The below wiki article is based on user submitted content.
Please verify all hyperlinks and terminal commands below!
AES Keys
How to obtain AES Keys
Users can provide some additional crypto keys to enable some advanced features in Citra. These keys are not officially provided by Citra due to legal considerations.
Method 1
In this method, you will dump the ARM9 BootROM, NATIVE_FIRM
, and SAFE_MODE_FIRM
(and the secret section for the new revision models) from your console using GodMode9.
Note: Extracting 0x25KeyX from NATIVE_FIRM
is still not correctly implemented, so you will have to provide the key manually using the second method. NATIVE_FIRM
extraction & installation is still included for completeness.
Step 1 - ARM9 BootROM
- After launching GodMode9, enter the
[M:] MEMORY VIRTUAL
drive. - Navigate to
boot9.bin
; pressA
. - Select
Copy to 0:/gm9/out
.boot9.bin
will be dumped togm9/out
on your SD card. - Power off the console by pressing
HOME
, and thenPoweroff system
. - Eject the SD card from your console and insert it into your computer/device. Copy/move
boot9.bin
fromgm9/out
on the SD card to thesysdata
folder in the User Directory.
Step 2 - NATIVE_FIRM
, SAFE_MODE_FIRM
, and the secret section.
For old revision models
- Reinsert the SD card into the console and launch GodMode9
- Press
HOME
, selectTitle manager
, and then select[1:] NAND / TWL
as a source. - After the title scan is complete, navigate to the titles named
0004013800000002 (CTR-P-CTAP)
and0004013800000003 (CTR-P-CTAP)
. - Open
0004013800000002 (CTR-P-CTAP)
, selectManage Title...
, and then selectBuild CIA (standard)
. - Repeat the process above with
0004013800000003 (CTR-P-CTAP)
- Power off the system by pressing
HOME
, and thenPoweroff system
. - Eject the SD card from your console and insert it into your computer/device. Copy/move both CIA files from
gm9/out
on the SD card to a location of your choosing, and install both to Citra’s NAND (File
>Install CIA...
).
For new revision models
- Reinsert the SD card into the console and launch GodMode9
- Press
HOME
, selectTitle manager
, and then select[1:] NAND / TWL
as a source. - After the title scan is complete, navigate to the title named
0004013820000003 (CTR-P-CTAP)
. - Open
0004013820000003 (CTR-P-CTAP)
, selectManage Title...
, and then selectBuild CIA (standard)
. - Exit the Title manager by pressing
B
, then enter the[S:] SYSNAND VIRTUAL
drive. Opensector0x96.bin
(the secret section), and selectCopy to 0:/gm9/out
. - Power off the system by pressing
HOME
, and thenPoweroff system
. - Eject the SD card from your console and insert it into your computer/device. Copy/move the CIA file from
gm9/out
on the SD card to a location of your choosing, and install it to Citra’s NAND (File
>Install CIA...
). - Copy/move
sector0x96.bin
fromgm9/out
on the SD card to thesysdata
folder in the User Directory.
Method 2
As an alternative, instead of dumping the required files, you can provide all the AES keys manually. The keys are supplied by filling the file sysdata/aes_keys.txt
(located in the User Directory) in the following format:
slot0x0DKeyX=0123456789ABCDEF0123456789ABCDEF
slot0x0DKeyY=0123456789ABCDEF0123456789ABCDEF
slot0x0DKeyN=0123456789ABCDEF0123456789ABCDEF
slot0x18KeyX=0123456789ABCDEF0123456789ABCDEF
slot0x1BKeyX=0123456789ABCDEF0123456789ABCDEF
slot0x25KeyX=0123456789ABCDEF0123456789ABCDEF
slot0x2CKeyX=0123456789ABCDEF0123456789ABCDEF
slot0x2DKeyX=0123456789ABCDEF0123456789ABCDEF
slot0x2DKeyY=0123456789ABCDEF0123456789ABCDEF
slot0x2DKeyN=0123456789ABCDEF0123456789ABCDEF
slot0x31KeyX=0123456789ABCDEF0123456789ABCDEF
slot0x31KeyY=0123456789ABCDEF0123456789ABCDEF
slot0x31KeyN=0123456789ABCDEF0123456789ABCDEF
slot0x3DKeyX=0123456789ABCDEF0123456789ABCDEF
common0=0123456789ABCDEF0123456789ABCDEF
common1=0123456789ABCDEF0123456789ABCDEF
The strings 0123456789ABCDEF0123456789ABCDEF
in the example above are all placeholder and should be replaced by correct 32-digit hex values of keys. Not all lines in the example are required at the same time. Please read the explanation below about which key enables which feature
Loading encrypted games
Required keys: slot0x25KeyX
and slot0x2CKeyX
.
If loading encrypted New 3DS games, slot0x18KeyX
and slot0x1BKeyX
are also required.
For those who are interested, here’s a write-up about 3DS security, that also talks about the slot0x25KeyX
.
Sharing Mii via QR code between Citra and 3DS
Required keys: single slot0x2DKeyN
, OR slot0x2DKeyX
, slot0x2DKeyY
together.
Generating accurate UDS data frame
Required keys: single slot0x31KeyN
, OR slot0x31KeyX
, slot0x31KeyY
together.
Using client cert dumped from 3DS
Required keys: single slot0x0DKeyN
, OR slot0x0DKeyX
, slot0x0DKeyY
together.
Installing encrypted CIA
Required keys: slot0x3DKeyX
and common0
. common1
~5
are probably also required for some
unusual CIA.