Read First!

The below wiki article is based on user submitted content.
Please verify all hyperlinks and terminal commands below!

See a mistake? Want to contribute? Edit this article on Github

AES Keys

Users can provide some additional crypto keys to enable some advanced features in Citra. These keys are not officially provided by Citra due to legal considerations.

Instructions to obtain AES Keys

Method 1

In this method, you will need to dump your bootrom, native_firm & secret section(for n3ds) from your console.

Note: You will still need to provide the 0x25 KeyX using Method 2.

Step 1 - bootrom

The bootrom boot9.bin can be dumped with Godmode9:

  • Go to drive M: Memory Virtual
  • Navigate to boot9.bin, press A
  • Select Copy to O:/gm9out. This will give you boot9.bin in gm9out on your SD card
  • The boot9.bin needs to be placed in the sysdata folder in the User Directory.

Step 2 - native_firm & secret section

For o3DS / o2DS

  • In GodMode9, navigate to sysnand ctrnand -> title -> and then dump 00040138/00000003 as cia and install it in Citra.

For n3DS/n2DS

  • In GodMode9, navigate to sysnand ctrnand -> title -> and then dump 00040138/20000003 as cia and install it in Citra.
  • Dump the secret section with godmode9 and copy the file (sector0x96.bin) to sysdata in the user folder.

Method 2

As an alternative, instead of dumping the required files, you can provide all the AES keys manually. The keys are supplied by filling the file sysdata/aes_keys.txt (located in the User Directory) in the following format:

slot0x0DKeyX=0123456789ABCDEF0123456789ABCDEF
slot0x0DKeyY=0123456789ABCDEF0123456789ABCDEF
slot0x0DKeyN=0123456789ABCDEF0123456789ABCDEF
slot0x18KeyX=0123456789ABCDEF0123456789ABCDEF
slot0x1BKeyX=0123456789ABCDEF0123456789ABCDEF
slot0x25KeyX=0123456789ABCDEF0123456789ABCDEF
slot0x2CKeyX=0123456789ABCDEF0123456789ABCDEF
slot0x2DKeyX=0123456789ABCDEF0123456789ABCDEF
slot0x2DKeyY=0123456789ABCDEF0123456789ABCDEF
slot0x2DKeyN=0123456789ABCDEF0123456789ABCDEF
slot0x31KeyX=0123456789ABCDEF0123456789ABCDEF
slot0x31KeyY=0123456789ABCDEF0123456789ABCDEF
slot0x31KeyN=0123456789ABCDEF0123456789ABCDEF
slot0x3DKeyX=0123456789ABCDEF0123456789ABCDEF
common0=0123456789ABCDEF0123456789ABCDEF
common1=0123456789ABCDEF0123456789ABCDEF

The strings 0123456789ABCDEF0123456789ABCDEF in the example above are all placeholder and should be replaced by correct 32-digit hex values of keys. Not all lines in the example are required at the same time. Please read the explanation below about which key enables which feature

Loading encrypted games

Required keys: slot0x25KeyX and slot0x2CKeyX. If loading encrypted New 3DS games, slot0x18KeyX and slot0x1BKeyX are also required.

For those who are interested, here’s a write-up about 3DS security, that also talks about the slot0x25KeyX.

Sharing Mii via QR code between Citra and 3DS

Required keys: single slot0x2DKeyN, OR slot0x2DKeyX, slot0x2DKeyY together.

Generating accurate UDS data frame

Required keys: single slot0x31KeyN, OR slot0x31KeyX, slot0x31KeyY together.

Using client cert dumped from 3DS

Required keys: single slot0x0DKeyN, OR slot0x0DKeyX, slot0x0DKeyY together.

Installing encrypted CIA

Required keys: slot0x3DKeyX and common0. common1~5are probably also required for some unusual CIA.