ROM Hack [Tutorial] How to Decrypt, Extract & Rebuild 3DS|CIA|CXI Files

[nero99]

With this tutorial, you will be able to decrypt, extract, and rebuild a 3DS ROM.
You will also be able to launch X/Y, OmegaRuby/AlphaSapphire without having to update.

Thanks a lot to Ericzander & BullyWiiPlaza for their help to translate this tutorial in english
(Because I'm French, it’s difficult to make a full tutorial in a good English...)

This tutorial will try to help you decrypt a 3DS ROM to change its content and will also explain how to rebuild an edited game.
The decryption method is the same for all 3DS games developed with SDK 7.X or lower.

Ce tutoriel est également disponible pour les français ici :
This tutorial is also available for french user here:
http://www.pokemontrash.com/jeux-pokemon/decrypter-compiler-rom-3ds.php

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Summary:​

- What you need
- Prerequisites
- With Internet (More faster)
- Without Internet
- Edit your Game
- Rebuild your Game​

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

What you Need​

• A 2DS/3DS/3DSXL/N3DS/N3DSXL with SysNand Firmware between 4.1 and 9.2 for obtaining your Xorpads
• Only Gateway3DS, Sky3DS (up to 9.2 and LayeredFS) PastaCFW, RxTools, CakeFW, and ReiNandCFW are able to play an edited game
• A 3DS ROM (PokemonY.3ds, PokemonAlphaSapphire.3ds, etc...)
• WinRAR, or another archive extractor
• Cubic Ninja, Ninjhax already installed and Decrypt9, or a Sky3DS using Cubic Ninja. Just for obtaining Xorpads on N3DS<9.2
• A SD card (for the console) with a minimum free capacity of 4GB
• Download this Pack: Click Here
• Download Python 2.7.7 (and not another): Click Here
• Download Notepad++: Click Here
• Download RxTool: Click Here
• Download 3DS Simple CIA Converter: Click Here. Just if you want turn your HackRom in a CIA file.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Prerequisites​

Part 1 - Obtaining slot0x25KeyX.bin:
In the tool pack, you will find a slot0x25KeyX.bin file.
Open it with a HexEditor (HxD, PsPad, etc...) and replace 00 with the key.
Copy and paste the key (Search this on Govanify's Website).

The outcome will look like this:

Part 2 - Python Installation:
Now, we will install Python 2.7.7.
To do this, download Python in What you Need, run the Python 2.7.7.msi file, choose the default installation directory, C:\Python27 and allow the installation to complete.

Once all these tasks are completed, you will have to add links in the "Path" environment variable.
For this you need to go to Start, right-click on My Computer, choose Properties in the context menu, click on Advanced System Settings and finally Environment Variables....
Then in the lower column System Variables, find the line Path, double-click it.
A window appears. At the end of the line Variable Value, append this:

;C:\Python27

Done, the prerequisites of the installation are complete.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

With Internet
Faster, because xorpads are useless.​

Part 1 : Decrypt your rom with RxTool

First, you will need to download RxTools. Once it's done, do this :

Put in the root of your SD Card:
- rxTool.dat
- slot0x25KeyX.bin (If your SysNand is 7.X or higher, your slot0x25KeyX.bin is useless)
- YourRom.3ds (or named as you want)

Launch the WebBrowser, erase cookies and data, and go to this URL:

http://launch.rxtools.net
http://www.launch.rxtools.net
http://dukesrg.no-ip.org/3ds/go/?rxTool.dat

Now, go in Decryption Options and launch Decrypt CTR Titles:

Once it's finished, remove your SD Card and put it in your computer.
Now, your 3DS ROM is decrypted.
It means that your xorpads are useless.

Part 2 : All Scripts in One

Double-click on HackingToolkit.bat.
Enter D, and enter your 3DS ROM name here (Without .3ds).

3 files will be created:
- DecryptedExHeader.bin
- DecryptedExeFs.bin
- DecryptedExeFS.bin

The ExeFS content will be extracted in an exe folder.
The RomFS content will be extracted in a romfs folder.

Now you’re able to edit the game.
Look at the bottom of this post.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Without Internet​

Part 1: Obtaining Ncch file and Xorpads

Part 1.1: Obtaining Xorpads on 4.5 (O3DS)

Head into the PackHack folder.
Take your 3DS ROM.
Rename it with a simple name, such as PokemonAlphaSapphire.3ds.

Attention: Don’t put an accent or space in the name or you might run into problems!

Drag&Drop your 3DS ROM onto the ctrKeyGen_Normal.py file.
A ncchinfo.bin file is generated.

Copy the files Launcher.dat, slot0x25KeyX.bin, and the file ncchinfo.bin onto your SD card (the one you're using for the 3DS, also overwriting all prompts).
Do not insert any flashcard into the console, just the SD card with the files I have just mentioned.

Go into the settings of the Nintendo 3DS, then Other Settings, Profile, press the L button and enter Nintendo DS Profile at the same time.
You will access a menu with 5 options, place the cursor onto the first option (NCCH padgen) and press A:

Wait while creating Xorpads files, this could take a while.
Once all Xorpads are generated, put your SD Card back into your PC, copy the generated .xorpad files and paste them to the root of the folder PackHack.

Part 1.2: Obtaining Xorpads on 9.2 (O3DS / N3DS)

Head into the PackHack folder.
Take your 3DS Rom.
Rename it with a simple name, such as PokemonAlphaSapphire.3ds.

Attention: Don’t put an accent or space in the name or you might run into problems!

Drag&Drop your 3DS ROM onto the ctrKeyGen-Decrypt9.py file.
A ncchinfo.bin file is generated.
Copy the files slot0x25KeyX.bin and ncchinfo.bin in a Decrypt9 folder at the root of you SD Card.

Put the Decrypt9 folder (included in my Pack) in a 3ds folder, himself at the root of your SD Card.
Run Cubic Ninja, QR Code, and launch Decrypt9.
Choose NCCH Padgen by pressing A.

Wait while creating Xorpads files, this could take a while.
Once all Xorpads are generated, put your SD Card back into your PC, copy the generated .xorpad files and paste them to the root of the folder PackHack.

Part 2 : All Script in One

Double-click on HackingToolkit.bat.

Enter SDK6 or SDK7:

Enter the file name and the TitleID of your game/file:

Choose if you want decompress or not your code.bin file:

Read all steps.

The ExeFS content will be extracted in an exe folder.
The RomFS content will be extracted in a romfs folder.

Now you’re ready to edit the game.
Look at the bottom of this post.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Edit your Game​

Do what you want.
Edit music, textures..
If you follow this tutorial, you know what you want to do.
Once it's finished, rebuild your game.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Rebuild your Game​

Part 1 : Rebuild your RomFS

You need to rebuild your RomFS.
Open RomFS Builder, with it open your romfs folder (in PackHack)

Click GO. Wait and save it named romfs.bin:

Done !

Part 2 : Rebuild your Rom

Open 3DS Builder.

Open a romfs folder, or check the Use Pre-Built Romfs box and select a RomFS binary (Decrypted or Rebuild).

Open an exe folder, or check the Use Pre-Built Exefs box and select a ExeFS binary (Decrypted or Rebuild).

Open the DecryptedExHeader.bin for the game you're rebuilding.
If the game in question was released before the tool, 3DS Builder should recognize the game's name and provide the correct serial.
You can also enter a custom serial, if you want, of the form (CTR|KTR)-(P|U|N)-([A-Z0-9]){4}.

Choose a location to save the resulting file.

Hit go, and the program will generate a playable .3ds.

Optional: Turn this .3ds in .cia for CFW

Put the .3ds in the rom folder.
Open the tool.
Check FW Spoof and hit Convert 3DS ROM to CIA.
Target the rom folder.
Wait, and the tool will generate a cia file in the cia folder.

Credits:
CTRTool : Neimod
3ds_extract.py : Nagato
3DSExplorer Mod : Elisher & 3DSGuy
ctrulib : Smealum
Makerom : 3dsguy
3DS Multi Decryptor (CtrKeyGen) : Relys
Padxorer : xerpi
RomFS Builder : SciresM
RxTool : Roxas75
Decrypt9 : Archshift
Decrypt9 (3DSX and Python Scripts) : d0k3 and Shadowtrance
3DSFAT16Tool.exe : d0k3
3DS Simple CIA Converter : RikuKH3
This tutorial :3 : Asia81/Mizoré
This stupid batch :3 : Asia81/Mizoré

Thanks to:
Megadrifter
Stratovarius
Reisyukaku
Weby
Guitoh
Apache Thunder
Ericzander
BullyWiiPlaza​

This isnt creating a romfs folder for me.. only the exefs.

 

[Thelostrune]

This isnt creating a romfs folder for me.. only the exefs.

Are you using the right xorpad?

 

[nero99]

Are you using the right xorpad?

Yup. Followed every step in the tutorial exactly. it only puts out the exrfs folder, but then a folder called decrypted with romfs.bin, exheader.bin, and exefs.bin.

 

[Asia81]

can you give me a screenshot of all your folder?

 

[keithC]

So I am not sure what I am doing wrong but I have followed the tutorial step by step and just finished decrypting my rom with rxtools.

Now when I run the hackingtoolkit.bat enter d then my rom name without.3ds it just says could not open file and asks do I want to decompress the code.bin.

Can anyone help,
where am I going wrong?

Thanks

 

[Asia81]

Are you sure your ROM.3ds doesn't have special characters (something like, é, o) or spaces in its name?

 

[keithC]

Are you sure your ROM.3ds doesn't have special characters (something like, é, o) or spaces in its name?

No special characters, I have even tried with the original rom dump name and renaming the rom.

Finally got this working. For some reason it would only read the rom if it was in the pack hack folder.

 

[Mojay]

i tried to run HackingToolKit.bat, i put the rom name and says "The application was unable to sart correctly (0xc000007b). Click OK to close the application." Is it an issue from my computer itself or from the program itself. (ctrtool.exe was the app that was unable to launch).

 

[Asia81]

i tried to run HackingToolKit.bat, i put the rom name and says "The application was unable to sart correctly (0xc000007b). Click OK to close the application." Is it an issue from my computer itself or from the program itself. (ctrtool.exe was the app that was unable to launch).

It seems like ctrtool can't be launch on your pc.
Try to find another version of ctrtool, but I can't help you for that, sorry.

 

[keithC]

Hi

So following the guide I was able to successfully randomize pokemon X.

Now I am trying to randomize omega ruby following the same steps as before but I can not get it to load past the 3ds screen.

I have read some other posts about this issue but can not seem to find a solution.

Any help would be appreciated.

So just to post a fix for this, it was completely my fault.

When I first started I had a problem with my internal memory card and swapped it out.
This means I also removed my updated emunand software.

So the whole time I was trying to load Omega Ruby on sysnand 6.0.

This is why pokemon x would load and not Oras.

Also a big Thank you to Asia81 for the great guide.

 

[Chocsy]

help...
i want to randomize my alpha sapphire so bad, so i had to decrypt the rom.
i followed the tutorial (https://gbatemp.net/threads/tutoria...oms-run-xy-oras-without-update.383055/page-17).
but i got stuck at this (see below) part cause nothing happens when i go to the urls... i tried to visit them seperatly, or combined, in emunand or in sysnand, nothing works, the first url only opens a loading page which loads endless and the other pages simply do nothing.
what am i doing wrong?
my sysnand is 9.2 and my emunand is 9.5. i am using a new3dsXL.

""Part 1 : Decrypt your rom with RxTool

First, you will need to download RxTools. Once it's done, do this :

Put in the root of your SD Card:
- rxTool.dat
- slot0x25KeyX.bin (If your SysNand is 7.X or higher, your slot0x25KeyX.bin is useless)
- YourRom.3ds (or named as you want)

Launch the WebBrowser, erase cookies and data, and go to this URL:
Code:
http://launch.rxtools.net
http://www.launch.rxtools.net
http://dukesrg.no-ip.org/3ds/go/?rxTool.dat

Now, go in Decryption Options and launch Decrypt CTR Titles""

 

[Asia81]

Because via internet it's just for O3DS.

 

[Chocsy]

ohhhhhhhhhh. okay. thanks!! ^^ """

 

[Cilerba]

I used this tutorial to decrypt and recompile Animal Crossing New Leaf but whenever I recompile it, I get this blank icon. Any idea why?

 

[troa11]

I'm getting the same result. I also noticed that while I get a decryptedexefs.bin, I get nothing in the exe folder. Rom folder is fine and full of the proper files. I'm using RX with pasta nightly to decrpyt a dump of my personal ACNL rom on a NA N3DS XL.

 

[Cilerba]

I get an "ExeFS section X size invalid:" error when decompressing code.bin so I'm assuming that's got something to do with it. I'm getting an empty exe folder as well.

 

[ultimatetemper]

Just a question.
I replaced some music and randomized Alpha Sapphire, do I have to delete Alpha Sapphire's data to get it working?
(The music is in the romfs folder, BTW)

 

[Urbanshadow]

I got all the way along and I succesfully created a layerfs.plg for alpha saphire. Even the game boots flawlessly, but I dont see ANY changes in the game. I called the layerfs folder with the title id of the game, and I have a sd:/title_id_here/modded_files . What am I doing wrong?
The game flashes green at startup so I assume layerfs.plg is fine.

EDIT: Oh ok, I now see... I have .bin files to inject into romfs game files. NVM, got it!!

 

[Asia81]

Can someone try my new script (.exe now) and see if you can use it without problems?
No need to have ctrtool and padxorer in the folder, they are included in my exe (Try in an empty folder)!

http://uptobox.com/sz6ryupwn4ou

@Cyan
Could you help me and tell me why I can't upload the .rar on GBA-Temp using "Upload a file"?
It's just a .rar (174kb) with a .exe inside

 

[Cyan]

I don't know, the rar seems to be an accepted format, and your file is smaller than 2MB. it should work.
You can upload it to filetrip if you want too.