The Paladin leak occurred on the 30th of September 2020 and included about 2.4GB of content related to the Nintendo IRIS and Pokemon spinoffs. This was the third Nintendo leak in September 2020 with the First being the Emerald leak and the second being the Platinum leak.
![]()
Nintendo Emerald Leak
For more information on the Emerald leak check out this post.
As usual the files were uploaded to anonfiles and the links shared on the 4Chan /vp board, the files were:
When the paladin.7z archive has been extracted it creates the following contents:
Similar to the previous Gigaleak, this leak also contains content from the Nintendo Lot Check process, in this case it was the Famicom Disk System ROMs. Some of these games had been previously unreleased, you can find more details in our post about the Nintendo Lot Check ROMs.
![]()
Nintendo Lot Check ROM Leak
For full information on the new Famicom Disk System ROMs in the leak check out this post.
The files have the standard Nintendo SRL extension which was used both both GBA and NDS ROMS, you can rename the extension to .gba and they will play just fine in a GBA emulator.
It is unclear the file naming convention and how far along the different builds of the game are but we know that the first 4 characters are the standard product ID for Leaf Green (BPGE) and Fire Red (BPRE).
It is currently unknown what differences are in these builds, but you can rename them to ‘.gba’ and run them in any Game Boy Advance emulator to find out.
Contents:
In the Dungeon folder it has a bunch of Game Boy Advance and Nintendo DS ROMS for Pokemon Mystery Dungeon, they are in the SRL format which is the same as .GBA, so can you can easily play these in any GBA emulator.
Contents:
The Product IDs with numbers as the second 2 characters tend to be Demo versions and are not in the GBA or NDS LotCheck spreadsheet (AGB_data).
Not sure what these Wii WAD files are and they don’t open in the Dolphin emulator, the contents of this folder are:
You can extract both devmon_.wad and viewer_.wad with the tool ShowMiiWads but it is still not clear what purpose they have.
Pokemon Ranger is a Nintendo Ds game that was first released in Japan on the 23rd of March 2006. It was jointly developed by HAL Laboratory and Creatures Inc.
Unfortunately this leak does not have the source code for it but it does have some interesting E3 builds of the game and the translation files sent out to the localisation teams.
This folder contains two Nintendo DS ROMs for Pokemon Ranger, you can play these in any Nintendo DS emulator as they are the same as the .NDS format.
The Contents of this folder are:
The only difference in the file names is the last letter either being an f or an m. Currently waiting for the Pokemon Rom hacking community to figure out what the differences are in these two ROMs.
Could the F stand for Female and the M stand for Male?
The PokeRanger_Euro.zip seems to be created before the localisation process for Pokemon Ranger has started, for the result of the translation process check out the other archive Ranger_EURO.zip.
There is a folder called To_Alessio which were files to be sent to Alessio Danieli who is a Localization Producer at Nintendo of Europe, files in this folder are:
The second folder is titled To_translators and contains the documents that translators need to create their respective localization:
The remaining files in this folder are:
This folder contains a slightly modified /Documents folder compared to the previous PokeRanger_Euro.zip archive, but the changes are not particularly interesting apart from the new folder containing the Japanese translations Ranger_JP.
There are four localisations which each have their own separate folder with the same files but with different locale text, these are: German, Italian, French and Spanish.
The list of files that are present in all the localisations are:
The file from the previous archive RangerTextList_Eng.xls was sent to translators which explains the contents of each of these files.
The other two files not related to the four localisations are at the root of this folder:
This folder also contains the Japanese version of the Documents seen in the previous archive (PokeRanger_Euro.zip), these are the new files in the new Ranger_JP in the documents directory:
The most interesting document here is the PKRanger_DebugMode.doc which describes the debug functions in the provided Pokemon Ranger DS ROM. it has functions for infinite life, mission select and map select, this would make it a lot easier for translators to go to the exact area of the game to make sure the text they are writing would work in that context.
Overall this is a very interesting insight into the translation process of a Nintendo DS game, it is something people don’t really think about very much but nice to see whole they solved the task, especially for PAL regions that required four additional languages.
When the rangereu.7z archive has been extracted you will get a folder for each of the Pokemon Ranger builds.
Each folder contains both a M and F (Male/Female?) version of the European Nintendo DS ROM, it will take some time for Pokemon ROM hackers to understand all the differences in these builds but for now here is the list of builds included:
The archives Ranger_trial_eu_061214.zip and Ranger_trial_eu_061214.rar have exactly the same content inside, so they were probably seeing which format compressed the best when sending it on.
In order to access the contents of the SVN repository you have to run the following command:
svn checkout "file:///$PWD" trunk
This is the first in a number of Citrus (CTR/3DS) source code archives which contain interesting test programs used internally at Nintendo.
This project creates a 3DS ROM which has a variety of testing functions:
The files that will be checked out into the trunk directory are:
The nakayama.cpp file is a pretty useful library of functions to create a basic UI for 3DS programs, it has classes such as Page/UIControl etc which can be used to create nice clean UI code.
One of the more interesting files is actually クラス図.bmp which is a rare case of programmers actually using UML to design or document the code they are writing.
It can be quite rare for game developers to use UML, but this class diagram was created for the Nintendo 3DS (CTR) Test Card. This was presumably created by Nakayama (nakayama.cpp) who seems to have created a nice little UI library for the 3DS. #NintendoLeaks #Nintendo3ds pic.twitter.com/drWynTWPEL
— RetroReversing.com (@RetroReversing) October 3, 2020
Also this project seems to use OMake rather than standard make, but since it is a fork of make it is fully backwards compatible and has a few new features such as dependency analysis 1.
This needs more investigation in to how the ROM performs each of the tests, if you have a build environment set up for 3DS and an emulator then lets us know what you find.
In order to access the contents of the SVN repository you have to run the following command:
svn checkout "file:///$PWD" trunk
This seems to be the source code for a Unix (Windows via Cygwin) tool to generate an eFuseID. eFuse are microscopic ‘fuses’ that can be physically burned away. They are used to prevent downgrading a firmware to a lower version as each firmware requires a higher number of fuses to have been destroyed. However we are not exactly sure what this software is used for or what an eFuse ID is. Also we know that the Nintendo Switch uses eFuses but no record of the 3DS using eFuses.
All we know is that this project uses openssl and uses private/public key encryption using AES.
It creates three different executables:
The files that will be checked out into the trunk directory are:
If you know anything about this tool please reach out to us so we can update the information here.
Mystery from the Nintendo Paladin Leak: Why is there a Nintendo 3DS "eFuse" repository when they were not used on the console? The switch used eFuses to prevent downgrading firmware versions but the 3DS did not as far as we know. https://t.co/1BrJ1wDS7i #NintendoLeaks #3ds
— RetroReversing.com (@RetroReversing) October 3, 2020
In order to access the contents of the SVN repository you have to run the following command:
svn checkout "file:///$PWD" trunk
The files that will be checked out into the trunk directory are:
In order to access the contents of the SVN repository you have to run the following command:
svn checkout "file:///$PWD" trunk
The ctr_test_tools.zip archive contains source code for a tool called TwlBkpCheck which was created for the DSi (Project Twilight/TWL) partition on the 3DS.
The project comes in two parts, one that runs on the 3DS itself and the other that runs on Windows PCs.
The first tool is for the 3DS system itself and it is called TwlBkpImporter, which seems to be a tool to import a previously backed-up DSi (partition?/game?) from the SD card into the TWL NAND partition, the source files are:
One interesting thing is that some of the source files says they are part of project “Horizon”, but it is not mentioned anywhere what this project is.
The Bin folder contains the compiled version as two different CCI ROM files:
One of the builds is TwlBkpImporterForWPS, the WPS stands for With Private Save, the make file for this is in the TwlBkpImporterForWPS folder:
The other folder holds the Windows based tools for the TwlBkpCheck tool, the contents are:
The Bin folder just contains the compiled results of both TWLBackupBlock and FalsifyTwlBackup:
This is a Dynamic Library that provides encryption / decryption processing for TWL backup data. Not sure if this is for TAD files, the contents are:
This is a .net C# executable that seems to modify a TWL backup by removing sections of bytes and replacing with 0-only bytes.
There seems to be 6 different categories of modifications it will make (1xx,2xx,3xx,4xx,5xx and 9xx).
This program is to presumably create bad input for the 3DS TwlBkpImporter application to test that it correctly errors on bad input. The contents of this folder are:
When trying to run the FalsifyTwlBackup.exe executable the following usage information is printed:
./FalsifyingTwlBackup.exe BACKUP_FILE ENC_KEY_FILE MAC_KEY_FILE [-mode MODE] [-type TYPE]
BACKUP_FILE : *.bin
ENC_KEY_FILE : *.txt
MAC_KEY_FILE : *.txt
MODE
all (default) : output all falsifying pattern
cat:CAT_NUM : output all pattern of CAT_NUM category
ex) -mode cat:100 -> falsifying 100,101,102....
each:PAT_NUM : output PAT_NUM pattern
ex) -mode each:204 -> falsifying 204 only
verify : verify backup file
TYPE
normal (default) : normal bkp type
wps : bkp with private save type
legacy : legacy bkp type
Second Mystery from the Paladin Leak, what were the DSi Backup tools for 3DS used for (FalsifyTwlBackup). They seem to be tools to import a DSi Backup and "Falsify" it but why would this be needed on the 3DS? https://t.co/1BrJ1wmgII #nintendoleak
— RetroReversing.com (@RetroReversing) October 3, 2020
In order to access the contents of the SVN repository you have to run the following command:
svn checkout "file:///$PWD" trunk
The folders that will be checked out into the trunk directory are:
Sarion Systems Research is a Japanese Company who specialise in Hardware Security Modules (HSM) 2.
This is the source code to a server that issues HSM certificates for 3DS downloadable content. This acts in a similar way to browsers certificate authorities to make sure that the software being sent to the 3DS is signed by official sources and has not been tampered with.
Basically it is Java EE web application source code that gets compiled into a war file and uses apache as the web server for static content.
They call the application Web Service Signer (WSSigner) and it comes in a few parts:
Unless you are really interested in security and cryptography you will probably not be interested in this source code.
This folder contains the source code for a tool that updated *.cia files and adds a standard update partition into it.
Presumably this tool is used just before mastering the final Game card so that it will contain the necessary update data so that if the user doesn’t have a high enough firmware version, they can update via the Game Card.
Most if not all 3DS game cards had update partitions with the latest firmware available at the time on them.
This project is a mix of Python and bash scripts a long with two executables which we are not sure the purpose of:
Note that many of these files confirm that the 3DS operating Systems name was “Horizon”.
When you try to run the ** executable from the Command Prompt it provides the following usage information:
Usage: ./CommandLineOls *.xml threadNum[default=1]
It is not clearly understood the purpose, but we believe it is a tool to contact the Official Licensing Server (OLS) to create signed licenses for each game title, presumably it is quite an extensive operation if you can customise the number of threads used!
Although there is a few scripts that can give a clue as to what this tools does, they are:
When you try to run one of the python files it prints the following usage information:
Usage:
genOlsXml.py UserName Password Tin downloadDirectory serverName titlePassword ciaFiles...
The Username and Password will be for a Nintendo user admin, serverName will presumably be one of the licensing servers that handles 3DS content.
The executable imas-tool.4.8.1.exe is quite interesting, while we don’t quite know the purpose of it, some of the contents can be seen using a simple strings command.
It contains compiled Java classes for apache and even some from Nintendo, this is because the executable is using Launch4J, so it’s a Java application that looks like a standard executable.
You can see the Nintendo files in the table below.
| Name | Possible Purpose |
|---|---|
| jp/co/nintendo/imas/tool/ImasTool.class | |
| jp/co/nintendo/imas/tool/MailSender.class | |
| jp/co/nintendo/imas/tool/util/PropertyManager$PropertyKey.class | |
| jp/co/nintendo/imas/tool/util/UserConfigurationManager.class | |
| jp/co/nintendo/imas/tool/util/Messages.class | |
| jp/co/nintendo/imas/tool/util/UserConfigurationManager$1.class | |
| jp/co/nintendo/imas/tool/util/ImasUrlUtil.class | |
| jp/co/nintendo/imas/tool/util/PropertyManager.class | |
| jp/co/nintendo/imas/tool/util/ImasToolUtil.class | |
| jp/co/nintendo/imas/tool/xml/Proxy.class | |
| jp/co/nintendo/imas/tool/xml/BmsAccount.class | |
| jp/co/nintendo/imas/tool/xml/Operation.class | |
| jp/co/nintendo/imas/tool/xml/Configuration.class | |
| jp/co/nintendo/imas/tool/xml/Operations.class | |
| jp/co/nintendo/imas/tool/xml/Titles.class | |
| jp/co/nintendo/imas/tool/xml/ObjectFactory.class | |
| jp/co/nintendo/imas/tool/xml/Notification.class | |
| jp/co/nintendo/imas/tool/xml/RsaServerDownNotification.class | |
| jp/co/nintendo/imas/tool/xml/Title.class | |
| jp/co/nintendo/imas/tool/xml/ServerInfo.class | |
| jp/co/nintendo/imas/tool/HttpClientManager$1.class | |
| jp/co/nintendo/imas/tool/OlsException.class | |
| jp/co/nintendo/imas/tool/ResponseParser.class | |
| jp/co/nintendo/imas/tool/ResponseParser$1.class | |
| jp/co/nintendo/imas/tool/NotificationException.class | |
| jp/co/nintendo/imas/tool/HttpClientManager.class | |
| jp/co/nintendo/imas/tool/BtsException.class | |
| jp/co/nintendo/imas/tool/BmsException.class | |
| jp/co/nintendo/imas/tool/HttpClientManager$3.class | |
| jp/co/nintendo/imas/tool/HttpClientManager$2.class | |
| jp/co/nintendo/imas/tool/MailSender$1.class | |
| jp/co/nintendo/imas/tool/enums/OperationEnum.class | |
| jp/co/nintendo/imas/tool/enums/CountryEnum.class | |
| jp/co/nintendo/imas/tool/enums/PlatformEnum.class | |
| jp/co/nintendo/imas/tool/enums/BmsErrorCodeEnum.class | |
| jp/co/nintendo/imas/tool/enums/TitleTypeEnum.class | |
| jp/co/nintendo/imas/tool/ols/BtsOperation$UploadStatusTask.class | |
| jp/co/nintendo/imas/tool/ols/BtsOperation.class | |
| jp/co/nintendo/imas/tool/ols/OlsOperation.class | |
| jp/co/nintendo/imas/tool/ols/AbstractOlsOperation.class | |
| jp/co/nintendo/imas/tool/HttpClientManager$4.class | |
| jp/co/nintendo/imas/tool/HttpClientManager$5.class | |
| jp/co/nintendo/imas/tool/messages.properties | |
| jp/co/nintendo/imas/tool/messages_ja.properties | |
| jp/co/nintendo/imas/tool/HttpManager.class | |
| jp/co/nintendo/imas/tool/RsaServerDownException.class | |
| jp/co/nintendo/imas/tool/Constants.class | |
| META-INF/maven/jp.co.nintendo/imas-tool/pom.xml | |
| META-INF/maven/jp.co.nintendo/imas-tool/pom.properties |
If you try to run the application with a Java Runtime installed it shows the following usage information and then quits:
Usage:
- Execute from command line : ./item-uploader.exe [Configuration file]
- Execute from explorer : Drag & drop a configuration file over item-uploader.exe icon
The IRIS project was supposed to be the next in the Game Boy line, a more powerful Game Boy Advance with a single screen. Later the project was changed into the NITRO project when another screen was added and it became the Nintendo DS.
The irisSDKbulb-snapshot-031203-forToolMaker.tar.gz archive is the earliest known Software development kit for the IRIS project.
There are some files that are not in this archive that are in the irisSDKbulb-snapshot-031203.tar.gz archive instead, namely the docs/_private/ folder which will be covered in the next section.
As for the files in this archive they are just earlier versions of the IRIS SDK so check out the section below for the files in the last known version of the IRIS SDK as it is very similar.
This is almost exactly the same as the content from irisSDKbulb-snapshot-031203-forToolMaker.tar.gz but contains some new files which I guess are not to be sent in the forToolMaker build (whatever that is).
All the new files are under the folder docs/_private/ which is a completely new directory, these files are:
The contents are pretty much the same as December 3rd but there has been development work so there isn’t that many new files but quite a few source files have changed, which is to be expected.
Nothing of real interest is in this archive unless you want to see the progress made between two different snapshots. Check out the last IRIS SDK (irisSDKbulb-snapshot-040120.tar.gz) for an overview of the contents of the IRIS SDK.
This is an interesting archive as it only contains contents not found in the other build from 20th January 2004 (irisSDKbulb-snapshot-040120.tar.gz).
These files are:
This is the last known version of the IRIS SDK built on the 20th of January 2004, presumably just after the Nintendo DS (NITRO) project was started as it contains files referencing the project under the name Nitro. Contents:
Contents:
These files are for the ARM7 CPU core and would be included in your C/C++ source code in order to use the functionalities provided by the Sub-processor SDK library.
| Name | Description |
|---|---|
| ./iris_sp.h | |
| ./iris_sp/init | |
| ./iris_sp/init/crt0.h | |
| ./iris_sp/hw | |
| ./iris_sp/hw/mmap_global.h | |
| ./iris_sp/hw/ioreg_SPSND.h | |
| ./iris_sp/hw/ioreg.h | |
| ./iris_sp/hw/mmap_wram.h | |
| ./iris_sp/hw/ioreg_SPPAD.h | |
| ./iris_sp/hw/armArch.h | |
| ./iris_sp/hw/ioreg_SPMPI.h | |
| ./iris_sp/hw/ioreg_SPDISP.h | |
| ./iris_sp/hw/ioreg_SPOS.h | |
| ./iris_sp/hw/ioreg_SPMI.h | |
| ./iris_sp/code32.h | |
| ./iris_sp/os.h | |
| ./iris_sp/memorymap.h | |
| ./iris_sp/snd | |
| ./iris_sp/snd/snd_capture.h | |
| ./iris_sp/snd/snd_channel.h | |
| ./iris_sp/snd/snd.h | |
| ./iris_sp/snd/snd_init.h | |
| ./iris_sp/snd/snd_util.h | |
| ./iris_sp/os | |
| ./iris_sp/os/interrupt.h | |
| ./iris_sp/os/system.h | |
| ./iris_sp/code16.h |
These files are for the ARM9 CPU core and would be included in your C/C++ source code in order to use the functionalities provided by the main processor SDK library.
| Name | Description |
|---|---|
| ./iris/init | |
| ./iris/init/crt0.h | |
| ./iris/ARM7-TEG.lcf | |
| ./iris/version.h | |
| ./iris/hw | |
| ./iris/hw/ioreg_PAD.h | |
| ./iris/hw/ioreg_G3X.h | |
| ./iris/hw/mmap_global.h | |
| ./iris/hw/ioreg_G3.h | |
| ./iris/hw/ioreg_OS.h | |
| ./iris/hw/mmap_shared.h | |
| ./iris/hw/ioreg.h | |
| ./iris/hw/mmap_main.h | |
| ./iris/hw/armArch.h | |
| ./iris/hw/ioreg_MI.h | |
| ./iris/hw/mmap_vram.h | |
| ./iris/hw/ioreg_GX.h | |
| ./iris/hw/mmap_tcm.h | |
| ./iris/hw/ioreg_SPI.h | |
| ./iris/hw/ioreg_CP.h | |
| ./iris/hw/ioreg_G2.h | |
| ./iris/types.s | |
| ./iris/code32.h | |
| ./iris/types.h | |
| ./iris/mi | |
| ./iris/mi/wram.h | |
| ./iris/mi/dma.h | |
| ./iris/mi/exMemory.h | |
| ./iris/ARM9-BB.lcf | |
| ./iris/misc.h | |
| ./iris/fx | |
| ./iris/fx/fx.h | |
| ./iris/fx/fx_mtx33.h | |
| ./iris/fx/fx_trig.h | |
| ./iris/fx/fx_mtx43.h | |
| ./iris/fx/fx_cp.h | |
| ./iris/fx/fx_mtx44.h | |
| ./iris/fx/fx_mtx.h | |
| ./iris/fx/fx_const.h | |
| ./iris/fx/fx_vec.h | |
| ./iris/os.h | |
| ./iris/ARM7-BB.lcf | |
| ./iris/pad | |
| ./iris/pad/pad.h | |
| ./iris/ARM9-TEG.lcf | |
| ./iris/memorymap.h | |
| ./iris/ARM9-TEG.lcf.template | |
| ./iris/gx | |
| ./iris/gx/gx.h | |
| ./iris/gx/g3c.h | |
| ./iris/gx/g3x.h | |
| ./iris/gx/g3.h | |
| ./iris/gx/g2_oam.h | |
| ./iris/gx/gxcommon.h | |
| ./iris/gx/gx_vramcnt.h | |
| ./iris/gx/g2.h | |
| ./iris/gx/gx_load.h | |
| ./iris/gx/g3imm.h | |
| ./iris/gx/g3_util.h | |
| ./iris/gx/gx_capture.h | |
| ./iris/gx/g3b.h | |
| ./iris/gx/gx_bgcnt.h | |
| ./iris/os | |
| ./iris/os/spinLock.h | |
| ./iris/os/halt.h | |
| ./iris/os/protectionUnit.h | |
| ./iris/os/context.h | |
| ./iris/os/cache.h | |
| ./iris/os/message.h | |
| ./iris/os/protectionRegion.h | |
| ./iris/os/emulator.h | |
| ./iris/os/systemCall.h | |
| ./iris/os/timer.h | |
| ./iris/os/thread.h | |
| ./iris/os/printf.h | |
| ./iris/os/interrupt.h | |
| ./iris/os/system.h | |
| ./iris/os/mutex.h | |
| ./iris/os/utility.h | |
| ./iris/os/init.h | |
| ./iris/os/exception.h | |
| ./iris/os/arena.h | |
| ./iris/os/alloc.h | |
| ./iris/os/tcm.h | |
| ./iris/cp | |
| ./iris/cp/sqrt.h | |
| ./iris/cp/divider.h | |
| ./iris/code16.h | |
| ./iris.h |
These are:
The compiled libraries are:
Contents:
contents:
Contents:
Contents:
