Nintendo DSi: Unblocking unofficial NTR carts!
28It has been documented by gbetek that v1.4E on DSi did not do RSA checking of any of the sections of the DS Cart Whitelist used for verifying NTR mode carts in slot-1.
Because of this it is possible to extract the SHA1-HMAC keys from Launcher (that's real easy, gbatek pretty much tells you where to find them in the SRL) and hash the header/arm9/arm7 and icon for addition to the cart white list.
The DS cart white list is separated into 3 sections. The third section operates mostly as a blacklist for flashcarts that pretend to be other games. (this section is the part that is frequently updated in fw updates). Simply removing all title listings from that section and setting "Number of titles" in the header of that section to 0 effectively removes that functionality from the white list so blocked flashcarts that pretended to be other games will work again.
But the real magic shown here is ADDING new game codes to the white list and hashing them using the SHA-1 HMAC keys. Assuming your flashcart does not use overlays/NitroFS this is pretty easy.
Section 1 has the Phase 1 and 2 hashes. The second hash for your title can be all zero if your flashcart does not use NitroFS/Overlays.
The first hash is over the header (first 0x160h bytes of the header) + arm9 + arm7 binaries (load them into a file in that order and hash it).
Arm9 binary must be hashed while the secure area is encrypted FYI.
The section section only hashes the icon/banner of the cart. That one is easy. Note that this section uses a seperate hmac key then the first section. Simply hash the 0x840h size NTR icon/banner data the cart uses.
That pretty much explains the jist of adding new carts to the white list. Scripts for genning the hashes and such may be released at a later date.
A nand mod is NOT required though recommended to do this. All you need is a standard entry point like sudokuhax and fwtool to allow dumping NAND and importing a modified one. I will not go into detail for that here. Google/gbatemp forums is your friend here.