User talk:3dsguy - Revision history

Brayton1234567: /* Add me! 0662 - 4312 - 7555 */ new section

2016-09-10T16:56:30Z

Add me! 0662 - 4312 - 7555: new section

← Older revision		Revision as of 20:56, 10 September 2016
Line 86:		Line 86:
	:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)		:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)
	:That ExeFs seems to need decoding before trying to get anything from it (via disassemblers). So no usage now indeed (regarding yellow reading those in memory..)? or maybe we will need a customed disassembler dealing these for us? --[[User:Syphurith\|Syphurith]] 17:15, 21 June 2013 (CEST)		:That ExeFs seems to need decoding before trying to get anything from it (via disassemblers). So no usage now indeed (regarding yellow reading those in memory..)? or maybe we will need a customed disassembler dealing these for us? --[[User:Syphurith\|Syphurith]] 17:15, 21 June 2013 (CEST)

			== Add me! 0662 - 4312 - 7555 ==

			Add me! 0662 - 4312 - 7555

Syphurith: about exefs

2013-06-21T13:15:11Z

about exefs

← Older revision		Revision as of 17:15, 21 June 2013
Line 85:		Line 85:
	::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)		::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
	:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)		:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)
			:That ExeFs seems to need decoding before trying to get anything from it (via disassemblers). So no usage now indeed (regarding yellow reading those in memory..)? or maybe we will need a customed disassembler dealing these for us? --[[User:Syphurith\|Syphurith]] 17:15, 21 June 2013 (CEST)

Syphurith: Thx

2013-04-02T05:33:37Z

Thx

← Older revision		Revision as of 09:33, 2 April 2013
Line 76:		Line 76:
	::* Or simply let us wait for some progress?		::* Or simply let us wait for some progress?
	:::You need to read up on the 3DS file formats, and boot order. It's nowhere near as simple as that.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)		:::You need to read up on the 3DS file formats, and boot order. It's nowhere near as simple as that.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
			::::I know there is a page of how 3DS got boot up (haven't found one telling me how a title got launched). Well i think i should try to read those documents (especially those has 'boot' or those word) again. --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)

	::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry)~~'''~~I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.~~'''~~ if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)		::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry) I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex. if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)
	::You won't find the 3DS common key by analysing 3DS communications. The common key(s) are stored in two parts, and scrambled, deep inside the 3DS.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)		::You won't find the 3DS common key by analysing 3DS communications. The common key(s) are stored in two parts, and scrambled, deep inside the 3DS.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
			:::That's right (yellows8 edited 'ClCertA' page and i knew that days ago); i've given up finding one without hardware help (now waiting and also learning some basis about hardware methods from Hackmii). Thanks. --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)

	:I tried to check the 'exefs.bin' in your archive uploaded, and found it not easy to analyse. There're many things seems to be timestamps (that WinHex told me).. and those text inside are merely readable (but you can get 'NULL' or something else like 'Mem' or 'display'). I tried hard to get some but found that not useful as a clue. Also the header and reserved in exefs are 0x180 length now. If you can get many decrypted exefs.bin please tell me (especially those on a same branch of source code), thx. Well hope you get progress everyday. --[[User:Syphurith\|Syphurith]] 07:22, 2 April 2013 (CEST)		:I tried to check the 'exefs.bin' in your archive uploaded, and found it not easy to analyse. There're many things seems to be timestamps (that WinHex told me).. and those text inside are merely readable (but you can get 'NULL' or something else like 'Mem' or 'display'). I tried hard to get some but found that not useful as a clue. Also the header and reserved in exefs are 0x180 length now. If you can get many decrypted exefs.bin please tell me (especially those on a same branch of source code), thx. Well hope you get progress everyday. --[[User:Syphurith\|Syphurith]] 07:22, 2 April 2013 (CEST)
	::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)		::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
			:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)

3dsguy at 05:59, 2 April 2013

2013-04-02T03:59:17Z

← Older revision		Revision as of 07:59, 2 April 2013
Line 75:		Line 75:
	::* Crack the storage chips and use something like a proxy to record all the data streams to a prepared storage (or to PC)		::* Crack the storage chips and use something like a proxy to record all the data streams to a prepared storage (or to PC)
	::* Or simply let us wait for some progress?		::* Or simply let us wait for some progress?
			:::You need to read up on the 3DS file formats, and boot order. It's nowhere near as simple as that.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)

	::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry)'''I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.''' if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)		::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry)'''I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.''' if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)
			::You won't find the 3DS common key by analysing 3DS communications. The common key(s) are stored in two parts, and scrambled, deep inside the 3DS.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
	:I tried to check the 'exefs.bin' in your archive uploaded, and found it not easy to analyse. There're many things seems to be timestamps (that WinHex told me).. and those text inside are merely readable (but you can get 'NULL' or something else like 'Mem' or 'display'). I tried hard to get some but found that not useful as a clue. Also the header and reserved in exefs are 0x180 length now. If you can get many decrypted exefs.bin please tell me (especially those on a same branch of source code), thx. Well hope you get progress everyday. --[[User:Syphurith\|Syphurith]] 07:22, 2 April 2013 (CEST)		:I tried to check the 'exefs.bin' in your archive uploaded, and found it not easy to analyse. There're many things seems to be timestamps (that WinHex told me).. and those text inside are merely readable (but you can get 'NULL' or something else like 'Mem' or 'display'). I tried hard to get some but found that not useful as a clue. Also the header and reserved in exefs are 0x180 length now. If you can get many decrypted exefs.bin please tell me (especially those on a same branch of source code), thx. Well hope you get progress everyday. --[[User:Syphurith\|Syphurith]] 07:22, 2 April 2013 (CEST)
			::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)

Syphurith: about exefs

2013-04-02T03:22:37Z

about exefs

← Older revision		Revision as of 07:22, 2 April 2013
Line 76:		Line 76:
	::* Or simply let us wait for some progress?		::* Or simply let us wait for some progress?
	::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry)'''I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.''' if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)		::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry)'''I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.''' if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)
			:I tried to check the 'exefs.bin' in your archive uploaded, and found it not easy to analyse. There're many things seems to be timestamps (that WinHex told me).. and those text inside are merely readable (but you can get 'NULL' or something else like 'Mem' or 'display'). I tried hard to get some but found that not useful as a clue. Also the header and reserved in exefs are 0x180 length now. If you can get many decrypted exefs.bin please tell me (especially those on a same branch of source code), thx. Well hope you get progress everyday. --[[User:Syphurith\|Syphurith]] 07:22, 2 April 2013 (CEST)

Syphurith: correct a mistake i've made

2013-03-28T09:41:37Z

correct a mistake i've made

← Older revision		Revision as of 12:41, 28 March 2013
Line 75:		Line 75:
	::* Crack the storage chips and use something like a proxy to record all the data streams to a prepared storage (or to PC)		::* Crack the storage chips and use something like a proxy to record all the data streams to a prepared storage (or to PC)
	::* Or simply let us wait for some progress?		::* Or simply let us wait for some progress?
	::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system~~, first replace the cert inside 3ds, then~~ use ~~the true one~~ for ~~proxy~~, ~~and decrypt all the data.~~ '''I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.''' if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)		::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry)'''I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.''' if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)

Syphurith: Add fact about certificates

2013-03-28T09:31:28Z

Add fact about certificates

← Older revision		Revision as of 12:31, 28 March 2013
Line 75:		Line 75:
	::* Crack the storage chips and use something like a proxy to record all the data streams to a prepared storage (or to PC)		::* Crack the storage chips and use something like a proxy to record all the data streams to a prepared storage (or to PC)
	::* Or simply let us wait for some progress?		::* Or simply let us wait for some progress?
	::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system, first replace the cert inside 3ds, then use the true one for proxy, and decrypt all the data). is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)		::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system, first replace the cert inside 3ds, then use the true one for proxy, and decrypt all the data. '''I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.''' if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)

Syphurith: Understand that. and Questions.

2013-03-28T07:50:55Z

Understand that. and Questions.

← Older revision		Revision as of 10:50, 28 March 2013
Line 69:		Line 69:
	@[[User:3dsguy\|3dsguy]]: About the [[SHBIN]] in [[RomFS\|romfs.bin]]. Have you ever found there is .shbin inside it? Look at which you uploaded to dropbox (''today or yesterday, named "CIA"'') and find that one in folder "CIA\Extracted CIA Content\CXI extract" and check offset 0x10C0. There is [[SHBIN]] name "font_RectDrawerShader.shbin" just above the offset (with 00 padding, also with the length of name 0x3a). There is also some other clear text. you can extract the file in hex to check the shbin (maybe 0x3A0+0x8/0x18, of that file). if you think there is chance to check those shbin, you may have to fetch some different CIA that generated and decrypt and then extract its Romfs. i will be eager to see the ''extracted decrypted romfs''. If there is the proper source code of those files that may be even easier to check the function's ASM. (well best way is ''use dev unit to generate a series of versions of the title and extract all CIAs and decrypt to check those shbins'') --[[User:Syphurith\|Syphurith]] 05:07, 28 March 2013 (CET)		@[[User:3dsguy\|3dsguy]]: About the [[SHBIN]] in [[RomFS\|romfs.bin]]. Have you ever found there is .shbin inside it? Look at which you uploaded to dropbox (''today or yesterday, named "CIA"'') and find that one in folder "CIA\Extracted CIA Content\CXI extract" and check offset 0x10C0. There is [[SHBIN]] name "font_RectDrawerShader.shbin" just above the offset (with 00 padding, also with the length of name 0x3a). There is also some other clear text. you can extract the file in hex to check the shbin (maybe 0x3A0+0x8/0x18, of that file). if you think there is chance to check those shbin, you may have to fetch some different CIA that generated and decrypt and then extract its Romfs. i will be eager to see the ''extracted decrypted romfs''. If there is the proper source code of those files that may be even easier to check the function's ASM. (well best way is ''use dev unit to generate a series of versions of the title and extract all CIAs and decrypt to check those shbins'') --[[User:Syphurith\|Syphurith]] 05:07, 28 March 2013 (CET)
	:[[User:Syphurith\|Syphurith]], I knew about the .shbin in the RomFS. I've updated the archive to include it. It's not a particularly special file, I've seen it in lots of CXIs. You know you can use ctrtool to extract and view everything in the .CIA file, as it is a debug CIA. If you want the application's executable code, then you should look in the code.bin inside the "exefs_extracted" directory.--[[User:3dsguy\|3dsguy]] 07:07, 28 March 2013 (CET)		:[[User:Syphurith\|Syphurith]], I knew about the .shbin in the RomFS. I've updated the archive to include it. It's not a particularly special file, I've seen it in lots of CXIs. You know you can use ctrtool to extract and view everything in the .CIA file, as it is a debug CIA. If you want the application's executable code, then you should look in the code.bin inside the "exefs_extracted" directory.--[[User:3dsguy\|3dsguy]] 07:07, 28 March 2013 (CET)
			::@[[User:3dsguy\|3dsguy]], thanks for the information. well is there any way to check the relations that between assembly and source code? well i found those in exefs is salted (ie 0x5A03, with 0x00 0x10 0x20 chars. so if there is some source code of that CIA, the analyse can be even easier)(Since it is salted we may find out the salt hex and can make a tool to filter them all out). BTW, please take a look at these below:
			::* Generate CIA series with Dev Unit (i mentioned above) and decrypt and try to compare those generated to see the assembly.
			::* Decap the chip and try to gain the ''Creator Power'' and we can take down Home Menu then (but there should be lots of work to do).
			::* Check all the potential storage media to look for 3ds Common Key, and use that and cetk of firmware on CDN to decrypt the firmware and check if there is any exploits that patched so the devices with lower version would have a chance to break in.
			::* Crack the storage chips and use something like a proxy to record all the data streams to a prepared storage (or to PC)
			::* Or simply let us wait for some progress?
			::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system, first replace the cert inside 3ds, then use the true one for proxy, and decrypt all the data). is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)

3dsguy at 06:07, 28 March 2013

2013-03-28T05:07:52Z

← Older revision		Revision as of 08:07, 28 March 2013
Line 68:		Line 68:

	@[[User:3dsguy\|3dsguy]]: About the [[SHBIN]] in [[RomFS\|romfs.bin]]. Have you ever found there is .shbin inside it? Look at which you uploaded to dropbox (''today or yesterday, named "CIA"'') and find that one in folder "CIA\Extracted CIA Content\CXI extract" and check offset 0x10C0. There is [[SHBIN]] name "font_RectDrawerShader.shbin" just above the offset (with 00 padding, also with the length of name 0x3a). There is also some other clear text. you can extract the file in hex to check the shbin (maybe 0x3A0+0x8/0x18, of that file). if you think there is chance to check those shbin, you may have to fetch some different CIA that generated and decrypt and then extract its Romfs. i will be eager to see the ''extracted decrypted romfs''. If there is the proper source code of those files that may be even easier to check the function's ASM. (well best way is ''use dev unit to generate a series of versions of the title and extract all CIAs and decrypt to check those shbins'') --[[User:Syphurith\|Syphurith]] 05:07, 28 March 2013 (CET)		@[[User:3dsguy\|3dsguy]]: About the [[SHBIN]] in [[RomFS\|romfs.bin]]. Have you ever found there is .shbin inside it? Look at which you uploaded to dropbox (''today or yesterday, named "CIA"'') and find that one in folder "CIA\Extracted CIA Content\CXI extract" and check offset 0x10C0. There is [[SHBIN]] name "font_RectDrawerShader.shbin" just above the offset (with 00 padding, also with the length of name 0x3a). There is also some other clear text. you can extract the file in hex to check the shbin (maybe 0x3A0+0x8/0x18, of that file). if you think there is chance to check those shbin, you may have to fetch some different CIA that generated and decrypt and then extract its Romfs. i will be eager to see the ''extracted decrypted romfs''. If there is the proper source code of those files that may be even easier to check the function's ASM. (well best way is ''use dev unit to generate a series of versions of the title and extract all CIAs and decrypt to check those shbins'') --[[User:Syphurith\|Syphurith]] 05:07, 28 March 2013 (CET)
			:[[User:Syphurith\|Syphurith]], I knew about the .shbin in the RomFS. I've updated the archive to include it. It's not a particularly special file, I've seen it in lots of CXIs. You know you can use ctrtool to extract and view everything in the .CIA file, as it is a debug CIA. If you want the application's executable code, then you should look in the code.bin inside the "exefs_extracted" directory.--[[User:3dsguy\|3dsguy]] 07:07, 28 March 2013 (CET)

Syphurith: About shbin in RomFS

2013-03-28T03:07:45Z

About shbin in RomFS

← Older revision		Revision as of 06:07, 28 March 2013
Line 66:		Line 66:
	Sure? In the content folder there is a file named [''id''?].app it's encrypted I cant find anything, arm opcodes, text plain --[[User:Jocopoco\|Jocopoco]] 19:09, 18 November 2011 (CET)		Sure? In the content folder there is a file named [''id''?].app it's encrypted I cant find anything, arm opcodes, text plain --[[User:Jocopoco\|Jocopoco]] 19:09, 18 November 2011 (CET)
	:That .app CXI is encrypted the same way as titles downloaded via eShop stored on SD card for retail 3DS,(besides different keys) the sample.cia is cleartext. --[[User:Yellows8\|Yellows8]] 20:37, 18 November 2011 (CET)		:That .app CXI is encrypted the same way as titles downloaded via eShop stored on SD card for retail 3DS,(besides different keys) the sample.cia is cleartext. --[[User:Yellows8\|Yellows8]] 20:37, 18 November 2011 (CET)

			@[[User:3dsguy\|3dsguy]]: About the [[SHBIN]] in [[RomFS\|romfs.bin]]. Have you ever found there is .shbin inside it? Look at which you uploaded to dropbox (''today or yesterday, named "CIA"'') and find that one in folder "CIA\Extracted CIA Content\CXI extract" and check offset 0x10C0. There is [[SHBIN]] name "font_RectDrawerShader.shbin" just above the offset (with 00 padding, also with the length of name 0x3a). There is also some other clear text. you can extract the file in hex to check the shbin (maybe 0x3A0+0x8/0x18, of that file). if you think there is chance to check those shbin, you may have to fetch some different CIA that generated and decrypt and then extract its Romfs. i will be eager to see the ''extracted decrypted romfs''. If there is the proper source code of those files that may be even easier to check the function's ASM. (well best way is ''use dev unit to generate a series of versions of the title and extract all CIAs and decrypt to check those shbins'') --[[User:Syphurith\|Syphurith]] 05:07, 28 March 2013 (CET)

← Older revision		Revision as of 17:15, 21 June 2013
Line 85:		Line 85:
	::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)		::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
	:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)		:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)
			:That ExeFs seems to need decoding before trying to get anything from it (via disassemblers). So no usage now indeed (regarding yellow reading those in memory..)? or maybe we will need a customed disassembler dealing these for us? --[[User:Syphurith\|Syphurith]] 17:15, 21 June 2013 (CEST)

← Older revision		Revision as of 09:33, 2 April 2013
Line 76:		Line 76:
	::* Or simply let us wait for some progress?		::* Or simply let us wait for some progress?
	:::You need to read up on the 3DS file formats, and boot order. It's nowhere near as simple as that.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)		:::You need to read up on the 3DS file formats, and boot order. It's nowhere near as simple as that.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
			::::I know there is a page of how 3DS got boot up (haven't found one telling me how a title got launched). Well i think i should try to read those documents (especially those has 'boot' or those word) again. --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)

	::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry)~~'''~~I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex.~~'''~~ if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)		::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry) I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex. if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith\|Syphurith]] 09:50, 28 March 2013 (CET)
	::You won't find the 3DS common key by analysing 3DS communications. The common key(s) are stored in two parts, and scrambled, deep inside the 3DS.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)		::You won't find the 3DS common key by analysing 3DS communications. The common key(s) are stored in two parts, and scrambled, deep inside the 3DS.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
			:::That's right (yellows8 edited 'ClCertA' page and i knew that days ago); i've given up finding one without hardware help (now waiting and also learning some basis about hardware methods from Hackmii). Thanks. --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)

	:I tried to check the 'exefs.bin' in your archive uploaded, and found it not easy to analyse. There're many things seems to be timestamps (that WinHex told me).. and those text inside are merely readable (but you can get 'NULL' or something else like 'Mem' or 'display'). I tried hard to get some but found that not useful as a clue. Also the header and reserved in exefs are 0x180 length now. If you can get many decrypted exefs.bin please tell me (especially those on a same branch of source code), thx. Well hope you get progress everyday. --[[User:Syphurith\|Syphurith]] 07:22, 2 April 2013 (CEST)		:I tried to check the 'exefs.bin' in your archive uploaded, and found it not easy to analyse. There're many things seems to be timestamps (that WinHex told me).. and those text inside are merely readable (but you can get 'NULL' or something else like 'Mem' or 'display'). I tried hard to get some but found that not useful as a clue. Also the header and reserved in exefs are 0x180 length now. If you can get many decrypted exefs.bin please tell me (especially those on a same branch of source code), thx. Well hope you get progress everyday. --[[User:Syphurith\|Syphurith]] 07:22, 2 April 2013 (CEST)
	::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)		::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS\|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy\|3dsguy]] 07:59, 2 April 2013 (CEST)
			:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith\|Syphurith]] 09:33, 2 April 2013 (CEST)

← Older revision		Revision as of 06:07, 28 March 2013
Line 66:		Line 66:
	Sure? In the content folder there is a file named [''id''?].app it's encrypted I cant find anything, arm opcodes, text plain --[[User:Jocopoco\|Jocopoco]] 19:09, 18 November 2011 (CET)		Sure? In the content folder there is a file named [''id''?].app it's encrypted I cant find anything, arm opcodes, text plain --[[User:Jocopoco\|Jocopoco]] 19:09, 18 November 2011 (CET)
	:That .app CXI is encrypted the same way as titles downloaded via eShop stored on SD card for retail 3DS,(besides different keys) the sample.cia is cleartext. --[[User:Yellows8\|Yellows8]] 20:37, 18 November 2011 (CET)		:That .app CXI is encrypted the same way as titles downloaded via eShop stored on SD card for retail 3DS,(besides different keys) the sample.cia is cleartext. --[[User:Yellows8\|Yellows8]] 20:37, 18 November 2011 (CET)

			@[[User:3dsguy\|3dsguy]]: About the [[SHBIN]] in [[RomFS\|romfs.bin]]. Have you ever found there is .shbin inside it? Look at which you uploaded to dropbox (''today or yesterday, named "CIA"'') and find that one in folder "CIA\Extracted CIA Content\CXI extract" and check offset 0x10C0. There is [[SHBIN]] name "font_RectDrawerShader.shbin" just above the offset (with 00 padding, also with the length of name 0x3a). There is also some other clear text. you can extract the file in hex to check the shbin (maybe 0x3A0+0x8/0x18, of that file). if you think there is chance to check those shbin, you may have to fetch some different CIA that generated and decrypt and then extract its Romfs. i will be eager to see the ''extracted decrypted romfs''. If there is the proper source code of those files that may be even easier to check the function's ASM. (well best way is ''use dev unit to generate a series of versions of the title and extract all CIAs and decrypt to check those shbins'') --[[User:Syphurith\|Syphurith]] 05:07, 28 March 2013 (CET)