Dumping NSPs on firmware 16.0.3 has corrupt NCAs

[e9854]

Dumping over MTP or dumping to SD card results in an NSP that cannot be opened, error: Failed to open content of NCA section «0»: ResultFsNonRealDataVerificationFailed (2002-4604): Hash error!

[ghost]

А у меня все работает. Без указания деталей, баг не засчитан.

[myzar472]

@duckbill007 - Я тоже вижу этот баг. У меня новая установка Atmosphere 1.5.4 и DBI 563.

Вот что произойдет если я скопирую игру с MTP Responder и проверю с NXFileViewer

[Ammako]

NxFileViewer is too old and can't handle sparse NCA. The files are fine.

[myzar472]

@Ammako -

Эта игра не Sparse. Все работает если я использую NXDumpTool/NSPDumper. Проблема возникает только с DBI и MTP.

[Ammako]

There has to be something more to this... a master key 13 FW 14.1.2 game I dumped on 16.0.2 with DBI 551 shows this error, same if I used DBI 563 on 16.0.3 (I had assumed this was sparse), but an older master key 9 FW 9.0.1 game is completely fine regardless. Yet my most recent game (being Fire Emblem Engage, also Master Key 13) shows completely fine as well, it just complains about missing deltas from the update cnmt but that's not actually an issue. Then one older game I have (from 2018) also shows this issue regardless.

The only thing I can think of is that the games I have which show this issue are legally-purchased games from the eShop with personalized tickets, so DBI has to do something when dumping to change them into common ticket NSPs. This should only affect the ticket though and not the NCAs... other games which had already been scrubbed of console-specific data beforehand dump fine and show no errors.

[Ammako]

Ok yeah, I know what the problem is. NxFileViewer doesn't know how to handle personalized tickets, so it's unable to decrypt contents. I guess I was wrong and DBI actually does preserve console-unique data when dumping games.

But still, the files are fine, NxFileViewer is the problem here. More info:

The title key can be stored as a 16-byte block when tickets are "common" [2.0.0+] with title key type 0, or as a "personalized" RSA-2048 message when title key type is 1. The latter is used for titles requiring stronger licensing (applications, add-on content), while the former (old) method is used for patches.

https://switchbrew.org/wiki/Ticket#Ticket_data

Personalized ticket NSPs have a 100h-byte title key which NxFileViewer doesn't know how to use. When you remove console-specific data and 'convert' a game to common ticket it's given title key type 0 with a shorter 16-byte title key, which NxFileViewer does know how to handle.

[e9854]

Personalized ticket NSPs have a 100h-byte title key which NxFileViewer doesn't know how to use. When you remove console-specific data and 'convert' a game to common ticket it's given title key type 0 with a shorter 16-byte title key, which NxFileViewer does know how to handle.

What tool did you use to convert the ticket?

And strange how it just started after I updated, and all previous games I dumped with DBI were handled fine with NxFileViewer. Is there a more up-to-date tool I should be using to extract NCA contents?

[myzar472]

Ребята:

Я тестировал v527, v543, v551 и v563 с одной игрой.

Эта проблема возникла только на v563.

@Ammako - попробуй проверить на v551 vs v563?

[Ammako]

@e9854 nxdumptool will do this for you if you select to remove console-specific data.

It's possible that older versions of DBI used to convert personalized tickets to common tickets, and that something was changed in the lead-up to 563 that made it so it doesn't do that anymore. Without being able to check the source code, only duckbill could tell you. @myzar472 this applies to you too

In NxFileViewer, right click the .tik and export, and check in a hex editor. If the ticket signature is all FF's and the title key at the bottom half is only one row long, you have a common ticket. If the signature is random stuff and the bottom half of the ticket file is 100h of randomness, you have a personalized ticket. Make a dump in 551 and one in 563 and then compare. I can do this later on my end if needed.

[myzar472]

@e9854 nxdumptool will do this for you if you select to remove console-specific data.

It's possible that older versions of DBI used to convert personalized tickets to common tickets, and that something was changed in the lead-up to 563 that made it so it doesn't do that anymore. Without being able to check the source code, only duckbill could tell you. @myzar472 this applies to you too

In NxFileViewer, right click the .tik and export, and check in a hex editor. If the ticket signature is all FF's and the title key at the bottom half is only one row long, you have a common ticket. If the signature is random stuff and the bottom half of the ticket file is 100h of randomness, you have a personalized ticket. Make a dump in 551 and one in 563 and then compare. I can do this later on my end if needed.

@Ammako - Я проверил игру Animality. Я вижу разницу; v551 имел FF's и v563 выглядел random.

[ghost]

Ок. Вот теперь это нормальный багрепорт

[ghost]

Да. В процессе рефакторинга работы с тикетами дамп пострадал. К версии прошивки или самим тикетам отношения не имеет. Исправлено в 569+

[Ammako]

It was most definitely the tickets. 551-569 overwrites it with fake common ticket while 563 kept the personalized ticket. It's the only difference I can see in my dumps and this is the same thing you get with nxdumptool. Firmware version didn't matter though.