Fix build, add modern builds

.gitignore

@@ -258,4 +258,7 @@ paket-files/
 
 # Python Tools for Visual Studio (PTVS)
 __pycache__/
-*.pyc
+*.pyc
+
+# VSCode
+/NDecrypt.Core/Properties/launchSettings.json

.vscode/tasks.json

@@ -0,0 +1,24 @@
+{
+    // See https://go.microsoft.com/fwlink/?LinkId=733558
+    // for the documentation about the tasks.json format
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "build",
+            "command": "dotnet",
+            "type": "shell",
+            "args": [
+                "build",
+                // Ask dotnet build to generate full paths for file names.
+                "/property:GenerateFullPaths=true",
+                // Do not generate summary otherwise it leads to duplicate errors in Problems panel
+                "/consoleloggerparameters:NoSummary"
+            ],
+            "group": "build",
+            "presentation": {
+                "reveal": "silent"
+            },
+            "problemMatcher": "$msCompile"
+        }
+    ]
+}

NDecrypt.Core/DSTool.cs

@@ -1,5 +1,7 @@
 using System;
 using System.IO;
+using System.Linq;
+using NDecrypt.Core.Data;
 using NDecrypt.Core.Headers;
 
 namespace NDecrypt.Core
@@ -21,6 +23,13 @@ namespace NDecrypt.Core
         /// </summary>
         private readonly bool force;
 
+        #region Encryption process variables
+
+        private uint[] cardHash = new uint[0x412];
+        private uint[] arg2 = new uint[3];
+
+        #endregion
+
         public DSTool(string filename, bool encrypt, bool force)
         {
             this.filename = filename;
@@ -50,10 +59,308 @@ namespace NDecrypt.Core
                 }
 
                 // Process the secure area
-                header.ProcessSecureArea(reader, writer, encrypt, force);
+                ProcessSecureArea(header, reader, writer);
             }
 
             return true;
         }
+
+        /// <summary>
+        /// Process secure area in the DS/DSi file
+        /// </summary>
+        /// <param name="ndsHeader">NDS header representing the DS file</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        public void ProcessSecureArea(NDSHeader ndsHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            // If we're forcing the operation, tell the user
+            if (force)
+            {
+                Console.WriteLine("File is not verified due to force flag being set.");
+            }
+            // If we're not forcing the operation, check to see if we should be proceeding
+            else
+            {
+                bool? isDecrypted = CheckIfDecrypted(reader);
+                if (isDecrypted == null)
+                {
+                    Console.WriteLine("File has an empty secure area, cannot proceed");
+                    return;
+                }
+                else if (encrypt ^ isDecrypted.Value)
+                {
+                    Console.WriteLine("File is already " + (encrypt ? "encrypted" : "decrypted"));
+                    return;
+                }
+            }
+
+            ProcessARM9(ndsHeader, reader, writer);
+
+            Console.WriteLine("File has been " + (encrypt ? "encrypted" : "decrypted"));
+        }
+
+        /// <summary>
+        /// Determine if the current file is already decrypted or not (or has an empty secure area)
+        /// </summary>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <returns>True if the file has known values for a decrypted file, null if it's empty, false otherwise</returns>
+        private bool? CheckIfDecrypted(BinaryReader reader)
+        {
+            reader.BaseStream.Seek(0x4000, SeekOrigin.Begin);
+            uint firstValue = reader.ReadUInt32();
+            uint secondValue = reader.ReadUInt32();
+
+            // Empty secure area standard
+            if (firstValue == 0x00000000 && secondValue == 0x00000000)
+            {
+                Console.WriteLine("Empty secure area found. Cannot be encrypted or decrypted.");
+                return null;
+            }
+
+            // Improperly decrypted empty secure area (decrypt empty with woodsec)
+            else if ((firstValue == 0xE386C397 && secondValue == 0x82775B7E)
+                  || (firstValue == 0xF98415B8 && secondValue == 0x698068FC))
+            {
+                Console.WriteLine("Improperly decrypted empty secure area found. Should be encrypted to get proper value.");
+                return true;
+            }
+
+            // Improperly encrypted empty secure area (encrypt empty with woodsec)
+            else if ((firstValue == 0x4BCE88BE && secondValue == 0xD3662DD1)
+                  || (firstValue == 0x2543C534 && secondValue == 0xCC4BE38E))
+            {
+                Console.WriteLine("Improperly encrypted empty secure area found. Should be decrypted to get proper value.");
+                return false;
+            }
+
+            // Properly decrypted nonstandard value (mastering issue)
+            else if (firstValue == 0xD0D48B67 && secondValue == 0x39392F23)
+            {
+                Console.WriteLine("Decrypted secure area for known, nonstandard value found.");
+                return true;
+            }
+
+            // Properly decrypted prototype value
+            else if (firstValue == 0xBA35F813 && secondValue == 0xB691AAE8)
+            {
+                Console.WriteLine("Decrypted secure area for prototype found.");
+                return true;
+            }
+
+            // Properly encrypted prototype value
+            else if (firstValue == 0xA71329EE && secondValue == 0x2A1D4C38)
+            {
+                Console.WriteLine("Encrypted secure area for prototype found.");
+                return false;
+            }
+
+            // Standard decryption values
+            return (firstValue == 0xE7FFDEFF && secondValue == 0xE7FFDEFF);
+        }
+
+        /// <summary>
+        /// Process the secure ARM9 region of the file, if possible
+        /// </summary>
+        /// <param name="ndsHeader">NDS header representing the DS file</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void ProcessARM9(NDSHeader ndsHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            // Seek to the beginning of the secure area
+            reader.BaseStream.Seek(0x4000, SeekOrigin.Begin);
+            writer.BaseStream.Seek(0x4000, SeekOrigin.Begin);
+
+            // Grab the first two blocks
+            uint p0 = reader.ReadUInt32();
+            uint p1 = reader.ReadUInt32();
+
+            // Perform the initialization steps
+            Init1(ndsHeader);
+            if (!encrypt) Decrypt(ref p1, ref p0);
+            arg2[1] <<= 1;
+            arg2[2] >>= 1;
+            Init2();
+
+            // If we're decrypting, set the proper flags
+            if (!encrypt)
+            {
+                Decrypt(ref p1, ref p0);
+                if (p0 == Constants.MAGIC30 && p1 == Constants.MAGIC34)
+                {
+                    p0 = 0xE7FFDEFF;
+                    p1 = 0xE7FFDEFF;
+                }
+
+                writer.Write(p0);
+                writer.Write(p1);
+            }
+
+            // Ensure alignment
+            reader.BaseStream.Seek(0x4008, SeekOrigin.Begin);
+            writer.BaseStream.Seek(0x4008, SeekOrigin.Begin);
+
+            // Loop throgh the main encryption step
+            uint size = 0x800 - 8;
+            while (size > 0)
+            {
+                p0 = reader.ReadUInt32();
+                p1 = reader.ReadUInt32();
+
+                if (encrypt)
+                    Encrypt(ref p1, ref p0);
+                else
+                    Decrypt(ref p1, ref p0);
+
+                writer.Write(p0);
+                writer.Write(p1);
+
+                size -= 8;
+            }
+
+            // Replace the header explicitly if we're encrypting
+            if (encrypt)
+            {
+                reader.BaseStream.Seek(0x4000, SeekOrigin.Begin);
+                writer.BaseStream.Seek(0x4000, SeekOrigin.Begin);
+
+                p0 = reader.ReadUInt32();
+                p1 = reader.ReadUInt32();
+
+                if (p0 == 0xE7FFDEFF && p1 == 0xE7FFDEFF)
+                {
+                    p0 = Constants.MAGIC30;
+                    p1 = Constants.MAGIC34;
+                }
+
+                Encrypt(ref p1, ref p0);
+                Init1(ndsHeader);
+                Encrypt(ref p1, ref p0);
+
+                writer.Write(p0);
+                writer.Write(p1);
+            }
+        }
+
+        /// <summary>
+        /// First common initialization step
+        /// </summary>
+        /// <param name="ndsHeader">NDS header representing the DS file</param>
+        private void Init1(NDSHeader ndsHeader)
+        {
+            Buffer.BlockCopy(Constants.NDSEncryptionData, 0, cardHash, 0, 4 * (1024 + 18));
+            arg2 = new uint[] { ndsHeader.Gamecode, ndsHeader.Gamecode >> 1, ndsHeader.Gamecode << 1 };
+            Init2();
+            Init2();
+        }
+
+        /// <summary>
+        /// Second common initialization step
+        /// </summary>
+        private void Init2()
+        {
+            Encrypt(ref arg2[2], ref arg2[1]);
+            Encrypt(ref arg2[1], ref arg2[0]);
+
+            byte[] allBytes = BitConverter.GetBytes(arg2[0])
+                .Concat(BitConverter.GetBytes(arg2[1]))
+                .Concat(BitConverter.GetBytes(arg2[2]))
+                .ToArray();
+
+            UpdateHashtable(allBytes);
+        }
+
+        /// <summary>
+        /// Perform a decryption step
+        /// </summary>
+        /// <param name="arg1">First unsigned value to use in decryption</param>
+        /// <param name="arg2">Second unsigned value to use in decryption</param>
+        private void Decrypt(ref uint arg1, ref uint arg2)
+        {
+            uint a = arg1;
+            uint b = arg2;
+            for (int i = 17; i > 1; i--)
+            {
+                uint c = cardHash[i] ^ a;
+                a = b ^ Lookup(c);
+                b = c;
+            }
+
+            arg1 = b ^ cardHash[0];
+            arg2 = a ^ cardHash[1];
+        }
+
+        /// <summary>
+        /// Perform an encryption step
+        /// </summary>
+        /// <param name="arg1">First unsigned value to use in encryption</param>
+        /// <param name="arg2">Second unsigned value to use in encryption</param>
+        private void Encrypt(ref uint arg1, ref uint arg2)
+        {
+            uint a = arg1;
+            uint b = arg2;
+            for (int i = 0; i < 16; i++)
+            {
+                uint c = cardHash[i] ^ a;
+                a = b ^ Lookup(c);
+                b = c;
+            }
+
+            arg2 = a ^ cardHash[16];
+            arg1 = b ^ cardHash[17];
+        }
+
+        /// <summary>
+        /// Lookup the value from the hashtable
+        /// </summary>
+        /// <param name="v">Value to lookup in the hashtable</param>
+        /// <returns>Processed value through the hashtable</returns>
+        private uint Lookup(uint v)
+        {
+            uint a = (v >> 24) & 0xFF;
+            uint b = (v >> 16) & 0xFF;
+            uint c = (v >> 8) & 0xFF;
+            uint d = (v >> 0) & 0xFF;
+
+            a = cardHash[a + 18 + 0];
+            b = cardHash[b + 18 + 256];
+            c = cardHash[c + 18 + 512];
+            d = cardHash[d + 18 + 768];
+
+            return d + (c ^ (b + a));
+        }
+
+        /// <summary>
+        /// Update the hashtable
+        /// </summary>
+        /// <param name="arg1">Value to update the hashtable with</param>
+        private void UpdateHashtable(byte[] arg1)
+        {
+            for (int j = 0; j < 18; j++)
+            {
+                uint r3 = 0;
+                for (int i = 0; i < 4; i++)
+                {
+                    r3 <<= 8;
+                    r3 |= arg1[(j * 4 + i) & 7];
+                }
+
+                cardHash[j] ^= r3;
+            }
+
+            uint tmp1 = 0;
+            uint tmp2 = 0;
+            for (int i = 0; i < 18; i += 2)
+            {
+                Encrypt(ref tmp1, ref tmp2);
+                cardHash[i + 0] = tmp1;
+                cardHash[i + 1] = tmp2;
+            }
+            for (int i = 0; i < 0x400; i += 2)
+            {
+                Encrypt(ref tmp1, ref tmp2);
+                cardHash[i + 18 + 0] = tmp1;
+                cardHash[i + 18 + 1] = tmp2;
+            }
+        }
     }
 }

NDecrypt.Core/Headers/ExeFSFileHeader.cs

@@ -6,7 +6,7 @@ namespace NDecrypt.Core.Headers
 {
     public class ExeFSFileHeader
     {
-        private const string codeSegment = ".code\0\0\0";
+        // .code\0\0\0
         private readonly byte[] codeSegmentBytes = new byte[] { 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x00, 0x00, 0x00 };
 
         /// <summary>

NDecrypt.Core/Headers/NCCHHeader.cs

@@ -41,27 +41,27 @@ namespace NDecrypt.Core.Headers
         /// <summary>
         /// Boot rom key
         /// </summary>
-        private BigInteger KeyX;
+        public BigInteger KeyX { get; set; }
 
         /// <summary>
         /// NCCH boot rom key
         /// </summary>
-        private BigInteger KeyX2C;
+        public BigInteger KeyX2C { get; set; }
 
         /// <summary>
         /// Kernel9/Process9 key
         /// </summary>
-        private BigInteger KeyY;
+        public BigInteger KeyY { get; set; }
 
         /// <summary>
         /// Normal AES key
         /// </summary>
-        private BigInteger NormalKey;
+        public BigInteger NormalKey { get; set; }
 
         /// <summary>
         /// NCCH AES key
         /// </summary>
-        private BigInteger NormalKey2C;
+        public BigInteger NormalKey2C { get; set; }
 
         /// <summary>
         /// Maker code

NDecrypt.Core/NDecrypt.Core.csproj

@@ -2,7 +2,14 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFrameworks>netcoreapp3.1,net5.0</TargetFrameworks>
+    <TargetFrameworks>netcoreapp3.1;net5.0</TargetFrameworks>
+    <RuntimeIdentifiers>win10-x64;win7-x86</RuntimeIdentifiers>
+    <Configurations>Debug;Release</Configurations>
+    <Platforms>AnyCPU;x64</Platforms>
   </PropertyGroup>
 
+  <ItemGroup>
+    <PackageReference Include="BouncyCastle.NetCore" Version="1.8.8" />
+  </ItemGroup>
+
 </Project>

NDecrypt.Core/ThreeDSTool.cs

@@ -1,5 +1,8 @@
 using System;
 using System.IO;
+using System.Linq;
+using System.Numerics;
+using NDecrypt.Core.Data;
 using NDecrypt.Core.Headers;
 
 namespace NDecrypt.Core
@@ -34,6 +37,8 @@ namespace NDecrypt.Core
             this.force = force;
         }
 
+        #region Common Methods
+
         /// <summary>
         /// Process an input file given the input values
         /// </summary>
@@ -56,10 +61,524 @@ namespace NDecrypt.Core
                 }
 
                 // Process all 8 NCCH partitions
-                header.ProcessAllPartitions(reader, writer, encrypt, development, force);
+                ProcessAllPartitions(header, reader, writer);
             }
 
             return true;
-        }        
+        }
+
+        /// <summary>
+        /// Process all partitions in the partition table of an NCSD header
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void ProcessAllPartitions(NCSDHeader ncsdHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            // Iterate over all 8 NCCH partitions
+            for (int p = 0; p < 8; p++)
+            {
+                NCCHHeader ncchHeader = GetPartitionHeader(ncsdHeader, reader, p);
+                if (ncchHeader == null)
+                    continue;
+
+                ProcessPartition(ncsdHeader, ncchHeader, reader, writer);
+            }
+        }
+
+        /// <summary>
+        /// Get a specific partition header from the partition table
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="partitionNumber">Partition number to attempt to retrieve</param>
+        /// <returns>NCCH header for the partition requested, null on error</returns>
+        private NCCHHeader GetPartitionHeader(NCSDHeader ncsdHeader, BinaryReader reader, int partitionNumber)
+        {
+            if (!ncsdHeader.PartitionsTable[partitionNumber].IsValid())
+            {
+                Console.WriteLine($"Partition {partitionNumber} Not found... Skipping...");
+                return null;
+            }
+
+            // Seek to the beginning of the NCCH partition
+            reader.BaseStream.Seek((ncsdHeader.PartitionsTable[partitionNumber].Offset * ncsdHeader.MediaUnitSize), SeekOrigin.Begin);
+
+            NCCHHeader partitionHeader = NCCHHeader.Read(reader, true);
+            if (partitionHeader == null)
+            {
+                Console.WriteLine($"Partition {partitionNumber} Unable to read NCCH header");
+                return null;
+            }
+
+            partitionHeader.PartitionNumber = partitionNumber;
+            partitionHeader.Entry = ncsdHeader.PartitionsTable[partitionNumber];
+            return partitionHeader;
+        }
+
+        /// <summary>
+        /// Process a single partition
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void ProcessPartition(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            // If we're forcing the operation, tell the user
+            if (force)
+            {
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber} is not verified due to force flag being set.");
+            }
+            // If we're not forcing the operation, check if the 'NoCrypto' bit is set
+            else if (ncchHeader.Flags.PossblyDecrypted ^ encrypt)
+            {
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber}: Already " + (encrypt ? "Encrypted" : "Decrypted") + "?...");
+                return;
+            }
+
+            // Determine the Keys to be used
+            SetEncryptionKeys(ncsdHeader, ncchHeader);
+
+            // Process the extended header
+            ProcessExtendedHeader(ncsdHeader, ncchHeader, reader, writer);
+
+            // If we're encrypting, encrypt the filesystems and update the flags
+            if (encrypt)
+            {
+                EncryptExeFS(ncsdHeader, ncchHeader, reader, writer);
+                EncryptRomFS(ncsdHeader, ncchHeader, reader, writer);
+                UpdateEncryptCryptoAndMasks(ncsdHeader, ncchHeader, writer);
+            }
+
+            // If we're decrypting, decrypt the filesystems and update the flags
+            else
+            {
+                DecryptExeFS(ncsdHeader, ncchHeader, reader, writer);
+                DecryptRomFS(ncsdHeader, ncchHeader, reader, writer);
+                UpdateDecryptCryptoAndMasks(ncsdHeader, ncchHeader, writer);
+            }
+        }
+
+        /// <summary>
+        /// Determine the set of keys to be used for encryption or decryption
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        private void SetEncryptionKeys(NCSDHeader ncsdHeader, NCCHHeader ncchHeader)
+        {
+            ncchHeader.KeyX = 0;
+            ncchHeader.KeyX2C = development ? Constants.DevKeyX0x2C : Constants.KeyX0x2C;
+
+            // Backup headers can't have a KeyY value set
+            if (ncchHeader.RSA2048Signature != null)
+                ncchHeader.KeyY = new BigInteger(ncchHeader.RSA2048Signature.Take(16).Reverse().ToArray());
+            else
+                ncchHeader.KeyY = new BigInteger(0);
+
+            ncchHeader.NormalKey = 0;
+            ncchHeader.NormalKey2C = Helper.RotateLeft((Helper.RotateLeft(ncchHeader.KeyX2C, 2, 128) ^ ncchHeader.KeyY) + Constants.AESHardwareConstant, 87, 128);
+
+            // Set the header to use based on mode
+            BitMasks masks;
+            CryptoMethod method;
+            if (encrypt)
+            {
+                masks = ncsdHeader.BackupHeader.Flags.BitMasks;
+                method = ncsdHeader.BackupHeader.Flags.CryptoMethod;
+            }
+            else
+            {
+                masks = ncchHeader.Flags.BitMasks;
+                method = ncchHeader.Flags.CryptoMethod;
+            }
+
+            if (masks.HasFlag(BitMasks.FixedCryptoKey))
+            {
+                ncchHeader.NormalKey = 0x00;
+                ncchHeader.NormalKey2C = 0x00;
+                Console.WriteLine("Encryption Method: Zero Key");
+            }
+            else
+            {
+                if (method == CryptoMethod.Original)
+                {
+                    ncchHeader.KeyX = development ? Constants.DevKeyX0x2C : Constants.KeyX0x2C;
+                    Console.WriteLine("Encryption Method: Key 0x2C");
+                }
+                else if (method == CryptoMethod.Seven)
+                {
+                    ncchHeader.KeyX = development ? Constants.DevKeyX0x25 : Constants.KeyX0x25;
+                    Console.WriteLine("Encryption Method: Key 0x25");
+                }
+                else if (method == CryptoMethod.NineThree)
+                {
+                    ncchHeader.KeyX = development ? Constants.DevKeyX0x18 : Constants.KeyX0x18;
+                    Console.WriteLine("Encryption Method: Key 0x18");
+                }
+                else if (method == CryptoMethod.NineSix)
+                {
+                    ncchHeader.KeyX = development ? Constants.DevKeyX0x1B : Constants.KeyX0x1B;
+                    Console.WriteLine("Encryption Method: Key 0x1B");
+                }
+
+                ncchHeader.NormalKey = Helper.RotateLeft((Helper.RotateLeft(ncchHeader.KeyX, 2, 128) ^ ncchHeader.KeyY) + Constants.AESHardwareConstant, 87, 128);
+            }
+        }
+
+        /// <summary>
+        /// Process the extended header, if it exists
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private bool ProcessExtendedHeader(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            if (ncchHeader.ExtendedHeaderSizeInBytes > 0)
+            {
+                reader.BaseStream.Seek((ncchHeader.Entry.Offset * ncsdHeader.MediaUnitSize) + 0x200, SeekOrigin.Begin);
+                writer.BaseStream.Seek((ncchHeader.Entry.Offset * ncsdHeader.MediaUnitSize) + 0x200, SeekOrigin.Begin);
+
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber} ExeFS: " + (encrypt ? "Encrypting" : "Decrypting") + ": ExHeader");
+
+                var cipher = Helper.CreateAESCipher(ncchHeader.NormalKey2C, ncchHeader.PlainIV, encrypt);
+                writer.Write(cipher.ProcessBytes(reader.ReadBytes(Constants.CXTExtendedDataHeaderLength)));
+                writer.Flush();
+                return true;
+            }
+            else
+            {
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber} ExeFS: No Extended Header... Skipping...");
+                return false;
+            }
+        }
+    
+        /// <summary>
+        /// Process the extended header, if it exists
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void ProcessExeFSFileEntries(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            reader.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.ExeFSOffsetInMediaUnits) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+            ExeFSHeader exefsHeader = ExeFSHeader.Read(reader);
+
+            // If the header failed to read, log and return
+            if (exefsHeader == null)
+            {
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber} ExeFS header could not be read. Skipping...");
+                return;
+            }
+
+            foreach (ExeFSFileHeader fileHeader in exefsHeader.FileHeaders)
+            {
+                // Only decrypt a file if it's a code binary
+                if (!fileHeader.IsCodeBinary)
+                    continue;
+
+                uint datalenM = ((fileHeader.FileSize) / (1024 * 1024));
+                uint datalenB = ((fileHeader.FileSize) % (1024 * 1024));
+                uint ctroffset = ((fileHeader.FileOffset + ncsdHeader.MediaUnitSize) / 0x10);
+
+                byte[] exefsIVWithOffsetForHeader = Helper.AddToByteArray(ncchHeader.ExeFSIV, (int)ctroffset);
+
+                var firstCipher = Helper.CreateAESCipher(ncchHeader.NormalKey, exefsIVWithOffsetForHeader, encrypt);
+                var secondCipher = Helper.CreateAESCipher(ncchHeader.NormalKey2C, exefsIVWithOffsetForHeader, !encrypt);
+
+                reader.BaseStream.Seek((((ncchHeader.Entry.Offset + ncchHeader.ExeFSOffsetInMediaUnits) + 1) * ncsdHeader.MediaUnitSize) + fileHeader.FileOffset, SeekOrigin.Begin);
+                writer.BaseStream.Seek((((ncchHeader.Entry.Offset + ncchHeader.ExeFSOffsetInMediaUnits) + 1) * ncsdHeader.MediaUnitSize) + fileHeader.FileOffset, SeekOrigin.Begin);
+
+                if (datalenM > 0)
+                {
+                    for (int i = 0; i < datalenM; i++)
+                    {
+                        writer.Write(secondCipher.ProcessBytes(firstCipher.ProcessBytes(reader.ReadBytes(1024 * 1024))));
+                        writer.Flush();
+                        Console.Write($"\rPartition {ncchHeader.PartitionNumber} ExeFS: " + (encrypt ? "Encrypting" : "Decrypting") + $": {fileHeader.ReadableFileName}... {i} / {datalenM + 1} mb...");
+                    }
+                }
+
+                if (datalenB > 0)
+                {
+                    writer.Write(secondCipher.DoFinal(firstCipher.DoFinal(reader.ReadBytes((int)datalenB))));
+                    writer.Flush();
+                }
+
+                Console.Write($"\rPartition {ncchHeader.PartitionNumber} ExeFS: " + (encrypt ? "Encrypting" : "Decrypting") + $": {fileHeader.ReadableFileName}... {datalenM + 1} / {datalenM + 1} mb... Done!\r\n");
+            }
+        }
+
+        /// <summary>
+        /// Process the ExeFS Filename Table
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void ProcessExeFSFilenameTable(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            reader.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.ExeFSOffsetInMediaUnits) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+            writer.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.ExeFSOffsetInMediaUnits) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+
+            Console.WriteLine($"Partition {ncchHeader.PartitionNumber} ExeFS: " + (encrypt ? "Encrypting" : "Decrypting") + $": ExeFS Filename Table");
+
+            var exeFSFilenameTable = Helper.CreateAESCipher(ncchHeader.NormalKey2C, ncchHeader.ExeFSIV, encrypt);
+            writer.Write(exeFSFilenameTable.ProcessBytes(reader.ReadBytes((int)ncsdHeader.MediaUnitSize)));
+            writer.Flush();
+        }
+
+        /// <summary>
+        /// Process the ExeFS, if it exists
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void ProcessExeFS(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            int exefsSizeM = (int)((long)((ncchHeader.ExeFSSizeInMediaUnits - 1) * ncsdHeader.MediaUnitSize) / (1024 * 1024));
+            int exefsSizeB = (int)((long)((ncchHeader.ExeFSSizeInMediaUnits - 1) * ncsdHeader.MediaUnitSize) % (1024 * 1024));
+            int ctroffsetE = (int)(ncsdHeader.MediaUnitSize / 0x10);
+
+            byte[] exefsIVWithOffset = Helper.AddToByteArray(ncchHeader.ExeFSIV, ctroffsetE);
+
+            var exeFS = Helper.CreateAESCipher(ncchHeader.NormalKey2C, exefsIVWithOffset, encrypt);
+
+            reader.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.ExeFSOffsetInMediaUnits + 1) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+            writer.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.ExeFSOffsetInMediaUnits + 1) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+            if (exefsSizeM > 0)
+            {
+                for (int i = 0; i < exefsSizeM; i++)
+                {
+                    writer.Write(exeFS.ProcessBytes(reader.ReadBytes(1024 * 1024)));
+                    writer.Flush();
+                    Console.Write($"\rPartition {ncchHeader.PartitionNumber} ExeFS: " + (encrypt ? "Encrypting" : "Decrypting") + $": {i} / {exefsSizeM + 1} mb");
+                }
+            }
+            if (exefsSizeB > 0)
+            {
+                writer.Write(exeFS.DoFinal(reader.ReadBytes(exefsSizeB)));
+                writer.Flush();
+            }
+
+            Console.Write($"\rPartition {ncchHeader.PartitionNumber} ExeFS: " + (encrypt ? "Encrypting" : "Decrypting") + $": {exefsSizeM + 1} / {exefsSizeM + 1} mb... Done!\r\n");
+        }
+
+        #endregion
+
+        #region Decrypt
+
+        /// <summary>
+        /// Decrypt the ExeFS, if it exists
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void DecryptExeFS(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            // If the ExeFS size is 0, we log and return
+            if (ncchHeader.ExeFSSizeInMediaUnits == 0)
+            {
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber} ExeFS: No Data... Skipping...");
+                return;
+            }
+
+            // Decrypt the filename table
+            ProcessExeFSFilenameTable(ncsdHeader, ncchHeader, reader, writer);
+
+            // For all but the original crypto method, process each of the files in the table
+            if (ncchHeader.Flags.CryptoMethod != CryptoMethod.Original)
+                ProcessExeFSFileEntries(ncsdHeader, ncchHeader, reader, writer);
+
+            // Decrypt the rest of the ExeFS
+            ProcessExeFS(ncsdHeader, ncchHeader, reader, writer);
+        }
+
+        /// <summary>
+        /// Decrypt the RomFS, if it exists
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        /// TODO: See how much can be extracted into a common method with Encrypt
+        private void DecryptRomFS(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            // If the RomFS offset is 0, we log and return
+            if (ncchHeader.RomFSOffsetInMediaUnits == 0)
+            {
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber} RomFS: No Data... Skipping...");
+                return;
+            }
+
+            long romfsSizeM = (int)((long)(ncchHeader.RomFSSizeInMediaUnits * ncsdHeader.MediaUnitSize) / (1024 * 1024));
+            int romfsSizeB = (int)((long)(ncchHeader.RomFSSizeInMediaUnits * ncsdHeader.MediaUnitSize) % (1024 * 1024));
+
+            var cipher = Helper.CreateAESCipher(ncchHeader.NormalKey, ncchHeader.RomFSIV, encrypt);
+
+            reader.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.RomFSOffsetInMediaUnits) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+            writer.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.RomFSOffsetInMediaUnits) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+            if (romfsSizeM > 0)
+            {
+                for (int i = 0; i < romfsSizeM; i++)
+                {
+                    writer.Write(cipher.ProcessBytes(reader.ReadBytes(1024 * 1024)));
+                    writer.Flush();
+                    Console.Write($"\rPartition {ncchHeader.PartitionNumber} RomFS: Decrypting: {i} / {romfsSizeM + 1} mb");
+                }
+            }
+            if (romfsSizeB > 0)
+            {
+                writer.Write(cipher.DoFinal(reader.ReadBytes(romfsSizeB)));
+                writer.Flush();
+            }
+
+            Console.Write($"\rPartition {ncchHeader.PartitionNumber} RomFS: Decrypting: {romfsSizeM + 1} / {romfsSizeM + 1} mb... Done!\r\n");
+        }
+
+        /// <summary>
+        /// Update the CryptoMethod and BitMasks for the decrypted partition
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void UpdateDecryptCryptoAndMasks(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryWriter writer)
+        {
+            // Write the new CryptoMethod
+            writer.BaseStream.Seek((ncchHeader.Entry.Offset * ncsdHeader.MediaUnitSize) + 0x18B, SeekOrigin.Begin);
+            writer.Write((byte)CryptoMethod.Original);
+            writer.Flush();
+
+            // Write the new BitMasks flag
+            writer.BaseStream.Seek((ncchHeader.Entry.Offset * ncsdHeader.MediaUnitSize) + 0x18F, SeekOrigin.Begin);
+            BitMasks flag = ncchHeader.Flags.BitMasks;
+            flag &= (BitMasks)((byte)(BitMasks.FixedCryptoKey | BitMasks.NewKeyYGenerator) ^ 0xFF);
+            flag |= BitMasks.NoCrypto;
+            writer.Write((byte)flag);
+            writer.Flush();
+        }
+
+        #endregion
+
+        #region Encrypt
+
+        /// <summary>
+        /// Encrypt the ExeFS, if it exists
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void EncryptExeFS(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            // If the ExeFS size is 0, we log and return
+            if (ncchHeader.ExeFSSizeInMediaUnits == 0)
+            {
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber} ExeFS: No Data... Skipping...");
+                return;
+            }
+
+            // For all but the original crypto method, process each of the files in the table
+            if (ncsdHeader.BackupHeader.Flags.CryptoMethod != CryptoMethod.Original)
+                ProcessExeFSFileEntries(ncsdHeader, ncchHeader, reader, writer);
+
+            // Encrypt the filename table
+            ProcessExeFSFilenameTable(ncsdHeader, ncchHeader, reader, writer);
+
+            // Encrypt the rest of the ExeFS
+            ProcessExeFS(ncsdHeader, ncchHeader, reader, writer);
+        }
+
+        /// <summary>
+        /// Encrypt the RomFS, if it exists
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="reader">BinaryReader representing the input stream</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        /// TODO: See how much can be extracted into a common method with Decrypt
+        private void EncryptRomFS(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryReader reader, BinaryWriter writer)
+        {
+            // If the RomFS offset is 0, we log and return
+            if (ncchHeader.RomFSOffsetInMediaUnits == 0)
+            {
+                Console.WriteLine($"Partition {ncchHeader.PartitionNumber} RomFS: No Data... Skipping...");
+                return;
+            }
+
+            long romfsSizeM = (int)((long)(ncchHeader.RomFSSizeInMediaUnits * ncsdHeader.MediaUnitSize) / (1024 * 1024));
+            int romfsSizeB = (int)((long)(ncchHeader.RomFSSizeInMediaUnits * ncsdHeader.MediaUnitSize) % (1024 * 1024));
+
+            // Encrypting RomFS for partitions 1 and up always use Key0x2C
+            if (ncchHeader.PartitionNumber > 0)
+            {
+                if (ncsdHeader.BackupHeader.Flags?.BitMasks.HasFlag(BitMasks.FixedCryptoKey) == true) // except if using zero-key
+                {
+                    ncchHeader.NormalKey = 0x00;
+                }
+                else
+                {
+                    ncchHeader.KeyX = (development ? Constants.DevKeyX0x2C : Constants.KeyX0x2C);
+                    ncchHeader.NormalKey = Helper.RotateLeft((Helper.RotateLeft(ncchHeader.KeyX, 2, 128) ^ ncchHeader.KeyY) + Constants.AESHardwareConstant, 87, 128);
+                }
+            }
+
+            var cipher = Helper.CreateAESCipher(ncchHeader.NormalKey, ncchHeader.RomFSIV, encrypt);
+
+            reader.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.RomFSOffsetInMediaUnits) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+            writer.BaseStream.Seek((ncchHeader.Entry.Offset + ncchHeader.RomFSOffsetInMediaUnits) * ncsdHeader.MediaUnitSize, SeekOrigin.Begin);
+            if (romfsSizeM > 0)
+            {
+                for (int i = 0; i < romfsSizeM; i++)
+                {
+                    writer.Write(cipher.ProcessBytes(reader.ReadBytes(1024 * 1024)));
+                    writer.Flush();
+                    Console.Write($"\rPartition {ncchHeader.PartitionNumber} RomFS: Encrypting: {i} / {romfsSizeM + 1} mb");
+                }
+            }
+            if (romfsSizeB > 0)
+            {
+                writer.Write(cipher.DoFinal(reader.ReadBytes(romfsSizeB)));
+                writer.Flush();
+            }
+
+            Console.Write($"\rPartition {ncchHeader.PartitionNumber} RomFS: Encrypting: {romfsSizeM + 1} / {romfsSizeM + 1} mb... Done!\r\n");
+        }
+
+        /// <summary>
+        /// Update the CryptoMethod and BitMasks for the encrypted partition
+        /// </summary>
+        /// <param name="ncsdHeader">NCSD header representing the 3DS file</param>
+        /// <param name="ncchHeader">NCCH header representing the partition</param>
+        /// <param name="writer">BinaryWriter representing the output stream</param>
+        private void UpdateEncryptCryptoAndMasks(NCSDHeader ncsdHeader, NCCHHeader ncchHeader, BinaryWriter writer)
+        {
+            // Write the new CryptoMethod
+            writer.BaseStream.Seek((ncchHeader.Entry.Offset * ncsdHeader.MediaUnitSize) + 0x18B, SeekOrigin.Begin);
+            
+            // For partitions 1 and up, set crypto-method to 0x00
+            if (ncchHeader.PartitionNumber > 0)
+                writer.Write((byte)CryptoMethod.Original);
+
+            // If partition 0, restore crypto-method from backup flags
+            else
+                writer.Write((byte)ncsdHeader.BackupHeader.Flags.CryptoMethod);
+
+            writer.Flush();
+
+            // Write the new BitMasks flag
+            writer.BaseStream.Seek((ncchHeader.Entry.Offset * ncsdHeader.MediaUnitSize) + 0x18F, SeekOrigin.Begin);
+            BitMasks flag = ncchHeader.Flags.BitMasks;
+            flag &= (BitMasks.FixedCryptoKey | BitMasks.NewKeyYGenerator | BitMasks.NoCrypto) ^ (BitMasks)0xFF;
+            flag |= (BitMasks.FixedCryptoKey | BitMasks.NewKeyYGenerator) & ncsdHeader.BackupHeader.Flags.BitMasks;
+            writer.Write((byte)flag);
+            writer.Flush();
+        }
+
+        #endregion
     }
 }

NDecrypt/Headers/ExeFSFileHeader.cs

@@ -6,7 +6,7 @@ namespace NDecrypt.Headers
 {
     public class ExeFSFileHeader
     {
-        private const string codeSegment = ".code\0\0\0";
+        // .code\0\0\0
         private readonly byte[] codeSegmentBytes = new byte[] { 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x00, 0x00, 0x00 };
 
         /// <summary>

NDecrypt/Headers/NCCHHeader.cs

@@ -275,7 +275,7 @@ namespace NDecrypt.Headers
 
             // Process each of the pieces if they exist
             ProcessExtendedHeader(reader, writer, header.MediaUnitSize, encrypt);
-            ProcessExeFS(reader, writer, header.MediaUnitSize, encrypt);
+            ProcessExeFS(reader, writer, header.MediaUnitSize, header.BackupHeader.Flags, encrypt);
             ProcessRomFS(reader, writer, header.MediaUnitSize, header.BackupHeader.Flags, encrypt, development);
 
             // Write out new CryptoMethod and BitMask flags
@@ -383,8 +383,9 @@ namespace NDecrypt.Headers
         /// <param name="reader">BinaryReader representing the input stream</param>
         /// <param name="writer">BinaryWriter representing the output stream</param>
         /// <param name="mediaUnitSize">Number of bytes per media unit</param>
+        /// <param name="backupFlags">File backup flags for encryption</param>
         /// <param name="encrypt">True if we want to encrypt the extended header, false otherwise</param>
-        private void ProcessExeFS(BinaryReader reader, BinaryWriter writer, uint mediaUnitSize, bool encrypt)
+        private void ProcessExeFS(BinaryReader reader, BinaryWriter writer, uint mediaUnitSize, NCCHHeaderFlags backupFlags, bool encrypt)
         {
             if (ExeFSSizeInMediaUnits > 0)
             {
@@ -393,7 +394,8 @@ namespace NDecrypt.Headers
                     ProcessExeFSFilenameTable(reader, writer, mediaUnitSize, encrypt);
 
                 // For all but the original crypto method, process each of the files in the table
-                if (Flags.CryptoMethod != CryptoMethod.Original)
+                if ((!encrypt && Flags.CryptoMethod != CryptoMethod.Original)
+                    || (encrypt && backupFlags.CryptoMethod != CryptoMethod.Original))
                 {
                     reader.BaseStream.Seek((Entry.Offset + ExeFSOffsetInMediaUnits) * mediaUnitSize, SeekOrigin.Begin);
                     ExeFSHeader exefsHeader = ExeFSHeader.Read(reader);

NDecrypt/NDecrypt.csproj

@@ -9,7 +9,7 @@
     <AppDesignerFolder>Properties</AppDesignerFolder>
     <RootNamespace>NDecrypt</RootNamespace>
     <AssemblyName>NDecrypt</AssemblyName>
-    <TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>
+    <TargetFrameworkVersion>v4.8</TargetFrameworkVersion>
     <FileAlignment>512</FileAlignment>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">