25E-hashed file with the .cert and .tik and all that jazz has the cnmt file in a 4kb NCA which extracts into the 1kb cnmt file

C2C-hashed file has no .cert or .tik files, and the CNMT NCA is 20kb, but still only extracts a 1kb cnmt file. 16kb of extra data is appended to C2C's NCA on just that one, but this is true of several other NCAs.

*Edit 2: (Did a bad copy-paste job)

The 20kb NCA that holds the CNMT file for the suspect NSP has all the same data as the trusted NSP for the first 4kb, but AFTER that it changes. That's called appended data. If it was just a difference of compression or compacting it, the entire contents would be different.

Investigation of the files has shown 25E to be legitimate and C2C to had extra data appended to several NCAs, including ones which contain the exact same files within them and, other than the appended data, are exactly the same. NCAs are encrypted files, normally so being the exact same aside from the appended data isn't possible from a normal extraction/conversation. If there was a difference of contents, the file would be radically different.

Just to reiterate redundantly: Two files are different after the NCAs have all been extracted. One is completely different, one has only a single byte changed. I'm told the single-byte is for "isGameCart" checks.

Pre-extraction, the NCAs are very different in super suspect ways. The NCA which contains only the CNMT file appears to have the encrypted CNMT differences, then some kind of footer-data that is the same either way, then about 16 kilobytes of data that has no reason to be there. This is all within the C2C-hashed file.

Anyone telling you to trust C2C either hasn't tested it, or is flat-out lying to you. If a Warez group dedicated to NX titles told you to trust C2C, they are either misinformed, stupid, or willfully malicious.

Edit: And yes, I only joined GBATemp to post this thread. Too many people use GBATemp as the source of ALL KNOWLEDGE. Look at the attached images for screenshots.

Edit 3:

Good hash: 25E8328F47D3A1EBFE5A4197814D9B62
Bad hash: C2C2F8FC8E1986357484D083F94C2DAD