Tutorial  Updated

Photo guide to installing DSiWare backups on real hardware and emulator

First, some USEFUL NOTES

Tickets are not actually required by the DSi launcher (this was unknown at the time the above procedure was written), you may skip the related steps

While still incomplete, @MarioMasta64 is working on automating this process for Windows+Python users:
http://gbatemp.net/threads/a-tool-to-make-converting-dsiware-from-3ds-to-dsi-easier.479996/

If you are using an emunand (through Hiya, for example), consider using DSi Title Manager instead; there's no reason it couldn't work on sysnand with minor changes but... it doesn't do that, yet or ever




Steal Acquire some decrypted DSiware apps. You can use Funkeycia, 3DSeStuff, etc the 3DS eShop to legally download them, rip them to cia, then use ctrtool to extract the cia into "contents" = .app (the very newest versions of ctrtool decrypt them during this extraction); alternatively you can use Godmode9 to directly copy the appropriate .app under twln:/title/00030004/* to the SD.
There's also a no-intro catalogue but no romset I know of, officer...

Backup your console's NAND, CID, and ConsoleID using well documented methods (hardmod if you have some DSiware that can be copied to SD, or fwTool+safety mod if you have an usable DSiware exploit - Team Twiizer's original sudokuhax is not suitable #clobberedkeyslots, while fourswordshax and the leaked ugopwn use minitwlpayload).
If you're using NO$GBA with a nand you didn't dump yourself, you can find the CID and the byteswapped ConsoleID by looking at the end of the dump with a hex editor.
1 NOCASHNAND.PNG
(Adding this block is also how you convert a raw backup for use with NO$GBA, just in case you didn't read the manual)

Use TwlTool to decrypt the nand.
2 nand decrypt.PNG

Mount the 1st partition of the decrypted image with OSFMount (Linux equivalent: losetup + mount; Mac equivalent, hdiutil + mount I guess?).
3 osfmount.PNG 4 osfmount.PNG

Pick (any?) ticket from the NAND, preferably from the regular DSiware category = 00030004, and decrypt it with TwlTool. This will be a base for the edited tickets we will make.
5 ticket crypto.PNG

Open the folder with our dumped title. You will find a "content" folder, possibly a "data" folder, and a .ctx file if it came from a 3DS.
Delete it, then go to the content folder.
Remove the "cmd" folder, and the 3DS-format TMD.
6 source.PNG 7 source content.PNG

Search the TMD pack for the full TitleID of the DSiware; copy the TMD to the content folder, renaming it to "title.tmd".
Open title.tmd in a hex editor.
8 tmd.PNG

Find offset 1E7; rename the .app file (better known as .srl or .nds) so that the last 2 digits are the ones written at 1E7.
Find offset 208; delete everything from there to the end of the file. (A small number of tmds are already trimmed).
Save the file.
9 tmd edit.PNG

Open the ticket we decrypted earlier in a hex editor.
Find offset 1DC and replace the next 8 bytes with the TitleID of the app we're installing;
Save the file with a name equal to the TitleID-low of the app.
10 ticket edit.PNG 11 ticket save.PNG

Use TwlTool to encrypt the ticket, and put it into the NAND.
12 ticket crypto.PNG

Copy the title's (content & data) folder to the NAND.
13 app copy.PNG

Unmount the NAND and re-encrypt it.
14 unmount.PNG 15 nand crypt.PNG

If you're using NO$GBA, you will have to re-add the footer since it will have been removed by TwlTool's NAND features.
16 nand footer.PNG

Enjoy your DSiWarez, and if you liked it, BUY THE ORIGINAL... oh wait, they closed the DSi shop
17.PNG 18.PNG
 
Last edited by Ryccardo,

smf

Well-Known Member
Member
Joined
Feb 23, 2009
Messages
6,638
Trophies
2
XP
5,835
Country
United Kingdom
All of the files and help seem to be aimed at USA region. Is there anyone here with four swords EUR ?
I don't have a 3DS...
 
Last edited by smf,

dpad_5678

Ape weak on own. Ape strong in unity.
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
All of the files and help seem to be aimed at USA region. Is there anyone here with four swords EUR ?
If you can find the EUR Four Swords 3DS CIA, you can open it up in GodMode9 and extract the .app file. Here's the EUR FSAE TMD :grog:
 

Attachments

  • Zelda_FSAE_EUR_TMD.zip
    503 bytes · Views: 225

smf

Well-Known Member
Member
Joined
Feb 23, 2009
Messages
6,638
Trophies
2
XP
5,835
Country
United Kingdom
If you can find the EUR Four Swords 3DS CIA, you can open it up in GodMode9 and extract the .app file. Here's the EUR FSAE TMD :grog:

Thanks, that looks a lot better than the one that NSU downloader gave me.

I don't have a 3ds & AFAICT godmode9 runs on the 3ds. I used CtrTool64 -x 000480044b513956.cia -commonkey (common key removed) --contents=contents and it wrote a file called contents.0000.00000001, is that correct? how do I check it? Do I just rename that to 00000000.app? File size and sha1 of the correct file would be useful...
 
Last edited by smf,

dpad_5678

Ape weak on own. Ape strong in unity.
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
Thanks, that looks a lot better than the one that NSU downloader gave me.

I don't have a 3ds & AFAICT godmode9 runs on the 3ds. I used CtrTool64 -x 000480044b513956.cia -commonkey (common key removed) --contents=contents and it wrote a file called contents.0000.00000001, is that correct? how do I check it? Do I just rename that to 00000000.app? File size and sha1 of the correct file would be useful...
Not really sure to be honest. I have never used CTRtool. If rename that to .app, open it in a program such as dsbuff to see if it's recognized as a valid SRL (doubt it will be).
 

dpad_5678

Ape weak on own. Ape strong in unity.
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
nope I have one ticket decrypt that works with all the games.
Yes, but for OUR consoles we'd have to decrypt the ticket, change the title ID inside the decrypted ticket, and re-encrypt the ticket with OUR console-specific ConsoleID.

Rinse and repeat for each game.
 

ToneCapone-RF

Well-Known Member
Newcomer
Joined
Jun 30, 2017
Messages
65
Trophies
0
Age
51
XP
359
Country
United States
Yes, but for OUR consoles we'd have to decrypt the ticket, change the title ID inside the decrypted ticket, and re-encrypt the ticket with OUR console-specific ConsoleID.

Rinse and repeat for each game.

True but what I meant was all the games have there tickets decrypt already with there title id already in place, so all you have to do is reencrypt with you own ConsoleID.
 

smf

Well-Known Member
Member
Joined
Feb 23, 2009
Messages
6,638
Trophies
2
XP
5,835
Country
United Kingdom
Not really sure to be honest. I have never used CTRtool. If rename that to .app, open it in a program such as dsbuff to see if it's recognized as a valid SRL (doubt it will be).

Have you used anything that runs on a PC to do it?

If it's not recognised as a valid SRL then does that mean it's a problem?
 

smf

Well-Known Member
Member
Joined
Feb 23, 2009
Messages
6,638
Trophies
2
XP
5,835
Country
United Kingdom
No, that just means that content.xxx.xxx file is not the .app you're looking for.

dsbuff just gives garbage output, the decrypted USA NDS I found online gives correct output and I can't recreate it using the USA cia from freeshop.

I don't know why I can't pursuade ctrtool to decrypt either the USA or EUR cia, maybe I'm doing it wrong or I'm using the wrong ctrtool. Or maybe the first post is wrong and it's not possible?

Am I the only person in europe wanting to do this that doesn't have a 3ds?
 

redunka

Well-Known Member
Member
Joined
Nov 26, 2014
Messages
423
Trophies
0
Age
29
XP
2,519
Country
Russia
If you're using old ctrtool, the proper command should look like this:
ctrtool 000480044b513956.cia --titlekey=<decrypted titlekey> --contents=contents

Newer versions of ctrtool can extract decrypted SRL automatically with just this:
ctrtool 000480044b513956.cia --contents=contents

Both should give you valid SRL, you can compare its hash with the hash from TMD (either 3DS or DSi one).
For example, these are EUR Zelda 4Swords hashes:
SHA256 (from 3DS TMD): 3A880DCE73ACE38F923EB2C3F3E497CA00749C7349AB14C99AD88710C45A8BE8
SHA1 (from DSi TMD): F151325756B6804D5C27E20AB8E70FE69239CBBF
 

Attachments

  • ctrtool_b1484289.rar
    327.5 KB · Views: 169

smf

Well-Known Member
Member
Joined
Feb 23, 2009
Messages
6,638
Trophies
2
XP
5,835
Country
United Kingdom
Newer versions of ctrtool can extract decrypted SRL automatically with just this:

Thanks, I tried using all the ctrtool I could find with google but they were all obviously too old. I didn't know I'd need the decrypted title key and I have no idea how to get it anyway.
The one you posted worked great though, where is the correct place to get the latest?

One step closer, if I get time later I'll try faking the ticket and running it in no$gba
 
Last edited by smf,

redunka

Well-Known Member
Member
Joined
Nov 26, 2014
Messages
423
Trophies
0
Age
29
XP
2,519
Country
Russia
Thanks, I tried using all the ctrtool I could find with google but they were all obviously too old. I didn't know I'd need the decrypted title key and I have no idea how to get it anyway.
The one you posted worked great though, where is the correct place to get the latest?

One step closer, if I get time later I'll try faking the ticket and running it in no$gba
I'm glad that it worked for you. :)
That ctrtool I posted is currently the latest one, I compiled it myself, as there was no official release with those new decryption features.
Here's the GitHub repo, in case you'd like to compile it yourself, or to get official build (when/if it's released): https://github.com/profi200/Project_CTR
 

smf

Well-Known Member
Member
Joined
Feb 23, 2009
Messages
6,638
Trophies
2
XP
5,835
Country
United Kingdom
Thanks to those who helped, I now have 4swordhax,exidiahax,fieldrunhax,gtrpwn & sudokuhax.
 
Last edited by smf,
D

Deleted-394630

Guest
My nand crashes No$gba when I run it, is it a bricked dump?

This is after following this guide.
 
Last edited by ,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • Psionic Roshambo @ Psionic Roshambo:
    Batman joined the Trans Justice League
    +2
  • Sicklyboy @ Sicklyboy:
    based af
    +2
  • Sonic Angel Knight @ Sonic Angel Knight:
    Forget the base, get on the roof.
  • K3Nv2 @ K3Nv2:
    Is that a bat in your buckle or are you just happy to have me
  • Psionic Roshambo @ Psionic Roshambo:
    Wonder "Woman" lol you wonder if they are a woman?
  • Psionic Roshambo @ Psionic Roshambo:
    The Riddler has questions...
  • K3Nv2 @ K3Nv2:
    Played a little of snow day glad I didn't spend $30
  • K3Nv2 @ K3Nv2:
    It's asthetic is okay maybe a good $10 grab
  • Psionic Roshambo @ Psionic Roshambo:
    Lol is it a game about doing cocaine?
  • K3Nv2 @ K3Nv2:
    Probably in pvp
  • Psionic Roshambo @ Psionic Roshambo:
    I tried Balders Gate II on the PS2 a few minutes ago, not bad lol
  • Psionic Roshambo @ Psionic Roshambo:
    My back catalog of games is like that scene at the end of Indiana Jones where the arc of the covenant is being stored in a giant ass warehouse
  • K3Nv2 @ K3Nv2:
    At least I can will my game catalog to family members
    +1
  • K3Nv2 @ K3Nv2:
    It's your problem now bitches
  • Psionic Roshambo @ Psionic Roshambo:
    Put it in your will that in order to receive any money they have to beat certain games, hard games and super shitty games...
  • Psionic Roshambo @ Psionic Roshambo:
    Say 20 bucks per Ninja Gaiden on the NES lol 60 bucks for all 3
  • Psionic Roshambo @ Psionic Roshambo:
    People you like "Beat level 1 of Ms Pacman" lol
  • K3Nv2 @ K3Nv2:
    Hello kitty ds is required
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Beat Celebrity Death Match on the PS1 omg tried it earlier today .... Absolutely trash
  • Psionic Roshambo @ Psionic Roshambo:
    Like -37 out of 10
  • Psionic Roshambo @ Psionic Roshambo:
    One of the worst games I have ever played
  • K3Nv2 @ K3Nv2:
    Make them rank up every cod game out
  • K3Nv2 @ K3Nv2:
    "Now I know why he took his own life"
    K3Nv2 @ K3Nv2: "Now I know why he took his own life"