Decrypting SD DSiWare Exports?


Views: 1,609,209	Main \| Rules/FAQ \| Memberlist \| Active users \| Last posts \| Calendar \| Stats \| Online users \| Search	11-21-24 11:06 AM
Guest:

0 users reading Decrypting SD DSiWare Exports? | 1 bot

Main - Reverse-engineering - Decrypting SD DSiWare Exports?

Hide post layouts | New reply

d0k3

Posted on 12-22-15 06:25 PM (rev. 2 of 12-22-15 06:42 PM)

Link | #838

Member
Normal user

Level: 20

Posts: 73/75
EXP: 38194
Next: 4245

Since: 06-04-15

Last post: 3250 days ago
Last view: 2998 days ago

I just noticed that I did this wrong all the time... The DSiWare Exports are found in /Nintendo 3DS///Nintendo DSiWare. Everything else in that // folder is decrypted by a rather simple scheme of AES-CTR with an IV calculated from the path name. Not the DSiWare Exports though:
http://3dbrew.org/wiki/DSiWare_Exports

These use AES-CBC, and the IV for that seems to come from the 'Block Metadata' at the end of each section (if I got that right). Sections are Banner, Header, Footer, Content, and at the start of each section, I have to set the IV to the correct value.

DSiWare exported from 3DS use console-unique keyslots initialized by movable.sed. Each section is encrypted with AES-CBC.

Now, console-unique keyslots... I tried to bruteforce that, but no success so far. I'm also unsure if I can just use the keyY from movable.sed with each and every AES keyslot in the range from 0x10 - 0x40, without any danger of damaging my console.

Any ideas on how to proceed with that?

EDIT: Forgot about that... I'm also unsure about endianness and order. I'd assume it is the same as for everything else on the SD though.

profi200

Posted on 12-22-15 07:38 PM

Link | #839

Member
Who knows?

Level: 19

Posts: 43/70
EXP: 34507
Next: 1270

Since: 05-21-15
From: Germany

Last post: 2992 days ago
Last view: 2860 days ago

Don't really see the need for this if you just can decrypt twln. The effort to implement this is not worth the gain.
The required AES keyslot is documented on the AES Registers page.

d0k3

Posted on 12-23-15 12:14 AM

Link | #840

Member
Normal user

Level: 20

Posts: 74/75
EXP: 38194
Next: 4245

Since: 06-04-15

Last post: 3250 days ago
Last view: 2998 days ago

Posted by profi200
Don't really see the need for this if you just can decrypt twln. The effort to implement this is not worth the gain.
The required AES keyslot is documented on the AES Registers page.

Well, that should be 0x34 then, same as with everything else in that folder. But you're right, at a second look this looks like as much effort as for CIA decryption (the contents themselves also consist of multiple sections), and that was a lot.

profi200

Posted on 12-23-15 01:30 AM

Link | #841

Member
Who knows?

Level: 19

Posts: 44/70
EXP: 34507
Next: 1270

Since: 05-21-15
From: Germany

Last post: 2992 days ago
Last view: 2860 days ago

No, look again. There is a special keyslot just for DSi Ware exports en-/decryption.

d0k3

Posted on 12-28-15 04:39 PM

Link | #846

Member
Normal user

Level: 20

Posts: 75/75
EXP: 38194
Next: 4245

Since: 06-04-15

Last post: 3250 days ago
Last view: 2998 days ago

Alright, found it! After recognizing the effort that would have to be put into this, I decided to put this on ice for now. Although an interesting project, this is not even that useful for now. Will see about that later. Thank you!

Main - Reverse-engineering - Decrypting SD DSiWare Exports?

Hide post layouts | New reply

Page rendered in 0.013 seconds. (2048KB of memory used)
MySQL - queries: 26, rows: 71/71, time: 0.007 seconds.
[powered by Acmlm]