Difference between revisions of "Nintendo Switch Digital Software Dumping Guide"

Revision as of 12:10, 22 November 2019

[todo: find out how to sniff network traffic of download on console to get raw data including HTTP Response headers]

From installed title (NXDumpTool)

It's an open-source homebrew application capable of generating installable Nintendo Submission Package (NSP) dumps from installed digital titles.

Requirements

• A Nintendo Switch console with a firmware version greater than or equal to 3.0.0. Must either be vulnerable to Fusée Gelée or have a firmware version compatible with Caffeine. The exact details on how to use these exploits to launch homebrew applications aren't covered in this guide.
• The latest NXDumpTool release saved to sdmc:/switch/nxdumptool/nxdumptool.nro.
• Keys file generated using Lockpick_RCM, located at sdmc:/switch/prod.keys. Run the payload on your console in order to dump the keys. They're needed by NXDumpTool to decrypt contents while generating NSP dumps.

Note #1: if you use a SD card with a FAT32 partition and the game you wish to dump is bigger than 4 GiB, you can dump it in smaller parts, but you must reassemble them afterwards.

Note #2: you don't need to have enough free space in your SD card for a whole dump. Sequential (multi-session) dumping is available in NXDumpTool, and it's automatically triggered if there's not enough space for a whole dump - but there must be at least 1 GiB of free space. After each session, you'll have to transfer the generated part files to your PC before continuing the dump process in the next session.

Dumping steps

1. Using either Fusée Gelée or Caffeine, boot into the CFW of your preference and load the Homebrew Launcher using title override (hold R while launching a game).
2. Load NXDumpTool.
3. Select Dump SD card / eMMC (NANDUSER) content, then select the game you wish to dump from the displayed list.
   • If you can't find your game on the list, it most likely means you're using a gamecard with updates/DLCs installed to the SD card and/or eMMC. These titles are internally referred to as "orphan content" in NXDumpTool. You can access the orphan content list by pressing the Y button in the SD/eMMC menu. For more information, see Dumping steps (orphan content).
4. Select Nintendo Submission Package (NSP) dump.
   1. If you have installed updates / DLCs for the selected title:
      • If you want to dump the base game / application, select Dump base application NSP.
      • If you want to dump an installed update, select Dump installed update NSP.
      • If you want to dump an installed DLC, select Dump installed DLC NSP.
   2. Otherwise, if you have no installed updates / DLCs for the selected title, go to the next step.
5. Set the available options to the following values:
   • Split output dump (FAT32 support): set it to Yes if you're using a FAT32 partition in your SD card. Otherwise, set it to No.
   • CRC32 checksum calculation: No.
   • Remove console specific data: Yes. This will remove console/account data from a personalized ticket and convert it to a common ticket if the title you wish to dump uses titlekey crypto.
   • Generate ticket-less dump: No.
   • Change NPDM RSA key/sig in Program NCA: No. This option only appears with base applications and updates.
   • If you chose to dump an installed update / DLC, select the Use update / Use DLC option and use the left/right buttons to cycle between the available updates / DLCs.
6. Select Start NSP dump process, press A and wait for the process to finish. You'll be able to find the output file(s) in sdmc:/switch/nxdumptool/NSP.
7. Copy the output dump to your PC. If you used the split method for FAT32, or if you used sequential (multi-session) dumping, you'll need to reassemble the part files into a single NSP dump. For more information, see Merge part files (FAT32 / multi-session dump only).

Dumping steps (orphan content)

1. Using either Fusée Gelée or Caffeine, boot into the CFW of your preference and load the Homebrew Launcher using title override (hold R while launching a game).
2. Load NXDumpTool.
3. Select Dump SD card / eMMC (NANDUSER) content, then press the Y button.
4. Look for the orphan update / DLC you wish to dump, then press A on it.
5. Select Nintendo Submission Package (NSP) dump.
6. Set the available options to the following values:
   • Split output dump (FAT32 support): set it to Yes if you're using a FAT32 partition in your SD card. Otherwise, set it to No.
   • CRC32 checksum calculation: No.
   • Remove console specific data: Yes. This will remove console/account data from a personalized ticket and convert it to a common ticket if the title you wish to dump uses titlekey crypto.
   • Generate ticket-less dump: No.
   • Change NPDM RSA key/sig in Program NCA: No. This option only appears with orphan updates.
7. Select Start NSP dump process, press A and wait for the process to finish. You'll be able to find the output file(s) in sdmc:/switch/nxdumptool/NSP.
8. Copy the output dump to your PC. If you used the split method for FAT32, or if you used sequential (multi-session) dumping, you'll need to reassemble the part files into a single NSP dump. For more information, see Merge part files (FAT32 / multi-session dump only).

Merge part files (FAT32 / multi-session dump only)

1. Copy all parts of your NSP dump to your PC.
2. Merge your part files into a complete dump:
   1. On Windows:
      1. Open the command prompt and use cd to change the current working directory to the one that holds your split files (e.g. cd C:\switch_dumps).
      2. Type the following command according to your specific case, then press Enter:
         • If you're dealing with a split NSP dump (non-sequential): copy /b * game.nsp.
         • If you're dealing with a split NSP dump (sequential): copy /b *.nsp.hdr+*.nsp.0* game.nsp.
   2. On Linux/Mac:
      1. Open your terminal emulator and use cd to change the current working directory to the one that holds your split files (e.g. cd /dev/sdb/switch_dumps).
      2. Type the following command according to your specific case, then press Enter:
         • If you're dealing with a split NSP dump (non-sequential): cat * > game.nsp.
         • If you're dealing with a split NSP dump (sequential): cat *.nsp.hdr *.nsp.0* > game.nsp.
3. Your part files should be reassembled into a full game.nsp file. You can safely delete your part files afterwards.

Extracting Data from NSP

[To do: some sort of batch script would be desirable for this section]

In order to gather relevant data from digital title dumps (like NCA information, ticket, titlekey, etc.), you'll need to use hactool and nstool. The following sections will assume:

1. You have already downloaded both programs to a specific location in your PC.
2. Moved the full NSP dump and copied the keys file generated by Lockpick_RCM (located at sdmc:/switch/prod.keys) to the same location.
3. Opened a command prompt / terminal emulator window.
4. Used cd to change the current working directory accordingly.

Unpacking NSP dump

1. Type hactool -r -t pfs0 --outdir=unpacked_nsp [game.nsp] and press Enter. You'll end up with a unpacked_nsp directory, which holds the unpacked NSP data.
   • Note: replace [game.nsp] with the actual NSP filename. If it has any whitespaces, enclose it using double quotes (e.g. hactool -r -t pfs0 --outdir=unpacked_nsp "VA-11 HALL-A v65536 (0100A6700D66E800) (UPD).nsp").

Collect ticket information

1. Look for a .tik file inside the unpacked_nsp directory and copy its full filename (e.g. 0100a6700d66e8000000000000000008.tik).
   • Note: if there's no .tik file available, it means the digital title you dumped uses standard crypto. Skip to Collect NCA information.
2. To collect data from the ticket:
   • On Windows:
     • Type nstool -t tik unpacked_nsp\[file.tik] > tik_info.txt and press Enter.
   • On Linux/Mac:
     • Type nstool -t tik unpacked_nsp/[file.tik] > tik_info.txt and press Enter.
   • Note: replace [file.tik] with the actual ticket filename (e.g. nstool -t tik unpacked_nsp\0100a6700d66e8000000000000000008.tik > tik_info.txt).
3. You'll end up with a tik_info.txt file, which contains info from the ticket file. Open it, copy the Data element and strip the colons from it (e.g. 00:01:02:03:04:05:06:07:08:09:0A:0B:0C:0D:0E:0F -> 000102030405060708090A0B0C0D0E0F). This is the encrypted titlekey for your dumped title - keep it in your clipboard or save it somewhere else.

Collect NCA information

You'll have to repeat the following steps for every .nca file inside the unpacked_nsp directory.

1. To collect data from a NCA:
   • On Windows:
     • If your dumped title uses titlekey crypto, type hactool -r -y -k prod.keys -t nca --titlekey=[stripped_titlekey] --disablekeywarns unpacked_nsp\[file.nca] > [nca_info.txt] and press Enter.
     • Otherwise, if your dumped title uses standard crypto, type hactool -r -y -k prod.keys -t nca --disablekeywarns unpacked_nsp\[file.nca] > [nca_info.txt] and press Enter.
   • On Linux/Mac:
     • If your dumped title uses titlekey crypto, type hactool -r -y -k prod.keys -t nca --titlekey=[stripped_titlekey] --disablekeywarns unpacked_nsp/[file.nca] > [nca_info.txt] and press Enter.
     • Otherwise, if your dumped title uses standard crypto, type hactool -r -y -k prod.keys -t nca --disablekeywarns unpacked_nsp/[file.nca] > [nca_info.txt] and press Enter.
   • Note: replace the following sections in the provided command(s):
     • [stripped_titlekey] with the encrypted titlekey from the previous section, if applicable (e.g. 000102030405060708090A0B0C0D0E0F).
     • [file.nca] with the current NCA filename (e.g. e4239b7e79cc5a4b307413e5f34ea325.nca).
     • [nca_info.txt] with a TXT filename that resembles the current NCA file (e.g. e4239b7e79cc5a4b307413e5f34ea325_info.txt).
   • Example command line: hactool -r -y -k prod.keys -t nca --titlekey=000102030405060708090A0B0C0D0E0F --disablekeywarns unpacked_nsp\e4239b7e79cc5a4b307413e5f34ea325.nca > e4239b7e79cc5a4b307413e5f34ea325_info.txt.
2. You'll end up with a TXT for each NCA file available in the unpacked_nsp directory, each one containing in-depth details about their corresponding NCA file.

Gathering Dump Info

• The extracted files should be datted as follows:
  • [todo: a title id should be put in the "digital serial" field, but we need to determine which to use. the one stored in the cnmt is an option, but if the console stores the one from the CDN endpoint request, it would be better to use that]
  • The files should be in the following order in the datfile:
    • ncas alphabetically using the "x.cnmt.nca"/"x.nca" naming (add the ".nca"/.cnmt.nca" if it isn't present - i.e. if dumped straight from CDN)
    • [lowercase_rights_id].tik (optional)
    • [lowercase_rights_id]-enctitlekey.bin (titlekey as binary data) (optional)
    • [lowercase_rights_id]-dectitlekey.bin (decrypted titlekey as binary data) (optional)

Submitting Info to No-Intro

If you have datter rights you can submit the dumpinfo using the "Submit" form in DAT-o-MATIC.

Otherwise post the info in the New Dumps & Redumps section of the forum.