Hacking Binding Of Isaac: Rebirth doesn't appear to work on 9.5 or lower

[motezazer]

#Spoiler Alert

OH MY....

What do you are thinking you two?
Monday update will simply add N3DS support for RxTools tools (so not rxMode). Nothing exciting.

 

[Ronhero]

Yes you can have the ticket! Not the seed, but the ticket.
With RxTools, dump your ticket.db.

--------------------- MERGED ---------------------------

But wait RxTools Monday update for it

So you're saying n3ds support on monday?

Edit: even with rxtools we still need 9.6+ support

 

[Bonovox40]

So you're saying n3ds support on monday?

Edit: even with rxtools we still need 9.6+ support

So even with you not able to extract the 9.9 nand w/ the isaac game on it, we're sure it's built w 9/6+ encryption/keys on it? Thought there was a slim chance it could've been built with 9.5 keys on it. Dang.

I guess if it is 9.6, is there anything useful to do w the extracted files? (once u get your 3ds serviced/fixed and can get the files) Or is there nothing else at all we can do until GW or someone figures out the 9.6 keys?

 

[Ronhero]

So even with you not able to extract the 9.9 nand w/ the isaac game on it, we're sure it's built w 9/6+ encryption/keys on it? Thought there was a slim chance it could've been built with 9.5 keys on it. Dang.

I guess if it is 9.6, is there anything useful to do w the extracted files? (once u get your 3ds serviced/fixed and can get the files) Or is there nothing else at all we can do until GW or someone figures out the 9.6 keys?

That's not what im saying. I'm saying even with rxtools we need to be on 9.9 emunand for decryption to work hence the need for a hard mod

 

[Bonovox40]

That's not what im saying. I'm saying even with rxtools we need to be on 9.9 emunand for decryption to work hence the need for a hard mod

Oh, I see. So assuming you get your 3ds fixed next week and such, what's the next steps that we can do w/ GW/cfw limitations?

 

[Ronhero]

Oh, I see. So assuming you get your 3ds fixed next week and such, what's the next steps that we can do w/ GW/cfw limitations?

Once I dump it I will see if it can be crypto fixed with old 9.5 crypto so it can be fixed for emunand

 

[WulfyStylez]

Once I dump it I will see if it can be crypto fixed with old 9.5 crypto so it can be fixed for emunand

Shortcut: if the byte at 0x18B in the NCCH is 0x0B, the game uses 9.6+ (secure4, not just seeddb) crypto. I've been meaning to look into this myself, but I don't have the money to buy the game just to check this.

 

[Deleted-19228]

You forget that Sony has the technical team equivalent to baboons. A company almost to the level of Samsung in offerings that was hacked, costing them trillions.

With encryption and certificates, you can't just willy nilly release a new passphrase and hope for the best. Especially if a previous encryption scheme was in place prior.

why have trillions when we can have...millions?

 

[Bonovox40]

Shortcut: if the byte at 0x18B in the NCCH is 0x0B, the game uses 9.6+ (secure4, not just seeddb) crypto. I've been meaning to look into this myself, but I don't have the money to buy the game just to check this.

So best case scenario (thought unlikely) is if that byte does NOT reference 9.6+, then we can eventually cryptofix this for current emunand/fw spoof?
Worst case is it does and we have to wait for GW/cfw to figure out 9.6+?

 

[WulfyStylez]

So best case scenario (thought unlikely) is if that byte does NOT reference 9.6+, then we can eventually cryptofix this for current emunand/fw spoof?
Worst case is it does and we have to wait for GW/cfw to figure out 9.6+?

The best and worst are flipped for me, but yeah. Also don't expect CFW to ever get those keys without GW getting them first (which is also doubtful.)

 

[zuxicovp]

The best and worst are flipped for me, but yeah. Also don't expect CFW to ever get those keys without GW getting them first (which is also doubtful.)

How did they get the keys for 7.x in the first place?

 

[Ronhero]

How did they get the keys for 7.x in the first place?

They use an acid to dissolve the processor and trace everything or something like that.

 

[WulfyStylez]

How did they get the keys for 7.x in the first place?

highly secretive exploitation vectors

 

[zuxicovp]

highly secretive exploitation vectors

Any chance of this working for the new keys?

 

[Ronhero]

Any chance of this working for the new keys?

I just watched the video and can say it positively will work

 

[WulfyStylez]

Any chance of this working for the new keys?

Dramatically less likely.

 

[zoogie]

Shortcut: if the byte at 0x18B in the NCCH is 0x0B, the game uses 9.6+ (secure4, not just seeddb) crypto. I've been meaning to look into this myself, but I don't have the money to buy the game just to check this.

0x18B is 01

here is the plaintext region

Spoiler

[SDK+NINTENDO:CTR_SDK-10_1_1_200_none].
[SDK+NINTENDO:Firmware-02_46_01].
[SDK+NINTENDO:ExtraPad].
[SDK+NINTENDO:IsRunOnSnake].
[SDK+NINTENDO:3DVolume].
[SDK+MobiclipspAdpcmDec_2_0_3].
[SDK+Mobiclip:FastAudioDec_2_0_3].
[SDK+Mobiclipeblocker_2_0_3].
[SDK+Mobiclip:ImaAdpcmDec_2_0_3].
[SDK+Mobiclip:MobiclipDec_2_0_3].
[SDK+Mobiclip:MoflexDemuxer_2_0_3].
[SDK+NINTENDO:Ir]....

Don't anybody PM me to upload it lol
I simply was able to decrypt the first stage -- the seeddb part remains. And since I only have the movable.sed of this updated-without-backup n3ds, I can't do anything else with it.

 

[Ronhero]

0x18B is 01

here is the plaintext region

Spoiler

[SDK+NINTENDO:CTR_SDK-10_1_1_200_none].
[SDK+NINTENDO:Firmware-02_46_01].
[SDK+NINTENDO:ExtraPad].
[SDK+NINTENDO:IsRunOnSnake].
[SDK+NINTENDO:3DVolume].
[SDK+MobiclipspAdpcmDec_2_0_3].
[SDK+Mobiclip:FastAudioDec_2_0_3].
[SDK+Mobiclipeblocker_2_0_3].
[SDK+Mobiclip:ImaAdpcmDec_2_0_3].
[SDK+Mobiclip:MobiclipDec_2_0_3].
[SDK+Mobiclip:MoflexDemuxer_2_0_3].
[SDK+NINTENDO:Ir]....

Don't anybody PM me to upload it lol
I simply was able to decrypt the first stage -- the seeddb part remains. And since I only have the movable.sed of this updated-without-backup n3ds, I can't do anything else with it.

So your saying when I get my n3ds back it should be able to be crypto fixed?

 

[zoogie]

So your saying when I get my n3ds back it should be able to be crypto fixed?

Looks like it. Also, the native firm is 02_46_01 (0x38) which means minimum of 9.0. So the SDK it uses is just right.

 

[Ronhero]

Looks like it. Also, the native firm is 02_46_01 (0x38) which means minimum of 9.0. So the SDK it uses is just right.

I thought this be the case since SDK is determined when the project starts we will just have to deal with the seed bin for a bit but as long as there is people like me this shouldn't be a problem. Fingers crossed by the time SDK 9.6+ comes out we will have the keys