hactool is a tool to view information about, decrypt, and extract common file formats for the Nintendo Switch, especially Nintendo Content Archives.
Usage
Usage: hactool [options...] <file>
Options:
-i, --info Show file info.
This is the default action.
-x, --extract Extract data from file.
This is also the default action.
-r, --raw Keep raw data, don't unpack.
-y, --verify Verify hashes and signatures.
-d, --dev Decrypt with development keys instead of retail.
-k, --keyset Load keys from an external file.
-t, --intype=type Specify input file type [nca, xci, pfs0, romfs, hfs0, npdm, pk11, pk21, ini1, kip1, nax0, keygen]
--titlekey=key Set title key for Rights ID crypto titles.
--contentkey=key Set raw key for NCA body decryption.
NCA options:
--plaintext=file Specify file path for saving a decrypted copy of the NCA.
--header=file Specify Header file path.
--section0=file Specify Section 0 file path.
--section1=file Specify Section 1 file path.
--section2=file Specify Section 2 file path.
--section3=file Specify Section 3 file path.
--section0dir=dir Specify Section 0 directory path.
--section1dir=dir Specify Section 1 directory path.
--section2dir=dir Specify Section 2 directory path.
--section3dir=dir Specify Section 3 directory path.
--exefs=file Specify ExeFS file path. Overrides appropriate section file path.
--exefsdir=dir Specify ExeFS directory path. Overrides appropriate section directory path.
--romfs=file Specify RomFS file path. Overrides appropriate section file path.
--romfsdir=dir Specify RomFS directory path. Overrides appropriate section directory path.
--listromfs List files in RomFS.
--baseromfs Set Base RomFS to use with update partitions.
--basenca Set Base NCA to use with update partitions.
--basefake Use a fake Base RomFS with update partitions (all reads will return 0xCC).
--onlyupdated Ignore non-updated files in update partitions.
NPDM options:
--json=file Specify file path for saving JSON representation of program permissions to.
KIP1 options:
--json=file Specify file path for saving JSON representation of program permissions to.
--uncompressed=f Specify file path for saving uncompressed KIP1.
NSO0 options:
--uncompressed=f Specify file path for saving uncompressed NSO0.
PFS0 options:
--pfs0dir=dir Specify PFS0 directory path.
--outdir=dir Specify PFS0 directory path. Overrides previous path, if present.
--exefsdir=dir Specify PFS0 directory path. Overrides previous paths, if present for ExeFS PFS0.
RomFS options:
--romfsdir=dir Specify RomFS directory path.
--outdir=dir Specify RomFS directory path. Overrides previous path, if present.
--listromfs List files in RomFS.
HFS0 options:
--hfs0dir=dir Specify HFS0 directory path.
--outdir=dir Specify HFS0 directory path. Overrides previous path, if present.
--exefsdir=dir Specify HFS0 directory path. Overrides previous paths, if present.
XCI options:
--rootdir=dir Specify XCI root HFS0 directory path.
--updatedir=dir Specify XCI update HFS0 directory path.
--normaldir=dir Specify XCI normal HFS0 directory path.
--securedir=dir Specify XCI secure HFS0 directory path.
--logodir=dir Specify XCI logo HFS0 directory path.
--outdir=dir Specify XCI directory path. Overrides previous paths, if present.
Package1 options:
--package1dir=dir Specify Package1 directory path.
--outdir=dir Specify Package1 directory path. Overrides previous path, if present.
Package2 options:
--package2dir=dir Specify Package2 directory path.
--outdir=dir Specify Package2 directory path. Overrides previous path, if present.
--extractini1 Enable INI1 extraction to default directory (redundant with --ini1dir set).
--ini1dir=dir Specify INI1 directory path. Overrides default path, if present.
INI1 options:
--ini1dir=dir Specify INI1 directory path.
--outdir=dir Specify INI1 directory path. Overrides previous path, if present.
--saveini1json Enable generation of JSON descriptors for all INI1 members.
NAX0 options:
--sdseed=seed Set console unique seed for SD card NAX0 encryption.
--sdpath=path Set relative path for NAX0 key derivation (ex: /registered/000000FF/cafebabecafebabecafebabecafebabe.nca).
Key Derivation options:
--sbk=key Set console unique Secure Boot Key for key derivation.
--tseckey=key Set console unique TSEC Key for key derivation.```
Building
Copy config.mk.template
to config.mk
, make changes as required, and then run make
. If your make
is not GNU make (e.g. on BSD variants), you need to call gmake
instead.
If on Windows, I recommend using MinGW.
External Keys
External keys can be provided by the -k/--keyset argument to the a keyset filename. Keyset files are text files containing one key per line, in the form "key_name = HEXADECIMALKEY". Case shouldn't matter, nor should whitespace.
In addition, if -k/--keyset is not set, hactool will check for the presence of a keyset file in $HOME/.switch/prod.keys (or $HOME/.switch/dev.keys if -d/--dev is set). If present, this file will automatically be loaded.
Licensing
This software is licensed under the terms of the ISC License.
You can find a copy of the license in the LICENSE file.
Que novedades incluye la versión 1.4.0
Released
- Support was fixed for parsing save files (thanks @shchmue)!
- Support was fixed for extracting package1 binaries newer than 4.0.0.
- Support was added for performing mariko-specific key derivation.
- Support was added for decrypting and extracting mariko package1 binaries.
The following Switch file formats are supported:
- NCA
- XCI
- HFS0
- PFS0
- RomFS
- NPDM
- Package1 (PK11)
- Package2 (PK21)
- INI1
- KIP1
- NAX0
- NSO0
- Save files
Keydata can be baked in at compile-time, or loaded from an external key file. See README.md and KEYS.md for details. In addition, a secure boot key + TSEC key + boot0 file pair can be passed in with an external key file to derive all keys it is possible to know given the information one has.