Skip to content

Instantly share code, notes, and snippets.

@jason0597
Last active May 15, 2023 21:47
Show Gist options
  • Save jason0597/a47768992e9e8947f28144af27eb728a to your computer and use it in GitHub Desktop.
Save jason0597/a47768992e9e8947f28144af27eb728a to your computer and use it in GitHub Desktop.
How seedminer works

DSiWare games are vulnerable to a specific set of exploits which allows you to install boot9strap with them. You can also export DSiWare games from the System settings (System settings --> Data Management --> Nintendo DSiWare), however, these DSiWare exports are encrypted with your console unique movable.sed encryption key. Unless you can get that key somehow, you cannot decrypt them/modify them/re-encrypt them/re-import them

The DSiWare games are encrypted with AES-128. 128 means 128 bits. A byte in computing means 8 bits together. Therefore, the encryption key is 128 bits aka 16 bytes (128 / 8 == 16) The first 8 bytes are the LocalFriendCodeSeed (L.F.C.S.). You can dump this if you have access to userland homebrew (things like ninjhax, freakyhax, stickerhaxx etc.). However, it is also possible to dump this for your friends if your 3DS is hacked. Therefore, somebody with a hacked 3DS can dump your LFCS for you. Now, you have the first 8 bytes of your movable.sed. However, there are still 8 bytes left which you don't know what they look like.

What zoogie (the inventor of seedminer) discovered, is that in those 8 bytes, the last 4 of the 8 bytes can be calculated from your LFCS. There is a mathematical relationship that links the LFCS and the last 4 bytes of your movable.sed. If you know the 12 out of 16 bytes (8 + 4 = 12), you have 4 bytes left, which are easily bruteforceable by an average modern PC. You can crack these keys very fast with a good gaming GPU as well.

So once you get your movable.sed, you can decrypt the DSiWare export, modify it, re-encrypt it, import it, and then launch it and then you can install boot9strap onto your 3DS.


I'll tell you what the ID0 is as well. -There is something in cryptography called a hashing algorithm. The way this works is that you give it a long (any length!) piece of data, and it will give you a unique string of bytes that is of set length (256 bits in the case of sha256, i.e. 256 / 8 = 32 bytes) -The foldername inside the Nintendo 3DS folder is the hash of your movable.sed encryption key -The fundamental property of a hashing algorithm is that it is impossible to reverse. If you have a hash of a piece of data, you cannot reverse the output to get the input, it is impossible. What you do instead, is you hash your movable.sed and keep trying random combinations of those 4 bytes I told you before until you manage to get the exact same hash as your ID0. -The ID0 is itself a hash of the movable.sed, and it is generated by the 3DS itself secretly deep down the in kernel, where you don't have access to it. -In some time, you will get, by sheer chance, a perfect match that will give you the perfect ID0, at which moment you are 100% sure that the movable.sed you just hashed belongs to the ID0.

@FieryMewtwo
Copy link

wow

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment