[Request] CTRAging (3ds debug app) research.

Discussion in '3DS - Homebrew Development and Emulators' started by PabloMK7, Jan 23, 2016.

  1. PabloMK7
    OP

    PabloMK7 Red Yoshi! ^ω^

    Member
    1,784
    1,090
    Feb 21, 2014
    Spain
    Yoshi's Island
    Do you remember the debug card AGING-NTR also known as NTR-EVA which had some tests for the NDS?

    CTRAging, the 3DS equivalent to AGING-NTR, is an app used for testing the hardware at the factory, before it is approved for selling.
    And after the tests, it uninstalls itself as well as other test apps, such as DevMenu.
    However, uninstall isn't equal to fully deleted from NAND, that means:

    YOU PROBABLY STILL HAVE IT IN YOUR FAT16 PARTITION OF YOUR NAND.

    Great right!? Well.... no. Each time the console writes to NAND, it has a chance to overwrite it, because since it is no longer installed, the 3ds doesn't care about overwriting it. That means, the most used the system is, less probabilities to still have it in NAND. As stated here, sometimes only the TitleID is kept in NAND, other times its header, or nothing. I tried with my two o3ds, the first, which went throught many updates (5.0 to 9.2), didn't have it at all. However, my 2nd 3DS, which went from 1.0 to 4.5 with a card update (yes, I know I shouldn't have to update), only had the TitleID (000400000F980000) between a lot of FF.

    If you want to try a working copy on your N3DS (O3DS crashes), you can go to pastebin and search for 3DS ctraging.

    (29/05/16) The N3DS dump is working, it has to be launched from DevMenu. Video by @CrispyYoshi (thanks :))



    Holding START shows a menu!
    Warning: Spoilers inside!

    So if you feel like you have a OLD 3DS which never updated, and hasn't been used much, you may be lucky. Dump and decrypt your fat16 partition and search for the TitleID, here it is how:

    1- Use Decrypt9 to dump your nand fat16 xorpad.
    2- (Dump your NAND if haven't already, the older the copy is, the more probabilities)
    3- Download this tool
    4- Place the nand file and the xorpad in the same folder as the tool. Name them nand.bin and fat16.xorpad
    5- Run "run.bat"
    6- If it creates a file called "000400000F980000.ncch", you may be lucky, put that file on your 3DS SD, run Decrypt9 and select NCCH Decryptor. If you can read "Exheader / Exefs / Romfs: whatever / OK / whatever" let me know :)
     
    Last edited by PabloMK7, May 30, 2016


  2. Reisyukaku

    Reisyukaku Onii-sama~

    Member
    1,184
    2,301
    Feb 11, 2014
    United States
    I've been looking for this for a while as well. I dumped my Animal Crossing N3DS NAND before the first power on, and no goodies were found.
     
    cearp likes this.
  3. froggestspirit

    froggestspirit D/P/Pt Demix Guy

    Member
    1,094
    534
    Jul 28, 2011
    United States
    would this be a legit signed thing? and it uninstalls devmenu? seems like it could lead to something (or I'm just hopeful)
     
  4. Suiginou

    Suiginou (null)

    Member
    565
    588
    Jun 26, 2012
    Gambia, The
    pc + 8
    Note a launchday 1.0 O3DS doesn't necessarily have a clean CTRAging, either. Even just the initial system setup tasks have a chance to botch it. Some 3DSes contain no factory titles at all.

    An unbooted or barely used N3DS has a decent chance of having a full CTRAging, but it seems neutered in terms of service lists (exheader) compared to the O3DS one, so the O3DS one is more interesting.

    Also worth to note: It seems what gets overwritten in terms of NAND sectors is pretty much random. I found a bunch of factory titles (only a broken CTRAging, however) on a 3DS that had gone through a lot of versions before the first NAND dump. Even people with a O3DS not in prime conditions should try and dump CTRAging.
     
    Last edited by Suiginou, Jan 23, 2016
    Seamus9999 likes this.
  5. MassExplosion213

    MassExplosion213 .

    Member
    1,416
    958
    Feb 15, 2015
    United States
    So the N3DS one is dumped?
     
  6. Suiginou

    Suiginou (null)

    Member
    565
    588
    Jun 26, 2012
    Gambia, The
    pc + 8
    Yes, IcySon55 on the CakesFW IRC got a full dump where exefs and romfs hashes check out.
     
    PabloMK7 and Seamus9999 like this.
  7. PabloMK7
    OP

    PabloMK7 Red Yoshi! ^ω^

    Member
    1,784
    1,090
    Feb 21, 2014
    Spain
    Yoshi's Island
    You already need to have kernel to install legit cias, so there is no point to use ctraging to get kernel access, and anyway, all it is supposed to do is make a factory setup.
     
    Last edited by PabloMK7, Jan 24, 2016
  8. PabloMK7
    OP

    PabloMK7 Red Yoshi! ^ω^

    Member
    1,784
    1,090
    Feb 21, 2014
    Spain
    Yoshi's Island
    Mhetralla and Vappy like this.
  9. Reisyukaku

    Reisyukaku Onii-sama~

    Member
    1,184
    2,301
    Feb 11, 2014
    United States
    Do you have a working ticket for it? or should i make a fake one? i'd test it on my n3ds
     
  10. PabloMK7
    OP

    PabloMK7 Red Yoshi! ^ω^

    Member
    1,784
    1,090
    Feb 21, 2014
    Spain
    Yoshi's Island
    I only converted the cxi to a cia, it Imported fine, but crashed at the Nintendo 3ds logo.
    I was able to see the App title: Test Programm Nintendo Co, and the icon, the same as safety info. The banner doesn't display because is incorrect, it has 2 CGFX which can't be opened in EFE or ohana.
     
  11. Reisyukaku

    Reisyukaku Onii-sama~

    Member
    1,184
    2,301
    Feb 11, 2014
    United States
    I just tried it on both sysnand and emunand.. same result.
    It boots up and gets past the logo, it sits at a black screen for a second, then you see the backlight come on for a second, then I get the 'power button error'
     
  12. NekoMichi

    NekoMichi Retro Collector

    Member
    1,286
    918
    Jun 4, 2015
    Minus World
    I have an N3DS that came with 9.0E, NAND.bin was dumped with emuNAND9 pretty much as soon as initial setup was complete after purchase. Would that be of use to anyone trying to examine CTRAging traces?
     
  13. daxtsu

    daxtsu GBAtemp Guru

    Member
    5,546
    3,952
    Jun 9, 2007
    Antarctica
    Maybe it needs the 178MB mode? Just a guess, though.
     
    kiwiis likes this.
  14. shutterbug2000

    shutterbug2000 Cubic NINJHAX!

    Member
    1,079
    2,102
    Oct 11, 2014
    United States
    Huh. My N3DS is fairly new(lol). How would I know if I have it?
     
  15. Suiginou

    Suiginou (null)

    Member
    565
    588
    Jun 26, 2012
    Gambia, The
    pc + 8
    Yes, that'd be prime material... Well, except there's a CTRAging dump already, but maybe there were more factory titles, so whatever.

    Note since the NAND keys are console-unique, you'll also need a dump of the FAT16 xorpad for CTRNAND.
     
  16. PabloMK7
    OP

    PabloMK7 Red Yoshi! ^ω^

    Member
    1,784
    1,090
    Feb 21, 2014
    Spain
    Yoshi's Island
    Use rxtools or whatever to generate fat16 xorpad. I'll update first post with a tool to decrypt fat16.
     
    NekoMichi likes this.
  17. ketal

    ketal aiueo

    Member
    744
    569
    Aug 20, 2015
    Italy
    My nand dump from a brand new console is clean, didn't find the app there
     
  18. PabloMK7
    OP

    PabloMK7 Red Yoshi! ^ω^

    Member
    1,784
    1,090
    Feb 21, 2014
    Spain
    Yoshi's Island
    You have to open the fat16 image with HxD and search 0000980F00000400
     
    Last edited by PabloMK7, Jan 25, 2016
  19. piratesephiroth

    piratesephiroth I wish I could read

    Member
    3,007
    1,619
    Sep 5, 2013
    Brazil
    More like "you probably don't have it, but you could try anyway"
     
    Ricken, ketal and Suiginou like this.
  20. ketal

    ketal aiueo

    Member
    744
    569
    Aug 20, 2015
    Italy
    That's what I did