Hacking [Release] 3DSFAT16tool - dump/inject the fat16 partition from nand dumps

[cearp]

http://3dbrew.org/wiki/Flash_Filesystem#NAND_structure

 

[Codename]

http://3dbrew.org/wiki/Flash_Filesystem#NAND_structure

Thank you. I'm sorry to ask a newbish question, but how can I xor my fat16? Where/how can I get my (console-specific I'm assuming) xorpad?

 

[mvmiranda]

Does this look like a "valid" XORed FAT16?

When I try to open the 0.fat file I get this error:

 

[lemanuel]

Thank you. I'm sorry to ask a newbish question, but how can I xor my fat16? Where/how can I get my (console-specific I'm assuming) xorpad?

this might help https://github.com/Relys/3DS_Multi_Decryptor

 

[Zidapi]

i could have added the xor process to this too, but, at least for now i will keep it separate.

What's the xor process, and what's the current method of achieving it?

 

[RandomUser]

Like other posters before me, How do I get the XORpad for my fat16 NAND? Is it similar too getting XORpad for ROM?

 

[cearp]

just like generating xorpads for roms, for sd stuff, use this:
https://github.com/Relys/3DS_Multi_Decryptor

 

[Codename]

I figured out how to do that, but I can't get the decrypted fat16 image to mount. I always just get an unknown or corrupt image file. Yet when I look at the file with a hex editor, I can see plenty of stuff (like folder names and stuff that should be in the fat16 of the NAND.) If it matters, the fat16 I got was from my MT-Card 9.4 EmuNAND, plus I don't even have a 3DS-mode flashcard. Help with the mounting issue please?

Edit: Nevermind, I got it working. I'll post a simple guide tomorrow

 

[cearp]

I figured out how to do that, but I can't get the decrypted fat16 image to mount. I always just get an unknown or corrupt image file. Yet when I look at the file with a hex editor, I can see plenty of stuff (like folder names and stuff that should be in the fat16 of the NAND.) If it matters, the fat16 I got was from my MT-Card 9.4 EmuNAND, plus I don't even have a 3DS-mode flashcard. Help with the mounting issue please?

Edit: Nevermind, I got it working. I'll post a simple guide tomorrow

a guide for what? for mounting it? most people on windows just use 'winimage'
getting your fat16 partition is not new, people have been able to do it for a while, just this makes it a lot easier because you don't need to use a hex editor, that is it.

 

[Codename]

So now that I've gotten my fat16 partition decrypted, what can I do to it? Can I add custom titles or remove system titles? Can I move downloadable titles from my SD card to my fat16 partition? Can I add devmenu or other leaked software from the developer SDK? Is there anyway I can edit my fat16 to allow me to play homebrew or ROMs? Or is the only purpose of decrypting the fat16 to browse the filesystem? Thank you!

 

[cearp]

So now that I've gotten my fat16 partition decrypted, what can I do to it? Can I add custom titles or remove system titles? Can I move downloadable titles from my SD card to my fat16 partition? Can I add devmenu or other leaked software from the developer SDK? Is there anyway I can edit my fat16 to allow me to play homebrew or ROMs? Or is the only purpose of decrypting the fat16 to browse the filesystem? Thank you!

you can delete stuff sure, why not 'health and saftey'.
things still need to be signed, we can't simply add custom stuff/dev stuff.
no you cannot edit anything on fat16 to let you play roms. unless you know exactly what to edit, and how to resign it

 

[Bug_Checker_]

I wanted a better/faster way to extract the fat16 partition from the nand dump, so I made a python tool to do it. Opening up a hex editor and doing it like that is possible, but some hex editors are better than others and difficult to use for some people, but this tool I made is nice and easy to use.
It supports dumping and injecting it, and supports the 'normal' 3ds nand and new3ds nand.
I'm sure I could detect it automatically, but for new3ds you need to add '-n3ds' as an argument. (although this is not useful for n3ds right now because we don't have public nand access, but later it will be useful)

Naturally you need to xor the fat16 partition to make it readable, so xor is after dumping, and re-xor it before injecting.

For browsing/editing the fat16 file, instead of relying on something weird like 'WinImage' - just rename the fat16 file as '.iso', then I simply double click it and it mounts just like any other drive/volume on my computer - easy editing! I'm on mac so it is very easy for me to do. I'm not sure how easy it is to mount disks on windows...

If you can answer 1 question, was the private N3DS NAND dump done with hardware or software?
And a 2nd question, what was the firmware version/region of the N3DS that was dumped?

 

[cearp]

Bug_Checker_ - i have no idea. it has nothing to do with me, but the size of the n3ds fat16 partition is listed on 3dbrew so i knew how to add support to it, simple

i tried to use a fat16 partition from a different 3ds, but it didn't work. - why not?
maybe i made a mistake, if anyone has success please share here! i would have thought it would be ok.

 

[swarzesherz]

Hi, new version with fix in injection only in my version, added -lowmem option to chunk in 50MB
https://gist.github.com/swarzesherz/651f69b2e8e5c370a0f4/d9b77da4b3a6d2ed909944c7d1e01d0ec6803296

And version with XOR support
https://gist.github.com/swarzesherz/651f69b2e8e5c370a0f4

XOR version require numpy (to fast xor large file), instalation
1.- Install pip https://pip.pypa.io/en/latest/installing.html
2.- In command line: pip install numpy

 

[cearp]

nice help, thanks!

 

[Dean_]

Can it be used to change the region of emunand?
I'm very interested in that

 

[liomajor]

Changing is possible > http://gbatemp.net/threads/poc-3ds-region-changing-proof.378110

It's not that easy to get it all working like you are used to with your unchanged Region.

If we could obtain a new version .csu from "config" it could be easier (2.3.4 is too old).

http://3dbrew.org/wiki/3DS_Development_Unit_Software

 

[cearp]

Changing is possible > http://gbatemp.net/threads/poc-3ds-region-changing-proof.378110

It's not that easy to get it all working like you are used to with your unchanged Region.

If we could obtain a new version .csu from "config" it could be easier (2.3.4 is too old).

http://3dbrew.org/wiki/3DS_Development_Unit_Software

the config just changes region as in selected country, not actual 3ds console region (but i still thought maybe it will help with our problem with eshop)

 

[mvmiranda]

Quick question guys, can I use padxorer do "re-XOR" my FAT16 NAND file or it only works for "un-XOR"?
I want to test something.

Thx!

 

[cearp]

yes, re-xor it so you can write it back to nand