Tutorial  Updated

Photo guide to installing DSiWare backups on real hardware and emulator

First, some USEFUL NOTES

Tickets are not actually required by the DSi launcher (this was unknown at the time the above procedure was written), you may skip the related steps

While still incomplete, @MarioMasta64 is working on automating this process for Windows+Python users:
http://gbatemp.net/threads/a-tool-to-make-converting-dsiware-from-3ds-to-dsi-easier.479996/

If you are using an emunand (through Hiya, for example), consider using DSi Title Manager instead; there's no reason it couldn't work on sysnand with minor changes but... it doesn't do that, yet or ever




Steal Acquire some decrypted DSiware apps. You can use Funkeycia, 3DSeStuff, etc the 3DS eShop to legally download them, rip them to cia, then use ctrtool to extract the cia into "contents" = .app (the very newest versions of ctrtool decrypt them during this extraction); alternatively you can use Godmode9 to directly copy the appropriate .app under twln:/title/00030004/* to the SD.
There's also a no-intro catalogue but no romset I know of, officer...

Backup your console's NAND, CID, and ConsoleID using well documented methods (hardmod if you have some DSiware that can be copied to SD, or fwTool+safety mod if you have an usable DSiware exploit - Team Twiizer's original sudokuhax is not suitable #clobberedkeyslots, while fourswordshax and the leaked ugopwn use minitwlpayload).
If you're using NO$GBA with a nand you didn't dump yourself, you can find the CID and the byteswapped ConsoleID by looking at the end of the dump with a hex editor.
1 NOCASHNAND.PNG
(Adding this block is also how you convert a raw backup for use with NO$GBA, just in case you didn't read the manual)

Use TwlTool to decrypt the nand.
2 nand decrypt.PNG

Mount the 1st partition of the decrypted image with OSFMount (Linux equivalent: losetup + mount; Mac equivalent, hdiutil + mount I guess?).
3 osfmount.PNG 4 osfmount.PNG

Pick (any?) ticket from the NAND, preferably from the regular DSiware category = 00030004, and decrypt it with TwlTool. This will be a base for the edited tickets we will make.
5 ticket crypto.PNG

Open the folder with our dumped title. You will find a "content" folder, possibly a "data" folder, and a .ctx file if it came from a 3DS.
Delete it, then go to the content folder.
Remove the "cmd" folder, and the 3DS-format TMD.
6 source.PNG 7 source content.PNG

Search the TMD pack for the full TitleID of the DSiware; copy the TMD to the content folder, renaming it to "title.tmd".
Open title.tmd in a hex editor.
8 tmd.PNG

Find offset 1E7; rename the .app file (better known as .srl or .nds) so that the last 2 digits are the ones written at 1E7.
Find offset 208; delete everything from there to the end of the file. (A small number of tmds are already trimmed).
Save the file.
9 tmd edit.PNG

Open the ticket we decrypted earlier in a hex editor.
Find offset 1DC and replace the next 8 bytes with the TitleID of the app we're installing;
Save the file with a name equal to the TitleID-low of the app.
10 ticket edit.PNG 11 ticket save.PNG

Use TwlTool to encrypt the ticket, and put it into the NAND.
12 ticket crypto.PNG

Copy the title's (content & data) folder to the NAND.
13 app copy.PNG

Unmount the NAND and re-encrypt it.
14 unmount.PNG 15 nand crypt.PNG

If you're using NO$GBA, you will have to re-add the footer since it will have been removed by TwlTool's NAND features.
16 nand footer.PNG

Enjoy your DSiWarez, and if you liked it, BUY THE ORIGINAL... oh wait, they closed the DSi shop
17.PNG 18.PNG
 
Last edited by Ryccardo,

incidentallyscribble

Well-Known Member
Member
Joined
Apr 24, 2016
Messages
863
Trophies
0
Age
38
XP
1,467
Country
United States
People that attempt this need to remember to re-encrypt the NAND.
This severely reduces the chances of bricking (literally all bricking).

I would not attempt this on a DSi if you don't have the means to restore it with hardware.

Just a friendly reminder, that's all.
If anyone wants to lower their chances of brick severely, they just need to wait. A more viable tool will possibly be released in the future that Will have way more checks in place.
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,013
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,436
Country
United States
People that attempt this need to remember to re-encrypt the NAND.
This severely reduces the chances of bricking (literally all bricking).

I would not attempt this on a DSi if you don't have the means to restore it with hardware.

Just a friendly reminder, that's all.
I for sure encrypted mine. I know for a fact I did because any encrypt/decrypt/modification has a completely new nand dump saved for every step I did. And the restore I used was the one labeled it was modified and decrypted.
But yes I would definitely agree with you.
Unless you already have a hardmod (or are masochist like me and just have a second dsi laying around you don't care about) then I would definitely wait. From all the whisperings going around there will be much better methods to do this in the near future.
 

JohnSmith41

Well-Known Member
Newcomer
Joined
Oct 9, 2013
Messages
61
Trophies
0
XP
177
Country
United States
I tried this with Sudoku, and everything seems to have worked alright, but when I restore my NAND, I don't see any new titles. Data Management also shows nothing. Do I have to refresh something somehow?
 

Ryccardo

Penguin accelerator
OP
Member
Joined
Feb 13, 2015
Messages
7,696
Trophies
1
Age
28
Location
Imola
XP
6,926
Country
Italy
I tried this with Sudoku, and everything seems to have worked alright, but when I restore my NAND, I don't see any new titles. Data Management also shows nothing. Do I have to refresh something somehow?
No, in all my experiments they were immediately picked up

The best test now is to redump your nand and decrypt it, then checking if the files are still in the right places...
 

mariogamer

Well-Known Member
Member
Joined
Aug 12, 2015
Messages
1,256
Trophies
0
Age
28
XP
790
Country
Canada
Just tho know what are the file needed for dsi emulation (can't run no$gba for now)

(Also 0000FEFE means there's a problem with the boot sector, and I don't think you can get this if you do not modify the raw backup)

There's also a version of fwtool that check if the nand is decrypted. But I still don't understand why all those brick (I could post a build if requested)
 
Last edited by mariogamer,

ToneCapone-RF

Well-Known Member
Newcomer
Joined
Jun 30, 2017
Messages
65
Trophies
0
Age
51
XP
359
Country
United States
Just tho know what are the file needed for dsi emulation (can't run no$gba for now)

(Also 0000FEFE means there's a problem with the boot sector, and I don't think you can get this if you do not modify the raw backup)

There's also a version of fwtool that check if the nand is decrypted. But I still don't understand why all those brick (I could post a build if requested)

You need your Nand and the DSI bios.
 

ToneCapone-RF

Well-Known Member
Newcomer
Joined
Jun 30, 2017
Messages
65
Trophies
0
Age
51
XP
359
Country
United States
But like I said before everyone dumping there Nand need to be very careful. if you don't have any soldering skills I wouldn't reflash your nand back to your DSI. Just wait you proper tools to be release this way you have a better chance of not bricking your system.
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,013
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,436
Country
United States
Google finds everything, that's how I got them.
I found mine by a specific phrase being searched in archive.org, which can be found in a reddit tutorial post.
I set up the DSi part of no$gba to test my previous bricked nand and my current modified nand of a working console (not yet flashed to the console). The bricked nand seemed to have a bunch of garbage corruption data and crashed the emulator. But, my modified nand (with fieldrunners installed with the hacked save) booted perfectly fine even with RSA checks enabled. So with fingers crossed I did something stupid and flashed the modified dump to the DSi.
And I can happily say I now have fieldrunnerhax installed and working on the system. So I guess it's a good idea to check your nand dumps and test them on no$gba if you for some reason really want to test this right now without a hardmod. I still recommend just waiting for the proper tools to come out later though.
 
  • Like
Reactions: siamese

Ryccardo

Penguin accelerator
OP
Member
Joined
Feb 13, 2015
Messages
7,696
Trophies
1
Age
28
Location
Imola
XP
6,926
Country
Italy
I don't believe too much in "safety mods" (I believe that a computer must do what you tell it to... else it flies out of the window quickly), but noted since software dumpers aren't that well documented :)

--------------------- MERGED ---------------------------

seemed to have a bunch of garbage corruption data and crashed the emulator
Hmmm, typo in the keys while reencrypting?
 

jerbear64

Well-Known Member
Member
Joined
Dec 10, 2011
Messages
304
Trophies
1
Age
25
XP
391
Country
United States
I don't believe too much in "safety mods" (I believe that a computer must do what you tell it to... else it flies out of the window quickly), but noted since software dumpers aren't that well documented :)

Do be advised that this fork of fwtool is incompatible with minitwlpayload since it has a DSi Extended header, so the leaked build of ugopwn as well as fourswordshax will not work with it.
 
  • Like
Reactions: Ryccardo

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Xdqwerty @ Xdqwerty: good night