.

 

[Apache Thunder]

I believe content downloaded/saved on SD card are encrypted using the private key unique to each 3DS. Unless you managed to hardmod/decapp the 3DS to find it out (and somehow keep the unit in working order), you will never see a program able to decrypt this content unless a future exploit is released that could somehow exploit the boot-loader. I highly doubt this will ever happen during this console's expected lifespan on the market.

EDIT: Posted before I can see the above user's work.

Not too surprising that there's a method out that isn't released. The 3DS is the king of vapor ware in terms of exploits and homebrew.

 

[gamesquest1]

I believe content downloaded/saved on SD card are encrypted using the private key unique to each 3DS. Unless you managed to hardmod/decapp the 3DS to find it out (and somehow keep the unit in working order), you will never see a program able to decrypt this content unless a future exploit is released that could somehow exploit the boot-loader. I highly doubt this will ever happen during this console's expected lifespan on the market.

its device specific.....so its in the device, as i understand it, this program decrypts with one key......you could decrypt the SD contents by using the device specific key instead, as st4rk said for anyone looking into it, 3dbrew has info on all the keyslots etc, i doubt it would be much harder than decrypting the roms

 

[Apache Thunder]

So it's possible to get the 3DS to decrypt it for you, but I still believe you never actually find out the key yourself. That still requires destroying the unit by decapping it.

 

[drwhojan]

Thanks both ^^ , yes I know the site half of the file links are removed are missing now sadly , But I'm not good at compiling the source code of any they have .

"I believe content downloaded/saved on SD card are encrypted using the private key unique to each 3DS"

That's what I meant log tearm, you rounded it up in one xd.

 

[gamesquest1]

So it's possible to get the 3DS to decrypt it for you, but I still believe you never actually find out the key yourself. That still requires destroying the unit by decapping it.

same as decrypting roms....this "key" isnt THE decryption key, its the "raw" key.....it still has to go through the 3DS to be usable

 

[Apache Thunder]

I suppose this also means that if you had the know how, you could use this key to decrypt/re-encrypt the system nand? I assume that also uses the same key. Unless it's different. I don't see why it isn't though. Being able to use the private key would allow for a CFW theoretically.

 

[gamesquest1]

I suppose this also means that if you had the know how, you could use this key to decrypt/re-encrypt the system nand? I assume that also uses the same key. Unless it's different. I don't see why it isn't though. Being able to use the private key would allow for a CFW theoretically.

decrypting/re-encrypting is different than signing....you couldnt mod the sysnand or it wouldnt boot....you might be able to do certain stuff that wouldnt effect the signatures, but CFW nope, booting into a CFW via the same exploit as gateway yeah

 

[Apache Thunder]

Does the leaked keys also allow decrypting of save games of Pokémon X/Y and similar games? I'm not talking about ones that were played on Gateway as that card fudges with the save encryption system to make them work on a 4.5 console. Datel has been able to decrypt-reencrypt save files as well as the more recent cyber gadget device. It would be nice to be able to do save edits without buying a $100+ device.

Would probably still need a 4.5 console to do it though as obviously there isn't a exploit out right now that would allow doing this from a 9.x console.

 

[gamesquest1]

Does the leaked keys also allow decrypting of save games of Pokémon X/Y and similar games? I'm not talking about ones that were played on Gateway as that card fudges with the save encryption system to make them work on a 4.5 console. Datel has been able to decrypt-reencrypt save files as well as the more recent cyber gadget device. It would be nice to be able to do save edits without buying a $100+ device.

Would probably still need a 4.5 console to do it though as obviously there isn't a exploit out right now that would allow doing this from a 9.x console.

nope leaked keys are for 7.x rom decryption, what you would need is the 6.x save decryption keys.....still lost in the wilderness without a home afaik, until gateway add support for proper 6.x save decryption i doubt these keys will be known except for the datel and powersaves guys, once gateway has them someone will hack them out of the gateway FW and whether the public see anything from it would be a separate matter, but i imagine once gateway has them they will add some sort of save editor while they are there

 

[drwhojan]

!lol by commenting by someone, I turned a mole hill into a volcano .

Now it's beyond me, It's not that simple I agree .

I'll leave you guy's to it

Cheers all.

All best to what you guy's come up with in future .

So it's possible to get the 3DS to decrypt it for you, but I still believe you never actually find out the key yourself. That still requires destroying the unit by decapping it.

Kind of like decapping some think inside the 3DS system, so files/demos can be downloaded in Raw/decrypted format to an SD card ....

 

[gtaking112]

yeah i havent been able to use a makerom built romfs with anything other than the VC games, using the original romfs work fine, but its a fairly pointless exercise, th only way i got the pokemon mod to work was by using the original romfs and manually editing the files i wanted to mod and injecting them back into the romfs, then recalculating the IVFC hashes and xor'ing..........i wish makerom would just let us rebuild the romfs into working order on more than just smaller games, would be so much simpler for making mods and stuff

I tried giving this a try myself, basically I opened up the file that contains the encounter tables in X and Y and modified it. I then opened this file in a hex editor and pasted the modified hex directly into the corresponding offsets in the decrypted romfs. I then rebuilt the ROM using the edited romfs and while the game boots, as soon as I make it to route 1 (where I modified the encounters) I encounter a black screen. Is this the part where I need to recalculate the hashes of the romfs? If so, how would I go about doing that?

 

[Huntereb]

Welp, finally some progress. Most of the tutoring I got was for nothing, though. Still, very educational!

Spoiler: Images

 

[gamesquest1]

I tried giving this a try myself, basically I opened up the file that contains the encounter tables in X and Y and modified it. I then opened this file in a hex editor and pasted the modified hex directly into the corresponding offsets in the decrypted romfs. I then rebuilt the ROM using the edited romfs and while the game boots, as soon as I make it to route 1 (where I modified the encounters) I encounter a black screen. Is this the part where I need to recalculate the hashes of the romfs? If so, how would I go about doing that?

make sure you didn't leave any spaces on the encounter table, if its booting up you have done it all correctly, but just for the record, there is methods now for repacking the romfs and everything still working.....im sure it will be shared pretty soon with everyone, finally glad to not have to mess about with hashes and stuff

 

[Huntereb]

The tool can't be shared here because it contains parts of the Nintendo SDK. PM me, though. I like conversations.

 

[Huntereb]

This works with any game, and the romfs can be any size. Here's an example: Mario Kart 7. I replaced DK's model with Metal Mario's (Who I haven't unlocked yet). I also created a backup folder in the character models directory to store DK's real models for later. That also got packed into the romfs, but it isn't being used for anything.