https://gbatemp.net/threads/nintendo-switch-sd-to-nsp-dumper.514816/ for a more automated and easier way to do this
This guide assumes you have previous experience with hactool and messing with your NAND. You aren't supposed to blindly copy commands in this, so read before pasting!
Also, the Python sections require Python 2.7 and pycrypto. Make sure your hactool is v1.2 or above.
Obtaining Your SD Seed
- Run https://cdn.discordapp.com/attachments/432400335235973120/478053328857726976/Compelled-Disclosure.nro (source at https://github.com/shadowninja108/Compelled-Disclosure, thx Shadów#6239)
- Rename the bin files in
80000000000000e2to whatever you want and copy them to your computer. Also copy the
8000000000000043to your computer.
sd:/Nintendo/contents/privatein a hex editor.
- Copy the hex representation of it.
- Open the
8000000000000043in a hex editor.
- Search for the contents of the
privatefrom the contents folder.
- Copy the 16 bytes after that. This is your SD seed. Don't lose it!
Obtaining Your Title Keys
put_eticket_rsa_kek_herein get_titlekeys.py with the actual eticket_rsa_kek.
- Run get_titlekeys.py with the first argument being a raw decrypted backup of your PRODINFO.bin and the second being a ticketblob (those bin files in the e1 and e2 folders). Make sure to run it on both to get all keys!
python get_titlekeys.py /path/to/PRODINFO.bin ticket.bin
- Save the outputs somewhere safe. These are your title keys! If you buy another title and want to dump it, you'll have to do these steps again.
Decrypting (the hard part)
sd:/Nintendo/Contents/registered. There should be a lot of folders with hexadecimal names. (e.g. 0000004C)
- Use a tool like WizTree to find the sizes of each folder. This can help pinpoint what title you should dump. Taking a look at the creation dates can help, too.
- Time for the part everyone messes up:
Let's say the title you want to dump is at
The command you would write would look something like this:
hactool -k path/to/prod.keys -t nax0 --sdseed=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --sdpath="/registered/00001337/cafebebecafebebecafebebecafebebe.nca" --plaintext=game.nca "F:/Nintendo/Contents/registered/00001337/cafebebecafebebecafebebecafebebe.nca/00"
If it works, great! If you get
Error: NAX0 key derivation failed. Check SD card seed and relative path?, you probably messed up typing the command.
- It's not over yet! The dumped NCA is still title key encrypted. Run
hactool -k path/to/prod.keys your.nca. Since it's encrypted, hactool will complain about it being corrupted.
- Check the output for the
Rights ID. For example, Splatoon 2 USA would say
Rights ID: 01003BC0000A00000000000000000000.
- Look for the corresponding title key in your title key dump.
- Finally, run this command:
hactool -k path/to/prod.keys game.nca --titlekey=put_your_title_key_here
- If it doesn't complain about corruption, you're done! You can extract exefs and romfs the usual ways, but you need to put in the titlekey flag.
Simpleflips whoever writes those python scripts. You guys are the best!
That hactool build was cloned from commit 9d9b781 with commit 94d55a9 cherry-picked and was compiled on MSYS2 with the config.mk.template. (or at least until I removed it because hactool 1.2 launched with that regression fixed)
Game updates can be extracted with
hactool -k path/to/prod.keys game_update.nca --titlekey=update_titlekey --basenca=game.nca --romfsdir=updatedgameromfs --exefsdir=updatedgameexefs where
game_update is the update NCA,
update_titlekey is the title key for the update, and
game.nca is the original, unpatched NCA for the game. The dump will be the update combined with the base.
You can dump titles from System Memory by mounting your USER partition. The layout is similar, but the files aren't NAX0 files. Instead, they're just normal NCAs. They can be decrypted with the correct master key and you still need the title key.
v2: add jakibaki's modified get_ticketbins
v3: hactool doesn't seem to support dumping plaintext from titlekeys and i put in my own hactool build
v4: add some bonuses
v5: clarify keys
v7: add a better method of getting the ticketbins
v8: nobody reads this changelog just go look in revisions