Hacking The general VC rom injection thread (NES,GB/C/A etc.)

[durangodoug]

I managed to inject "Mendel Palace" into the Super C Virtual Console game (I basically used the MK7 tools/scripts here since they maintained Download Play: http://www.dshack.org/forum/index.php?/topic/2378-how-to-hack-european-mk7/), but it looks like the Download Play app already has the ROM of Super C embedded, so unlike Mario Kart 7 your changes to the main romfs aren't reflected in the Download Play spawn.

The "Download Play" child contains an encrypted CIA. If that was decrypted and modified, would I still be able to send a Download Play client to a 3DS without signature patches (unmodded)? It seems like modifying that CIA would prevent me from sending it to a "legit" 3DS.

 

[Deleted User]

I have no idea at all what you mean with the NES injection. Can you make a seperate tutorial about how to inject NES roms?

 

[gudenau]

How does one decrypt a CIA?

 

[sea_man]

I like to inject this nes rom :

Batman - Return of the Joker 128k PRG / 256k CHR H Sunsoft 5 (69)

But.. it have the Sunsoft 5 (69) mapper.... witch number can i put in the hex ?? .. i only have this options " Mapper, 00= none 01 = MMC1 03=MMC3 05=MMC5 06=UNROM "

 

[hippy dave]

..this latest Sega 3D Classic seems to have a great new version of M2's Megadrive emulator, will be interesting to see how compatible it is. Seems to work great with Mega Bomberman anyway MDashK has posted a nice straightforward tutorial/toolset for Megadrive injection over on the ISO site.

 

[davhuit]

00 NROM
01 SxROM (MMC1)
02 PxROM (MMC2)
03 TxROM (MMC3)
04 FxROM (MMC4)
05 ExROM (MMC5)
06 UxROM
09 AxROM
64 FDS (.tds)

Found a new one, CxROM is either 07 or 08.

I found that by trying to convert a game (Milon's Secret Castle) using CROM and so, I created several roms with a different value (07 ; 08 ; 0A ; 0B ; 0C ; 0D ; 0E ; 0F) and it appears that two values make the game runs correctly, with other ones, the game either doesn't boot at all or have mixed tiles.

As two values works fine, I can either suppose the game support several values/mapper or either both values are the same for the VC emulator.

So here's an up-to-date list :

00 NROM
01 SxROM (MMC1)
02 PxROM (MMC2)
03 TxROM (MMC3)
04 FxROM (MMC4)
05 ExROM (MMC5)
06 UxROM
07 CxROM (seems to also work with 08, so try 08 is 07 is not making your game works).
09 AxROM
64 FDS (.tds)

 

[Philip3ds]

I will convert any gba game to CIA. Just tell me the game's region in which you want it in.

 

[NoNoNeko]

Is it possible to do this without kernal access?

 

[Deleted User]

Is it possible to do this without kernal access?

No

 

[Giodude]

im using hans. I tried contra, i did everything but mm. No idea what it is. I get a gray screen. Any ideas?

 

[3DxMan]

sorry for posting a new thread i already think this matter has way too many as it is.....yet for some reason they all focused on gameboy (probably because its the easiest, and works the best though).

so i thought i would condense all the info spread about the 3 threads or so into 1 thread, lets clear up a few things first, the VC system is a sort of multi purpose emulator, the one system works as a gameboy,nes and crappy gba emulator, the output depends on what rom you drop into it, so you could decrypt a GBC VC title and then put nes roms in it and it will be the nes VC emulator....put a GBA
rom in and it does GBA

Decryption Methods

Spoiler

Retail encrypted VC games

Spoiler

1 drag your .3ds rom onto "crtkeygen.exe" this will create a file called ncchinfo.bin in the same folder as your rom

2. copy the XORpad generator (launcher.dat) from the "For the 3DS SD card" folder in this download to the 3DS's SD card
and the ncchinfo.bin that was generated in step 1, then pop the SD back in the 3DS and go to DS profile, this will generate the
Xor pads used to decrypt the game.(this step can be a little buggy if it stays on "opening ncchinfo.bin" for more than a few seconds
reset the console and repeat untill it kicks into action)

3. copy your ROM and XOR pads here, leave out any CTR-P-CTAP.romfs*.xorpad files they are un-needed and may cause issues you just need
the 3 Xor pads for the game exefs,romfs and exh


4. run unpackv2.bat, enter your roms filename (may help if you rename it to something easy like rom.3ds)
go into the "decrypted" folder then "romfs",
make your edits,

5. Go back to the main directory and run makerom.bat

6. If all goes well and you will be given romedited.3ds in the main folder.


thanks to ground for the neat and tidy decryption script,and everyone involved in making the tools
http://filetrip.net/dl?klFzuXHgmF

Using the bbb pokemon zero key encrypted roms as a base

Spoiler

DOWNLOAD BOBMCJR VERSION
(FIXED)
1.- Get Pokemon Crystal 3ds VC game
2.- Move the pokemon 3DS VC game to the prepare.bat
3.- Move the GBC/NES game to create3ds.bat or createcia.bat
4.- Fill out the prompts
5.- Wait and it's done!!
DOWNLOAD
https://gbatemp.net/attachments/vcpkg-zip.14975/
this is just the method copied from here
http://gbatemp.net/threads/gbc-vc-generator.371819/
Note that GBA and FDS roms will not work with the BBB Pokemon base, and someone makes an updated tnes.exe, AxROM NES ROMs will not be automatically converted.

Popular Mods that will work on all different systems

Spoiler

Full screen

Spoiler

mod, so depending on the rom you intend to run in full screen, make this adjustment in the config.ini file found in the RomFS of your decrypted rom, find the header for the system you are wanting to full screen i.e [NES][GBC] [AGB]
once at the correct header the options underneath let you toggle various features so for example setting the "Width" to 400 on all systems will make the game play in fullscreen

Get rid of the delays in bringing up the VC menu and saving

Spoiler

again in the config.ini file found in RomFS, if you go to the bottom of the ini you will see options to change the [MENU] settings, here if you change all the delays to 0, the VC system will be much more responsive instead of having delays between trying to enter the VC menu

Adding games for various systems

Spoiler

GB/C

Spoiler

simply get a .gb or .gbc rom rename it to follow the naming structure that the VC uses, you don't need to stick to the built in name like Dmgazlp2.f11, you can go for something more recognizable like POKEMONY.F11 (not sure what the limits of the file name are so try to stick to similar to the original setup)

also for GBC its best to make sure you only have a 1 rom inserted or it may cause issues, so don't for example leave the original rom in there too when rebuilding

GBA

Spoiler

another simple one, remove the old roms and copy a GBA rom into the rom folder, the name to match a similar set up to the old filename (but not exactly the same) and leave the extension as .gba so for example you could have AdvanceW.gba

worth noting the GBA emulation is very poor, very slow and only works on smaller roms i think after about 4MB it will just crash the 3DS

NES

Spoiler

this one is actually the biggest pain in the butt, basically nintendo doesn't use the normal public method of headers for NES roms (suppose its to be expected),

ok so me and alexenochs got the header layout figured out, so now you should be able to generate you custom header to play pretty much all nes games on the nes VC,
basically the format is
54 4E 45 53 XX YY ZZ 00 01 MM? 00 00 00 00 00 00
XX= Mapper type
YY= PRG
ZZ= CHR
MM= possibly mirroring....not sure though

mapper types we figured out so far are
00= none 01 = MMC1 03=MMC3 05=MMC5 06=UNROM
PRG and CHR are added in 8kb blocks, so 01=8kb, 10=128kb,20=256kb etc

so now you should be able to generate your own header to match the rom you want to inject meaning you aren't tied to only roms that have the same header as released NES VC games

so check here for the details of any given game and edit the header appropriately
http://tuxnes.sourceforge.net/nesmapper.txt

As a bonus feature that only seems to work with nes roms you can actually insert more than one rom in the "rom" folder, and when you start it up you will be able to select the game you want......it will really help giving the games recognizable file names this time, and it seems the only way to get back to the menu is to exit and reload the rom..........but it works

Making your own banners and icons

Spoiler

fist you will need to get python and Pillow to use these tools, install both of them and then download
3DSBannerMaker

edit you pictures, running the python script(icon.py,banner.py respectively) in each folder after editing, then once all your icons/banners are edited go back to the main folder, edit the AppData.txt to change the name etc and then run _buildscript.py (using the build.bat would require setting up environment variables which i cba explaining atm, running the .py file will work fine anyway)

one thing to note is that you will need to edit the RSF file for each game or you will end up having cached icons ruining your work, to make sure your custom icons show up between each game, be sure to edit "UniqueId : 0x123456" (in the rsf file)for each custom rom injection you make to avoid icon conflicts

copy the icon.icn and banner.bnr that are outputted into the /decrypted/exefs folder of your VC build, delete/rename the existing banner.bin and icon.bin and rename the banner.bnr and icon.icn to *.bin, and dont forget to make the adjustment to the rsf.rsf file to give each game a unique ID or they will just keep loading the old games icon and name in the menu

and i think that's it, if i have missed anything out let me know, and inb4, what about gamegear/master system, it appears the roms are compressed for them, so unless a way to compress roms using the same method is found, you cant do GG/SMS

have fun everyone

PLEASE NOTE: these custom VC games will not work on R4i DE,3DSlink or orange3ds, as they dont have "homebrew" loading capabilities yet

sorry for posting a new thread i already think this matter has way too many as it is.....yet for some reason they all focused on gameboy (probably because its the easiest, and works the best though).

so i thought i would condense all the info spread about the 3 threads or so into 1 thread, lets clear up a few things first, the VC system is a sort of multi purpose emulator, the one system works as a gameboy,nes and crappy gba emulator, the output depends on what rom you drop into it, so you could decrypt a GBC VC title and then put nes roms in it and it will be the nes VC emulator....put a GBA
rom in and it does GBA

Decryption Methods

Spoiler

Retail encrypted VC games

Spoiler

1 drag your .3ds rom onto "crtkeygen.exe" this will create a file called ncchinfo.bin in the same folder as your rom

2. copy the XORpad generator (launcher.dat) from the "For the 3DS SD card" folder in this download to the 3DS's SD card
and the ncchinfo.bin that was generated in step 1, then pop the SD back in the 3DS and go to DS profile, this will generate the
Xor pads used to decrypt the game.(this step can be a little buggy if it stays on "opening ncchinfo.bin" for more than a few seconds
reset the console and repeat untill it kicks into action)

3. copy your ROM and XOR pads here, leave out any CTR-P-CTAP.romfs*.xorpad files they are un-needed and may cause issues you just need
the 3 Xor pads for the game exefs,romfs and exh


4. run unpackv2.bat, enter your roms filename (may help if you rename it to something easy like rom.3ds)
go into the "decrypted" folder then "romfs",
make your edits,

5. Go back to the main directory and run makerom.bat

6. If all goes well and you will be given romedited.3ds in the main folder.


thanks to ground for the neat and tidy decryption script,and everyone involved in making the tools
http://filetrip.net/dl?klFzuXHgmF

Using the bbb pokemon zero key encrypted roms as a base

Spoiler

DOWNLOAD BOBMCJR VERSION
(FIXED)
1.- Get Pokemon Crystal 3ds VC game
2.- Move the pokemon 3DS VC game to the prepare.bat
3.- Move the GBC/NES game to create3ds.bat or createcia.bat
4.- Fill out the prompts
5.- Wait and it's done!!
DOWNLOAD
https://gbatemp.net/attachments/vcpkg-zip.14975/
this is just the method copied from here
http://gbatemp.net/threads/gbc-vc-generator.371819/
Note that GBA and FDS roms will not work with the BBB Pokemon base, and someone makes an updated tnes.exe, AxROM NES ROMs will not be automatically converted.

Popular Mods that will work on all different systems

Spoiler

Full screen

Spoiler

mod, so depending on the rom you intend to run in full screen, make this adjustment in the config.ini file found in the RomFS of your decrypted rom, find the header for the system you are wanting to full screen i.e [NES][GBC] [AGB]
once at the correct header the options underneath let you toggle various features so for example setting the "Width" to 400 on all systems will make the game play in fullscreen

Get rid of the delays in bringing up the VC menu and saving

Spoiler

again in the config.ini file found in RomFS, if you go to the bottom of the ini you will see options to change the [MENU] settings, here if you change all the delays to 0, the VC system will be much more responsive instead of having delays between trying to enter the VC menu

Adding games for various systems

Spoiler

GB/C

Spoiler

simply get a .gb or .gbc rom rename it to follow the naming structure that the VC uses, you don't need to stick to the built in name like Dmgazlp2.f11, you can go for something more recognizable like POKEMONY.F11 (not sure what the limits of the file name are so try to stick to similar to the original setup)

also for GBC its best to make sure you only have a 1 rom inserted or it may cause issues, so don't for example leave the original rom in there too when rebuilding

GBA

Spoiler

another simple one, remove the old roms and copy a GBA rom into the rom folder, the name to match a similar set up to the old filename (but not exactly the same) and leave the extension as .gba so for example you could have AdvanceW.gba

worth noting the GBA emulation is very poor, very slow and only works on smaller roms i think after about 4MB it will just crash the 3DS

NES

Spoiler

this one is actually the biggest pain in the butt, basically nintendo doesn't use the normal public method of headers for NES roms (suppose its to be expected),

ok so me and alexenochs got the header layout figured out, so now you should be able to generate you custom header to play pretty much all nes games on the nes VC,
basically the format is
54 4E 45 53 XX YY ZZ 00 01 MM? 00 00 00 00 00 00
XX= Mapper type
YY= PRG
ZZ= CHR
MM= possibly mirroring....not sure though

mapper types we figured out so far are
00= none 01 = MMC1 03=MMC3 05=MMC5 06=UNROM
PRG and CHR are added in 8kb blocks, so 01=8kb, 10=128kb,20=256kb etc

so now you should be able to generate your own header to match the rom you want to inject meaning you aren't tied to only roms that have the same header as released NES VC games

so check here for the details of any given game and edit the header appropriately
http://tuxnes.sourceforge.net/nesmapper.txt

As a bonus feature that only seems to work with nes roms you can actually insert more than one rom in the "rom" folder, and when you start it up you will be able to select the game you want......it will really help giving the games recognizable file names this time, and it seems the only way to get back to the menu is to exit and reload the rom..........but it works

Making your own banners and icons

Spoiler

fist you will need to get python and Pillow to use these tools, install both of them and then download
3DSBannerMaker

edit you pictures, running the python script(icon.py,banner.py respectively) in each folder after editing, then once all your icons/banners are edited go back to the main folder, edit the AppData.txt to change the name etc and then run _buildscript.py (using the build.bat would require setting up environment variables which i cba explaining atm, running the .py file will work fine anyway)

one thing to note is that you will need to edit the RSF file for each game or you will end up having cached icons ruining your work, to make sure your custom icons show up between each game, be sure to edit "UniqueId : 0x123456" (in the rsf file)for each custom rom injection you make to avoid icon conflicts

copy the icon.icn and banner.bnr that are outputted into the /decrypted/exefs folder of your VC build, delete/rename the existing banner.bin and icon.bin and rename the banner.bnr and icon.icn to *.bin, and dont forget to make the adjustment to the rsf.rsf file to give each game a unique ID or they will just keep loading the old games icon and name in the menu

and i think that's it, if i have missed anything out let me know, and inb4, what about gamegear/master system, it appears the roms are compressed for them, so unless a way to compress roms using the same method is found, you cant do GG/SMS

have fun everyone

PLEASE NOTE: these custom VC games will not work on R4i DE,3DSlink or orange3ds, as they dont have "homebrew" loading capabilities yet

--------------------- MERGED ---------------------------

Found a new one, CxROM is either 07 or 08.

I found that by trying to convert a game (Milon's Secret Castle) using CROM and so, I created several roms with a different value (07 ; 08 ; 0A ; 0B ; 0C ; 0D ; 0E ; 0F) and it appears that two values make the game runs correctly, with other ones, the game either doesn't boot at all or have mixed tiles.

As two values works fine, I can either suppose the game support several values/mapper or either both values are the same for the VC emulator.

So here's an up-to-date list :

00 NROM
01 SxROM (MMC1)
02 PxROM (MMC2)
03 TxROM (MMC3)
04 FxROM (MMC4)
05 ExROM (MMC5)
06 UxROM
07 CxROM (seems to also work with 08, so try 08 is 07 is not making your game works).
09 AxROM
64 FDS (.tds)

Found some new mappers vrc4 (15) vrc6 (19) or (1A) and vrc7 is (1B)

 

[ric.]

Shit, sorry for the bump, but I'm in dire need of help.
I want to inject the Famicom game Summer Carnival 92 - Recca to a .cia for a friend of mine - tried looking for the actual .cia dump but no dice. So the next thing to do is inject it, right? I followed the steps from some tutorial I found on the ISO site that shall not be mentioned, created a banner.bin and icon.bin and everything - but when I get to the hex editing part where I'm supposed to change the header, the tutorial expects the first four bytes of the ROM's header to be 54 4E 45 53 (TNES), while the actual ROM's bytes are 4E 45 53 1A (NES.)
My question is, wat do? There's no way the game doesn't work with the VC emulator - it's been released officially so it has to - so there's clearly a step I'm missing here. Any help would be appreciated.
Also, in case it helps, here's the ROM information I got from the NES Mapper Reader:

MAPPER: 4 - Nintendo MMC3 Chipset [MMC3] [T(x)ROM], [MMC6] (H(x)ROM]
MIRROR: [Horizontal Mirroring ONLY]
PRG SIZE: 128kb (8 x 16kb pages )
CHR SIZE: 128kb (16 x 8kb pages)
VRAM: N/A
WRAM: No.

EDIT: Nevermind I just tried replacing the header and it worked just fine. Duh-doy.

 

[Cornholio309]

Asked this in another HANS VC Injection thread, but I figured I'd ask here too:

Does anybody understand how to extract NES ROMs from the VC? The most I understand is that they're two separate files but I can't find any info on how to make it a usable ROM. It's more of a curiosity thing and would love any responses that could point me in the right direction. Thank you!

 

[gamesquest1]

Asked this in another HANS VC Injection thread, but I figured I'd ask here too:

Does anybody understand how to extract NES ROMs from the VC? The most I understand is that they're two separate files but I can't find any info on how to make it a usable ROM. It's more of a curiosity thing and would love any responses that could point me in the right direction. Thank you!

decompress rpx, search for "NES" and if you have any experience with NES roms you can probably figure the rest out by yourself.....oh and the rom in the RPX is all in one piece

 

[Cornholio309]

decompress rpx, search for "NES" and if you have any experience with NES roms you can probably figure the rest out by yourself.....oh and the rom in the RPX is all in one piece

I appreciate the advice, but I'm still a bit confused on what exactly needs to be done.

I've already dumped my SMB3 VC romfs via braindump, and then used ctrtool.exe to extract my romfs.bin file. Once I've done that, I get a couple of folders, including one titled "rom", but none of them seem to have an rpx/rpl file anywhere. The only thing inside the "rom" folder is NESUM1A.055.

Do I need something else to dump the romfs, or am I looking for the wrong thing?

Here are some images of my dumped romfs.bin:

http://i.imgur.com/8H3xiwH.png
http://i.imgur.com/45LHaGm.png

 

[gamesquest1]

I appreciate the advice, but I'm still a bit confused on what exactly needs to be done.

I've already dumped my SMB3 VC romfs via braindump, and then used ctrtool.exe to extract my romfs.bin file. Once I've done that, I get a couple of folders, including one titled "rom", but none of them seem to have an rpx/rpl file anywhere. The only thing inside the "rom" folder is NESUM1A.055.

Do I need something else to dump the romfs, or am I looking for the wrong thing?

Here are some images of my dumped romfs.bin:

http://i.imgur.com/8H3xiwH.png
http://i.imgur.com/45LHaGm.png

oh sorry my bad though this was the wiiu thread

, as for 3DS you can just take that NESUM1A.055 file, find the normal rom dump online for SMB3 and take the header from the normal dump and replace the TNES header used for 3DS NES roms

 

[Keizel]

Any method for inyect NES to VC? The first post looks very difficult... Any program?

 

[Deleted User]

Any method for inyect NES to VC? The first post looks very difficult... Any program?

It's very hard to do so and I don't even know either, but amloast every NES are already converted to VC if you check at the iso site.

 

[Asia81]

SNES is really more easy to inject vs NES, wtf

 

[Keizel]

It's very hard to do so and I don't even know either, but amloast every NES are already converted to VC if you check at the iso site.

Thank you, I found that I was searched!