void downgradeMSET()
{
File dg;
char *dgpath = "0:msetdg.bin";
unsigned int titleid_low = 0x00040010;
unsigned int titleid_high[6] = { 0x00020000, 0x00021000, 0x00022000, 0x00026000, 0x00027000, 0x00028000 }; //JPN, USA, EUR, CHN, KOR, TWN
unsigned int mset_hash[10] = { 0x96AEC379, 0xED315608, 0x3387F2CD, 0xEDAC05D7, 0xACC1BE62, 0xF0FF9F08, 0x565BCF20, 0xA04654C6, 0xAFD07166, 0xD40B12F4 }; //JPN, USA, EUR, CHN, KOR, TWN
unsigned short mset_ver[10] = { 3074, 5127, 3078, 5128, 3075, 5127, 8, 1026, 2049, 8 };
unsigned short mset_dg_ver = 0;
ConsoleInit();
ConsoleSetTitle(" MSET DOWNGRADER");
int checkLoop = 0;
while( checkLoop < 1 )
{
print("What would you like to Downgrade to?\n\n"); ConsoleShow();
print("[A] 4.x MSET\n[B] 5.x/6.x MSET\n"); ConsoleShow();
if (InputWait() == BUTTON_A)
{
if (region == 1)
{
mset_dg_ver = 1;
}
else if (region == 2)
{
mset_dg_ver = 3;
}
else if (region == 3)
{
mset_dg_ver = 5;
}
else if (region == 4)
{
mset_dg_ver = 7;
}
else if (region == 5)
{
mset_dg_ver = 8;
}
else if (region == 6)
{
mset_dg_ver = 10;
}
else
{
print("Unsupported Region!\n"); ConsoleShow();
mset_dg_ver = 0;
}
checkLoop = 1;
}
else if (InputWait() == BUTTON_B)
{
if (region == 1)
{
mset_dg_ver = 2;
}
else if (region == 2)
{
mset_dg_ver = 4;
}
else if (region == 3)
{
mset_dg_ver = 6;
}
else if (region == 4)
{
mset_dg_ver = 7;
print("CHN Region Detected, falling back to 4.x MSET\n"); ConsoleShow();
}
else if (region == 5)
{
mset_dg_ver = 9;
}
else if (region == 6)
{
mset_dg_ver = 10;
print("TWN Region Detected, falling back to 4.x MSET\n"); ConsoleShow();
}
else
{
print("Unsupported Region!\n"); ConsoleShow();
mset_dg_ver = 0;
}
checkLoop = 1;
}
else
{
print("Please press a valid button!\n"); ConsoleShow();
}
}
print("Opening MSET app...\n"); ConsoleShow();
if (CheckRegion(SYS_NAND) == 0)
{
if (FindApp(titleid_low, titleid_high[region], SYS_NAND)) // SysNAND only
{
if (FileOpen(&dg, tmdpath, 0))
{
/* Get the MSET TMD version */
unsigned short tmd_ver;
FileRead(&dg, &tmd_ver, 2, 0x1DC);
tmd_ver = bswap_16(tmd_ver);
FileClose(&dg);
/* Verify version number */
if (tmd_ver > mset_ver[mset_dg_ver])
{
/* Open MSET content file */
if (FileOpen(&dg, cntpath, 0))
{
unsigned int check_val;
FileRead(&dg, &check_val, 4, 0x130);
FileClose(&dg);
if (check_val != 0)
{
if (checkDgFile(dgpath, mset_hash[mset_dg_ver]))
{
print("Opening downgrade pack... "); ConsoleShow();
if (FileOpen(&dg, dgpath, 0))
{
print("OK!\n"); ConsoleShow();
unsigned int dgsize = FileGetSize(&dg);
unsigned char *buf = (unsigned char*)0x21000000;
FileRead(&dg, buf, dgsize, 0);
/* Downgrade pack decryption */
u8 iv[0x10] = {0};
u8 Key[0x10] = {0};
GetTitleKey(&Key[0], titleid_low, titleid_high[region], SYS_NAND);
aes_context aes_ctxt;
aes_setkey_dec(&aes_ctxt, Key, 0x80);
aes_crypt_cbc(&aes_ctxt, AES_DECRYPT, dgsize, iv, buf, buf);
FileWrite(&dg, buf, dgsize, 0);
FileClose(&dg);
if (*((unsigned int*)(buf + 0x100)) == 0x4843434E) // "NCCH" magic word
{
print("Downgrading... "); ConsoleShow();
if (FSFileCopy(cntpath, dgpath) == 0)
{
print("done!\nRemoving downgrade pack... "); ConsoleShow();
f_unlink(dgpath);
print("done.\n"); ConsoleShow();
} else {
print("\nError downgrading MSET content.\nRemoving downgrade pack... "); ConsoleShow();
f_unlink(dgpath);
print("done.\n"); ConsoleShow();
}
} else {
print("Error: bad downgrade pack.\n"); ConsoleShow();
}
} else {
print("Error.\n"); ConsoleShow();
}
} else {
print("Error: bad downgrade pack.\n"); ConsoleShow();
}
} else {
print("Your MSET version is exploitable.\nDowngrade isn't necessary.\n"); ConsoleShow();
}
} else {
print("Error opening MSET content file.\n"); ConsoleShow();
}
} else {
print("Your MSET version is exploitable.\nDowngrade isn't necessary.\n"); ConsoleShow();
}
} else {
print("Error opening MSET TMD.\n"); ConsoleShow();
}
} else {
print("Error: couldn't find MSET data.\n"); ConsoleShow();
}
}
print("\nPress A to exit\n");
ConsoleShow();
WaitForButton(BUTTON_A);
}