Tutorial  Updated

Photo guide to installing DSiWare backups on real hardware and emulator

First, some USEFUL NOTES

Tickets are not actually required by the DSi launcher (this was unknown at the time the above procedure was written), you may skip the related steps

While still incomplete, @MarioMasta64 is working on automating this process for Windows+Python users:
http://gbatemp.net/threads/a-tool-to-make-converting-dsiware-from-3ds-to-dsi-easier.479996/

If you are using an emunand (through Hiya, for example), consider using DSi Title Manager instead; there's no reason it couldn't work on sysnand with minor changes but... it doesn't do that, yet or ever




Steal Acquire some decrypted DSiware apps. You can use Funkeycia, 3DSeStuff, etc the 3DS eShop to legally download them, rip them to cia, then use ctrtool to extract the cia into "contents" = .app (the very newest versions of ctrtool decrypt them during this extraction); alternatively you can use Godmode9 to directly copy the appropriate .app under twln:/title/00030004/* to the SD.
There's also a no-intro catalogue but no romset I know of, officer...

Backup your console's NAND, CID, and ConsoleID using well documented methods (hardmod if you have some DSiware that can be copied to SD, or fwTool+safety mod if you have an usable DSiware exploit - Team Twiizer's original sudokuhax is not suitable #clobberedkeyslots, while fourswordshax and the leaked ugopwn use minitwlpayload).
If you're using NO$GBA with a nand you didn't dump yourself, you can find the CID and the byteswapped ConsoleID by looking at the end of the dump with a hex editor.
1 NOCASHNAND.PNG
(Adding this block is also how you convert a raw backup for use with NO$GBA, just in case you didn't read the manual)

Use TwlTool to decrypt the nand.
2 nand decrypt.PNG

Mount the 1st partition of the decrypted image with OSFMount (Linux equivalent: losetup + mount; Mac equivalent, hdiutil + mount I guess?).
3 osfmount.PNG 4 osfmount.PNG

Pick (any?) ticket from the NAND, preferably from the regular DSiware category = 00030004, and decrypt it with TwlTool. This will be a base for the edited tickets we will make.
5 ticket crypto.PNG

Open the folder with our dumped title. You will find a "content" folder, possibly a "data" folder, and a .ctx file if it came from a 3DS.
Delete it, then go to the content folder.
Remove the "cmd" folder, and the 3DS-format TMD.
6 source.PNG 7 source content.PNG

Search the TMD pack for the full TitleID of the DSiware; copy the TMD to the content folder, renaming it to "title.tmd".
Open title.tmd in a hex editor.
8 tmd.PNG

Find offset 1E7; rename the .app file (better known as .srl or .nds) so that the last 2 digits are the ones written at 1E7.
Find offset 208; delete everything from there to the end of the file. (A small number of tmds are already trimmed).
Save the file.
9 tmd edit.PNG

Open the ticket we decrypted earlier in a hex editor.
Find offset 1DC and replace the next 8 bytes with the TitleID of the app we're installing;
Save the file with a name equal to the TitleID-low of the app.
10 ticket edit.PNG 11 ticket save.PNG

Use TwlTool to encrypt the ticket, and put it into the NAND.
12 ticket crypto.PNG

Copy the title's (content & data) folder to the NAND.
13 app copy.PNG

Unmount the NAND and re-encrypt it.
14 unmount.PNG 15 nand crypt.PNG

If you're using NO$GBA, you will have to re-add the footer since it will have been removed by TwlTool's NAND features.
16 nand footer.PNG

Enjoy your DSiWarez, and if you liked it, BUY THE ORIGINAL... oh wait, they closed the DSi shop
17.PNG 18.PNG
 
Last edited by Ryccardo,

Billy Acuña

Well-Known Member
Member
Joined
Oct 10, 2015
Messages
3,126
Trophies
1
Age
31
XP
3,701
Country
Mexico
I think it's possibke to patch the dsi header with nds_dsiware_header_patcher.py.
It will not work, that script is used to add the DSi extended header, all you need is to compile the lastest payload.dat from Yellows8 repo (or strip down the DSi extended header from the fwtool fork's binaries...).
Anyways noobs cannot manage to compile lastest payload.dat nor strip down the header.
 
Last edited by Billy Acuña,

ToneCapone-RF

Well-Known Member
Newcomer
Joined
Jun 30, 2017
Messages
65
Trophies
0
Age
51
XP
359
Country
United States
I found mine by a specific phrase being searched in archive.org, which can be found in a reddit tutorial post.
I set up the DSi part of no$gba to test my previous bricked nand and my current modified nand of a working console (not yet flashed to the console). The bricked nand seemed to have a bunch of garbage corruption data and crashed the emulator. But, my modified nand (with fieldrunners installed with the hacked save) booted perfectly fine even with RSA checks enabled. So with fingers crossed I did something stupid and flashed the modified dump to the DSi.
And I can happily say I now have fieldrunnerhax installed and working on the system. So I guess it's a good idea to check your nand dumps and test them on no$gba if you for some reason really want to test this right now without a hardmod. I still recommend just waiting for the proper tools to come out later though.

Nice guess you got lucky, when you mean RSA Check where do you add this maybe I can find out what happen to my nand dump.
 

JohnSmith41

Well-Known Member
Newcomer
Joined
Oct 9, 2013
Messages
61
Trophies
0
XP
177
Country
United States
No, in all my experiments they were immediately picked up

The best test now is to redump your nand and decrypt it, then checking if the files are still in the right places...
I still have my ticket file in ticket\00030004, but it turns out I forgot to move the title data over. Oops :P

I am going to re-encrypt and reflash to see if it works then.
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
Well I decided to continue my stupidity and retest trying to get sudokuhax up and running. This time I managed to do it successfully. It seems testing with no$gba before pushing to real hardware works fairly well. Though I'll stop while I'm ahead before I accidentally brick and wait till rocketlauncher and HiyaCFW come out (which iirc will have something similar to emunand but use decrypted contents on the SD). I just wanted to test out srloader and other homebrew to see how anything improves with the upcoming hacks.
 

ToneCapone-RF

Well-Known Member
Newcomer
Joined
Jun 30, 2017
Messages
65
Trophies
0
Age
51
XP
359
Country
United States
Dude your right about the RSA checking notice I did something wrong fix it everything came up fine, recheck making another nand and that one also work in nogba. added Sudoku and Zelda both with save hack flashed the system and to my surprise it actually worked this time. so now the system is downgraded to 1.4 and has both dsiwares games.
 

Attachments

  • KIMG0195.JPG
    KIMG0195.JPG
    148.5 KB · Views: 214
  • KIMG0196.JPG
    KIMG0196.JPG
    232.7 KB · Views: 183

froggestspirit

Aspiring Game Dev
Member
Joined
Jul 28, 2011
Messages
1,281
Trophies
1
XP
1,561
Country
United States
Just tho know what are the file needed for dsi emulation (can't run no$gba for now)

(Also 0000FEFE means there's a problem with the boot sector, and I don't think you can get this if you do not modify the raw backup)

There's also a version of fwtool that check if the nand is decrypted. But I still don't understand why all those brick (I could post a build if requested)
Well, it had to have been adding titles, because the same fwtool successfully restored a nand i downgraded
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
I've been having a field day with this. Smooth sailing after the first brick, and can't seem to replicate the first brick and why the nand was a bunch of garbage corruption data is beyond me. Testing the modification with no$gba is mighty helpful in making sure the modifications were done correctly and your dump isn't corrupted before flashing back to the system.
g755jDl.jpg
 

ToneCapone-RF

Well-Known Member
Newcomer
Joined
Jun 30, 2017
Messages
65
Trophies
0
Age
51
XP
359
Country
United States
I've been having a field day with this. Smooth sailing after the first brick, and can't seem to replicate the first brick and why the nand was a bunch of garbage corruption data is beyond me. Testing the modification with no$gba is mighty helpful in making sure the modifications were done correctly and your dump isn't corrupted before flashing back to the system.
g755jDl.jpg

OK seems I having trouble with the dsi wares now lol they wont boot I get the turn off system error.
 

ToneCapone-RF

Well-Known Member
Newcomer
Joined
Jun 30, 2017
Messages
65
Trophies
0
Age
51
XP
359
Country
United States
? didn't know you can download from there.

I don't know I did everything right and yet my Sudoku does work and fieldrunners wont show up. must be that I'm using the wrong .tik.

--------------------- MERGED ---------------------------

I don't know I did everything right and yet my Sudoku doesnt work and fieldrunners wont show up. must be that I'm using the wrong .tik.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    SylverReZ @ SylverReZ: https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-window...