CIA Decryptor Fails with Pokemon Moon

[VoltageMiner]

Since @d0k3 said to make a new issue.

Console: Nintendo o3DS XL A9LH: Yes Luma CFW Version: 6.5 (Latest stable is 6.6, but I don't know if it will change anything.) (Updated to 6.6 for now) Firmware: 11.2.0-35U D9Wip: Decrypt9WIP all-in-one 20161113

Log Dump:

Selected: [Update SeedDB]
Searching for seedsave.bin...
Found at 13794000, size 688kB
Creating new seeddb.bin
...
Found 0004000000175E00 seed (new) <-- Pokemon Moon
Found 12 new seeds, 12 total
Update SeedDB: succeeded!

Press B to return, START to reboot.

Selected: [CIA Builder (SysNAND/decr.)]
0x34 KeyY: set up from NAND

<id0> is (Do I need to show this?)
Use arrow keys and <A> to choose a folder
/title/00040000/00175e00

Building CIA from ID 0004000000175E00
Fetching TMD...
Searching for proper ticket...
Found ticket, injecting...
Writing CIA stub (14656 byte)...
Injecting content id 00000002 (3127132 kB)...
Decrypting content id 00000002 (SD)...
Decrypting content id 00000002 (NCCH)...
Code / Crypto: CTR-P-BNEA / 7x Seed 
Loading seed from NAND: ok
Decrypt ExHdr/ExeFS/RomFS (2kB/6340kB/3047MB)
Verify ExHdr/ExeFS/RomFS: OK/Fail/Fail
Failed decrypting content
0x generated / 1x failed
CIA Builder (SysNAND/decr.): failed!

Press B to return, START to reboot.

I went to the eshop page and I can play the game, so I don't know why this is happening.

[VoltageMiner]

117

[Kurausukun]

Sorry to hijack your issue, but just in case the one I made that got closed doesn't get any attention, I want to post here that I still have the issue, and my output looks pretty much exactly the same as yours, except there's a line about "console-unique info found, wiping."

Also, my console is a JPN N3DS, as mentioned in the other issue.

[d0k3]

Well, both of you, I guess a bad seed found it's way into your seeddb. I have an idea how to solve this, though. For now, try this: delete or rename the seeddb.bin, then try decryption the CIA file again (without the seeddb.bin on your SD card). Tell me the result.

[Kurausukun]

Failed again, unfortunately. But here's the entire log, in case that helps:

Initializing SD card... success Build: Decrypt9WIP (2016/11/13) Work directory: / Game directory: /D9Game sector0x96 Key: loaded, stored 0x03 KeyX & KeyY: automatically set up 0x05 KeyY: automatically set up 0x25 KeyX: loaded, verified, set up 0x18 KeyX: already set up 0x1B KeyX: loaded, verified, set up 0x24 KeyY: automatically set up Finalizing Initialization...

Initialization: success!

Selected: [CIA Builder (SysNAND/decr.)] 0x34 KeyY: set up from NAND

is 9D69DC18709044F4CFE4F32F5790D30F Use arrow keys and to choose a folder /title/00040000/00175e00 Building CIA from ID 0004000000175E00 Fetching TMD... Searching for proper ticket... Found ticket, injecting... Console unique info found, wiping... Writing CIA stub (14656 byte)... Injecting content id 00000002 (3127132 kB)... Decrypting content id 00000002 (SD)... Decrypting content id 00000002 (NCCH)... Code / Crypto: CTR-P-BNEA / 7x Seed Loading seed from NAND: ok Decrypt ExHdr/ExeFS/RomFS (2kB/6340kB/3047MB) Verify ExHdr/ExeFS/RomFS: OK/Fail/Fail Failed decrypting content 0x generated / 1x failed CIA Builder (SysNAND/decr.): failed! Press B to return, START to reboot.

Duh. Okay, try the same, but now use this test build: https://transfer.sh/DX2kT/decrypt9wip-20161126-192010.zip

I'm pretty sure this will solve it.

[Kurausukun]

Sorry to say, but it still failed. Log file looks exactly the same (except for the build date, of course). Is there some other information I could give you that would help?

[d0k3]

Can you try to get a seeddb.bin that contains the correct seed (not yours), then retry? I'm currently wondering if the problem is really seed related.

[VoltageMiner]

Alright, I downloaded the seed with a program. Anyway to check the seeds in the seeddb so I can compare?

[Kurausukun]

Can you tell me what program you used?

[VoltageMiner]

Looks like the seeddb.bin isn't encrypted or compressed. I compared the seed and bin in HxD andI can 100% confirm that my Moon seed it is the right seed. I checked the seed from the kagiya server and it matches. I will try the build you posted @d0k3 and I will get back to you.

[Kurausukun]

I downloaded a seeddb.bin from https://3ds.titlekeys.com since I didn't know where else to look. I have no idea if theirs would have the correct seed, but it didn't work either way. It failed the exact same way as before as far as I can tell.

[VoltageMiner]

rip it failed :/ Is there a release that has more debugging logs that may help find the error? Also, is there a way to fix the broken cia in d9game without having to redump it? It takes hours. :/

[Kurausukun]

Yeah, that's my main complaint too. It's exhausting and annoying to test over and over again since S/M are huge, so it takes multiple hours to complete. More debugging would definitely be helpful, though.

[d0k3]

I suggest you build the CIA via "CIA Builder (SysNAND/orig.)". The problem is in the decryption of the CIA, not elsewhere. Keep a copy of the CIA you build this way somewhere. Then you can test the decryption only (which takes long, too, granted) via the "CIA Decryptor (deep)" option.

BTW, the CIA you build this way is installable, too, but it has the seed, which is somewhat bad (cause playing it requires the seed, too).

I still need to think about what could cause this, it should be the seed, but your last few tests say it isn't.

[d0k3]

I may have an idea on how to speed up testing by a lot. Let us try this...

• Build the CIA the way I described above
• Get my 3DS Tools Package
• Put the CIA you created into the 'Commandline Tools' folder
• Drag and drop the CIA on to 'ctrtool_unpack_CIA.bat'

The CIA is unpacked to a new folder, inside there are content files in NCCH format. The biggest one is the game file, the smaller ones are manual and DLP. Now, try to decrypt the smaller ones first via the "NCCH/NCSD decryptor". Does that work? If it does not, we can use this for testing from now on. If it does, try the game file content in the "NCCH/NCSD decryptor".

And, thanks for testing, too!

[d0k3]

Okay, triple post, but make sure you read the two posts above, too. Here's a new test build, which might fix the issue you two have there: (link removed)

EDIT: Okay, I don't want to quadruple post. D9 now has a method of actually validating seeds before starting the decryption process. Get the new test build from here: https://transfer.sh/i49Tw/decrypt9wip-20161127-132429.zip

[Kurausukun]

Alright, I read all of the posts, and I'll try both the new D9 build and the 3DS Tools method soon. It might not be as fast as I have been before on this thread because of travel and school and stuff, but I'll get it done and report back within a day.

[VoltageMiner]

Same, will try those methods as well. I already got a "Ticket not legit, disabling reencrypt..." message via sysnand/orig that I didn't get before with the other one. Game was installed via Freeshop, if it helps.

Initializing SD card... success
Build: Decrypt9WIP (2016/11/27)
Work directory: /files9
Game directory: /files9/D9Game
sector0x96 Key: loaded, stored
0x03 KeyX & KeyY: automatically set up
0x25 KeyX: loaded, verified, set up
0x18 KeyX: already set up
0x1B KeyX: loaded, verified, set up
0x24 KeyY: automatically set up
Finalizing Initialization...

Initialization: success!

Selected: [CIA Builder (SysNAND/orig.)]
0x34 KeyY: set up from NAND

<id0> is (Still don't know if you need this.)
Use arrow keys and <A> to choose a folder
/title/00040000/00175e00

Building CIA from ID 0004000000175E00
Fetching TMD...
Searching for proper ticket...
Found ticket, injecting...
Ticket not legit, disabling reencrypt...
Writing CIA stub (14656 byte)...
Injecting content id 00000002 (3127132 kB)...
Decrypting content id 00000002 (SD)...
Injecting content id 00000001 (2020 kB)...
Decrypting content id 00000001 (SD)...
Finalizing CIA file...

1x generated / 0x failed
CIA Builder (SysNAND/orig.): succeeded!

Press B to return, START to reboot.

Unmounting SD card...

Selected: [CIA Decryptor (deep)]
Opening /files9/D9Game ...

Processing CIA "0004000000175E00.cia"
Pass #1: CIA decryption...
Pass #2: NCCH decryption...
Processing Content 1 of 2 (3053MB)...
Code / Crypto: CTR-P-BNEA / 7x Seed 
Loading seed from NAND: ok
Seed found, but validation failed!
Try fixing your seeddb.bin
Failed decrypting NCCH!
Processing Content 2 of 2 (1MB)...
Code / Crypto: CTR-P-CTAP / Seed 
Loading seed from NAND: ok
Seed found, but validation failed!
Try fixing your seeddb.bin
Failed decrypting NCCH!
CIA is not encrypted
Failed!

CIA Decryptor (deep): failed!

Press B to return, START to reboot.

Selected: [NCCH/NCSD Decryptor]
Opening /files9/D9Game ...
Processing NCCH "contents.0001.00000001"
Code / Crypto: CTR-P-CTAP / Seed 
Loading seed from NAND: ok
Seed found, but validation failed!
Try fixing your seeddb.bin
Failed!

NCCH/NCSD Decryptor: failed!

Press B to return, START to reboot.

[d0k3]

Okay, the "ticket not legit..." message is expected with CIA Builder (orig.), cause that will at least try to keep the the CIA as legit as possible.

See this? Seed found, but validation failed! Try fixing your seeddb.bin

This means that something in your seed is wrong. Maybe your NAND contains two seeds now, and one of the two is wrong. I guess freeShop may be at fault for this. I still wonder (ie. I have no idea) how this game can be playable.

Can you get a seeddb.bin with a valid seed and retry?

EDIT: And, btw, as you see, you can use the 1MB content.0001.00000001 for further testing. No need to test the whole thing from now on.

[VoltageMiner]

Any way to check if I have an invalid seed in my NAND? I never installed the preload nor the .cia with the leaked cia and dummy seed. As for getting a valid seed, I got the seed from the kagiya server using SEEDchecker. I used the seed I got from the checker and compared the hex with what's in either the seeddb or the seedsave(pretty sure it was seeddb) and I found the seed at the very end. I don't know if I'm allowed to put the HEX of the seed in a comment or not.

[d0k3]

Well, get a correct seeddb.bin, then this will be used instead of the one from the NAND. There is no chance that check would fail when the seed was indeed correct.

[VoltageMiner]

Grabbed the 12kb seeddb.bin from "that titlekey site", didn't work. I'll try asking some peeps on Discord for theirs and I'll see if those work. Fun fact: Titlekey site has Moon listed as "CTR-N-BNEA" while the title that I got from Freeshop is "CTR-P-BNEA" Likely not important, but just adding it anyway.

[d0k3]

Same output?

[VoltageMiner]

Pretty sure, yeah.

Processing NCCH "contents.0001.00000001"
Code / Crypto: CTR-P-CTAP / Seed 
Loading seed from NAND: ok
Seed found, but validation failed!
Try fixing your seeddb.bin
Failed!

NCCH/NCSD Decryptor: failed!

Press B to return, START to reboot.

Someone was able to decrypt the game if they did the following: "1. I downloaded the encrypted cia from the CDN with CDN-FX

2. New3ds
3. I didn't dump - only decrypt. I did so with decrypt 9 after - installing cia - importing seed through fbi so it is in my Nand - update SeedDB.bin (located in /files9) through D9 - Run Cia decrypt deep on cia in files9"

Could this be an o3DS problem?

[Kurausukun]

I don't think it's an O3DS problem since I'm having the same problem on a N3DS. Unlike you, though, I preloaded the game through the actual eShop, so I should have no problems, yet I do.

EDIT: Okay, I just started CIA builder without decryption, and it also gave me the message that my ticket is not legit, despite the fact that I preloaded it from the eShop. What gives there?

[Kurausukun]

Sorry for the double post, but here are my results:

I made a .cia using .cia builder (sysnand/orig), and then tried to decrypt it with cia decrypot (deep). It failed, with this output:

Initializing SD card... success Build: Decrypt9WIP (2016/11/27) Work directory: / Game directory: /D9Game sector0x96 Key: loaded, stored 0x03 KeyX & KeyY: automatically set up 0x05 KeyY: automatically set up 0x25 KeyX: loaded, verified, set up 0x18 KeyX: already set up 0x1B KeyX: loaded, verified, set up 0x24 KeyY: automatically set up Finalizing Initialization...

Initialization: success!

Selected: [CIA Builder (SysNAND/orig.)] 0x34 KeyY: set up from NAND

is 9D69DC18709044F4CFE4F32F5790D30F Use arrow keys and to choose a folder /title/00040000/00175e00 Building CIA from ID 0004000000175E00 Fetching TMD... Searching for proper ticket... Found ticket, injecting... Console unique info found, wiping... Ticket not legit, disabling reencrypt... Writing CIA stub (14656 byte)... Injecting content id 00000002 (3127132 kB)... Decrypting content id 00000002 (SD)... Injecting content id 00000001 (2020 kB)... Decrypting content id 00000001 (SD)... Finalizing CIA file... 1x generated / 0x failed CIA Builder (SysNAND/orig.): succeeded! Press B to return, START to reboot. Initializing SD card... success Build: Decrypt9WIP (2016/11/27) Work directory: / Game directory: /D9Game sector0x96 Key: loaded, stored 0x03 KeyX & KeyY: automatically set up 0x05 KeyY: automatically set up 0x25 KeyX: loaded, verified, set up 0x18 KeyX: already set up 0x1B KeyX: loaded, verified, set up 0x24 KeyY: automatically set up Finalizing Initialization... Initialization: success! Selected: [CIA Decryptor (deep)] Opening /D9Game ... Processing CIA "0004000000175E00.cia" Pass #1: CIA decryption... Pass #2: NCCH decryption... Processing Content 1 of 2 (3053MB)... Code / Crypto: CTR-P-BNEA / 7x Seed Loading seed from NAND: ok Seed found, but validation failed! Try fixing your seeddb.bin Failed decrypting NCCH! Processing Content 2 of 2 (1MB)... Code / Crypto: CTR-P-CTAP / Seed Loading seed from NAND: ok Seed found, but validation failed! Try fixing your seeddb.bin Failed decrypting NCCH! CIA is not encrypted Failed! CIA Decryptor (deep): failed! Press B to return, START to reboot. Running it through the .bat you told me gives me a folder with certs.bin, contents.0000.00000002, contents.0001.00000001, meta.bin, ticket.bin, and tmd.bin. Since contents.0001.00000001 was huge, I figured it was the game files, so I tried running contents.0000.00000002 through the NCCH/NCSD decryptor, but it gave me the same "seed found but validation failed, try fixing your seeddb.bin" message. EDIT: Just to clarify, I was doing this all without a seeddb.bin, since I have no idea where to find one that we know has a good seed.

Alright, thanks, both of you. I have a fix that should work now, get the test build from here: https://transfer.sh/ZxtjM/decrypt9wip-20161128-130255.zip

Testing with the smaller content that you extracted earlier and the NCCH/NCSD Decryptor is enough! (if it should work, trying the whole thing again is appreciated). You can provide the seeddb.bin, but you don't have to. In any case, failure or success - give me the logs after testing.

[VoltageMiner]

Initializing SD card... success
Build: Decrypt9WIP (2016/11/28)
Work directory: /files9
Game directory: /files9/D9Game
sector0x96 Key: loaded, stored
0x03 KeyX & KeyY: automatically set up
0x25 KeyX: loaded, verified, set up
0x18 KeyX: already set up
0x1B KeyX: loaded, verified, set up
0x24 KeyY: automatically set up
Finalizing Initialization...

Initialization: success!

Selected: [NCCH/NCSD Decryptor]
Opening /files9/D9Game ...

Processing NCCH "contents.0001.00000001"
Code / Crypto: CTR-P-CTAP / Seed 
Loading seed from seeddb.bin: ok
Decrypt ExHdr/ExeFS/RomFS (0kB/0kB/1MB)
Verify ExHdr/ExeFS/RomFS: -/-/OK
Success!

1x processed / 0x failed 
NCCH/NCSD Decryptor: succeeded!

Press B to return, START to reboot.

Looks like it worked. I'll try the whole thing later. I unpacked Manual.bcma with no errors. I wonder what the problem was.. hm.

[d0k3]

The problem was/is an invalid seed in your NAND. I have no idea how this game can work, but apprently it does. D9 now has a workaround included that skips such invalid seeds.

[urherenow]

Once this situation occurs, can the invalid seed be identified and/or get zeroed out?

[d0k3]

In theory, yes. But actually? Nope, I won't risk writing to important system files for a reason such as this.

[VoltageMiner]

Going to try the full CIA Builder (SysNAND/decr.) for the final test. I personally think it isn't the seed itself, but something else down the line because Moon's seed and title only appears once in seedsave.bin and in seeddb.bin. But hey, whatever works. Currently using my original seeddb.bin with the seed I always had.

[VoltageMiner]

Initializing SD card... success
Build: Decrypt9WIP (2016/11/28)
Work directory: /files9
Game directory: /files9/D9Game
sector0x96 Key: loaded, stored
0x03 KeyX & KeyY: automatically set up
0x25 KeyX: loaded, verified, set up
0x18 KeyX: already set up
0x1B KeyX: loaded, verified, set up
0x24 KeyY: automatically set up
Finalizing Initialization...

Initialization: success!

Selected: [CIA Builder (SysNAND/decr.)]
0x34 KeyY: set up from NAND

<id0> is (3D Shacks)
Use arrow keys and <A> to choose a folder
/title/00040000/00175e00

Building CIA from ID 0004000000175E00
Fetching TMD...
Searching for proper ticket...
Found ticket, injecting...
Writing CIA stub (14656 byte)...
Injecting content id 00000002 (3127132 kB)...
Decrypting content id 00000002 (SD)...
Decrypting content id 00000002 (NCCH)...
Code / Crypto: CTR-P-BNEA / 7x Seed 
Loading seed from seeddb.bin: ok
Decrypt ExHdr/ExeFS/RomFS (2kB/6340kB/3047MB)
Verify ExHdr/ExeFS/RomFS: OK/OK/OK
Injecting content id 00000001 (2020 kB)...
Decrypting content id 00000001 (SD)...
Decrypting content id 00000001 (NCCH)...
Code / Crypto: CTR-P-CTAP / Seed 
Loading seed from seeddb.bin: ok
Decrypt ExHdr/ExeFS/RomFS (0kB/0kB/1MB)
Verify ExHdr/ExeFS/RomFS: -/-/OK
Finalizing CIA file...

1x generated / 0x failed
CIA Builder (SysNAND/decr.): succeeded!

Press B to return, START to reboot.

And it looks like ctrtool extracted it successfully.

[Kurausukun]

Unfortunately mine still fails, but it's a different message now:

Initializing SD card... success Build: Decrypt9WIP (2016/11/28) Work directory: / Game directory: /D9Game sector0x96 Key: loaded, stored 0x03 KeyX & KeyY: automatically set up 0x05 KeyY: automatically set up 0x25 KeyX: loaded, verified, set up 0x18 KeyX: already set up 0x1B KeyX: loaded, verified, set up 0x24 KeyY: automatically set up Finalizing Initialization...

Initialization: success!

Selected: [CIA Builder (SysNAND/decr.)] 0x34 KeyY: set up from NAND

is 9D69DC18709044F4CFE4F32F5790D30F Use arrow keys and to choose a folder /title/00040000/00175e00 Building CIA from ID 0004000000175E00 Fetching TMD... Searching for proper ticket... Found ticket, injecting... Console unique info found, wiping... Writing CIA stub (14656 byte)... Injecting content id 00000002 (3127132 kB)... Decrypting content id 00000002 (SD)... Decrypting content id 00000002 (NCCH)... Code / Crypto: CTR-P-BNEA / 7x Seed Seed not found in seeddb.bin or NAND! Try updating your seeddb.bin Failed decrypting content 0x generated / 1x failed CIA Builder (SysNAND/decr.): failed! Press B to return, START to reboot. I got this message both by doing it without a seeddb.bin and by doing it with a self-built seeddb.bin, though the latter didn't contain the seed because it got caught as invalid by Decrypt9, so it was skipped (so the new feature is working :P). Should I be trying this with a seeddb I've downloaded from somewhere, or do I have other problems?

Alright... so, when D9 searches for seeds, it searches in SysNAND. Any chance you have the title installed on EmuNAND (looks like SysNAND, though)? One way or another, try to get a a seeddb.bin that contains the correct seed. Can't help much with that, but I'm pretty sure with a little bit of searching you will find it.

[Kurausukun]

I don't have an EmuNAND. I tried downloading a seeddb from 3dstitlekeys, but the same error happened.

[Kurausukun]

@ThunderRemix Do you mind sharing your seeddb?

[VoltageMiner]

@Kurausukun I'll try to decrypt something using the seeddb from the titlekey site, but it appears you have another issue.

[Kurausukun]

If I could test using a seeddb that we know is working, it would be very helpful, which is why I asked for yours.

[VoltageMiner]

@Kurausukun @d0k3 Here is a working seeddb.bin. Feel free to remove if this violates anything. (link removed)

[Kurausukun]

Thanks a lot, and sorry for forgetting about this thread for a bit. I've downloaded the file, so feel free to remove the link if you're worried, though I doubt anyone cares as long as it stays just here.

EDIT: Seems to have worked perfectly. Not sure if I could have made a similar working seeddb.bin if I made it with an old version then used it with the new version, but this works, and I'm happy with that.

[d0k3]

Alright, closing this now. Thanks both of you!