Skip to content

Commit

Permalink
Merge pull request #2 from jason0597/master
Browse files Browse the repository at this point in the history
Add things to readme, seperate source & header files, and remove unused functions from tadpole.cpp
  • Loading branch information
zoogie committed Dec 8, 2018
2 parents 5cc06bf + 53b3aae commit ea39154
Show file tree
Hide file tree
Showing 2 changed files with 32 additions and 53 deletions.
13 changes: 10 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,15 @@
# Frogminer title manager
This tool allows you to export, inject, import and boot a patched DS Download Play title with flipnote_v0 JPN.
It also copies the necessary files for the ugopwn exploit right to the SD card from RomFS.

## Instructions
https://jisagi.github.io/FrogminerGuide/ or https://3ds.hacks.guide/

Thanks:
jason0597 - for about 75% of the TAD crypto code<br>
Daniel (Nintendo Homebrew Discord #4420) - for the icon and bottom screen banner
## Thanks
* [jason0597](https://github.com/jason0597) - for about 75% of the [TAD crypto code](https://github.com/jason0597/TADPole-3DS/)
* Daniel (Nintendo Homebrew Discord #4420) - for the icon and bottom screen banner

## Libraries used
* [Texas Instruments AES-128 CBC and AES CMAC functions](https://github.com/flexibity-team/AES-CMAC-RFC)
* [ECDSA sect233r1 code (along with BigNum code)](http://git.infradead.org/?p=users/segher/wii.git)
* [Nintendo 3DS key scrambler function](https://github.com/luigoalma/3ds_keyscrambler/blob/master/src/UnScrambler.c#L50)
72 changes: 22 additions & 50 deletions source/tadpole.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,6 @@
#include "tadpole.h"
#include "ec.h"

typedef uint32_t element[8];
void ninty_233_ecdsa_sign_sha256(uint8_t * input, int length, const uint8_t * private_key, element r_out, element s_out);
void elem_to_os(const element src, uint8_t * output_os);

void getSection(u8 *dsiware_pointer, u32 section_size, u8 *key, u8 *output) {
decryptAES(dsiware_pointer, section_size, key, (dsiware_pointer + section_size + 0x10), output);
}
Expand All @@ -27,52 +23,6 @@ void placeSection(u8 *dsiware_pointer, u8 *section, u32 section_size, u8 *key, u
memset((dsiware_pointer + section_size + 0x10), 0, 0x10);
}

/*
1) Read in the Public/Private key pair from the ctcert.bin into the KeyPair object
2) Copy the ctcert.bin to the CTCert section of the footer.bin
3) Take the 13 hashes at the top, and hash them all to get a single master hash of all the contents of the DSiWare container
4) Sign that hash. Retrieve the ECDSA (X, Y) coordinates in the form of byte arrays, each one of size 0x1E.
If the points retrieved are not 0x1E in size, add padding 0s at the start. Then, take those two arrays,
combine them and you'll get a single big byte array of size 0x3C. Place that in the correct spot for the footer. (it's placed
immediately after the 13 hashes, i.e. 13 * 0x20 == 0x1A0)
5) Make a new byte array of size 0x40. Then, fill it up with this formula:
snprintf(your_byte_array, 0x40, "%s-%s", ctcert->issuer, ctcert->key_id);
6) Copy that byte array into the issuer section for the APCert (it's at offset 0x80 relative to the start of the APCert)
7) Hash the APCert's bytes in the range of 0x80 to 0x180 (in total 0x100 bytes).
Essentially skip the signature portion of the APCert (cause you don't sign a signature)
8) Sign that hash you just created with your KeyPair. Do the same coordinate retrieval process as for step 4.
9) Take your coordinates byte array (2 * 0x1E = 0x3C in size), and place it in the signature
section of the APCert (it's at offset 0x04 relative to the start of the APCert)
10) Copy the public key byte array into the APCert's public key field (it's at offset 0x108 relative to the start of the APCert)
*/

Result load2buffer(u8 *buf, u32 size, const char *filename){
u32 bytesread=0;
FILE *f=fopen(filename,"rb");
bytesread=fread(buf, 1, size, f);
fclose(f);
if(bytesread != size){
printf("File read error: %s\n", filename);
return 1;
}
return 0;
}

Result dumpfile(u8 *buf, u32 size, const char *filename){
u32 byteswritten=0;
FILE *f=fopen(filename,"wb");
byteswritten=fwrite(buf, 1, size, f);
fclose(f);
if(byteswritten != size){
printf("File write error: %s\n", filename);
return 1;
}
return 0;
}

Result copyFile(const char *src, const char *dst){
u32 limit=0x80000;
u8 *copybuf=(u8*)malloc(limit);
Expand Down Expand Up @@ -138,6 +88,28 @@ Result seed_check()
return 0;
}

/*
1) Read in the Public/Private key pair from the ctcert.bin into the KeyPair object
2) Copy the ctcert.bin to the CTCert section of the footer.bin
3) Take the 13 hashes at the top, and hash them all to get a single master hash of all the contents of the DSiWare container
4) Sign that hash. Retrieve the ECDSA (X, Y) coordinates in the form of byte arrays, each one of size 0x1E.
If the points retrieved are not 0x1E in size, add padding 0s at the start. Then, take those two arrays,
combine them and you'll get a single big byte array of size 0x3C. Place that in the correct spot for the footer. (it's placed
immediately after the 13 hashes, i.e. 13 * 0x20 == 0x1A0)
5) Make a new byte array of size 0x40. Then, fill it up with this formula:
snprintf(your_byte_array, 0x40, "%s-%s", ctcert->issuer, ctcert->key_id);
6) Copy that byte array into the issuer section for the APCert (it's at offset 0x80 relative to the start of the APCert)
7) Hash the APCert's bytes in the range of 0x80 to 0x180 (in total 0x100 bytes).
Essentially skip the signature portion of the APCert (cause you don't sign a signature)
8) Sign that hash you just created with your KeyPair. Do the same coordinate retrieval process as for step 4.
9) Take your coordinates byte array (2 * 0x1E = 0x3C in size), and place it in the signature
section of the APCert (it's at offset 0x04 relative to the start of the APCert)
10) Copy the public key byte array into the APCert's public key field (it's at offset 0x108 relative to the start of the APCert)
*/

Result doSigning(u8 *ctcert_bin, footer_t *footer) {
Result res;
u8 ct_priv[0x1E], ap_priv[0x1E], tmp_pub[0x3C], tmp_hash[0x20];
Expand Down

0 comments on commit ea39154

Please sign in to comment.