Homebrew TWLbf - a tool to brute force DSi Console ID or EMMC CID

JimmyZ

Sarcastic Troll
OP
Member
Joined
Apr 2, 2009
Messages
681
Trophies
0
XP
762
Country
Zimbabwe
So, I habe read the OP.... but I still don't geht it where I'm supossed to take the month/year data code from the EMMC Chip. I already habe my CID from a TBL copy but I also would like to test this programm.
It should be the 3 digits after "SAMSUNG", for example:
CC, DSi XL, U, Burgundy, report from kittensauce, SAMSUNG 949 KMAPF0000M-S998 N24N5GJB
I guess 949 means 2009 49th week, so 49th week -> december -> Month code C, 2009 -> Year code C.

Oh my, my fault! While the information provided (ConsoleID and CID) is correct, that second DSi doesn't have A-F digits in ConsoleID. I've just made a mistake when writing this post (I was writing this when I was at work thinking about other stuff and I've written information about the digits after writing full values and read them from the footer, where the value is reversed). :glare: I'm so sorry about this one. Still, if you are still anyhow interested in NAND dump please let me know, but I assume you were interested due to the A-F digits in ConsoleID but it was just my typo. Just in case I'll provide full ConsoleID and CID if you want.

Sorry again for the mistake.
Nothing to be sorry for :) I needed some samples of NAND dumps when developing this, now I have plenty except some really strange cases, so thanks for the offer :)
 
Last edited by JimmyZ,
  • Like
Reactions: FFT and Sahaquiel

Sahaquiel

Member
Newcomer
Joined
Dec 13, 2017
Messages
23
Trophies
0
XP
208
Country
Germany
It should be the 3 digits after "SAMSUNG", for example:
CC, DSi XL, U, Burgundy, report from kittensauce, SAMSUNG 949 KMAPF0000M-S998 N24N5GJB
I guess 949 means 2009 49th week, so 49th week -> december -> Month code C, 2009 -> Year code C.


Nothing to be sorry for :) I needed some samples of NAND dumps when developing this, now I have plenty except some really strange cases, so thanks for the offer :)

Thank you, now I got it.
I got "022" on my chip. "0" stands for 2010, the 22 divided trough 4 is 5,5. 2010 is equivalent to "D". And Nintendo seems to round up the numbers, because my CID dumped from the TBL exploit is " 6" not "5,6".

EDIT: In a few days I will post here my CID, Console ID and PM you the EMMC dump.
 
Last edited by Sahaquiel,

Sahaquiel

Member
Newcomer
Joined
Dec 13, 2017
Messages
23
Trophies
0
XP
208
Country
Germany
Hey I want to give you some information from 4 mainboards that I habe. I can't take good pictures so I only can say what I see. All consoles are European and XL.

1. (Touch screen ribbon cable broken)
Color: Grey
EMMC: SAMSUNG 940 KMAPF0000M-S998 N21H6MG9
CID: Nope
Console ID: Nope
NAND dump: Yes, I will PM it.

2. (accidently desoldered the CLK chip)
Color: Grey
EMMC: SAMSUNG 946 KMAPF0000M-S998 N23A3WG5
CID: Nope
Console ID: 0820151514115110 (I can't say to 100% but it should be that)
NAND dump: Maybe (If you want I can search it)

3. (accidently desoldered the chip under the CLK chip)
Color: 25th Anniversary Edition OR unknown
EMMC: SAMSUNG 022 KMAPF0000M-S998 N2CXFFJ7
CID: Nope
Console ID: Nope
NAND dump: Nope

4. (the only one not broken and being used normaly)
Color: 25th Anniversary Edition OR unknown
EMMC: SAMSUNG 022 KMAPF0000M-S998 N2CXEHJ8
CID: PM
Console ID: PM
NAND dump: Yes, PM

5.
Color: Grey
EMMC: Coming soon™
CID: PM (soon™)
Console ID: PM (soon™)


I hope that information is useful and ask if you have any questions.
 
Last edited by Sahaquiel,
  • Like
Reactions: JimmyZ

JimmyZ

Sarcastic Troll
OP
Member
Joined
Apr 2, 2009
Messages
681
Trophies
0
XP
762
Country
Zimbabwe
Hey I want to give you some information from 4 mainboards that I habe. I can't take good pictures so I only can say what I see. All consoles are European and XL.

1. (Touch screen ribbon cable broken)
Color: Grey
EMMC: SAMSUNG 940 KMAPF0000M-S998 N21H6MG9
CID: Nope
Console ID: Nope
NAND dump: Yes, I will PM it.

2. (accidently desoldered the CLK chip)
Color: Grey
EMMC: SAMSUNG 946 KMAPF0000M-S998 N23A3WG5
CID: Nope
Console ID: 082015151 (I can't say to 100% but it should be that)
NAND dump: Maybe (If you want I can search it)

3. (accidently desoldered the chip under the CLK chip)
Color: 25th Anniversary Edition OR unknown
EMMC: SAMSUNG 022 KMAPF0000M-S998 N2CXFFJ7
CID: Nope
Console ID: Nope
NAND dump: Nope

4. (the only one not broken and being used normaly)
Color: 25th Anniversary Edition OR unknown
EMMC: SAMSUNG 022 KMAPF0000M-S998 N2CXEHJ8
CID: PM
Console ID: PM
NAND dump: Yes, PM

5. (it's not arrived yet)


I hope that information is useful and ASK if you have any questions.

Thanks for the offer, but I've had enough samples :)

BTW do you know we can brute with only the dump(or 32 bytes of the dump to be exact) now? nothing else required, like the first case.
 

Sahaquiel

Member
Newcomer
Joined
Dec 13, 2017
Messages
23
Trophies
0
XP
208
Country
Germany
Thanks for the offer, but I've had enough samples :)

BTW do you know we can brute with only the dump(or 32 bytes of the dump to be exact) now? nothing else required, like the first case.

So, you don't even want the ID's? God damn it xD
Yeah I know. And I want to do that because that was my first console and I bought a couple of games on it.
 

Corbanite

New Member
Newbie
Joined
Feb 12, 2018
Messages
1
Trophies
0
Age
22
XP
51
Country
New Zealand
Hi JimmyZ, this looks really awesome for people without usa consoles. I in particular am quite new to the dsi modding scene and am currently modding my friends 1.4A Australian console (non XL). I have soldered up a hardmod and have dumped 3 successful matching nands, but i am having trouble using this tool. How would i be able to brute both the CID and Console ID from just the single nand file? I tried using the read me but couldn't fully understand everything. Any help from anyone would be greatly appreciated. Thanks!
 

JimmyZ

Sarcastic Troll
OP
Member
Joined
Apr 2, 2009
Messages
681
Trophies
0
XP
762
Country
Zimbabwe
Hi JimmyZ, this looks really awesome for people without usa consoles. I in particular am quite new to the dsi modding scene and am currently modding my friends 1.4A Australian console (non XL). I have soldered up a hardmod and have dumped 3 successful matching nands, but i am having trouble using this tool. How would i be able to brute both the CID and Console ID from just the single nand file? I tried using the read me but couldn't fully understand everything. Any help from anyone would be greatly appreciated. Thanks!
Sorry, the documentation haven't been updated for a while, this functionality is not documented yet and only implemented in bfCL, not TWLbf.

I believe you've already read this: https://github.com/Jimmy-Z/TWLbf/blob/master/README.md
bfCL use the exact same command line interface, if you want brute both, first you use this syntax to brute console ID without EMMC CID
Code:
bfcl console_id_bcd [Console ID] [offset0] [src0] [verify0] [offset1] [src1] [verify1]
the second set of offset/src/verify would be 16 bytes from offset 0x00, and use 00000000000000000000000000000000 as [verify].
related code is here: https://github.com/Jimmy-Z/bfCL/blob/master/bfcl.c#L27-L44

Then you use this console ID and ordinary way to brute EMMC CID.
 
Last edited by JimmyZ,

The Only Me

New Member
Newbie
Joined
Jan 30, 2008
Messages
3
Trophies
0
Age
31
Location
Netherlands
XP
264
Country
United States
Nice tool, with some effort I got it working on Linux too. I'm pretty impatient though, any way to make bfCL use all 8 of my 1080 Tis? Right now it's only using one.
EDIT: nvm, just realized I can do it the same way as for multiple CPU threads.
 
Last edited by The Only Me,

JimmyZ

Sarcastic Troll
OP
Member
Joined
Apr 2, 2009
Messages
681
Trophies
0
XP
762
Country
Zimbabwe
Nice tool, with some effort I got it working on Linux too. I'm pretty impatient though, any way to make bfCL use all 8 of my 1080 Tis? Right now it's only using one.
EDIT: nvm, just realized I can do it the same way as for multiple CPU threads.
Well if you run multiple instance of bfCL, they'll all choose the same GPU, but that shouldn't be too hard to change.
 

Maritoguionyo

New Member
Newbie
Joined
Mar 13, 2018
Messages
4
Trophies
0
XP
261
Country
United States
DSI XL, U, Midnight Blue Edition/Dark Blue (where the outside camara is (not the back of the buttons) (and where the screens are)) and black (the back side of the front buttons) (Has Reflection) Brain Age Math & Letters... Edition
Console ID:
First 5 Digits: 08202
The 14th number is 1
eMMC CID: 5d zz zz zz zz 03 4d 30 30 46 50 41 00 00 15 zz
(ZZ means Skip)

Edit: doesn't have any letters (Console ID):P
(Going to add another DSI later DSI XL, U, Matte Red Edition/Red Dark (blackish like[Refle])) (Has Reflection) Brain Age Math & Letters... Edition
 
Last edited by Maritoguionyo,

catalin

Member
Newcomer
Joined
Mar 26, 2018
Messages
9
Trophies
0
Age
34
XP
57
Country
Romania
Hello guys.

I'm new here and to the DSi modding stuff.
I try to find my CID and Console ID.

I have first an error with bfcl. When i run it without parameters (or with them) i get this:
selected device GeForce GTX 980 on platform NVIDIA CUDA
mbed TLS 2.6.0, AES-NI supported
AES Key: 0d0b8bd02564dd0351d7e415e6f23f36
randomize source buffer using AES OFB
0.313 seconds for preparing test data, 429.03 MB/s
0.056 seconds for OpenCL compiling
failed to compile program, error: code: -11, build log:
<kernel>:479:12: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
uint32_t *RK = rk;
^ ~~
<kernel>:496:12: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
uint32_t *RK = rk, *SK = sk;
^ ~~
<kernel>:505:5: error: implicit conversion from address space "generic" to address space "private" is not supported in assignment
RK = rk;
^ ~~
<kernel>:576:18: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
const uint32_t *RK = rk;
^ ~~
<kernel>:626:18: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
const uint32_t *RK = rk;
^ ~~
<kernel>:686:11: warning: incompatible pointer types passing 'uint32_t __attribute__((address_space(16776963)))[4]' to parameter of type '__attribute__((address_space(16776963))) unsigned char *'
sha1_16(buf);
^~~
<kernel>:34:29: note: passing argument to parameter 'io' here
void sha1_16(unsigned char *io)
^

I cannot seem to find anything to make it work. Can you please help me?

Also, trying to use twlbf don't get me anywhere.

My emmc date code is 931. This would be 2009 (C) and month 7(so 7), and is transalted in 7C right?
Also, the chiop code is KMAPF0000M, so my emmc cid will be:
7C ss ss ss ss 03 4D 30 30 46 50 41 00 00 15 00?

Third thing would be that i have no idea where to put the dump file and how to name it, since it seems that i cannot really find anything about it.

Please help me a bit with some instruction of how to use this tool, and some help to fix bfcl error..

Will be really appreciate,
Thanks.

--------------------- MERGED ---------------------------

@
[SIZE=6][B]pedro-javierf[/B][/SIZE]
- i could help you with bruteforcing, but first, i will need to solve the issues i have
 
Last edited by catalin,

u12345678

Member
Newcomer
Joined
Aug 19, 2016
Messages
18
Trophies
0
XP
108
Country
Trinidad and Tobago
Hello guys.

I'm new here and to the DSi modding stuff.
I try to find my CID and Console ID.

I have first an error with bfcl. When i run it without parameters (or with them) i get this:
selected device GeForce GTX 980 on platform NVIDIA CUDA
mbed TLS 2.6.0, AES-NI supported
AES Key: 0d0b8bd02564dd0351d7e415e6f23f36
randomize source buffer using AES OFB
0.313 seconds for preparing test data, 429.03 MB/s
0.056 seconds for OpenCL compiling
failed to compile program, error: code: -11, build log:
<kernel>:479:12: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
uint32_t *RK = rk;
^ ~~
<kernel>:496:12: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
uint32_t *RK = rk, *SK = sk;
^ ~~
<kernel>:505:5: error: implicit conversion from address space "generic" to address space "private" is not supported in assignment
RK = rk;
^ ~~
<kernel>:576:18: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
const uint32_t *RK = rk;
^ ~~
<kernel>:626:18: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
const uint32_t *RK = rk;
^ ~~
<kernel>:686:11: warning: incompatible pointer types passing 'uint32_t __attribute__((address_space(16776963)))[4]' to parameter of type '__attribute__((address_space(16776963))) unsigned char *'
sha1_16(buf);
^~~
<kernel>:34:29: note: passing argument to parameter 'io' here
void sha1_16(unsigned char *io)
^

I cannot seem to find anything to make it work. Can you please help me?

Also, trying to use twlbf don't get me anywhere.

My emmc date code is 931. This would be 2009 (C) and month 7(so 7), and is transalted in 7C right?
Also, the chiop code is KMAPF0000M, so my emmc cid will be:
7C ss ss ss ss 03 4D 30 30 46 50 41 00 00 15 00?

Third thing would be that i have no idea where to put the dump file and how to name it, since it seems that i cannot really find anything about it.

Please help me a bit with some instruction of how to use this tool, and some help to fix bfcl error..

Will be really appreciate,
Thanks.

I can't help you with the compile problem since I haven't experienced it, I suggest though to make sure you have OpenCL /whatever fails to compile installed and updated, also drivers and that.

As for the later, you don't really need the nand dump in the same folder at all (if I have understood correctly the documentation that, btw, it's not very clear). You just need an AES block, the documentation suggest to use the 16 bytes at 0x11f if I remember correctly. I remember but I'm not sure that 16 bytes at 0x0 can also be used as a second block in case you don't have the CID, since this program is able in theory to bruteforce without having it, but as I said you need 2 blocks. If you have the EMMC ID (aka CID) one block should be enough. Anyways, I haven't got it to work neither:

unknown.png


I think I'm not passing parameters correctly but again, the documentation isn't really clear. Concretely the template thing is really difficult to understand, also it isn't clear what to do with the template wheter you chose the bcd mode or the normal mode (I'm talking about Console ID not CID)

PS: Thanks tozeleal for the computing power xD
 

JimmyZ

Sarcastic Troll
OP
Member
Joined
Apr 2, 2009
Messages
681
Trophies
0
XP
762
Country
Zimbabwe
I have first an error with bfcl. When i run it without parameters (or with them) i get this:
selected device GeForce GTX 980 on platform NVIDIA CUDA
mbed TLS 2.6.0, AES-NI supported
AES Key: 0d0b8bd02564dd0351d7e415e6f23f36
randomize source buffer using AES OFB
0.313 seconds for preparing test data, 429.03 MB/s
0.056 seconds for OpenCL compiling
failed to compile program, error: code: -11, build log:
<kernel>:479:12: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
uint32_t *RK = rk;
^ ~~
<kernel>:496:12: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
uint32_t *RK = rk, *SK = sk;
^ ~~
<kernel>:505:5: error: implicit conversion from address space "generic" to address space "private" is not supported in assignment
RK = rk;
^ ~~
<kernel>:576:18: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
const uint32_t *RK = rk;
^ ~~
<kernel>:626:18: error: implicit conversion from address space "generic" to address space "private" is not supported in initialization expression
const uint32_t *RK = rk;
^ ~~
<kernel>:686:11: warning: incompatible pointer types passing 'uint32_t __attribute__((address_space(16776963)))[4]' to parameter of type '__attribute__((address_space(16776963))) unsigned char *'
sha1_16(buf);
^~~
<kernel>:34:29: note: passing argument to parameter 'io' here
void sha1_16(unsigned char *io)
^

I cannot seem to find anything to make it work. Can you please help me?
This is fixed in https://github.com/Jimmy-Z/bfCL/commit/6db579158477d2aea6285d7861b8837f8b412833
The release package is falling behind, you could compile trunk, or apply the diff to the cl directory.

the documentation isn't really clear.
Which part?
 
Last edited by JimmyZ,

catalin

Member
Newcomer
Joined
Mar 26, 2018
Messages
9
Trophies
0
Age
34
XP
57
Country
Romania
Hi again.

i have applied the diff from /cl folder (after trying to compile it in windows, without success, i keep getting /bin/sh: -c: line 0: unexpected EOF while looking for matching `"' error).
Now it get pastthe previous error related to nvidia, but it stops here:

c:\bfcl>bfcl.exe console_id_bcd 08A2010000000100 7C00000000034d303046504100001500 001f 3FBCCA88E4AC53CD32CB8155BDB36DC4 000000000000000000000000000055aa
selected device GeForce GTX 980 on platform NVIDIA CUDA
0.042 seconds for OpenCL compiling
failed to compile program, error: code: -11, build log:
<kernel>:522:3: error: 'long long' type is not supported
{0xbd4dc4d30ab9dc76ull, 0xe1a00005202ddd1dull};
^
<kernel>:522:26: error: 'long long' type is not supported
{0xbd4dc4d30ab9dc76ull, 0xe1a00005202ddd1dull};
^
<kernel>:525:3: error: 'long long' type is not supported
{0x2a680f5f1a4f3e79ull, 0xfffefb4e29590258ull};
^
<kernel>:525:26: error: 'long long' type is not supported
{0x2a680f5f1a4f3e79ull, 0xfffefb4e29590258ull};
^
From what i found is related to nvidia and their CUDA stuff.
Is there anything i can do?
 
Last edited by catalin,

JimmyZ

Sarcastic Troll
OP
Member
Joined
Apr 2, 2009
Messages
681
Trophies
0
XP
762
Country
Zimbabwe
Hi again.

i have applied the diff from /cl folder (after trying to compile it in windows, without success, i keep getting /bin/sh: -c: line 0: unexpected EOF while looking for matching `"' error).
Now it get pastthe previous error related to nvidia, but it stops here:

c:\bfcl>bfcl.exe console_id_bcd 08A2010000000100 7C00000000034d303046504100001500 001f 3FBCCA88E4AC53CD32CB8155BDB36DC4 000000000000000000000000000055aa
selected device GeForce GTX 980 on platform NVIDIA CUDA
0.042 seconds for OpenCL compiling
failed to compile program, error: code: -11, build log:
<kernel>:522:3: error: 'long long' type is not supported
{0xbd4dc4d30ab9dc76ull, 0xe1a00005202ddd1dull};
^
<kernel>:522:26: error: 'long long' type is not supported
{0xbd4dc4d30ab9dc76ull, 0xe1a00005202ddd1dull};
^
<kernel>:525:3: error: 'long long' type is not supported
{0x2a680f5f1a4f3e79ull, 0xfffefb4e29590258ull};
^
<kernel>:525:26: error: 'long long' type is not supported
{0x2a680f5f1a4f3e79ull, 0xfffefb4e29590258ull};
^
From what i found is related to nvidia and their CUDA stuff.
Is there anything i can do?
Sorry, as stated before, I don't have a nvidia GPU, so this might not be fixed in a foreseeable future, if you're impatient, maybe ask a friend with AMD GPU to do this for you.

BTW, from the command line you posted, it looks like you don't know your EMMC CID? read this: https://gbatemp.net/threads/twlbf-a...ole-id-or-emmc-cid.481732/page-7#post-7831411
 

JimmyZ

Sarcastic Troll
OP
Member
Joined
Apr 2, 2009
Messages
681
Trophies
0
XP
762
Country
Zimbabwe
Hi again.

i have applied the diff from /cl folder (after trying to compile it in windows, without success, i keep getting /bin/sh: -c: line 0: unexpected EOF while looking for matching `"' error).
Now it get pastthe previous error related to nvidia, but it stops here:

c:\bfcl>bfcl.exe console_id_bcd 08A2010000000100 7C00000000034d303046504100001500 001f 3FBCCA88E4AC53CD32CB8155BDB36DC4 000000000000000000000000000055aa
selected device GeForce GTX 980 on platform NVIDIA CUDA
0.042 seconds for OpenCL compiling
failed to compile program, error: code: -11, build log:
<kernel>:522:3: error: 'long long' type is not supported
{0xbd4dc4d30ab9dc76ull, 0xe1a00005202ddd1dull};
^
<kernel>:522:26: error: 'long long' type is not supported
{0xbd4dc4d30ab9dc76ull, 0xe1a00005202ddd1dull};
^
<kernel>:525:3: error: 'long long' type is not supported
{0x2a680f5f1a4f3e79ull, 0xfffefb4e29590258ull};
^
<kernel>:525:26: error: 'long long' type is not supported
{0x2a680f5f1a4f3e79ull, 0xfffefb4e29590258ull};
^
From what i found is related to nvidia and their CUDA stuff.
Is there anything i can do?
Try this one: https://github.com/Jimmy-Z/bfCL/files/1860621/bfcl-test.zip
This is a blind fix so it might not work.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: Look at you holding tiny things