GodMode9
GodMode9 copied to clipboard
[FEATURE REQUEST] Support dumping ntrboot carts
Currently, GM9 doesn't support ntrboot carts at all (they show up empty or with an error).
This is because ntrboot carts use different key derivation for the cartbus crypto.
I have a hacked up fork that allows dumping these, but it uses ifdefs to pick the correct key derivation to use, and other awkward things (correct dump is .nds.enc etc).
Here's some extra info:
- (at least) TWL ntrboot carts can have a zero byte as the first byte of the cart header, currently GM9 upstream rejects these
- ntrboot carts are NTR-mode only with custom key material
- TWL boot7, when deriving the cartbus keys, does it in a completely deterministic way (using the first 16 bytes of the RSA signature in the ntrboot cart header). CTR boot9 reuses this code but gets random data from the ARM9 RNG registers instead. I reimplemented what TWL boot7 does just in case the actual carts care.
- CTR boot9 just uses a blowfish table without any further derivation (one each for prod/dev). TWL boot7 uses a blowfish table with further derivation by the gamecode (slightly different than what is done for normal DS game carts).
- The secure area must not be decrypted by blowfish for ntrboot carts - I have no idea what is correct for CTR ntrboot carts (possibly empty as the FIRM starts at 0x7e00, with section data further encrypted by hardcoded keys; for TWL ntrboot carts, the arm7/arm9 data starts in the secure area, encrypted by TWL keyslot 2 where keyX=constant set by boot7 and keyY=first 0x10 bytes of the RSA signature message after padding.
I'd include that, if you (or someone else) could write a not-hacky pull request for that functionality.