3dbrew - User contributions [en]

Savegames

2021-09-03T12:15:49Z

Aspargas2: fix typos

This page describes the format and encryption of savegames contained in gamecards, SD and NAND. You can find savegames from various 3DS games on the [[Games]] page.

== Overview ==
Savegames are stored in [[DISA and DIFF|DISA container format]]. Inside the DISA container, it forms a [[Inner FAT|FAT filesystem]]. '''Please refer to these pages for how to fully extract save files'''. This page only describes additional encryption wear leveling on top of the DISA container. These layers only apply to gamecard save games. SD savegames and NAND savegames are DISA containers in plaintext after decrypting the common SD/NAND encryption layer.

== Gamecard savegame Encryption ==

Gamecard encryption is AES-CTR applied on top of DISA container, but below the wear leveling layer (if exists). The same key Y used for encryption is also used for DISA CMAC signing. Several versions of encryption scheme have been introduced over the time.

{| class="wikitable" border="1"
|-
! FW Introduced
! Old3DS
! [[AES#Keyslot|AES Keyslots]] (Encryption / CMAC)
! KeyY generation method
! Repeating CTR
|-
| The initial version
| style="background: #ccffbb" | Yes
| 0x37 / 0x33
| v1
| style="background: #ccffbb" | Yes
|-
| [[2.0.0-2]]
| style="background: #ccffbb" | Yes
| 0x37 / 0x33
| v2
| style="background: #ccffbb" | Yes
|-
| [[2.2.0-4]]
| style="background: #ccffbb" | Yes
| 0x37 / 0x33
| v2
| style="background: #ffccbb" | No
|-
| [[6.0.0-11]]
| style="background: #ccffbb" | Yes
| 0x37 / 0x33
| v3
| style="background: #ffccbb" | No
|-
| [[9.6.0-24|9.6.0-X]]
| style="background: #ffccbb" | No
| 0x1A / 0x19
| v2?
| style="background: #ffccbb" | No
|}

=== Repeating CTR Fail ===
On the 3DS savegames are stored much like on the DS, that is on a FLASH chip in the gamecart. On the DS these savegames were stored in plain-text but on the 3DS a layer of encryption was added. This is AES-CTR, as the contents of several savegames exhibit the odd behavior that xor-ing certain parts of the savegame together will result in the plain-text appearing.

The reason this works is because the stream cipher used has a period of 512 bytes. That is to say, it will repeat the same keystream after 512 bytes. The way you encrypt with a stream cipher is you XOR your data with the keystream as it is produced. Unfortunately, if your streamcipher repeats and you are encrypting a known plain-text (in our case, zeros) you are basically giving away your valuable keystream.

So how do you use this to decrypt a savegame on a 3DS? First off, you chunk up the savegame into 512 byte chunks. Then, you bin these chunks by their contents, discarding any that contain only FF. Now look for the most common chunk. This is your keystream. Now XOR the keystream with your original savegame and you should have a fully decrypted savegame. XOR with the keystream again to produce an encrypted savegame.

=== KeyY Generation method ===

The [[NCSD]] partition flags determine the method used to generate this keyY.

==== v1 ====

When all of the flags checked by the running NATIVE_FIRM are clear, the keyY is the following:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| First 8-bytes from the plaintext [[NCCH#CXI|CXI]] accessdesc signature.
|-
| 0x8
| 0x4
| u32 CardID0 from [[Gamecards|gamecard]] plaintext-mode command 0x90, Process9 reads this with the [[NTRCARD]] hw. The actual cmdID used by Process9 is different since Process9 reads it with the gamecard in encrypted-mode.
|-
| 0xC
| 0x4
| u32 CardID1 from [[Gamecards|gamecard]] plaintext-mode command 0xA0, Process9 reads this with the [[NTRCARD]] hw. The actual cmdID used by Process9 is different since Process9 reads it with the gamecard in encrypted-mode.
|}

==== v2 ====

Key Y is the first 0x10 bytes of SHA-256 calculated over the following data

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| First 8-bytes from the plaintext [[NCCH#CXI|CXI]] accessdesc signature.
|-
| 0x8
| 0x40
| read from a gamecard command(this 0x40-byte data is also read by [[Process_Services_PXI|GetRomId]], which is the gamecard-uniqueID)
|}

This keyY generation method was implemented with [[2.0.0-2]] via NCSD partition flag[3], however the proper CTR wasn't implemented for flag[7] until [[2.2.0-4]]. The hashed keyY flag[3] implemented with [[2.0.0-2]] was likely never used with retail gamecards.

==== v3 ====

[[6.0.0-11]] implemented support for generating the savegame keyY with a new method, this method is much more complex than previous keyY methods. This is enabled via new [[NCSD]] partition flags, all retail games which have the NCSD image finalized after the [[6.0.0-11]] release(and [[6.0.0-11]]+ in the system update partition) will have these flags set for using this new method.

First, a SHA-256 hash is calculated over the following data

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| First 8-bytes from the plaintext [[NCCH#CXI|CXI]] accessdesc signature.
|-
| 0x8
| 0x40
| Same ID as [[Process_Services_PXI|GetRomId]]
|-
| 0x48
| 0x8
| CXI Program ID
|-
| 0x50
| 0x20
| ExeFS:/.code hash from the decrypted [[ExeFS]] header
|}

Then an [[AES]]-CMAC is calculated over this hash. The output CMAC is used for keyY. The key slot for this CMAC is 0x2F.

The 0x2F keyY used for calculating this AES-CMAC (not to be confused with the final keyY for decrypting/signing savegames) is initialized while NATIVE_FIRM is loading, this keyY is generated via the [[RSA]] engine. The RSA slot used here is slot0(key-data for slot0 is initialized by bootrom), this RSA slot0 key-data is overwritten during system boot. This RSA slot0 key-data gets overwritten with the RSA key-data used for verifying RSA signatures, every time Process9 verifies any RSA signatures except for [[NCCH|NCCH]] accessdesc signatures. Starting with [[7.0.0-13]] this key-init function used at boot is also used to initialize a separate keyslot used for the new [[NCCH]] encryption method.

This [[FIRM|Process9]] key-init function first checks if a certain 0x10-byte block in the 0x01FF8000 region is all-zero. When all-zero it immediately returns, otherwise it clears that block then continues to do the key generation. This is likely for supporting launching a v6.0+ NATIVE_FIRM under this FIRM.

== Gamecard wear leveling ==

The 3DS employs a wear leveling scheme on the savegame FLASH chips(only used for CARD1 gamecards). This is done through the usage of blockmaps and a journal. The blockmap is located at offset 0 of the flash chip, and is immediately followed by the journal. The initial state is dictated by the blockmap, and the journal is then applied to that.

There are two versions of wear leveling have been observed. V1 is used for 128KB and 512 KB CARD1 flash chips. V2 is used for 1MB CARD1 flash chips (uncommon. Pokemon Sun/Moon is an example).

First, there are two 32-bit integers whose purposes are currently unknown. They generally increase the value as the savegame is written more times, so probably counter for how many times the journal became full and got flushed into the block map, and/or how many times <code>alloc_cnt</code> has wrapped around.

Then comes the actual blockmap. The block map contains entries of 10 bytes (V1) or 2 bytes (V2) with total number of <code>(flash_size / 0x1000 - 1)</code>.
The blockmap entry is simple:
<pre>
struct blockmap_entry_v1 {
uint8_t phys_sec; // when bit7 is set, block is initialized and has checksums, otherwise checksums are all zero
uint8_t alloc_cnt;
uint8_t chksums[8];
} __attribute__((__packed__));

struct blockmap_entry_v2 {
// Note that the phys_sec and alloc_cnt field are swapped in v2,
// but the initialized bit is still on the first byte
uint8_t alloc_cnt; // when bit7 is set, block is initialized
uint8_t phys_sec;
// v2 has no chksums
} __attribute__((__packed__));
</pre>

There's one entry per 0x1000-byte sector, counting from physical sector 1 (sector 0 contains the blockmap/journal).

A 2-byte CRC16 follows the block map. For V1 it immediately follows the last block map entry. For V2 it is located at 0x3FE, and bytes before the CRC is padded with zero. The CRC16 checks all the bytes before it, including the two unknown integers, the block map, and the padding bytes for V2. The CRC standard used looks like CRC-16-IBM (modbus). Here is the code in Rust for it

<pre>
fn crc16(data: &[u8]) -> u16 {
let poly = 0xA001;
let mut crc = 0xFFFFu16;
for byte in data {
crc ^= <u16>::from(*byte);
for _ in 0..8 {
let b = crc & 1 != 0;
crc >>= 1;
if b {
crc ^= poly;
}
}
}
crc
}
</pre>

Then comes the journal. The journal contains entries that describes how sectors should be remapped. The rest bytes before 0x1000 after all journal entries are padded with 0xFF
The journal entry structure is as follows:
<pre>
struct journal_entry_half {
uint8_t virt_sec; // Mapped to sector
uint8_t prev_virt_sec; // Physical sector previously mapped to
uint8_t phys_sec; // Mapped from sector
uint8_t prev_phys_sec; // Virtual sector previously mapped to
uint8_t phys_realloc_cnt; // Amount of times physical sector has been remapped
uint8_t virt_realloc_cnt; // Amount of times virtual sector has been remapped
uint8_t chksums[8]; // Unused & uninitialized for V2
} __attribute__((__packed__));

struct journal_entry{
struct journal_entry_half entry;
struct journal_entry_half dupe; // same data as `entry`. No idea what this is used fore
uint32_t uninitialized; // 0xFFFFFFFF in newer system
}__attribute__((__packed__));
</pre>

The checksums in the blockmap/journal entries work as follows:
* each byte is the checksum of an encrypted 0x200 bytes large block
* to calculate the checksum, a CRC16 of the block (same CRC16 algorithm as above) is calculated, and the two bytes of the CRC16 are XORed together to produce the 8bit checksum

== Initialization ==

When a save FLASH contains all xFFFF blocks it's assumed uninitialized by the game cartridges and it initializes default data in place, without prompting the user. The 0xFFFFFFFF blocks are uninitialized data. When creating a non-gamecard savegame and other images/files, it's initially all 0xFFFFFFFF until it's formatted where some of the blocks are overwritten with encrypted data.

I got a new game SplinterCell3D-Pal and I downloaded the save and it was 128KB of 0xFF, except the first 0x10 bytes which were the letter 'Z' (uppercase) --[[User:Elisherer|Elisherer]] 22:41, 15 October 2011 (CEST)

== Fun Facts ==

If you have facts that you found out by looking at the binary files please share them here:

* From one save to another the game backups the last files that were in the partition and the entire image header in "random" locations.. --[[User:Elisherer|Elisherer]] 22:41, 15 October 2011 (CEST)

== Tools ==

* [https://github.com/wwylele/save3ds save3ds] supports reading and modifying savegames, extdata and title database in FUSE filesystem or batch extracting/importing.
* [https://github.com/3dshax/3ds/tree/master/3dsfuse 3dsfuse] supports reading and modifying savegames. In the mounted FUSE filesystem, the /output.sav is the raw FLASH save-image. When the save was modified, a separate tool to update the CMAC must be used with /clean.sav, prior to writing output.sav to a gamecard. (This is an old tool that doesn't handle the savegame format correctly. --[[User:Wwylele|Wwylele]] ([[User talk:Wwylele|talk]]) 16:13, 2 December 2019 (CET))
* [[3DSExplorer]] supports reading of savegames, it doesn't support reading the new encrypted savegames and maybe in the future it will support modifying (some of the modyfing code is already implemented).
* [https://github.com/wwylele/3ds-save-tool wwylele's 3ds-save-tool] supports extracting files from savegames and extdata. It properly reconstructs data from the DPFS tree and extracts files in directories hierarchy.

[[セーブデータ|Japanese]]

Inner FAT

2019-11-28T03:15:44Z

Aspargas2: /* Mention which extdata device files use external IVFC level 4 */

This page describes a common FAT-like file system used in [[Savegames]], [[Extdata]] and [[Title Database]]. This file system format has several variants depending on which kind of data it stores. All the three kinds of data that use this file system structure also happen to use the [[DISA and DIFF]] container as well, but there is no direct relationship between the file system and the DISA/DIFF container. All data formats described here is in the inner data of the DISA/DIFF container (i.e. IVFC level 4). Please refer to the DISA/DIFF page for how to unwrap it first before trying to extract the file system.

== Overview ==

The file system consists of the following components:
* header
* directory hash table
* file hash table
* file allocation table
* directory entry table
* file entry table
* data region

The file allocation table (FAT) forms several linked lists inside, each of which represents a "file" allocated in the data region. Please refer to the File Allocation Table section below for more detail. In some variants, the directory entry table and the file entry table are also allocated as two special "files" in the data region, managed by the FAT, while in others they are stand-alone tables located outside the data region.

== Layout Variants ==
Four variants of the file system layout has been identified. A summary diagram can be found here: [https://github.com/wwylele/3ds-save-tool/raw/master/inner-fat.png]

=== Savegame, <code>duplicate data = true</code> ===

Such savegame is a single DISA container that only has one partition which is always configured as external IVFC level 4 disabled (see [[DISA and DIFF|DISA]] format for details). All components are stored in this partition as

* filesystem header at the beginning
* directory hash table
* file hash table
* file allocation table
* data region
** directory entry table is allocated inside data region
** file entry table as well
** all file data is also allocated here

In this layout, all data is duplicated by DISA's DPFS tree, which is what the parameter <code>duplicate data</code> implies.

=== Savegame, <code>duplicate data = false</code> ===
Such savegame is a single DISA container that has two partitions. Partition A is always configured as external IVFC level 4 disabled, and partition B is configured as it enabled. Components are stored among the two partitions as

* Partition A
** filesystem header at the beginning.
** directory hash table
** file hash table
** (stand-alone) file allocation table
** (stand-alone) directory entry table
** file entry table
* Partition B
** used as data region entirely, and only has file data allocated.

In this layout, all file system metadata is duplicated by partition A DPFS tree, but file data is not as partition B has external IVFC level 4.

=== Extdata ===
An extdata consists of several DIFF containers (device files), among which the special device file <code>00000000/00000001</code> contains the inner FAT system, while other devices contains normal subfiles of the extdata. Please refer to [[Extdata]] for detail. The special file <code>00000000/00000001</code> contists of the following components

* filesystem header at the beginning
* directory hash table
* file hash table
* file allocation table (degenerate, because the data region only has two "files": the directory entry table and the file entry table)
* data region
** directory entry table allocated inside data region
** file entry table as well
** normal subfiles are NOT in the data region. They are in their DIFF containers instead.

The special file <code>00000000/00000001</code> is configured as external IVFC level 4 disabled, and all other device files are configured as it enabled.

=== Title database ===
All [[Title Database]] files are DIFF containers. Except for <code>certs.db</code>, all of them uses this filesystem in the DIFF inner data, which consists of

* database-specific pre-header at the beginning (See [[Title Database]])
* filesystem header
* directory Hash Table (degenerate and always has only one bucket, as there is only one directory for "root")
* file Hash Table
* file allocation table
* data region
** directory entry table allocated inside data region (degenerate, as there is only one directory for "root")
** file entry table as well
** title entries (title info or ticket) are allocated as normal files in the data region as well.

== Filesystem Header ==
Offsets listed in the table below are all relative to the beginning of the header, while all "starting block index" are relative to the beginning of data region. This is especially important for title database, as the offsets doesn't count the pre header.
{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| Magic ("SAVE" for savegame; "BDRI" for title database; "VSXE" for extdata)
|-
| 0x04
| 4
| Version (0x40000 for savegame; 0x30000 for title database and extdata)
|-
| 0x08
| 8
| Filesystem Information offset (Y, =0x20 for savegame and title database, =0x138 for extdata)
|-
| 0x10
| 8
| Filesystem image size in blocks (including pre header for title database)
|-
| 0x18
| 4
| Filesystem Image block size
|-
| 0x1C
| 4
| Padding
|-
| 0x20
| 0x118 in total
| Below is additional data for extdata. Not present in savegame or title database
|-
| 0x20
| 8
| Unknown
|-
| 0x28
| 4
| 'Action' made on most recently mounted Extdata image
|-
| 0x2C
| 4
| Unknown
|-
| 0x30
| 4
| ID of most recently mounted Extdata image
|-
| 0x34
| 4
| Unknown
|-
| 0x38
| 0x100
| Mount path, from most recently mounted Extdata image
|-
| Y
| 0x68 in total
| Below is Filesystem Information
|-
| Y + 0x00
| 4
| Unknown
|-
| Y + 0x04
| 4
| Data region block size
|-
| Y + 0x08
| 8
| Directory hash table offset
|-
| Y + 0x10
| 4
| Directory hash table bucket count (=1 for title database)
|-
| Y + 0x14
| 4
| Padding
|-
| Y + 0x18
| 8
| File hash table offset
|-
| Y + 0x20
| 4
| File hash table bucket count
|-
| Y + 0x24
| 4
| Padding
|-
| Y + 0x28
| 8
| File allocation table offset
|-
| Y + 0x30
| 4
| File allocation table entry count
(excluding the leading 0th entry. See below)
|-
| Y + 0x34
| 4
| Padding
|-
| Y + 0x38
| 8
| Data region offset
(0 for savegame <code>duplicate data = false</code> layout, as the data region is in partition B for that layout)
|-
| Y + 0x40
| 4
| Data region block count
(= File allocation table entry count)
|-
| Y + 0x44
| 4
| Padding
|-
| Y + 0x48
| 8
| for savegame <code>duplicate data = false</code> layout: directory entry table offset;
otherwise: u32 directory entry table starting block index + u32 directory entry table block count
|-
| Y + 0x50
| 4
| Maximum directory count, excluding the mandatory "root" directory
(=1 for title database, but that 1 free directory slot is never used)
|-
| Y + 0x54
| 4
| Padding
|-
| Y + 0x58
| 8
| for savegame <code>duplicate data = false</code> layout: file entry table offset;
otherwise: u32 file entry table starting block index + u32 file entry table block count
|-
| Y + 0x60
| 4
| Maximum file count
|-
| Y + 0x64
| 4
| Padding
|}

* For savegames, the file/directory bucket count & maximum count are specified by the parameters of [[FS:FormatSaveData]] or [[FS:CreateSystemSaveData]].
* For extdata, the maximum file/directory count are specified by the parameters of [[FS:CreateExtSaveData]]. The bucket count is likely calculated by the system.
* Directory & file entry tables are allocated in the data region as if they are two normal files (except for savegame <code>duplicate data = false</code> layout). However, only continuous allocation has been observed, so directly reading block_count * block_size bytes from data_region + starting_block_index * block_size should be safe.
* For title database (except for ticket), the range specified for data region seems overflow the file end by 0x80 bytes, which is exactly the size of the pre header. This makes it as if the data region offset should be relative to the pre header instead of the BDRI header. However, further investigation on the directory/file table allocated inside the data region shows that the data region offset is indeed relative to the BDRI header. It might be a bug in 3DS that the title database files miss 0x80-byte space at the end.

== Directory Entry Table ==

The directory entry table is an array of the entry type shown below. It describes the directory hierarchy of the file system. There are two variants of the directory entry type, and a dummy entry type.

=== Savegame/Extdata Variant===
{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| Parent directory index. 0 for root
|-
| 0x04
| 16
| ASCII directory name in. All zero for root
|-
| 0x14
| 4
| Next sibling directory index. 0 if this is the last one
|-
| 0x18
| 4
| First subdirectory index. 0 if not exists
|-
| 0x1C
| 4
| First file index in file entry table. 0 for empty directory
|-
| 0x20
| 4
| Padding / zero?
|-
| 0x24
| 4
| Index of the next directory in the same hash table bucket. 0 if this is the last one
|}

=== Title Database Variant===
Because title database only has one directory for "root", its directory entry table degenerates into many zeros whose structure is not recognizable. The size of one entry here is guessed.
{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| Parent directory index = 0 for root
|-
| 0x04
| 4
| Next sibling directory index = 0 because this is the last one
|-
| 0x08
| 4
| First subdirectory index = 0 because there is no subdirectory
|-
| 0x0C
| 4
| First file index in file entry table. 0 for empty directory
|-
| 0x10
| 12
| Padding / zero?
|-
| 0x1C
| 4
| Index of the next directory in the same hash table bucket = 0 because there is no other directory
|}

=== Dummy Entry===
There are also some dummy entries in the array
{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| Current Total entry count
|-
| 0x04
| 4
| Maximum entry count = maximum directory count + 2
|-
| 0x08
| 28/20
| Padding / All zero
|-
| 0x24/0x1C
| 4
| Index of the next dummy entry. 0 if this is the last one
|}

The 0-th entry of the array is always a dummy entry, which functions as the head of the dummy entry linked list. The 1-st entry of the array is always the root. Therefore maximum entry count is two more than maximum directory count. Dummy entries are left there when deleting directories, and reserved for future use.

== File Entry Table ==

The file entry table is an array of the entry type shown below. It contains information for each file. There are three variants of the file entry type, and a dummy entry type.

=== Savegame Variant ===
{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| Parent directory index in directory entry table
|-
| 0x04
| 16
| ASCII file name
|-
| 0x14
| 4
| Next sibling file index. 0 if this is the last one
|-
| 0x18
| 4
| Padding
|-
| 0x1C
| 4
| First block index in data region. 0x80000000 if the file is just created and has no data.
|-
| 0x20
| 8
| File Size
|-
| 0x28
| 4
| Padding?
|-
| 0x2C
| 4
| Index of the next file in the same hash table bucket. 0 if this is the last one
|}

=== Extdata Variant ===
{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| Parent directory index in directory entry table
|-
| 0x04
| 16
| ASCII file name
|-
| 0x14
| 4
| Next sibling file index. 0 if this is the last one
|-
| 0x18
| 4
| Padding
|-
| 0x1C
| 4
| Always 0x80000000
|-
| 0x20
| 8
| Unique identifier. See [[Extdata]]
|-
| 0x28
| 4
| Padding?
|-
| 0x2C
| 4
| Index of the next file in the same hash table bucket. 0 if this is the last one
|}

=== Title database Variant ===

{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| Parent directory index in directory entry table
|-
| 0x04
| 8
| Title ID
|-
| 0x0C
| 4
| Next sibling file index. 0 if this is the last one
|-
| 0x10
| 4
| Padding
|-
| 0x14
| 4
| First block index in data region.
|-
| 0x18
| 8
| File size
|-
| 0x20
| 8
| Padding?
|-
| 0x28
| 4
| Index of the next file in the same hash table bucket. 0 if this is the last one
|}

=== Dummy Entry ===
Like directory entry table, file entry table also has some dummy entries:

{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| Current total entry count
|-
| 0x04
| 4
| Maximum entry count = maximum file count + 1
|-
| 0x08
| 36/32
| Padding / All zero
|-
| 0x2C/0x28
| 4
| Index of the next dummy entry. 0 if this is the last one
|}

The 0-th entry of the array is always a dummy entry, which functions as the head of the dummy entry linked list. Therefore maximum entry count is one more than maximum file count. Dummy entries are left there when deleting files, and reserved for future use.

== Directory Hash Table & File Hash Table ==

This is a u32 array of size = bucket count, each of which is an index to the directory / file entry table. The directory / file name is hashed and its entry index is put to the corresponding bucket. If there is already a directory/file entry in the bucket, then it appends to the linked list formed by <code>Index of the next directory/file in the same hash table bucket</code> field in the directory/file entry table. i.e. this is a hash table using separate chaining with linked lists

The hash function takes the parent index and the ASCII name (or title ID for title database) as key. The function is equivalent to

<pre>uint32_t GetBucket(
char name[16 or 8], // For savegame/extdata, this takes all 16 bytes including trailing zeros; For title database, this is the 8-byte title ID
uint32_t parent_dir_index,
uint32_t bucket_count
) {
uint32_t hash = parent_dir_index ^ 0x091A2B3C;
for (int i = 0; i < 4 or 2; ++i) {
hash = (hash >> 1) | (hash << 31);
hash ^= (uint32_t)name[i * 4]
hash ^= (uint32_t)name[i * 4 + 1] << 8
hash ^= (uint32_t)name[i * 4 + 2] << 16
hash ^= (uint32_t)name[i * 4 + 3] << 24
}
return hash % bucket_count;
}
</pre>

== File Allocation Table ==

The file allocation table is an array of a 8-byte entry shown below. The array size is actually ''one larger than'' the size recorded in the filesystem header. Each entry corresponds to a block in the data region (the block size is defined in filesystem header). However, the 0th entry corresponds to nothing, so the corresponding block index is off by one. e.g. entry 31 in this table corresponds to block 30 in the data region.

{| class="wikitable" border="1"
! Offset
! Length
! Description
|-
| 0x00
| 4
| bit[0:30]: Index U; bit[31]: Flag U
|-
| 0x04
| 4
| bit[0:30]: Index V; bit[31]: Flag V
|}

Entries in this table forms several chains, representing how blocks in the data region should be linked together. However, unlike normal FAT systems, which uses chains of entries, 3DS savegames use chain of ''nodes''. Each node spans one or multiple entries.

One node spanning <code>n</code> entries starting from <code>FAT[k]</code> is in the following format:

<pre>FAT[k + 0]:
Index_U = index of the first entry of the previous node. 0 if this is the first node.
Index_V = index of the first entry of the next node. 0 if this is the last node.
Flag_U set if this is the first node.
Flag_V set if this node has multiple entries.

FAT[k + 1]:
Index_U = k (the first entry index of this node)
Index_V = k + n - 1 (the last entry index of this node)
Flag_U always set
Flag_V always clear

FAT[k + 2] ~ FAT[k + n - 2]:
All these entries are uninitialized

FAT[k + n - 1]:
Index_U = k
Index_V = k + n - 1
Flag_U always set
Flag_V always clear
(Same values as FAT[k + 1])
</pre>
* Note: all indices above are entry indices (block index + 1)

All free blocks that are not allocated to any files also form a node chain in the allocation table. The head index of this "free chain" is recorded in <code>FAT[0].Index_V</code>. Other fields of <code>FAT[0]</code> are all zero

Here is an example: [https://raw.githubusercontent.com/wwylele/3ds-save-tool/master/disa-fat.png]

For extdata, because only two "files" (directory and file entry tables) are allocated in the data region, and their size never changes once the extdata is created, they are guaranteed continuous in the data region, and the FAT degenerates to two big nodes. Therefore, instead of going through FAT, the offset and size of directory / file entry table can be found directly by offset = entry_table_starting block * data_region_block_size + data_region_offset and size = entry_table_block_count * data_region_block_size.