Hacking How can I decrypt nand sysdata saves (Mii Maker, Mii Plaza, etc.)

[SOGAZG]

Hi, I have a nand backup of an old 3ds I had. This 3ds got lost. Thank god I got the backup and now I've recovered everything, from old data, to the sd card encrypted game save data (using movable.sed and other tools).

Now, next, I'm looking to recover my Mii Maker and Mii Plaza save files. Using ninfs, I decrypted my nand.bin, and in the ctrnand_full.img I got to the sysdata folder where this save data is stored. Now, my final goal is to be able to open these saves on citra. On citra I already installed all system cias (system settings, mii plaza, mii maker, etc.) and I got the folder where they store the saves. When I go in the sysdata folder from citra, and enter the game folder, instead of a 00000000 file with no extension, there is a folder with the same name and a "editSaveData.bin" file inside. I suppose this is the decrypted version of the 00000000 file on my Nand sysdata.

Mii Maker:
My Nand Backup:

Citra:

I want to know if there is a way to decrypt this type of files without having to use the original 3ds (since I no longer have it). I tried using tools like three sd to transfer everything to citra, but I got stuck in the part where I need to execute the threeSDumper.gm9 on the 3ds (because I don't have it).

If you need me to clear something up to help you understand please let me know.

Any help would be appreciated

 

[Kwyjor]

When I go in the sysdata folder from citra, and enter the game folder, instead of a 00000000 file with no extension, there is a folder with the same name and a "editSaveData.bin" file inside. I suppose this is the decrypted version of the 00000000 file on my Nand sysdata.

That's a broad assumption.

According to https://www.3dbrew.org/w/index.php?title=Mii_Maker&mobileaction=toggle_view_desktop , if you open editSaveData.bin in Notepad, and it's decrypted, you should see the word "TIDE" right at the start. Does that apply to both your editSaveData.bin and this 00000000 file?

Failing that, do you see the word "DISA" or "DIFF". as per https://www.3dbrew.org/wiki/DISA_and_DIFF ?

You are also probably going to need the information in https://www.reddit.com/r/3dshacks/comments/70gwgu/everything_you_wanted_to_know_about_the_3ds_but/ sooner or later.

 

[SOGAZG]

That's a broad assumption.

According to https://www.3dbrew.org/w/index.php?title=Mii_Maker&mobileaction=toggle_view_desktop , if you open editSaveData.bin in Notepad, and it's decrypted, you should see the word "TIDE" right at the start. Does that apply to both your editSaveData.bin and this 00000000 file?

Failing that, do you see the word "DISA" or "DIFF". as per https://www.3dbrew.org/wiki/DISA_and_DIFF ?

You are also probably going to need the information in https://www.reddit.com/r/3dshacks/comments/70gwgu/everything_you_wanted_to_know_about_the_3ds_but/ sooner or later.

In the citra one (editSaveData.bin) shows TIDE at the start, and in mine (file 00000000) shows DISA & DIFI.

What does this mean?

 

[Kwyjor]

All right, that means it's decrypted, but it's still packed in a container.

To unpack it, you need disa-extract from 3ds-save-tool. (This is a command-line Python program.)

 

[SOGAZG]

I have the program downloaded. Now, I ran the disa-extract.py without arguments and this is what it shows me:

Now, for this specific case
1st: Do I need to provide secrets.py?
2nd: Which arguments should I run disa-extract.py with? (I guess in this case is input: my save file 00000000, output: output folder, and -nand)

 

[Kwyjor]

Now, for this specific case
1st: Do I need to provide secrets.py?
2nd: Which arguments should I run disa-extract.py with? (I guess in this case is input: my save file 00000000, output: output folder, and -nand)

There is already a suitable example on the page.

./disa-extract.py \
    "sdmc/gm9out/00000001.sav" \
    "output/savedata"

This extracts game save data that has been decrypted using GodMode9 (or any other tools) to folder output/savedata.

(The backslashes are unnecessary; you can just enter everything on one line.)

 

[SOGAZG]

And do I need to fill secrets.py? And if yes, how do I obtain this variables?

 

[Kwyjor]

If you read my post again you will see that I did not mention secrets.py .

 

[SOGAZG]

Well no mentioning it still leaved me in blank. In my shoes idk if you do not saw that part, or by not mentioning it, it is not necessary. But no problem, it worked perfectly. Thank You so much for helping me

 

[Rude_Boy_EEEE]

Well no mentioning it still leaved me in blank. In my shoes idk if you do not saw that part, or by not mentioning it, it is not necessary. But no problem, it worked perfectly. Thank You so much for helping me

How'd you end up doing it? I can't seem to understand Python well enough to do this...

 

[DaniElectra]

How'd you end up doing it? I can't seem to understand Python well enough to do this...

Coming almost a year later, but assuming you have Python installed, you can just open a command prompt on the same folder where you download the tool and run:

python3 disa-extract.py input_file output_folder

Where input_file would be the sysdata save and output_folder is the folder where the save data will be extracted. The secrets.py part isn't required