Homebrew [Request] CTRAging (3ds debug app) research.

[Reisyukaku]

Could someone with N3DS and rxtools test it?:

Not only is that illegal and stupid, but i've already said it didnt work on emunand or sysnand. >.>

 

[ketal]

Are we sure this thing is not a dummy title? And anyway, if you want to access some "hidden" settings, ctr-sdk config menu does the job...

 

[PabloMK7]

Are we sure this thing is not a dummy title? And anyway, if you want to access some "hidden" settings, ctr-sdk config menu does the job...

It has some interesting content, anything else. And as I said, it is the equivalent as Nintendo DS NTR EVA Debug

 

[Reisyukaku]

Are we sure this thing is not a dummy title? And anyway, if you want to access some "hidden" settings, ctr-sdk config menu does the job...

Its probably used in conjuction with another app or module that communicates with some kind of hardware. similarly how Menu Selector is used with TestMenu. And how debug module is used with PARTNER CTR on dev units.

 

[piratesephiroth]

Are we sure this thing is not a dummy title? And anyway, if you want to access some "hidden" settings, ctr-sdk config menu does the job...

It's probably because of the hardware checks. Should be useful for emulator developers.

 

[PabloMK7]

Its probably used in conjuction with another app or module that communicates with some kind of hardware. similarly how Menu Selector is used with TestMenu. And how debug module is used with PARTNER CTR on dev units.

Maybe the reason it crashes is because the lack of other debug titles which are also unistalled during Factory Setup.
.

 

[Suiginou]

Maybe the reason it crashes is because the lack of other debug titles which are also unistalled during Factory Setup.
.

Looking at O3DS CTRAging, the N3DS version is probably the only special factory title. O3DS CTRAging explicitly references factory title IDs, whereas N3DS doesn't.

 

[shinyquagsire23]

wtf is this

https://npdl.cdn.nintendowifi.net/p01/nsa/B6Iqt2r0EGU549NW/comm/ctr_amke_community

Decrypted it, here's some of my personal favorite tidbits from it:

 

[ketal]

I'm fairly sure that to get ctraging to work you need all the other debug titles.
list:

Spoiler

0004000100000002 NATIVE_FIRM
0004000100001902 dmnt sysmodule
0004000100001B02 gpio sysmodule
0004000100001D02 hid sysmodule
0004000100001E02 i2c sysmodule
0004000100001F02 mcu sysmodule
0004000100002102 pdn sysmodule
0004000100002302 spi sysmodule
0004000100002702 csnd sysmodule
0004000100002802 dlp sysmodule
0004000100002A02 mp sysmodule
0004000100002B02 ndm sysmodule
0004000100002C02 nim sysmodule
0004000100002D02 nwm sysmodule
0004000100003102 ps module
0004000100003202 friends sysmodule
0004000100003302 ir sysmodule
0004000100003402 boss sysmodule
0004000100008002 ns
0004000100008102 TestMenu
0004000100008A02 Dev. ErrH
0004003000008102 TestMenu

 

[Suiginou]

I'm fairly sure that to get ctraging to work you need all the other debug titles.

N3DS CTRAging references only retail title IDs. You're right about O3DS, though.

 

[Shubshub]

Do you remember the debug card AGING-NTR also known as NTR-EVA which had some tests for the NDS?

CTRAging, the 3DS equivalent to AGING-NTR, is an app used for testing the hardware at the factory, before it is approved for selling.
And after the tests, it uninstalls itself as well as other test apps, such as DevMenu.
However, uninstall isn't equal to fully deleted from NAND, that means:

YOU PROBABLY STILL HAVE IT IN YOUR FAT16 PARTITION OF YOUR NAND.

Great right!? Well.... no. Each time the console writes to NAND, it has a chance to overwrite it, because since it is no longer installed, the 3ds doesn't care about overwriting it. That means, the most used the system is, less probabilities to still have it in NAND. As stated here, sometimes only the TitleID is kept in NAND, other times its header, or nothing. I tried with my two o3ds, the first, which went throught many updates (5.0 to 9.2), didn't have it at all. However, my 2nd 3DS, which went from 1.0 to 4.5 with a card update (yes, I know I shouldn't have to update), only had the TitleID (000400000F980000) between a lot of FF.

If you want to try to build it by yourself, here is the N3DS version of CTRAging: -snip-
(25/01/16, 18:12) Got a O3DS copy with matching exefs hashes, however, the keyX line at the signature to decrypt it is corrupted.

So if you feel like you have a 3ds which never updated, and wasn't much used, you can try luck, dump and decrypt your fat16 partition and search for the TitleID, here it is how:

1- Download this tool.
2- Place your NAND dump in the same folder, and name it NAND.bin.
3- Use rxtools or any homebrew, and generate NAND fat16 xorpad.
4- Copy the generated xorpad to the same folder and name it nand.fat16.xorpad
5- Run decrypt.bat
6- Open nand.fat16.bin in HxD (hex editor) and search 0000980F000004000
7- If you have it, it should look like this. Now, put your cursor behind NCCH and move the cursor 16 lines up (100 bytes). Now go to Select -> Select Block and set lenght to FFFFFFFFF (I know, I know...). Copy it and paste into a new file, NCCH string should be at offset 100.
8- Save the file as whatever.cxi, now use whatever method to decrypt it.

You need to remove that link Because it's copyrighted content to link here

 

[Suiginou]

You need to remove that link Because it's copyrighted content to link here

And of course, you did everything except press the report button.

 

[ketal]

Extracting the content from a private ctraging dump (this one doesn't boot too) I saw "tester" being referenced several times. It probably needs some external hardware too

 

[ItsMetaKnight]

Decrypted it, here's some of my personal favorite tidbits from it:

Oh my god! I have been trying to decrypt downloaded BOSS files for ages. Could you tell me how to do that?

 

[MelonGx]

I found my O3DS-2 O3DS-3 N3DS ticket.db had this title 000400000F980000.
Trying to dump it with FunkyCIA.....Failed.

 

[piratesephiroth]

I found my O3DS-2 O3DS-3 N3DS ticket.db had this title 000400000F980000.
Trying to dump it with FunkyCIA.....Failed.

Of course it's not available for public download.

 

[MassExplosion213]

I found my O3DS-2 O3DS-3 N3DS ticket.db had this title 000400000F980000.
Trying to dump it with FunkyCIA.....Failed.

That would be CTRAging.

 

[MelonGx]

Found 0000980F00004000 on my N3DS 8.1.0-0J decrypted CTR image.
But it doesn't look like this.
No NCCH there.

 

[Suiginou]

Found 0000980F00004000 on my N3DS 8.1.0-0J decrypted CTR image.
But it doesn't look like this.
No NCCH there.

1. That looks correct. You're highlighting the title ID; the "NCCH" magic is a bit prior to that, look at the right column.
2. It's N3DS, I doubt there's much to gain from a dump of yet another N3DS CTRAging unless you have a very recently made N3DS.

 

[KaduPSE]

I have an O3DS that was only once updated using a cartridge, never used again. Should I go for the trouble of searching for it or we already have an working dump?