Skip to content

Instantly share code, notes, and snippets.

@TheExpertNoob
Last active September 25, 2022 02:24
Show Gist options
  • Star 5 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save TheExpertNoob/1c68b471f6b95f9d2b48f728fb35856c to your computer and use it in GitHub Desktop.
Save TheExpertNoob/1c68b471f6b95f9d2b48f728fb35856c to your computer and use it in GitHub Desktop.
Get Encrypted title keys from NAND Dump
Decrypt with the only key needed to obtain your titlekeys.
ddffd9e6c550750b187ba5c09e669d40db5d031964cd63455d78d73ba24ae62b
Gathered from info from http://switchbrew.org/index.php?title=Ticket
1) dump your nand with linux
2) open NAND dump with HACDISKMOUNT
3) extract/dump PRODINFO partition with BIS0 key
4) mount SYSTEM (with BIS2 keys) and copy Save/80000000000000e2 to your physical harddrive
5) close HACDISKMOUNT
6) grab get_titlekeys.py from my repo or SciresM https://github.com/TheExpertNoob/get-encrypted-titlekeys
Dont forget to edit the file for the rsa_kek
# How to get ticket.bin from 800000000000000e2
1) open e2 file in your favorite hexeditor, I use HxD
2) search for the titleID you want your key for (HEX-values NOT text-string)
3) there may be multiple instances, look for the instance that has "Root-CA00000003-XS00000021" as a text-string just a little bit further up.
Pro Tip: you can also just search for 'Root-CA00000003-XS00000021' to find all your ticket.bin(s) but we will need to make a seperate file for each.
4) To "make" your ticket.bin count backwards 0x140 bytes from "Root-CA00000003-XS00000021" , It sould start with HEX '04 00 01' then copy down 0x400 bytes.
5) paste this into a NEW FILE and save it as ticket.bin
6) you now have your first ticket.bin
6) Run Python get_titlekeys.py PRODINFO titlekey.bin
7) you have your titlekey! Now use hactool to extract that pesky title crypto nca!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment