Exception: Mismatched masterKeyRevs about nut HOT 35 CLOSED

Hello! How are you doing?

Some people on the forum that tried to apply the method for themselves are having issues that all the NSPs that were modified with nut to remove the rights and ticket can be installed but, when the game is launched, it comes up as "corrupted" and are prompted to redownload the game from the eShop.

After making sure nut was working correctly for them, I managed to pinpoint that the users affected are using ReiNX (one of them gets the issue even though he's updated ReiNX to the latest nightly). The console's firmware version doesn't matter, the problem occurs both on 5.1 and 6.0. I read on reddit that since about a month ago, ReiNX supposedly supports launching modified NSPs, so I don't understand why they get this error message.

Do you know anything about that? Is there a modified sysmodule they must install in order to make ReiNX compatible with the NSPs modified method?

If you don't know why the problem occurs, I will ask the ReiNX dev about it, since he's the most likely candidate to be able to do something about it considering it's a ReiNX compatibility issue.

Thank you very much!!

from nut.

You don't need to give me credit, you'll have to link them to this page to download--that is credit enough. I look forward to reading your guide :)

from nut.

which title id is this?

from nut.

Into The Breach [010057d00b612000][v0].nsp

But it also does the same thing with The Messenger [0100dc300ac78000][v0].nsp

from nut.

Output from nut.py --remove-title-rights :

rightsId = 0x10057d00b6120000000000000000005
titleKeyDec = xxxxxxxxxxxxxxxxxxxxxxx
masterKeyRev = 0x0
Exception: Mismatched masterKeyRevs!
fin

Output from nut.py -i (Ticket section) :

   Ticket

    File Path: 010057d00b6120000000000000000005.tik
    File Size: 704
    signatureType = TicketSignature.RSA_2048_SHA256
    keyType = 0
    masterKeyRev = 0
    ticketId = 0000000000000000
    deviceId = 0000000000000000
    rightsId = 0x10057d00b6120000000000000000005
    accountId = 00000000
    titleKey = xxxxxxxxxxxxxxxxxxxxxxxxx
    titleKeyDec = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

titleKey is actually correct under -i
It's titleKeyDec I thought was different from the titleKey but it seems it's a different value and that's normal?

from nut.

Yeah your ticket has definitely been modified, how many times did you attempt to remove the title rights with nut? Do you have another copy of the NSP that you know is not modified?

from nut.

Also, please edit out / censor titleKey and titleKeyDec

from nut.

Done. Nah I never used CDN to get NSPs. I actually never used NSPs before, only XCI. But those two titles never got a cartridge release.

I attempted to remove the rights like 30 times (doing multiple attempts with different masterkey revisions and other things to understand what is going wrong).

Edit: I also attempted to unpack and repack the NSP but I can't seem to input the correct command to repack (and the -h section doesn't provide very much information for argument syntax).
It gives me the following result :

nut.py -c "D:\Documents\Nintendo Switch Homebrew\nut\Into The Breach [010057d00b612000][v0]"

creating D:\Documents\Nintendo Switch Homebrew\nut\Into The Breach [010057d00b612000][v0]
Repacking to NSP...
Writing header...
Into The Breach [010057d00b612000][v0]: 0%| | 0.00/32.0 [00:00<?, ?B/s]Traceback (most recent call last):
File "D:\Documents\Nintendo Switch Homebrew\nut\nut.py", line 577, in
nsp.pack(args.file)
File "D:\Documents\Nintendo Switch Homebrew\nut\Fs\Nsp.py", line 462, in pack
outf = open(self.path, 'wb')
PermissionError: [Errno 13] Permission denied: 'D:\Documents\Nintendo Switch Homebrew\nut\Into The Breach [010057d00b612000][v0]'

And when trying to --set-masterkeyX, it tells me to remove the rights first...

from nut.

The NSP file you receieved has been modified. I just ran this command on that NSP and it worked:

nut.py --remove-title-rights "Into the Breach[010057D00B612000][v0].nsp"
loaded user guest
                        ,;:;;,
                       ;;;;;
               .=',    ;:;;:,
              /_', "=. ';:;:;
              @=:__,  \,;:;:'
                _(\.=  ;:;;'
               `"_(  _/="`
                `"'
rightsId =      0x10057d00b6120000000000000000005
titleKeyDec =   b'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
masterKeyRev =  0x5
writing masterKeyRev for bdd9bb0fe0b5a840870d028ed8d0ad81.nca, 5

6E 11 AB 30 2B 1D 49 FF B6 17 81 D4 E2 EF 6A CE | n..0+.I.......j. |
6E 11 AB 30 2B 1D 49 FF B6 17 81 D4 E2 EF 6A CE | n..0+.I.......j. |
6E 11 AB 30 2B 1D 49 FF B6 17 81 D4 E2 EF 6A CE | n..0+.I.......j. |
6E 11 AB 30 2B 1D 49 FF B6 17 81 D4 E2 EF 6A CE | n..0+.I.......j. |
fin

from nut.

I see... And there's no way to make it work with modified NSPs? It would be very useful for me if I could get it to work with scene releases.

from nut.

You can run nut.py -i path/to/nsp to get an info dump, look for bdd9bb0fe0b5a840870d028ed8d0ad81.nca and see what it is reporting for the title rights field, and the keyblob field.

If titlerights are still enabled, you can hexedit your ticket to change the masterKey revision.

from nut.

also see what its reporting the master key revision as for that NCA.

from nut.

    File Path: bdd9bb0fe0b5a840870d028ed8d0ad81.nca
    File Size: 283459584
    magic = b'NCA3'
    titleId = 010057D00B612000
    rightsId = b'010057d00b6120000000000000000005'
    isGameCard = 0x0
    contentType = Content.PROGRAM
    cryptoType = Crypto.NONE
    Size: 283459584
    crypto master key: 2
    crypto master key2: 5
    key Index: 0
    key Block: b'\x91\xde\xa3X\x9aV\xe4\xfa\x1c\xe6\nD@\t\xe7\xd8'
    key Block: b'\x91\xde\xa3X\x9aV\xe4\xfa\x1c\xe6\nD@\t\xe7\xd8'
    key Block: b'\x91\xde\xa3X\x9aV\xe4\xfa\x1c\xe6\nD@\t\xe7\xd8'
    key Block: b'\x91\xde\xa3X\x9aV\xe4\xfa\x1c\xe6\nD@\t\xe7\xd8'

Does that mean the title rights are still enabled or they're already disabled?

from nut.

the ticket output from that same info command, does it match this?

Ticket

        File Path: 010057d00b6120000000000000000005.tik
        File Size: 704
        signatureType = TicketSignature.RSA_2048_SHA256
        keyType = 0
        masterKeyRev = 5
        ticketId = 0000000000000000
        deviceId = 0000000000000000
        rightsId = 0x10057d00b6120000000000000000005
        accountId = 00000000
        titleKey = xxxxxxxxxxxxxxxxxxxxxxxx
        titleKeyDec = b'xxxxxxxxxxxxxxxxxxxxxxxx'

from nut.

Nope, it's masterKeyRev = 0
So I can hex-edit it to "5"?

from nut.

i'm an idiot, you posted that above. ignore my last message. Im going to do some research to see if I am reading that field wrong.

from nut.

does that game install and play fine as is? also which scene nsp is this?

from nut.

No problem. Alright, thank you very much for taking the time to figure this out.
Do you have a donation link / Patreon or something?

from nut.

Make any donations to male domestic violence shelters. Thank you.

from nut.

Alright, I'll look for one in my area!

It's ISOSLAND's release. There's no team information in the post but it was posted by the site admin, so I'm guessing it works. I don't really want to try it out as is 'cause I'm not banned yet (and still update my XCIs using the official servers) and don't want to add fake tickets to my ticket blob (that's the reason for me wanting to remove those damned title rights)..!

from nut.

There is a solution here: unpack your nsp nut.py -x path/to/nsp, open up the ticket file with a hex editor, change the masterKey field to 5, save it, then repack the NSP.

If nut removes the titlerights successfully, then you should unpack again, delete the ticket file, then re-pack. I know thats a bit of a process but it should fix your issue.

from nut.

the command to repack is nut.py -c name.of.new.file.nsp folderwithExtractedContents/*

from nut.

Alright, I'll try this out. But (as stated above in one of my edits), when I tried to unpack/repack as part for my attempts at figuring it out, I got the following :

nut.py -c "D:\Documents\Nintendo Switch Homebrew\nut\Into The Breach [010057d00b612000][v0]"

[...]
PermissionError: [Errno 13] Permission denied: 'D:\Documents\Nintendo Switch Homebrew\nut\Into The Breach [010057d00b612000][v0]'

Did I input the command wrong or is it a Windows permissions thing?

EDIT: Ooooooh, nvm. I was doing it wrong!

from nut.

-c is for creating a file, -x is for extracting. you specified a folder not a filename for -c. use the command I posted about. make sure you use a new name for the newly created nsp (dont overwrite any files)

from nut.

Assuming that folder is where your extracted bits are, you should use this command:

nut.py -c into.the.breach.nsp "D:\Documents\Nintendo Switch Homebrew\nut\Into The Breach [010057d00b612000][v0]\*"

from nut.

Alright! My toddler is getting impatient so I'll do this later tonight and report back.
Thanks a lot for taking the time to help me in this matter!!

from nut.

You're welcome. The byte you want to edit is at offset 0x286 in the ticket file, should be 05

from nut.

I've done the hex edit, but when I try to repack (using -c), I get the following error :

nut.py -c into.the.breach.nsp "D:\Documents\Nintendo Switch Homebrew\nut\Into The Breach [010057d00b612000][v0]\*"

creating into.the.breach.nsp
        Repacking to NSP...
Traceback (most recent call last):
  File "D:\Documents\Nintendo Switch Homebrew\nut\nut.py", line 577, in <module>
    nsp.pack(args.file)
  File "D:\Documents\Nintendo Switch Homebrew\nut\Fs\Nsp.py", line 452, in pack
    hd = self.generateHeader(files)
  File "D:\Documents\Nintendo Switch Homebrew\nut\Fs\Nsp.py", line 488, in generateHeader
    fileSizes = [os.path.getsize(file) for file in files]
  File "D:\Documents\Nintendo Switch Homebrew\nut\Fs\Nsp.py", line 488, in <listcomp>
    fileSizes = [os.path.getsize(file) for file in files]
  File "C:\Program Files (x86)\Microsoft Visual Studio\Shared\Python36_64\lib\genericpath.py", line 50, in getsize
    return os.stat(filename).st_size
OSError: [WinError 123] The filename, directory name, or volume label syntax is incorrect: 'D:\\Documents\\Nintendo Switch Homebrew\\nut\\Into The Breach [010057d00b612000][v0]\\*'

I tried troubleshooting it and, however I seem to input the filepath, it doesn't work.

I tried the following :

D:\IntoTheBreach\*
D:\IntoTheBreach\*.*
D:\IntoTheBreach\
\IntoTheBreach\   (in nut.py's folder)
\IntoTheBreach\*
\IntoTheBreach\*.*

I also tried everyone of these permutations with "/" instead of "\", to no avail.

After a few Google searches, I found the following information, which seems to make sense :

Apparently, Wildcards -as shown in the docs- are not being supported on Windows.

Example: pyminifier -d "C:\Users\admin\Desktop\Projects\Python 3.5.1\sysAuth\New" "C:\Users\user\Desktop\Projects\abc\xyz\*.py" gives error OSError: [WinError 123] The filename, directory name, or volume label syntax is incorrect: 'C:\\Users\\user\\Desktop\\Projects\\abc\\xyz\\*.py'

However, when a definite filename in the directory is give, like "C:\Users\user\Desktop\Projects\abc\xyz\helloWorld.py", PyMinifier works perfectly.

This is not a problem with Linux, but for compatibility, I think a different method for going through directories should be used.

(source : liftoff/pyminifier#45)

from nut.

wildcard works on windows, i use it everytime when I pack NSP's. But you dont need the wild card, just specify each file one by one. nut.py -c new.nsp file1 file2 file3

from nut.

It worked!! It all worked!!

Ticket

        File Path: 010057d00b6120000000000000000005.tik
        File Size: 704
        signatureType = TicketSignature.RSA_2048_SHA256
        keyType = 0
        masterKeyRev = 5
        ticketId = 0000000000000000
        deviceId = 0000000000000000
        rightsId = 0x0
        accountId = 00000000
        titleKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        titleKeyDec = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Thank you so very much for everything!!

One last question, is the offset (0x286) for the hex edit the same for every NSP?
If I want to do the same process for my second NSP, it will work with 0x286?

Edit: Oh, I just reread your instructions and now I must delete the ticket! I'll do that now!

Edit2: Voilà! After removing the title rights, I unpacked it, deleted the ticket, and repacked it. There's now no trace of the ticket in the NSP. That's the way it should be right? Thanks again!!

Edit3: Just tried with the other game and it is indeed the same offset (0x286)!

from nut.

Now that I think about it, I also have two NSPs for the updates (one for each game).
Can I unpack the update, add its NCAs to the original NSP folder and repack the lot for a Game+Update.nsp?? If so, which files from the update NSP must I add to the game one?

Edit: I just finished processing both games and both updates (separately), so you can go ahead and close this issue! If you know the feasibility of merging two NSPs (Game.NSP and Update.NSP) into one (Game+Update.nsp), maybe share it here before closing the issue for future knowledge. If not, that's quite alright too, you've done more than enough for me today!

Once again, thank you very much for everything! I can safely say I would not have made it without your help (but I would probably have spent another 6 hours of pointless attempts before giving up, so thanks for sparing me that)!!

PS. I'll definitely look for a male domestic violence shelter in my area for a donation. Cheers!

from nut.

This may actually be a bug in the CDNSP code Nut is using. It appears the offset is incorrect, I just committed a fix, go ahead and update and it should fix your issue.

from nut.

Alright, I'll try this out! I just tested the two games (with the update NSP) and they both work flawlessly with the method you described previously!! They both have their rights removed AND no fake ticket in the console's ticket blob!!

If you don't mind, I will write up a tutorial on how to do the whole process for the community and post it on GBATemp (giving you the whole credit of coming up with the process, of course). I didn't find this information anywhere when I was researching how to install NSPs while mitigating the ban risk by not installing fake tickets, so I'm pretty sure it would help a lot of people to write up a detailed tutorial on how to do it.

Of course, if you don't want me to, I won't. It's your method and your script, after all!

from nut.

Hey, just wanted to inform you that I tried your fix with the latest commits and it worked flawlessly to remove-title-rights straight from the scene release NSP!! So now it's a few steps shorter to remove the title rights and delete the ticket!!

Thanks again!!

from nut.

By the way, I wrote up the tutorial today. Here's a link :
https://gbatemp.net/threads/how-to-remove-fake-tickets-from-nsp-file-standard-crypto-equivalent-ban-risk-mitigation.518312/

from nut.