RELEASE ShogunTool - Get game information from Title IDs!

I don't know how to fix but thanks anyway

 

What are you trying to do? If you have the token, simply put it to the request header like I did in my code.

 

did you write some python code to generate the dauth token/how did you obtain the token ?

 

Also interested. I wanted to add eshop metadata downloading to my CDN downloader/nsp library app, but by the time I got around to writing the code *poof* every request rejected and I don't know enough about the underlying tech to figure out myself what to do about it.

I hope this doesn't mean I have to log in to nintendo.com, get the auth token that they give me, then go back and send them that token in my app to prove I've logged in. I have no clue how I'd automate that, and I for damn sure don't want to use my personal account in the app.

Blah, it would probably be easier at this point to visit their publicly available eshop page and parse the html :/

 

I currently found this repo by @SimonMKWii https://github.com/simonmkwii/DAuther and it solves the crypto challenge in C#....
currently my problem is that I don't get how exactly the crypto challenge is solved (there is for some reason no padding, and this would be impossible with the 2nd encryption because AES-ECB requires padding....)

see here for a reference from SciresM:

I will keep this thread update if I can solve the crypto challenge and generate the bearer token via python3

@SimonMKWii I have some questions regarding your code, could you please DM me (regarding license of dauther and how you did figure all that stuff out O.O or if you adapted another source code (would be nice because I have no fucking clue how C# works....))

 

Yes, but it's basically a (simplified) reimplementation of @SimonMKWii DAuther. I recommend you look at its source.
Note that I never cleaned it up, so it's quite messy.
[EDIT] Also I've scraped Shogun using it but I'm not sure I'm allowed to post the results here, so I won't.

 

Thank you, and I'm keeping this tab open so I can remember later to read through the code and figure this out.

Funny, I originally wanted to grab the title's size from the eshop (I assumed that info was there as the eshop does show you how much space is needed on your device to download the game). I ended up just creating a function that goes through the motions of downloading a title, but instead of downloading anything it only grabs headers for their content-lengths, then adds everything together for a very close size estimate. It works great, is very fast and is one of my favorite features that my app has over CDNSP.

In fact, the reason I decided to make my own app was that I keep butting up against comcast's 1TB data cap and I wanted to know what the game's size was BEFORE I downloaded it. I also have a data-cap friendly feature that downloads your queue from smallest game to largest until it reaches a max game size OR a max total amount of data. So on Aug 30 I'm going to check my data usage, then download as many bytes worth of games as I can without passing the cap

 

Alternatively, the CNMT contains the sizes of the files it links to.

 

Yep, you're right. My first implementation was a copy/paste of the DownloadTitle method with the download-y parts deleted so it was done fast, but I have a rewrite that uses the CNMT content entry sizes is on my TODO list.

 

You have an app like ShogunTool?

 

No I have an app like CDNSP. Not released, but preferable to me to use.

 

I get invalid input and it shuts down

 

For anyone still watching this thread, I managed to get eshop data. I had to:

Implement getting the Dauth token (see DAuther link earlier).

Use my own personal cert for eshop access, because the public CDN cert is eshop banned. I know this because while it can download from the CDN just fine, it is rejected by the shogun server with a ban message. What was that people said about all bans being CDN bans now? I dunno. Even weirder, the personal cert I'm using is on a switch that has no linked nintendo account, but I have homebrew on and go online all the time with illegitimate NSPs, DevMenu, practically everthing that should get you banned. Nintendo even sends me free updates for my NSPs when I go online (or did, until 6.0 dropped and I didn't update).

Connect to the shogun server using the shopN cert (I had to log in with my console cert) and the dauth token specified using the header
"X-DeviceAuthorization", "Bearer XXXXXXXXXXXXXXXXXXXXXXXXXX".
Then using the nsuid (or the nsuid I already have from importing Game_info.json) to access the game's info.

I got kind of a sad face when I found out that the data returned there is incomplete. It is mostly screenshots and a bit of basic data. Well, anything you see on the eshop page I guess. The "total_rom_size" is useful, though I already had been calculating the size through the CNMT and/or calculating contentlength headers so I may not even use it. I already have the name and publisher from the nsp's internal control data. I already have the image from the control data as well.

Other than that, the only useful stuff is "description" and maybe "genre". There's some content rating stuff too

I'd be curious to know where to find the following:

BoxArt (url on the media.nintendo.com server). The images listed in the eshop are only accessible via eshop login since they're on the shogun server, while media.nintendo.com is publicly accessible.

Developer - the control NCA and the eshop data only have publisher.

Region - I currently get region from the nut db file, and I need region to access the shogun endpoint. Is there a way to find the region of a title by ID? Obv I can't get it from shogun if it asks for the region and language.

Price? Not exactly important, but I expected to see it in the eshop data and I didn't.

 

Oh, if it wasn't obvious from my last post, it is unlikely that shogun tool will come back since it requires a totally unbanned cert to even operate. That seems dumb as hell - you can access all this info by reading the public eshop web page and parsing the HTML, why hide it behind a login? I've written my app to not even bother trying to access the eshop data unless the user has a valid cert pointed to by a LoginCert setting, and otherwise just doesn't use it. I mean, shogun COULD be rewritten to work, he would just have to require that you provide your own unbanned certificate (the "public" one isn't good enough).

 

Aaaaaand within a day of using my cert for accessing the eshop api it was banned. This was after openly using NSPs and homebrew online for weeks and no ban, just one day of accessing an innocuous api containing public data was a bridge too far I guess.

I rewrote my app to just load the eshop web page and parse the HTML. Most of the same data is there (it is generated using the API data), and what isn't there isn't terribly important. Oh well. Link in sig.

Shogun could be rewritten to do the same, if the author had the motivation. It only took me a couple of hours, using the dcsoup library.