Hacking So a PR was just sent to pegaswitch to allow it to dump files from the console.

[Deleted member 418227]

Someone might want to try these paths: https://reswitched.tech/software/browser

Uh, so did nobody actually try this? Because it works.

switch> dirlist blacklist:/
[ 'blacklist:/blacklist.txt' ]
switch>

Here are the contents of blacklist.txt:

^https://www\.nintendo\.co\.jp/check_blacklisted_url-H2KMqKxRvwijbZ4xeB3C7mkr(\?|$)

As far as I'm aware though, we're currently limited to files related to the browser.

 

[datahoarder]

Uh, so did nobody actually try this? Because it works.

switch> dirlist blacklist:/
[ 'blacklist:/blacklist.txt' ]
switch>

Here are the contents of blacklist.txt:

^https://www\.nintendo\.co\.jp/check_blacklisted_url-H2KMqKxRvwijbZ4xeB3C7mkr(\?|$)

As far as I'm aware though, we're currently limited to files related to the browser.

Does dumping:
/browser/RootCaEtc.pem
/browser/RootCaSdk.pem
and spoofing the browser header mean we're able to browse and get the encrypted game files from the eShop?

 

[thomasnet]

These files are Root CAs. They are used to verify the server is indeed a real Nintendo one. We need the private keys to (de)crypt the traffic.

 

[datahoarder]

These files are Root CAs. They are used to verify the server is indeed a real Nintendo one. We need the private keys to (de)crypt the traffic.

Dang. I was hoping to parse the XMLs served somehow, but samurai.ctr doesn't return anything valid although ninja.ctr at least does when there's data; but nothing of use.
https://ninja.ctr.shop.nintendo.net/ninja/ws/titles/id_pair?ns_uid[]=70010000000187

<eshop><title_id_pairs><title_id_pair><ns_uid>70010000000187</ns_uid><type>T</type></title_id_pair></title_id_pairs></eshop>

 

[thomasnet]

For switch it's not ctr.nintendowifi.net it's hac.lp1.eshop.nintendo.net