How to Cryptofix a game (Version 2) This guide was originally posted by MDashK, thanks go to him for writting it & for allowing me to repost his guides on 3DS Chaos Thanks & credits also go to everyone involved in creating the process & making the tools used in the guide THIS TUTORIAL HAS BEEN HEAVILY UPDATED TO MAKE SURE THE PROCESS WORKS WITHOUT MUCH PROBLEMS. This tutorial is directed assuming you bought the game in the 3DS eShop and want to decrypt it and share it with the world. BUT, it can also be used if someone shared with you the SEED file needed AND the 3DS NON-CRYPTOFIXED ROM file. A Big Special Thanks To @Moody for providing the specific information from the previous tutorial version. First and NEEDED: - INSTALL Python 2.7.xx. YOU WILL NEED IT. (https://www.python.org/downloads/windows/) or python-2.7.8.msi Code: http://ul.to/3rwn312z http://vidzi.net/abz7l7zgho1o/python-2.7.8.msi.html - a 3DS console with MSET (4.x) Loader; - a generic NDS Flashcard (use to run NDS ROM files. This is needed to install the Decrypt9 ROP loader); - emuNAND (linked) or sysNAND partition with access to eShop (not needed if you have the SEED file and NON-CRYPTOFIXED 3DS ROM file); - access to the internet. PRE-PACKAGE: You can download a Pre-Assembled package with the needed tools here: Code: http://ul.to/9e1yusr2 http://vidzi.net/2cg0f0rzcect/CRYPTOFIX.rar.html Still, it's advised to ALWAYS get the latest version of the tools/scripts from their specific pages. 1) Install/Buy game from official eShop; 2) Use FunkyCIA's Launcher_ticketdb.dat to extract your ticket.db (sysNAND) and ticket.db_gwemu (emuNAND); 3) Use Shadowtrances's Decrypt9 (https://gbatemp.net/threads/download-decrypt9-wip-3dsx-launcher-dat.388831/) or https://github.com/Shadowtrance/Decrypt9/releases to get your NAND FAT16 XORPAD; 4) Extract your emuNAND using emuNANDTool, decrypt it using 3DSFAT16tool (you will need the FAT16 NAND XORPAD in here) and open the decrypted emuNAND with WinImage. Use it to extract the NAND\data\(console exclusive)\sysdata\0001000f\00000000 file; 5) Use SEEDConv to convert your 00000000 file to seeddb.bin; (https://gbatemp.net/threads/download-seedconv-seeddb-bin-generator-for-use-with-decrypt9.392856/) 6) Now, get the latest ncchinfo_gen.py (http://builds.archshift.com/decrypt9/nightly/decrypt9-latest-browser.7z) and use the seeddb.bin with the script. You will get a ncchinfo.bin file. WE WILL NEED THIS FILE ONCE WE HAVE THE 3DS FILE AT HAND. Now, how to get it. 7) Download 3DS_Multi_Decryptor (git clone or download zip - https://github.com/Relys/3DS_Multi_Decryptor). Don't forget to add makerom.exe in the CDNto3DS folder. 8) Now, use dumpticketkeys.py (from ticket-titlekey_stuff folder) with ticket.db_gwemu / ticket.db file to get encTitleKeys.bin file; Open a CMD window in the folder (Left Shift+Right Mouse Click -> Open Command Prompt Here), and type Code: dumpTicketKeys.py ticket.db (or ticket.db_gwemu) (Don't close the cmd window yet) Put the generated encTitleKeys.bin file in the Decrypt9 folder of your SD card. Also, go ahead and put the ncchinfo.bin file in this Decrypt9 folder as well. 9) Now, using Shadowtrances's Decrypt9, we will use the encTitleKeys.bin to get the decTitleKeys.bin file. For this, select "Titlekeys File" option in Decrypt9. Also, select "NCCH PADGEN" option to generate the needed XORPADs from the ncchinfo.bin file. These will be needed later. NOTE: Yes, I know some of you will say: "You could have used rxTools for all this.". Yeah, but rxTools kept spitting me errors for no known reason. So I said "**** this!" and took the long way, which in fact worked. 10) Grab the decTitleKeys.bin file from the SD Card and put it in the ticket-titlekey_stuff folder. Now, in the open CMD window, run: Code: printKeys.py > keys.txt This will create a TXT file with the Keys of your titles. NOTE: Another place that rxTools did stuff in a nutsy way. With the decTitleKeys.bin file created from rxTools, the Python script was stuck in an endless loop... 11) Open the Keys.txt file with Notepad. Search for the game TitleID and it's Title Key. (It should be on the latest line) If unsure about this, you can use DevMenu or similar to check the ID of the game you bought. Remember: 000400000015ba00 > Shows up in DevMenu has "0015ba" (or similar...) 12) Now, to use the CDNto3DS from 3DS_Multi_Decryptor Code: CDNto3DS.py titleid titlekey (again don't forget to add makerom.exe in the CDNto3DS folder first) Example (for 3D Sonic 2 EUR): CDNto3DS.py 000400000015ba00 0bbb7505d8bfa7cbbcc7061f3ac40c2f You will get a NON cryptofixed 3DS and CIA. We are going to use the 3DS file to cryptofix the game. 13) Download 3DS TO CIA 2.0.7. Now, we will need the XORPADs of the game (previously created with Decrypt9) to cryptofix it. So, put those XORPAD files in the main "3ds_to_cia" folder. They should go together with the BAT file of the converter. Grab the 3DS file created previously and put it here as well. Now, run the BAT from the converter. For the conversion, select the following options (meaning, they must be "YES"): Auto RSF, Original ExHeader, Keep Decrypted folder. The converter will create the decrypted cryptofixed CIA file for you. To generate a 3DS file, just use 3DS Builder (https://gbatemp.net/threads/release-3ds-builder.388858/) using the files (RomFS, ExeFS, etc...) from the decrypted folder created by 3DS to CIA converter.