3dbrew - User contributions [en]

Category:File formats

2012-04-26T07:06:32Z

Jl12: cdi

The following is a list of known file formats used by the 3DS.

=== Applications ( any executable code ) ===

.[[CCI]] - Cart image. Burned into a ROM (or loaded by official debugging hardware). These are also the actual format of ROM dumps, and the response of read requests between a 3DS and a cartridge.

.[[CXI]] - Executable image. Similar to above. The difference is CXI applications are installed onto [thus ran from] NAND.

.[[CIA]] - (CTR Importable Archive) It is the application compiled into an archive, ready to be installed to a designated location. A .CIA file can be extracted to install applications to the, CTR NAND, TWL NAND (part of the NAND used by DSi applications), and the SD card.

.[[CCI|CSU]] - System Update. Format varies slightly with revisions.

.CFA - CTR File Archive - Externalized ROM-FS. CXI data and ROMFS data can be separated into a list of external files instead of compiled into just 1 CXI image (Normally not used). Lib states this is similar to a CIA, a little like an archive of a CIA. Fortunately lib has some info on this format. CFA files are basically multiple packed CIAs. CFAs are used when the CCI file includes the child device distributed with download play.

.NSA - Archive used by several of the communication protocols in the 3DS.

.RSF - Descriptive data used when outputting a CCI/CXI file. Specifies options such as: title, save type, and so on.

.AXF - Pre-assembled ARM code. before being linked into a CCI/CXI format. They're practically ARM specific ELF files.

.CDI - (CTR Development Image) CDI files are system processes which other types of applications depend on for access to various other lower level functions. CDI are normally the same titles as listed in a CXI header's dependency list, they are just compiled to a different format. The difference is that CDI is used for a different (test) environment. They're loaded into hardware debugger's memory, along with the 2 cores in order to execute.

.CIP - (CTR Initial Process)

.[[BCWAV]] - CTR waveform file format

.[[CBMD]] - CTR binary banner model. Archive file before being made into a CTR banner for games or other applications.

.BNR - Simply contains a .[[CBMD]] and a .[[BCWAV]], in that order without any header or anything else.

=== Filesystem ===

The 3DS filesystem requires absolute paths. It can handle either short (8.3) and long (255 char maximum) file names.

== MPO (Multi-Picture Object Format) ==
Document describing the file format used in mpo files:
http://www.cipa.jp/english/hyoujunka/kikaku/pdf/DC-007_E.pdf

[[MPO|Nintendo's MPO Specifications]]

Talk:Flash Filesystem

2012-04-25T22:39:20Z

Jl12:

* Can't help with nand reading but lib references give some indication of the filesystem.

{| class="wikitable" border="1"
|-
|nand:/extdata
|-
|nand:/ro/
|-
|nand:/ro/sys/HWCAL0.dat
|-
|nand:/ro/sys/HWCAL1.dat
|-
|nand:/rw/
|-
|nand:/rw/sys/
|-
|nand:/rw/sys/config
|-
|nand:/rw/sys/updater.log
|-
|nand:/rw/sys/PlayHistory.dat
|-
|nand:/rw/sys/PedometerHistory.dat
|-
|nand:/rw/sys/LocalFriendCodeSeed
|-
|nand:/rw/sys/SecureInfo
|-
|nand:/title
|-
|nand:/title/%08x/%08x
|-
|nand:/title/%08x/%08x/%08x.app
|-
|nand:/title/%08x/%08x/title.tmd
|-
|nand:/ticket
|-
|nand:/ticket/%08x/%08x.tik
|-
|nand:/tmp
|}

Title list

2012-04-24T10:08:32Z

Jl12:

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The same [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ update server] is being used as was with the DSi, however a new common key has been introduced.

The organization of Title IDs has not been documented fully yet. It's unknown how regions are determined in titleids if at all though there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi).

'''TitleID Structure''': 0xCCCCTTTTLLLLLLRR

* CCCC defines the target console (4=3DS, i.e. 1=[http://wiibrew.org/wiki/Title_database Wii])
* TTTT defines the type of the title
* LLLLLLLL are the 3 high bytes in the TitleID low (which are documented here in the first field of the tables)
* RR contains various info including title type (00=App, 01=Demo, 02/03=System Applet)

'''Versions''': v## = 0xHHHH = 0bBBBBBBBB...

* The version major,minor,etc can be extracted from the version number by converting the 16 bit number to binary
* 6 bits : Major
* 6 bits : Minor
* 2 bits & 2 bits : Unknown...
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that it's HomeMenu v2.1.0-?...

== 00040010 - System Applications ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Status
|-
| 00020000
| JPN
| [[System Settings]]
| v0, v1027, v2062
| Active
|-
| 00021000
| USA
| [[System Settings]]
| v0, v1027, v2062
| Active
|-
| 00022000
| EUR
| [[System Settings]]
| v0, v1027, v2062
| Active
|-
| 00020100
| JPN
| [[Download Play]]
| v0, v1026
| Active
|-
| 00021100
| USA
| [[Download Play]]
| v0, v1026
| Active
|-
| 00022100
| EUR
| [[Download Play]]
| v0, v1026
| Active
|-
| 00020200
| JPN
| [[Activity Log]]
| v0, v1026, v2054
| Active
|-
| 00021200
| USA
| [[Activity Log]]
| v0, v1026, v2054
| Active
|-
| 00022200
| EUR
| [[Activity Log]]
| v0, v1026, v2054
| Active
|-
| 00020300
| JPN
| [[Health and Safety Information]]
| v0
| Active
|-
| 00021300
| USA
| [[Health and Safety Information]]
| v0
| Active
|-
| 00022300
| EUR
| [[Health and Safety Information]]
| v0
| Active
|-
| 00020400
| JPN
| [[Nintendo 3DS Camera]]
| v0, v16, v1039
| Active
|-
| 00021400
| USA
| [[Nintendo 3DS Camera]]
| v0, v16, v1039
| Active
|-
| 00022400
| EUR
| [[Nintendo 3DS Camera]]
| v0, v16, v1039
| Active
|-
| 00020500
| JPN
| [[Nintendo 3DS Sound]]
| v0, v1027, v2049
| Active
|-
| 00021500
| USA
| [[Nintendo 3DS Sound]]
| v0, v1027, v2049
| Active
|-
| 00022500
| EUR
| [[Nintendo 3DS Sound]]
| v0, v1027, v2049
| Active
|-
| 00020700
| JPN
| [[Mii Maker]]
| v0, v1026
| Active
|-
| 00021700
| USA
| [[Mii Maker]]
| v0, v1026
| Active
|-
| 00022700
| EUR
| [[Mii Maker]]
| v0, v1026
| Active
|-
| 00020800
| JPN
| [[StreetPass Mii Plaza]]
| v0, v1027, v2048, v3087, v4096
| Active
|-
| 00021800
| USA
| [[StreetPass Mii Plaza]]
| v0, v1027, v2048, v3087, v4096
| Active
|-
| 00022800
| EUR
| [[StreetPass Mii Plaza]]
| v0, v1027, v2048, v3087, v4096
| Active
|-
| 00020900
| JPN
| [[eShop]]
| v4, v1026, 2058
| Active
|-
| 00021900
| USA
| [[eShop]]
| v4, v1026, v2058
| Active
|-
| 00022900
| EUR
| [[eShop]]
| v4, v1026, v2058
| Active
|-
| 00020A00
| JPN
| Web browser
| v4, v1035
| Active
|-
| 00021A00
| USA
| Web browser
| v4, v1035
| Active
|-
| 00022A00
| EUR
| Web browser
| v4, v1035
| Active
|-
| 00020B00
| JPN
| [[Nintendo Zone]]
| v0, v1034
| Active
|-
| 00021B00
| USA
| [[Nintendo Zone]]
| v0, v1034
| Active
|-
| 00022B00
| EUR
| [[Nintendo Zone]]
| v0, v1034
| Active
|-
| 00020D00
| JPN
| ?
| v0, v1028
| Active
|-
| 00021D00
| USA
| ?
| v0, v1028
| Active
|-
| 00022D00
| EUR
| ?
| v0, v1028
| Active
|-
| 00020E00
| JPN
| ?
| v0, v1027
| Active
|-
| 00021E00
| USA
| ?
| v0, v1027
| Active
|-
| 00022E00
| EUR
| ?
| v0, v1027
| Active
|-
| 00020F00
| JPN
| ?
| v0, v1024
| Active
|-
| 00021F00
| USA
| ?
| v0, v1024
| Active
|-
| 00022F00
| EUR
| ?
| v0, v1024
| Active
|-
| 00023000
| JPN
| Promotional video
| v0, v2048
| Stubbed
|-
| 00024000
| USA
| Promotional video
| v0, v2048
| Stubbed
|-
| 00025000
| EUR
| Promotional video
| v0, v2048
| Stubbed
|}

== 0004001B ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| ?
| v0
|-
| 00010702
| ?
| v0
|}

== 00040030 ==
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! Versions
|-
| 00008202
| 00008F02
| 00009802
| SYSMENU
| v0, v1029, v2049, v4111
|-
| 00008402
| 00009002
| 00009902
| ?
| v0, v1036
|-
| 00008502
| 00009102
| 00009A02
| ?
| ?
|-
| 00008602
| 00009202
| 00009B02
| ?
| v0, v1026, v2048
|-
| 00008702
| 00009302
| 00009C02
| ?
| v0, v1026
|-
| 00008802
| 00009402
| 00009D02
| ?
| v6, v1024
|-
| 00008A02
| 00008A02
| 00008A02
| ?
| v0, v1025, v3072
|-
| 00008D02
| 00009602
| 00009F02
| ?
| v0, v1026, v3082 (EUR v6, v1024, v3082)
|-
| 00008E02
| 00009702
| 0000A002
| ?
| v0, v1029, v2054 (EUR v6, v1024, v2054)
|-
| 0000C002
| ?
| ?
| ?
| v0, v1026, v2053
|-
| 0000C102
| ?
| ?
| ?
| v0, v1026
|-
| 0000C302
| ?
| ?
| ?
| v0, v1024
|-
| 0000C502
| 0000C502
| 0000C502
| ?
| v0, v1026, v2053
|-
| 0000C602
| ?
| ?
| ?
| v5
|-
| ?
| 0000C802
| ?
| ?
| v0, v1026, v2053
|-
| ?
| 0000C902
| ?
| ?
| v0, v1026
|-
| ?
| 0000CB02
| ?
| ?
| v0, v1024
|-
| ?
| 0000CC02
| ?
| ?
| v3
|-
| 0000CD02
| 0000CD02
| 0000CD02
| ?
| v1
|-
| ?
| 0000CE02
| ?
| ?
| v5
|-
| ?
| ?
| 0000D002
| ?
| v0, v1026, v2053
|-
| ?
| ?
| 0000D102
| ?
| v0, v1026
|-
| ?
| ?
| 0000D302
| ?
| v0, v1024
|-
| ?
| ?
| 0000D602
| ?
| v5
|}

== 0004009B ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00010202
| All
| ?
| v0, v2050
|-
| 00010302
| All
| ?
| v0, v2052
|-
| 00010402
| All
| ?
| v0, v1024, v2050
|-
| 00010502
| All
| ?
| v0, v1024, v2048
|-
| 00010602
| All
| ?
| v2
|-
| 00011902
| JPN
| ?
| v0
|-
| 00011402
| USA
| ?
| v0
|-
| 00011202
| EUR
| ?
| v0
|-
| 00012102
| EUR
| ?
| v0, v1026, v2051
|-
| 00012202
| JPN
| ?
| v1026
|-
| 00012302
| USA
| ?
| v1026, v2053
|-
| 00012102
| EUR
| ?
| v1026, v2051
|-
| 00013102
| EUR
| ?
| v1024, v2049
|-
| 00013302
| USA
| ?
| v1024, v2051
|-
| 00016302
| USA
| ?
| v80
|-
| 00017302
| USA
| ?
| v3088
|}

== 000400DB ==

Some of these titleIDs can be found @ offset 0x320 in every [[CCI]].(The region-specific titles here may determine the CCI region)

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00010302
| All
| ?
| v0, v1024, v2052
|-
| 00010502
| All
| ?
| v0, v1024, v2048
|-
| 00016102
| EUR
| ?
| v32, v48, v64, v80, v96
|-
| 00016202
| JPN
| ?
| v32, v48, v64, v80, v96
|-
| 00016302
| USA
| ?
| v32, v48, v64, v80, v96
|-
| 00017102
| EUR
| ?
| v2049, v2069, v3088
|-
| 00017202
| JPN
| ?
| v2049, v2069, v3088
|-
| 00017302
| USA
| ?
| v2049, v2069, v3088
|}

== 00040130 - ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Title Name
! Description
! Versions
|-
| 00001502
| 02_15
| AM ( Application Manager ) - System applet
| v0, v1026, v2053
|-
| 00001503
| 03_15
|
| v0
|-
| 00001602
| 02_16
| Camera - System applet
| v0, v1026, v2048
|-
| 00001702
| 02_17
| Config - System applet
| v0, v1024, v2049
|-
| 00001703
| 03_17
|
| v0
|-
| 00001802
| 02_18
| Codec - system applet
| v0, v1025, v3072
|-
| 00001803
| 03_18
|
| v0
|-
| 00001A02
| 02_1A
| DSP - system applet.
| v0, v1024
|-
| 00001A03
| 03_1A
|
| v0
|-
| 00001B02
| 02_1B
| GPIO - System applet
| v0
|-
| 00001B03
| 03_1B
|
| v0
|-
| 00001C02
| 02_1C
| GSP - System applet
| v0, v1040, v2049, v3075
|-
| 00001C03
| 03_1C
|
| v0
|-
| 00001D02
| 02_1D
| HID - System applet
| v0, v1025, v3072
|-
| 00001D03
| 03_1D
|
| v0
|-
| 00001E02
| 02_1E
| i2c - system applet.
| v0, v1024
|-
| 00001E03
| 03_1E
|
| v0
|-
| 00001F02
| 02_1F
| MCU - System applet
| v0, v1026, v3072
|-
| 00001F03
| 03_1F
|
| v0
|-
| 00002002
| 02_20
| Microphone - system applet
| v0
|-
| 00002102
| 02_21
| PDN - System applet
| v0
|-
| 00002103
| 03_21
|
| v0
|-
| 00002202
| 02_22
| PTM - System applet
| v0, v1026, v3075
|-
| 00002203
| 03_22
|
| v0
|-
| 00002302
| 02_23
| spi - system applet.
| v0, v1025
|-
| 00002303
| 03_23
|
| v0
|-
| 00002402
| 02_24
| Network - System Applet
| v0, v1024, v2052, v4101
|-
| 00002403
| 03_24
|
| v0
|-
| 00002602
| 02_26
| Messaging (NintendoZone) - System Applet
| v0, v1026, v3073
|-
| 00002702
| 02_27
| CSND - System applet
| v0, v1025
|-
| 00002703
| 03_27
|
| v0
|-
| 00002802
| 02_28
| DownloadPlay - System applet
| v0, v1026, v3078
|-
| 00002902
| 02_29
| http - system applet
| v0, v1026, v4099
|-
| 00002903
| 03_29
|
| v0
|-
| 00002A02
| 02_2A
| MP - System applet
| v0
|-
| 00002A03
| 03_2A
|
| v0
|-
| 00002B02
| 02_2B
| NDM - System applet
| v0, v1025, v2049
|-
| 00002C02
| 02_2C
| NIM - System applet
| v0, v1028, v2055
|-
| 00002C03
| 03_2C
|
| v0
|-
| 00002D02
| 02_2D
| NWM ( Network manager? ) - System applet
| v0, v1024, v2052, v4101
|-
| 00002D03
| 03_2D
|
| v0
|-
| 00002E02
| 02_2E
| Sockets - System applet
| v0, v1024, v2053, v3075

|-
| 00002E03
| 03_2E
|
| v0
|-
| 00002F02
| 02_2F
| SSL - System applet.
| v0, v1024, v3072
|-
| 00002F03
| 03_2F
|
| v0
|-
| 00003102
| 02_31
| PS ( Process Manager ) - System applet
| v0, v1025
|-
| 00003103
| 03_31
|
| v0
|-
| 00003202
| 02_32
| FriendsList - System applet
| v0, v1028, v3072
|-
| 00003203
| 03_32
|
| v0
|-
| 00003302
| 02_33
| IR (Infrared) - System applet
| v0, v1026, v3072
|-
| 00003303
| 03_33
|
| v0
|-
| 00003402
| 02_34
| BOSS (SpotPass) System Applet
| v0, v1024, v2053, v4101
|-
| 00003502
| 02_35
| News - System applet
| v0, v1028, v3072
|-
| 00003702
| 02_37
| RO - System applet
| v0
|-
| 00008002
| 02_80
| NS - System applet
| v0, v1028, v3077
|-
| 00008003
| 03_80
|
| v0
|}

== 00040138 ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| v432, v1472, v2516, v3553, v5647
|-
| 00000003
| ( as above )
| v432, v5632
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| v432, v1489, 2565
|-
| 00000202
| AGB_FIRM
| v519
|}

== 00048005 ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 42383841(B88A)
| [[DS Internet]]
| v0, v1025, v2048
|-
| 484E4441(HNDA)
| [[Download Play]]
| v1024
|}

== 0004800F ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, v1026, v3072
|-
| 484E4C41(HNLA)
| ?
| v0
|}

== 00040000 - eShop Titles ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00032600
| EUR/USA
| Pokédex 3D
| v0
|-
| 00034700
| ?
| ?
| v0
|-
| 00040800
| ?
| ?
| v16
|-
| 00040900
| ?
| ?
| v16
|-
| 00040A00
| ?
| ?
| v16
|-
| 00040B00
| ?
| ?
| v16
|-
| 00040E00
| ?
| ?
| v0
|-
| 00041000
| ?
| ?
| v0
|-
| 00041100
| ?
| ?
| v0
|-
| 00041300
| ?
| ?
| v0
|-
| 00041500
| ?
| ?
| v0
|-
| 00041700
| USA
| Kirby's Dream Land
| v0
|-
| 00041800
| ?
| ?
| v0
|-
| 00041900
| EUR
| Kirby's Dream Land
| v0
|-
| 00041D00
| ?
| ?
| v0
|-
| 00041E00
| ?
| ?
| v0
|-
| 00041F00
| ?
| ?
| v0
|-
| 00042400
| ?
| ?
| v0
|-
| 00042600
| ?
| ?
| v0
|-
| 00042700
| ?
| ?
| v0
|-
| 00042800
| EUR
| Zelda: Link's Awakening DX
| v0
|-
| 00042900
| ?
| ?
| v16
|-
| 00042A00
| ?
| ?
| v0
|-
| 00042C00
| ?
| ?
| v0
|-
| 00042E00
| ?
| ?
| v0
|-
| 00043000
| ?
| ?
| v0
|-
| 00045C00
| JPN
| 3D Classics Excitebike
| v0
|-
| 00046C00
| EUR
| 3D Classics Excitebike
| v0
|-
| 00048900
| ?
| ?
| v0
|-
| 00049900
| ?
| ?
| v0
|-
| 00049D00
| ?
| ?
| v0
|-
| 0004A900
| ?
| ?
| v0
|-
| 0004AA00
| USA
| [[Nintendo Video]]
| v0
|-
| 0004AB00
| EUR
| [[Nintendo Video]]
| v0
|-
| 0004B400
| ?
| ?
| v0
|-
| 0004D500
| ?
| ?
| v0
|-
| 0004E700
| ?
| ?
| v16
|-
| 0004EF00
| ?
| ?
| v0
|-
| 0004F300
| ?
| ?
| v0
|-
| 0004FA00
| ?
| ?
| v0
|-
| 0004FD00
| ?
| ?
| v0
|-
| 00051700
| USA
| [[Swapnote]]
| v0
|-
| 00051800
| EUR
| [[Swapnote|Letter Box]]
| v0
|-
| 00052600
| ?
| ?
| v32
|-
| 00052700
| ?
| ?
| v16
|-
| 00052800
| ?
| ?
| v0, v1024
|-
| 00052900
| ?
| ?
| v32
|-
| 00052A00
| ?
| ?
| v0
|-
| 00052D00
| ?
| ?
| v16
|-
| 00054200
| USA
| 3D Classics Kid Icarus
| v0
|-
| 00054300
| USA
| 3D Classics Excitebike
| v0
|-
| 00054700
| USA
| 3D Classics Xevious
| v0
|-
| 00054E00
| EUR
| 3D Classics Excitebike
| v0, v1024
|-
| 00055800
| ?
| ?
| v16
|-
| 00057700
| USA
| Netflix
| v0
|-
| 00059200
| ?
| ?
| v16
|-
| 0005AD00
| JPN
| Kid Icarus Uprising E3 Video
| v0
|-
| 0005AE00
| USA
| Kid Icarus Uprising E3 Video
| v0
|-
| 0005AF00
| JPN
| Paper Mario E3 Video
| v0
|-
| 0005B000
| USA
| Paper Mario E3 Video
| v0
|-
| 0005B100
| JPN
| Mario Kart E3 Video
| v0
|-
| 0005B200
| USA
| Mario Kart E3 Video
| v0
|-
| 0005B300
| JPN
| Animal Crossing E3 Video
| v0
|-
| 0005B400
| USA
| Animal Crossing E3 Video
| v0
|-
| 0005B500
| JPN
| Luigi's Mansion 2 E3 Video
| v0
|-
| 0005B600
| USA
| Luigi's Mansion 2 E3 Video
| v0
|-
| 0005B700
| JPN
| Zelda Ocarina of Time E3 Video
| v0
|-
| 0005B800
| USA
| Zelda Ocarina of Time E3 Video
| v0
|-
| 0005B900
| JPN
| Super Mario E3 Video
| v0
|-
| 0005BA00
| USA
| Super Mario E3 Video
| v0
|-
| 0005BB00
| JPN
| MGS Snake Eater 3D E3 Video
| v0
|-
| 0005BC00
| USA
| MGS Snake Eater 3D E3 Video
| v32
|-
| 0005BD00
| JPN
| Biohazard Revelations E3 Video
| v16
|-
| 0005BE00
| USA
| Resident Evil Revelations E3 Video
| v32
|-
| 0005BF00
| JPN
| Starfox 64 3D E3 Video
| v0
|-
| 0005C000
| USA
| Starfox 64 3D E3 Video
| v0
|-
| 0005EA00
| EUR
| Green Lantern 3D Trailer Video
| v0
|-
| 0005F000
| USA
| Green Lantern 3D Trailer Video
| v0
|-
| 0005F800
| ?
| ?
| v0
|-
| 0005F900
| ?
| ?
| v0
|-
| 0005FC00
| ?
| ?
| v0
|-
| 0005FD00
| ?
| ?
| v0
|-
| 00060000
| ?
| ?
| v0
|-
| 00060F00
| EUR
| Pyramids
|
|-
| 00062400
| EUR
| Kid Icarus Uprising E3 Video
| v0
|-
| 00062700
| EUR
| Paper Mario E3 Video
| v0
|-
| 00062A00
| EUR
| Mario Kart E3 Video
| v0
|-
| 00062B00
| ?
| ?
| v0
|-
| 00062C00
| ?
| ?
| v0
|-
| 00062D00
| EUR
| Animal Crossing E3 Video
| v0
|-
| 00063000
| EUR
|Luigi's Mansion 2 E3 Video
| v0
|-
| 00063300
| EUR
| Zelda Ocarina of Time E3 Video
| v0
|-
| 00063400
| ?
| ?
| v0
|-
| 00063500
| ?
| ?
| v0
|-
| 00063600
| EUR
| Super Mario E3 Video
| v0
|-
| 00063700
| ?
| ?
| v0
|-
| 00063800
| ?
| ?
| v0
|-
| 00063900
| EUR
| MGS Snake Eater 3D E3 Video
| v0
|-
| 00063C00
| EUR
| Resident Evil Revelations E3 Video
| v0
|-
| 00063D00
| ?
| ?
| v0
|-
| 00063E00
| ?
| ?
| v0
|-
| 00063F00
| EUR
| Starfox 64 3D E3 Video
| v0
|-
| 00064000
| ?
| ?
| v0
|-
| 00064100
| ?
| ?
| v0
|-
| 00066300
| USA
| Mighty Switch Force
| v0
|-
| 0006E500
| USA
| Super Mario Bros.
| v0
|-
| 0006E600
| EUR
| Super Mario Bros.
| v0
|-
| 0006EE00
| USA
| Metroid
| v0
|-
| 0006EF00
| EUR
| Metroid
| v0
|-
| 0006F100
| USA
| The Legend of Zelda
| v0
|-
| 0006F200
| EUR
| The Legend of Zelda
| v0
|-
| 0006F700
| USA
| Wrecking Crew
| v0
|-
| 0006F800
| EUR
| Wrecking Crew
| v0
|-
| 0006FA00
| USA
| NES Open Tournament Golf
| v0
|-
| 0006FB00
| EUR
| NES Open Tournament Golf
| v0
|-
| 00070000
| USA
| Donkey Kong Jr.
| v0
|-
| 00070100
| EUR
| Donkey Kong Jr.
| v0
|-
| 00070300
| USA
| Balloon Fight
| v0
|-
| 00070400
| EUR
| Balloon Fight
| v0
|-
| 00070600
| USA
| Ice Climber
| v0
|-
| 00070700
| EUR
| Ice Climber
| v0
|-
| 00070900
| USA
| Zelda II The Adventure of Link
| v0
|-
| 00070A00
| EUR
| Zelda II The Adventure of Link
| v0
|-
| 00071200
| USA
| Yoshi
| v0
|-
| 00071300
| EUR
| Yoshi
| v0
|-
| 00072400
| EUR
| Ambassador Certificate
| v0
|-
| 00072500
| USA
| Ambassador Certificate
| v0
|-
| 00074900
| USA
| F-Zero: Maximum Velocity
| v0
|-
| 00074C00
| USA
| Mario Kart Super Circuit
| v0
|-
| 00074F00
| USA
| Wario Land 4
| v0
|-
| 00075300
| USA
| Yoshi's Island: Super Mario Advance 3
| v0
|-
| 00075600
| USA
| Metroid Fusion
| v0
|-
| 00075900
| USA
| WarioWare Inc: Mega Microgame$
| v0
|-
| 00075C00
| USA
| Kirby & The Amazing Mirror
| v0
|-
| 00075D00
| EUR
| Kirby & The Amazing Mirror
| v0
|-
| 00076700
| USA
| Mario vs Donkey Kong
| v0
|-
| 00076A00
| USA
| Fire Emblem: The Sacred Stones
| v0
|-
| 00076D00
| USA
| The Legend of Zelda: The Minish Cap
| v0
|-
| 00079700
| USA
| Preview Video: ?
| v0
|-
| 00079800
| USA
| Preview Video: ?
| v0
|-
| 00079900
| USA
| Preview Video: ?
| v0
|-
| 00079A00
| USA
| Preview Video: ?
| v0
|-
| 00079B00
| USA
| Preview Video: ?
| v0
|-
| 00079C00
| USA
| Preview Video: Animal Crossing
| v0
|-
| 00079D00
| USA
| Preview Video: ?
| v0
|-
| 0007AB00
| EUR
| Eurosport (looks/acts like Nintendo Video)
| v0
|}

== 00040000 - Retail Titles ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00030100
| USA
| Kid Icarus - Uprising
| v0
|-
| 00030200
| EUR
| Kid Icarus - Uprising
| v0
|-
| 00030500
| JPN
| Super Street Fighter IV - 3D Edition
| v0
|-
| 00030700
| EUR
| Mario Kart 7
| v0
|-
| 00030800
| USA
| Mario Kart 7
| v0
|-
| 00030C00
| EUR
| Nintendogs + Cats - Golden Retriever & New Friends
| v0
|-
| 00030D00
| USA
| Nintendogs + Cats - Golden Retriever & New Friends
| v0
|-
| 00031200
| USA
| Nintendogs + Cats - French Bulldog & New Friends
| v0
|-
| 00031700
| USA
| Nintendogs + Cats - Toy Poodle & New Friends
| v0
|-
| 00031C00
| USA
| Pilotwings Resort
| v0
|-
| 00031D00
| EUR
| Pilotwings Resort
| v0
|-
| 00031F00
| JPN
| Layton Kyouju to Kiseki no Kamen
| v0
|-
| 00032300
| EUR
| Steel Diver
| v0
|-
| 00032400
| USA
| Steel Diver
| v0
|-
| 00032800
| JPN
| Ridge Racer 3D
| v0
|-
| 00032D00
| USA
| Super Street Fighter IV - 3D Edition
| v0
|-
| 00033500
| USA
| Legend of Zelda, The - Ocarina of Time 3D
| v0
|-
| 00033600
| EUR
| Legend of Zelda, The - Ocarina of Time 3D
| v0
|-
| 00033800
| EUR
| Puzzle Bobble Universe
| v0
|-
| 00033900
| EUR
| Rayman 3D
| v0
|-
| 00033A00
| EUR
| Tom Clancy's Splinter Cell 3D
| v0
|-
| 00033B00
| EUR
| Ridge Racer 3D
| v0
|-
| 00033C00
| EUR
| Super Street Fighter IV - 3D Edition
| v0
|-
| 00033D00
| EUR
| Sims 3, The
| v0
|-
| 00033E00
| EUR
| Madden NFL Football
| v0
|-
| 00034B00
| EUR
| Combat of Giants - Dinosaurs 3D
| v0
|-
| 00034C00
| USA
| Asphalt 3D
| v0
|-
| 00034D00
| USA
| Samurai Warriors - Chronicles
| v0
|-
| 00034F00
| USA
| Dead or Alive - Dimensions
| v0
|-
| 00035100
| USA
| Combat of Giants - Dinosaurs 3D
| v0
|-
| 00035300
| USA
| Green Lantern - Rise of the Manhunters
| v0
|-
| 00035400
| USA
| LEGO Star Wars III - The Clone Wars
| v0
|-
| 00035500
| USA
| Madden NFL Football
| v0
|-
| 00035600
| USA
| Pro Evolution Soccer 2011 3D
| v0
|-
| 00035700
| USA
| Rabbids - Travel in Time 3D
| v0
|-
| 00035800
| USA
| Ridge Racer 3D
| v0
|-
| 00035900
| USA
| Resident Evil The Mercenaries 3D
| v0
|-
| 00035A00
| USA
| Tom Clancy's Ghost Recon - Shadow Wars
| v0
|-
| 00035E00
| USA
| Bust-A-Move Universe
| v0
|-
| 00036000
| USA
| Driver Renegade 3D
| v0
|-
| 00036100
| USA
| James Noir's Hollywood Crimes
| v0
|-
| 00036300
| USA
| Pac-Man & Galaga Dimensions
| v0
|-
| 00036400
| USA
| Rayman 3D
| v0
|-
| 00036500
| USA
| Sims 3, The
| v0
|-
| 00036600
| USA
| DualPenSports
| v0
|-
| 00036800
| USA
| Doctor Lautrec and the Forgotten Knights
| v0
|-
| 00036900
| USA
| Frogger 3D
| v0
|-
| 00036E00
| USA
| Skylanders - Spyro's Adventure
| v0
|-
| 00037100
| USA
| Crush 3D
| v0
|-
| 00037400
| USA
| LEGO Pirates of the Caribbean - The Video Game
| v0
|-
| 00037500
| EUR
| Tom Clancy's Ghost Recon - Shadow Wars
| v0
|-
| 00037600
| EUR
| Asphalt 3D
| v0
|-
| 00037700
| EUR
| Rabbids 3D
| v0
|-
| 00037800
| EUR
| Driver Renegade 3D
| v0
|-
| 00037900
| EUR
| Adventures of Tintin, The - The Secret of the Unicorn
| v0
|-
| 00037A00
| EUR
| Michael Jackson - The Experience 3D
| v0
|-
| 00037B00
| EUR
| James Noir's Hollywood Crimes 3D
| v0
|-
| 00037C00
| EUR
| Pro Evolution Soccer 2011 3D
| v0
|-
| 00038800
| USA
| Shin Megami Tensei - Devil Survivor Overclocked
| v0
|-
| 00038900
| EUR
| Super Monkey Ball 3D
| v0
|-
| 00038A00
| EUR
| Dead or Alive - Dimensions
| v0
|-
| 00038B00
| EUR
| Resident Evil - The Mercenaries 3D
| v0
|-
| 00038C00
| EUR
| LEGO Star Wars III - The Clone Wars
| v0
|-
| 00040100
| USA
| Tom Clancy's Splinter Cell 3D
| v0
|-
| 00040200
| EUR
| Samurai Warriors - Chronicles
| v0
|-
| 00040400
| EUR
| Crush 3D
| v0
|-
| 00040500
| USA
| Thor - God of Thunder
| v0
|-
| 00043300
| EUR
| Sports Island 3D
| v0
|-
| 00043400
| EUR
| Sudoku - The Puzzle Game Collection
| v0
|-
| 00043500
| EUR
| Green Lantern - Rise of the Manhunters
| v0
|-
| 00043600
| USA
| Dream Trigger 3D
| v0
|-
| 00043800
| USA
| Tetris Axis
| v0
|-
| 00043900
| USA
| Cartoon Network - Punch Time Explosion
| v0
|-
| 00043A00
| EUR
| Captain America - Super Soldier
| v0
|-
| 00043B00
| EUR
| Thor - God of Thunder
| v0
|-
| 00044300
| USA
| Happy Feet Two
| v0
|-
| 00044400
| EUR
| Naruto Shippuden 3D - The New Era
| v0
|-
| 00044500
| USA
| SpongeBob SquigglePants 3D
| v0
|-
| 00044600
| USA
| Deca Sports Extreme
| v0
|-
| 00044700
| EUR
| FIFA 12
| v0
|-
| 00044900
| EUR
| Generator Rex - Agent of Providence
| v0
|-
| 00044B00
| USA
| Petz Fantasy 3D
| v0
|-
| 00045400
| EUR
| DualPenSports
| v0
|-
| 00045600
| EUR
| LEGO Pirates of the Caribbean - The Video Game
| v0
|-
| 00045F00
| USA
| Bit.Trip Saga
| v0
|-
| 00046500
| USA
| Cubic Ninja
| v0
|-
| 00047900
| USA
| Harvest Moon 3D - The Tale of Two Towns
| v0
|-
| 00047A00
| USA
| FIFA Soccer 12
| v0
|-
| 00047B00
| USA
| Nano Assault
| v0
|-
| 00048100
| JPN
| Monster Hunter 3G
| v0
|-
| 00048C00
| USA
| Nikoli's Pencil Puzzle
| v0
|-
| 00048D00
| USA
| Reel Fishing Paradise 3D
| v0
|-
| 00049000
| USA
| Star Fox 64 3D
| v0
|-
| 00049100
| EUR
| Star Fox 64 3D
| v0
|-
| 0004A100
| USA
| Cave Story 3D
| v0
|-
| 0004A400
| USA
| LEGO Harry Potter - Years 5-7
| v0
|-
| 0004A500
| USA
| Transformers - Dark of the Moon - Stealth Force Edition
| v0
|-
| 0004AC00
| USA
| Blazblue - Continuum Shift II
| v0
|-
| 0004B200
| EUR
| Zoo Resort 3D
| v0
|-
| 0004B300
| EUR
| Cubic Ninja
| v0
|-
| 0004C100
| EUR
| Tetris
| v0
|-
| 0004C400
| USA
| Brunswick Pro Bowling
| v0
|-
| 0004C600
| USA
| Pinball Hall of Fame - The Williams' Collection
| v0
|-
| 0004C800
| EUR
| Dream Trigger 3D
| v0
|-
| 0004D000
| EUR
| Transformers 3 - Dark of the Moon - Stealth Force Edition
| v0
|-
| 0004DA00
| USA
| F1 2011
| v0
|-
| 0004DD00
| USA
| Wipeout 2
| v0
|-
| 0004E400
| USA
| Cooking Mama 4 - Kitchen Magic
| v0
|-
| 0004E900
| EUR
| Marvel Super Hero Squad - The Infinity Gauntlet
| v0
|-
| 0004EA00
| EUR
| SpongeBob SquigglePants
| v0
|-
| 0004EB00
| USA
| Mahjong Cub3D
| v0
|-
| 0004EC00
| USA
| Puzzler Mind Gym 3D
| v0
|-
| 00051100
| EUR
| Blazblue - Continuum Shift II
| v0
|-
| 00051500
| EUR
| Need for Speed - The Run
| v0
|-
| 00052400
| USA
| WWE All Stars
| v0
|-
| 00053F00
| EUR
| Super Mario 3D Land
| v0
|-
| 00054000
| USA
| Super Mario 3D Land
| v0
|-
| 00054000
| USA
| Super Monkey Ball 3D
| v0
|-
| 00054800
| USA
| Mario & Sonic at the London 2012 Olympic Games
| v0
|-
| 00054900
| EUR
| Mario & Sonic at the London 2012 Olympic Games
| v0
|-
| 00055B00
| USA
| Shinobi
| v0
|-
| 00056200
| EUR
| Doctor Lautrec and the Forgotten Knights
| v0
|-
| 00056400
| EUR
| WWE All Stars
| v0
|-
| 0005A300
| USA
| Sims 3, The - Pets
| v0
|-
| 0005AA00
| EUR
| Shinobi
| v0
|-
| 0005D700
| EUR
| Tales of the Abyss
| v0
|-
| 0005EE00
| EUR
| Resident Evil - Revelations
| v0
|-
| 00060200
| USA
| Resident Evil - Revelations
| v0
|-
| 00061100
| EUR
| Cartoon Network - Punch Time Explosion
| v0
|-
| 00061200
| USA
| Nicktoons MLB 3D
| v0
|-
| 00061300
| USA
| Tales of the Abyss
| v0
|-
| 00062000
| USA
| Let's Ride! Best in Breed 3D
| v0
|-
| 00062100
| USA
| Paws & Claws - Pampered Pets Resort 3D
| v0
|-
| 00062200
| EUR
| Sonic Generations
| v0
|-
| 00062300
| USA
| Sonic Generations
| v0
|-
| 00064900
| USA
| Ace Combat - Assault Horizon Legacy
| v0
|-
| 00066C00
| USA
| Pokemon Rumble Blast
| v0
|-
| 00066D00
| EUR
| Super Pokemon Rumble
| v0
|-
| 00067500
| USA
| Pro Evolution Soccer 2012 3D
| v0
|-
| 00068B00
| USA
| Pac-Man Party 3D
| v0
|-
| 0006A600
| EUR
| F1 2011
| v0
|-
| 0006CC00
| EUR
| Ace Combat - Assault Horizon Legacy
| v0
|-
| 00073600
| EUR
| One Piece - Unlimited Cruise SP
| v0
|-
| 0007E900
| EUR
| Tekken 3D - Prime Edition
| v0
|-
| 00080300
| USA
| Tekken 3D - Prime Edition
| v0
|-
| 00081E00
| USA
| Metal Gear Solid 3D - Snake Eater
| v0
|-
| 00082400
| EUR
| Metal Gear Solid 3D - Snake Eater
| v0
|}

== 00040002 - eShop Demos ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00030c01 || EUR || Nintendogs & Cats: Golden Retreiver Demo || v0
|-
| 00030d01 || USA || Nintendogs & Cats: Golden Retreiver Demo || v0
|-
| 00037101 || USA || CRUSH3D Demo || v0
|-
| 00040401 || EUR || CRUSH3D Demo || v0
|-
| 00048101 || JPN || Monster Hunter Tri G Demo || v1
|-
| 00054801 || USA || Mario & Sonic at the London 2012 Olympic games Demo || v0
|-
| 0005ed01 || EUR || Cooking Mama 4 Demo || v0
|-
| 0005ee01 || EUR || Resident Evil Revelations Demo || v0
|-
| 00060201 || USA || Resident Evil Revelations Demo || v0
|-
| 00081e01 || USA || Metal Gear Solid Snake Eater 3D Demo || v0
|-
| 00082401 || EUR || Metal Gear Solid Snake Eater 3D Demo || v0
|}

Title list

2012-04-24T09:57:52Z

Jl12:

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The same [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ update server] is being used as was with the DSi, however a new common key has been introduced.

The organization of Title IDs has not been documented fully yet. It's unknown how regions are determined in titleids if at all though there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi).

'''TitleID Structure''': 0xCCCCTTTTLLLLLLRR

* CCCC defines the target console (4=3DS, i.e. 1=[http://wiibrew.org/wiki/Title_database Wii])
* TTTT defines the type of the title
* LLLLLLLL are the 3 high bytes in the TitleID low (which are documented here in the first field of the tables)
* RR contains various info including title type (00=App, 01=Demo, 02/03=System Applet)

'''Versions''': v## = 0xHHHH = 0bBBBBBBBB...

* The version major,minor,etc can be extracted from the version number by converting the 16 bit number to binary
* 6 bits : Major
* 6 bits : Minor
* 2 bits & 2 bits : Unknown...
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that it's HomeMenu v2.1.0-?...

== 00040010 - System Applications ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Status
|-
| 00020000
| JPN
| [[System Settings]]
| v0, v1027, v2062
| Active
|-
| 00021000
| USA
| [[System Settings]]
| v0, v1027, v2062
| Active
|-
| 00022000
| EUR
| [[System Settings]]
| v0, v1027, v2062
| Active
|-
| 00020100
| JPN
| [[Download Play]]
| v0, v1026
| Active
|-
| 00021100
| USA
| [[Download Play]]
| v0, v1026
| Active
|-
| 00022100
| EUR
| [[Download Play]]
| v0, v1026
| Active
|-
| 00020200
| JPN
| [[Activity Log]]
| v0, v1026, v2054
| Active
|-
| 00021200
| USA
| [[Activity Log]]
| v0, v1026, v2054
| Active
|-
| 00022200
| EUR
| [[Activity Log]]
| v0, v1026, v2054
| Active
|-
| 00020300
| JPN
| [[Health and Safety Information]]
| v0
| Active
|-
| 00021300
| USA
| [[Health and Safety Information]]
| v0
| Active
|-
| 00022300
| EUR
| [[Health and Safety Information]]
| v0
| Active
|-
| 00020400
| JPN
| [[Nintendo 3DS Camera]]
| v0, v16, v1039
| Active
|-
| 00021400
| USA
| [[Nintendo 3DS Camera]]
| v0, v16, v1039
| Active
|-
| 00022400
| EUR
| [[Nintendo 3DS Camera]]
| v0, v16, v1039
| Active
|-
| 00020500
| JPN
| [[Nintendo 3DS Sound]]
| v0, v1027, v2049
| Active
|-
| 00021500
| USA
| [[Nintendo 3DS Sound]]
| v0, v1027, v2049
| Active
|-
| 00022500
| EUR
| [[Nintendo 3DS Sound]]
| v0, v1027, v2049
| Active
|-
| 00020700
| JPN
| [[Mii Maker]]
| v0, v1026
| Active
|-
| 00021700
| USA
| [[Mii Maker]]
| v0, v1026
| Active
|-
| 00022700
| EUR
| [[Mii Maker]]
| v0, v1026
| Active
|-
| 00020800
| JPN
| [[StreetPass Mii Plaza]]
| v0, v1027, v2048, v3087, v4096
| Active
|-
| 00021800
| USA
| [[StreetPass Mii Plaza]]
| v0, v1027, v2048, v3087, v4096
| Active
|-
| 00022800
| EUR
| [[StreetPass Mii Plaza]]
| v0, v1027, v2048, v3087, v4096
| Active
|-
| 00020900
| JPN
| [[eShop]]
| v4, v1026, 2058
| Active
|-
| 00021900
| USA
| [[eShop]]
| v4, v1026, v2058
| Active
|-
| 00022900
| EUR
| [[eShop]]
| v4, v1026, v2058
| Active
|-
| 00020A00
| JPN
| Web browser
| v4, v1035
| Active
|-
| 00021A00
| USA
| Web browser
| v4, v1035
| Active
|-
| 00022A00
| EUR
| Web browser
| v4, v1035
| Active
|-
| 00020B00
| JPN
| [[Nintendo Zone]]
| v0, v1034
| Active
|-
| 00021B00
| USA
| [[Nintendo Zone]]
| v0, v1034
| Active
|-
| 00022B00
| EUR
| [[Nintendo Zone]]
| v0, v1034
| Active
|-
| 00020D00
| JPN
| ?
| v0, v1028
| Active
|-
| 00021D00
| USA
| ?
| v0, v1028
| Active
|-
| 00022D00
| EUR
| ?
| v0, v1028
| Active
|-
| 00020E00
| JPN
| ?
| v0, v1027
| Active
|-
| 00021E00
| USA
| ?
| v0, v1027
| Active
|-
| 00022E00
| EUR
| ?
| v0, v1027
| Active
|-
| 00020F00
| JPN
| ?
| v0, v1024
| Active
|-
| 00021F00
| USA
| ?
| v0, v1024
| Active
|-
| 00022F00
| EUR
| ?
| v0, v1024
| Active
|-
| 00023000
| JPN
| Promotional video
| v0, v2048
| Stubbed
|-
| 00024000
| USA
| Promotional video
| v0, v2048
| Stubbed
|-
| 00025000
| EUR
| Promotional video
| v0, v2048
| Stubbed
|}

== 0004001B ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| ?
| v0
|-
| 00010702
| ?
| v0
|}

== 00040030 ==
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! Versions
|-
| 00008202
| 00008F02
| 00009802
| SYSMENU
| v0, v1029, v2049, v4111
|-
| 00008402
| 00009002
| 00009902
| ?
| v0, v1036
|-
| 00008502
| 00009102
| 00009A02
| ?
| ?
|-
| 00008602
| 00009202
| 00009B02
| ?
| v0, v1026, v2048
|-
| 00008702
| 00009302
| 00009C02
| ?
| v0, v1026
|-
| 00008802
| 00009402
| 00009D02
| ?
| v6, v1024
|-
| 00008A02
| 00008A02
| 00008A02
| ?
| v0, v1025, v3072
|-
| 00008D02
| 00009602
| 00009F02
| ?
| v0, v1026, v3082 (EUR v6, v1024, v3082)
|-
| 00008E02
| 00009702
| 0000A002
| ?
| v0, v1029, v2054 (EUR v6, v1024, v2054)
|-
| 0000C002
| ?
| ?
| ?
| v0, v1026, v2053
|-
| 0000C102
| ?
| ?
| ?
| v0, v1026
|-
| 0000C302
| ?
| ?
| ?
| v0, v1024
|-
| 0000C502
| 0000C502
| 0000C502
| ?
| v0, v1026, v2053
|-
| 0000C602
| ?
| ?
| ?
| v5
|-
| ?
| 0000C802
| ?
| ?
| v0, v1026, v2053
|-
| ?
| 0000C902
| ?
| ?
| v0, v1026
|-
| ?
| 0000CB02
| ?
| ?
| v0, v1024
|-
| ?
| 0000CC02
| ?
| ?
| v3
|-
| 0000CD02
| 0000CD02
| 0000CD02
| ?
| v1
|-
| ?
| 0000CE02
| ?
| ?
| v5
|-
| ?
| ?
| 0000D002
| ?
| v0, v1026, v2053
|-
| ?
| ?
| 0000D102
| ?
| v0, v1026
|-
| ?
| ?
| 0000D302
| ?
| v0, v1024
|-
| ?
| ?
| 0000D602
| ?
| v5
|}

== 0004009B ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00010202
| All
| ?
| v0, v2050
|-
| 00010302
| All
| ?
| v0, v2052
|-
| 00010402
| All
| ?
| v0, v1024, v2050
|-
| 00010502
| All
| ?
| v0, v1024, v2048
|-
| 00010602
| All
| ?
| v2
|-
| 00011902
| JPN
| ?
| v0
|-
| 00011402
| USA
| ?
| v0
|-
| 00011202
| EUR
| ?
| v0
|-
| 00012102
| EUR
| ?
| v0, v1026, v2051
|-
| 00012202
| JPN
| ?
| v1026
|-
| 00012302
| USA
| ?
| v1026, v2053
|-
| 00012102
| EUR
| ?
| v1026, v2051
|-
| 00013102
| EUR
| ?
| v1024, v2049
|-
| 00013302
| USA
| ?
| v1024, v2051
|-
| 00016302
| USA
| ?
| v80
|-
| 00017302
| USA
| ?
| v3088
|}

== 000400DB ==

Some of these titleIDs can be found @ offset 0x320 in every [[CCI]].(The region-specific titles here may determine the CCI region)

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00010302
| All
| ?
| v0, v1024, v2052
|-
| 00010502
| All
| ?
| v0, v1024, v2048
|-
| 00016102
| EUR
| ?
| v32, v48, v64, v80, v96
|-
| 00016202
| JPN
| ?
| v32, v48, v64, v80, v96
|-
| 00016302
| USA
| ?
| v32, v48, v64, v80, v96
|-
| 00017102
| EUR
| ?
| v2049, v2069, v3088
|-
| 00017202
| JPN
| ?
| v2049, v2069, v3088
|-
| 00017302
| USA
| ?
| v2049, v2069, v3088
|}

== 00040130 - ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Title Name
! Description
! Versions
|-
| 00001502
| 02_15
| AM ( Application Manager ) - System applet
| v0, v1026, v2053
|-
| 00001503
| 03_15
|
| v0
|-
| 00001602
| 02_16
| Camera - System applet
| v0, v1026, v2048
|-
| 00001702
| 02_17
| Config - System applet
| v0, v1024, v2049
|-
| 00001703
| 03_17
|
| v0
|-
| 00001802
| 02_18
| Codec - system applet
| v0, v1025, v3072
|-
| 00001803
| 03_18
|
| v0
|-
| 00001A02
| 02_1A
| DSP - system applet.
| v0, v1024
|-
| 00001A03
| 03_1A
|
| v0
|-
| 00001B02
| 02_1B
| GPIO - System applet
| v0
|-
| 00001B03
| 03_1B
|
| v0
|-
| 00001C02
| 02_1C
| GSP - System applet
| v0, v1040, v2049, v3075
|-
| 00001C03
| 03_1C
|
| v0
|-
| 00001D02
| 02_1D
| HID - System applet
| v0, v1025, v3072
|-
| 00001D03
| 03_1D
|
| v0
|-
| 00001E02
| 02_1E
| i2c - system applet.
| v0, v1024
|-
| 00001E03
| 03_1E
|
| v0
|-
| 00001F02
| 02_1F
| MCU - System applet
| v0, v1026, v3072
|-
| 00001F03
| 03_1F
|
| v0
|-
| 00002002
| 02_20
| Microphone - system applet
| v0
|-
| 00002102
| 02_21
| PDN - System applet
| v0
|-
| 00002103
| 03_21
|
| v0
|-
| 00002202
| 02_22
| PTM - System applet
| v0, v1026, v3075
|-
| 00002203
| 03_22
|
| v0
|-
| 00002302
| 02_23
| spi - system applet.
| v0, v1025
|-
| 00002303
| 03_23
|
| v0
|-
| 00002402
| 02_24
| Network - System Applet
| v0, v1024, v2052, v4101
|-
| 00002403
| 03_24
|
| v0
|-
| 00002602
| 02_26
| Messaging (NintendoZone) - System Applet
| v0, v1026, v3073
|-
| 00002702
| 02_27
| CSND - System applet
| v0, v1025
|-
| 00002703
| 03_27
|
| v0
|-
| 00002802
| 02_28
| DownloadPlay - System applet
| v0, v1026, v3078
|-
| 00002902
| 02_29
| http - system applet
| v0, v1026, v4099
|-
| 00002903
| 03_29
|
| v0
|-
| 00002A02
| 02_2A
| MP - System applet
| v0
|-
| 00002A03
| 03_2A
|
| v0
|-
| 00002B02
| 02_2B
| NDM - System applet
| v0, v1025, v2049
|-
| 00002C02
| 02_2C
| NIM - System applet
| v0, v1028, v2055
|-
| 00002C03
| 03_2C
|
| v0
|-
| 00002D02
| 02_2D
| NWM ( Network manager? ) - System applet
| v0, v1024, v2052, v4101
|-
| 00002D03
| 03_2D
|
| v0
|-
| 00002E02
| 02_2E
| Sockets - System applet
| v0, v1024, v2053, v3075

|-
| 00002E03
| 03_2E
|
| v0
|-
| 00002F02
| 02_2F
| SSL - System applet.
| v0, v1024, v3072
|-
| 00002F03
| 03_2F
|
| v0
|-
| 00003102
| 02_31
| PS ( Process Manager ) - System applet
| v0, v1025
|-
| 00003103
| 03_31
|
| v0
|-
| 00003202
| 02_32
| FriendsList - System applet
| v0, v1028, v3072
|-
| 00003203
| 03_32
|
| v0
|-
| 00003302
| 02_33
| IR (Infrared) - System applet
| v0, v1026, v3072
|-
| 00003303
| 03_33
|
| v0
|-
| 00003402
| 02_34
| BOSS (SpotPass) System Applet
| v0, v1024, v2053, v4101
|-
| 00003502
| 02_35
| News - System applet
| v0, v1028, v3072
|-
| 00003702
| 02_37
| RO - System applet
| v0
|-
| 00008002
| 02_80
| NS - System applet
| v0, v1028, v3077
|-
| 00008003
| 03_80
|
| v0
|}

== 00040138 ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00000002
| [[Home Menu]]
| v432, v1472, v2516, v3553, v5647
|-
| 00000003
| ?
| v432, v5632
|-
| 00000102
| ?
| v432, v1489, 2565
|-
| 00000202
| ?
| v519
|}

== 00048005 ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 42383841(B88A)
| [[DS Internet]]
| v0, v1025, v2048
|-
| 484E4441(HNDA)
| [[Download Play]]
| v1024
|}

== 0004800F ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, v1026, v3072
|-
| 484E4C41(HNLA)
| ?
| v0
|}

== 00040000 - eShop Titles ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00032600
| EUR/USA
| Pokédex 3D
| v0
|-
| 00034700
| ?
| ?
| v0
|-
| 00040800
| ?
| ?
| v16
|-
| 00040900
| ?
| ?
| v16
|-
| 00040A00
| ?
| ?
| v16
|-
| 00040B00
| ?
| ?
| v16
|-
| 00040E00
| ?
| ?
| v0
|-
| 00041000
| ?
| ?
| v0
|-
| 00041100
| ?
| ?
| v0
|-
| 00041300
| ?
| ?
| v0
|-
| 00041500
| ?
| ?
| v0
|-
| 00041700
| USA
| Kirby's Dream Land
| v0
|-
| 00041800
| ?
| ?
| v0
|-
| 00041900
| EUR
| Kirby's Dream Land
| v0
|-
| 00041D00
| ?
| ?
| v0
|-
| 00041E00
| ?
| ?
| v0
|-
| 00041F00
| ?
| ?
| v0
|-
| 00042400
| ?
| ?
| v0
|-
| 00042600
| ?
| ?
| v0
|-
| 00042700
| ?
| ?
| v0
|-
| 00042800
| EUR
| Zelda: Link's Awakening DX
| v0
|-
| 00042900
| ?
| ?
| v16
|-
| 00042A00
| ?
| ?
| v0
|-
| 00042C00
| ?
| ?
| v0
|-
| 00042E00
| ?
| ?
| v0
|-
| 00043000
| ?
| ?
| v0
|-
| 00045C00
| JPN
| 3D Classics Excitebike
| v0
|-
| 00046C00
| EUR
| 3D Classics Excitebike
| v0
|-
| 00048900
| ?
| ?
| v0
|-
| 00049900
| ?
| ?
| v0
|-
| 00049D00
| ?
| ?
| v0
|-
| 0004A900
| ?
| ?
| v0
|-
| 0004AA00
| USA
| [[Nintendo Video]]
| v0
|-
| 0004AB00
| EUR
| [[Nintendo Video]]
| v0
|-
| 0004B400
| ?
| ?
| v0
|-
| 0004D500
| ?
| ?
| v0
|-
| 0004E700
| ?
| ?
| v16
|-
| 0004EF00
| ?
| ?
| v0
|-
| 0004F300
| ?
| ?
| v0
|-
| 0004FA00
| ?
| ?
| v0
|-
| 0004FD00
| ?
| ?
| v0
|-
| 00051700
| USA
| [[Swapnote]]
| v0
|-
| 00051800
| EUR
| [[Swapnote|Letter Box]]
| v0
|-
| 00052600
| ?
| ?
| v32
|-
| 00052700
| ?
| ?
| v16
|-
| 00052800
| ?
| ?
| v0, v1024
|-
| 00052900
| ?
| ?
| v32
|-
| 00052A00
| ?
| ?
| v0
|-
| 00052D00
| ?
| ?
| v16
|-
| 00054200
| USA
| 3D Classics Kid Icarus
| v0
|-
| 00054300
| USA
| 3D Classics Excitebike
| v0
|-
| 00054700
| USA
| 3D Classics Xevious
| v0
|-
| 00054E00
| EUR
| 3D Classics Excitebike
| v0, v1024
|-
| 00055800
| ?
| ?
| v16
|-
| 00057700
| USA
| Netflix
| v0
|-
| 00059200
| ?
| ?
| v16
|-
| 0005AD00
| JPN
| Kid Icarus Uprising E3 Video
| v0
|-
| 0005AE00
| USA
| Kid Icarus Uprising E3 Video
| v0
|-
| 0005AF00
| JPN
| Paper Mario E3 Video
| v0
|-
| 0005B000
| USA
| Paper Mario E3 Video
| v0
|-
| 0005B100
| JPN
| Mario Kart E3 Video
| v0
|-
| 0005B200
| USA
| Mario Kart E3 Video
| v0
|-
| 0005B300
| JPN
| Animal Crossing E3 Video
| v0
|-
| 0005B400
| USA
| Animal Crossing E3 Video
| v0
|-
| 0005B500
| JPN
| Luigi's Mansion 2 E3 Video
| v0
|-
| 0005B600
| USA
| Luigi's Mansion 2 E3 Video
| v0
|-
| 0005B700
| JPN
| Zelda Ocarina of Time E3 Video
| v0
|-
| 0005B800
| USA
| Zelda Ocarina of Time E3 Video
| v0
|-
| 0005B900
| JPN
| Super Mario E3 Video
| v0
|-
| 0005BA00
| USA
| Super Mario E3 Video
| v0
|-
| 0005BB00
| JPN
| MGS Snake Eater 3D E3 Video
| v0
|-
| 0005BC00
| USA
| MGS Snake Eater 3D E3 Video
| v32
|-
| 0005BD00
| JPN
| Biohazard Revelations E3 Video
| v16
|-
| 0005BE00
| USA
| Resident Evil Revelations E3 Video
| v32
|-
| 0005BF00
| JPN
| Starfox 64 3D E3 Video
| v0
|-
| 0005C000
| USA
| Starfox 64 3D E3 Video
| v0
|-
| 0005EA00
| EUR
| Green Lantern 3D Trailer Video
| v0
|-
| 0005F000
| USA
| Green Lantern 3D Trailer Video
| v0
|-
| 0005F800
| ?
| ?
| v0
|-
| 0005F900
| ?
| ?
| v0
|-
| 0005FC00
| ?
| ?
| v0
|-
| 0005FD00
| ?
| ?
| v0
|-
| 00060000
| ?
| ?
| v0
|-
| 00060F00
| EUR
| Pyramids
|
|-
| 00062400
| EUR
| Kid Icarus Uprising E3 Video
| v0
|-
| 00062700
| EUR
| Paper Mario E3 Video
| v0
|-
| 00062A00
| EUR
| Mario Kart E3 Video
| v0
|-
| 00062B00
| ?
| ?
| v0
|-
| 00062C00
| ?
| ?
| v0
|-
| 00062D00
| EUR
| Animal Crossing E3 Video
| v0
|-
| 00063000
| EUR
|Luigi's Mansion 2 E3 Video
| v0
|-
| 00063300
| EUR
| Zelda Ocarina of Time E3 Video
| v0
|-
| 00063400
| ?
| ?
| v0
|-
| 00063500
| ?
| ?
| v0
|-
| 00063600
| EUR
| Super Mario E3 Video
| v0
|-
| 00063700
| ?
| ?
| v0
|-
| 00063800
| ?
| ?
| v0
|-
| 00063900
| EUR
| MGS Snake Eater 3D E3 Video
| v0
|-
| 00063C00
| EUR
| Resident Evil Revelations E3 Video
| v0
|-
| 00063D00
| ?
| ?
| v0
|-
| 00063E00
| ?
| ?
| v0
|-
| 00063F00
| EUR
| Starfox 64 3D E3 Video
| v0
|-
| 00064000
| ?
| ?
| v0
|-
| 00064100
| ?
| ?
| v0
|-
| 00066300
| USA
| Mighty Switch Force
| v0
|-
| 0006E500
| USA
| Super Mario Bros.
| v0
|-
| 0006E600
| EUR
| Super Mario Bros.
| v0
|-
| 0006EE00
| USA
| Metroid
| v0
|-
| 0006EF00
| EUR
| Metroid
| v0
|-
| 0006F100
| USA
| The Legend of Zelda
| v0
|-
| 0006F200
| EUR
| The Legend of Zelda
| v0
|-
| 0006F700
| USA
| Wrecking Crew
| v0
|-
| 0006F800
| EUR
| Wrecking Crew
| v0
|-
| 0006FA00
| USA
| NES Open Tournament Golf
| v0
|-
| 0006FB00
| EUR
| NES Open Tournament Golf
| v0
|-
| 00070000
| USA
| Donkey Kong Jr.
| v0
|-
| 00070100
| EUR
| Donkey Kong Jr.
| v0
|-
| 00070300
| USA
| Balloon Fight
| v0
|-
| 00070400
| EUR
| Balloon Fight
| v0
|-
| 00070600
| USA
| Ice Climber
| v0
|-
| 00070700
| EUR
| Ice Climber
| v0
|-
| 00070900
| USA
| Zelda II The Adventure of Link
| v0
|-
| 00070A00
| EUR
| Zelda II The Adventure of Link
| v0
|-
| 00071200
| USA
| Yoshi
| v0
|-
| 00071300
| EUR
| Yoshi
| v0
|-
| 00072400
| EUR
| Ambassador Certificate
| v0
|-
| 00072500
| USA
| Ambassador Certificate
| v0
|-
| 00074900
| USA
| F-Zero: Maximum Velocity
| v0
|-
| 00074C00
| USA
| Mario Kart Super Circuit
| v0
|-
| 00074F00
| USA
| Wario Land 4
| v0
|-
| 00075300
| USA
| Yoshi's Island: Super Mario Advance 3
| v0
|-
| 00075600
| USA
| Metroid Fusion
| v0
|-
| 00075900
| USA
| WarioWare Inc: Mega Microgame$
| v0
|-
| 00075C00
| USA
| Kirby & The Amazing Mirror
| v0
|-
| 00075D00
| EUR
| Kirby & The Amazing Mirror
| v0
|-
| 00076700
| USA
| Mario vs Donkey Kong
| v0
|-
| 00076A00
| USA
| Fire Emblem: The Sacred Stones
| v0
|-
| 00076D00
| USA
| The Legend of Zelda: The Minish Cap
| v0
|-
| 00079700
| USA
| Preview Video: ?
| v0
|-
| 00079800
| USA
| Preview Video: ?
| v0
|-
| 00079900
| USA
| Preview Video: ?
| v0
|-
| 00079A00
| USA
| Preview Video: ?
| v0
|-
| 00079B00
| USA
| Preview Video: ?
| v0
|-
| 00079C00
| USA
| Preview Video: Animal Crossing
| v0
|-
| 00079D00
| USA
| Preview Video: ?
| v0
|-
| 0007AB00
| EUR
| Eurosport (looks/acts like Nintendo Video)
| v0
|}

== 00040000 - Retail Titles ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00030100
| USA
| Kid Icarus - Uprising
| v0
|-
| 00030200
| EUR
| Kid Icarus - Uprising
| v0
|-
| 00030500
| JPN
| Super Street Fighter IV - 3D Edition
| v0
|-
| 00030700
| EUR
| Mario Kart 7
| v0
|-
| 00030800
| USA
| Mario Kart 7
| v0
|-
| 00030C00
| EUR
| Nintendogs + Cats - Golden Retriever & New Friends
| v0
|-
| 00030D00
| USA
| Nintendogs + Cats - Golden Retriever & New Friends
| v0
|-
| 00031200
| USA
| Nintendogs + Cats - French Bulldog & New Friends
| v0
|-
| 00031700
| USA
| Nintendogs + Cats - Toy Poodle & New Friends
| v0
|-
| 00031C00
| USA
| Pilotwings Resort
| v0
|-
| 00031D00
| EUR
| Pilotwings Resort
| v0
|-
| 00031F00
| JPN
| Layton Kyouju to Kiseki no Kamen
| v0
|-
| 00032300
| EUR
| Steel Diver
| v0
|-
| 00032400
| USA
| Steel Diver
| v0
|-
| 00032800
| JPN
| Ridge Racer 3D
| v0
|-
| 00032D00
| USA
| Super Street Fighter IV - 3D Edition
| v0
|-
| 00033500
| USA
| Legend of Zelda, The - Ocarina of Time 3D
| v0
|-
| 00033600
| EUR
| Legend of Zelda, The - Ocarina of Time 3D
| v0
|-
| 00033800
| EUR
| Puzzle Bobble Universe
| v0
|-
| 00033900
| EUR
| Rayman 3D
| v0
|-
| 00033A00
| EUR
| Tom Clancy's Splinter Cell 3D
| v0
|-
| 00033B00
| EUR
| Ridge Racer 3D
| v0
|-
| 00033C00
| EUR
| Super Street Fighter IV - 3D Edition
| v0
|-
| 00033D00
| EUR
| Sims 3, The
| v0
|-
| 00033E00
| EUR
| Madden NFL Football
| v0
|-
| 00034B00
| EUR
| Combat of Giants - Dinosaurs 3D
| v0
|-
| 00034C00
| USA
| Asphalt 3D
| v0
|-
| 00034D00
| USA
| Samurai Warriors - Chronicles
| v0
|-
| 00034F00
| USA
| Dead or Alive - Dimensions
| v0
|-
| 00035100
| USA
| Combat of Giants - Dinosaurs 3D
| v0
|-
| 00035300
| USA
| Green Lantern - Rise of the Manhunters
| v0
|-
| 00035400
| USA
| LEGO Star Wars III - The Clone Wars
| v0
|-
| 00035500
| USA
| Madden NFL Football
| v0
|-
| 00035600
| USA
| Pro Evolution Soccer 2011 3D
| v0
|-
| 00035700
| USA
| Rabbids - Travel in Time 3D
| v0
|-
| 00035800
| USA
| Ridge Racer 3D
| v0
|-
| 00035900
| USA
| Resident Evil The Mercenaries 3D
| v0
|-
| 00035A00
| USA
| Tom Clancy's Ghost Recon - Shadow Wars
| v0
|-
| 00035E00
| USA
| Bust-A-Move Universe
| v0
|-
| 00036000
| USA
| Driver Renegade 3D
| v0
|-
| 00036100
| USA
| James Noir's Hollywood Crimes
| v0
|-
| 00036300
| USA
| Pac-Man & Galaga Dimensions
| v0
|-
| 00036400
| USA
| Rayman 3D
| v0
|-
| 00036500
| USA
| Sims 3, The
| v0
|-
| 00036600
| USA
| DualPenSports
| v0
|-
| 00036800
| USA
| Doctor Lautrec and the Forgotten Knights
| v0
|-
| 00036900
| USA
| Frogger 3D
| v0
|-
| 00036E00
| USA
| Skylanders - Spyro's Adventure
| v0
|-
| 00037100
| USA
| Crush 3D
| v0
|-
| 00037400
| USA
| LEGO Pirates of the Caribbean - The Video Game
| v0
|-
| 00037500
| EUR
| Tom Clancy's Ghost Recon - Shadow Wars
| v0
|-
| 00037600
| EUR
| Asphalt 3D
| v0
|-
| 00037700
| EUR
| Rabbids 3D
| v0
|-
| 00037800
| EUR
| Driver Renegade 3D
| v0
|-
| 00037900
| EUR
| Adventures of Tintin, The - The Secret of the Unicorn
| v0
|-
| 00037A00
| EUR
| Michael Jackson - The Experience 3D
| v0
|-
| 00037B00
| EUR
| James Noir's Hollywood Crimes 3D
| v0
|-
| 00037C00
| EUR
| Pro Evolution Soccer 2011 3D
| v0
|-
| 00038800
| USA
| Shin Megami Tensei - Devil Survivor Overclocked
| v0
|-
| 00038900
| EUR
| Super Monkey Ball 3D
| v0
|-
| 00038A00
| EUR
| Dead or Alive - Dimensions
| v0
|-
| 00038B00
| EUR
| Resident Evil - The Mercenaries 3D
| v0
|-
| 00038C00
| EUR
| LEGO Star Wars III - The Clone Wars
| v0
|-
| 00040100
| USA
| Tom Clancy's Splinter Cell 3D
| v0
|-
| 00040200
| EUR
| Samurai Warriors - Chronicles
| v0
|-
| 00040400
| EUR
| Crush 3D
| v0
|-
| 00040500
| USA
| Thor - God of Thunder
| v0
|-
| 00043300
| EUR
| Sports Island 3D
| v0
|-
| 00043400
| EUR
| Sudoku - The Puzzle Game Collection
| v0
|-
| 00043500
| EUR
| Green Lantern - Rise of the Manhunters
| v0
|-
| 00043600
| USA
| Dream Trigger 3D
| v0
|-
| 00043800
| USA
| Tetris Axis
| v0
|-
| 00043900
| USA
| Cartoon Network - Punch Time Explosion
| v0
|-
| 00043A00
| EUR
| Captain America - Super Soldier
| v0
|-
| 00043B00
| EUR
| Thor - God of Thunder
| v0
|-
| 00044300
| USA
| Happy Feet Two
| v0
|-
| 00044400
| EUR
| Naruto Shippuden 3D - The New Era
| v0
|-
| 00044500
| USA
| SpongeBob SquigglePants 3D
| v0
|-
| 00044600
| USA
| Deca Sports Extreme
| v0
|-
| 00044700
| EUR
| FIFA 12
| v0
|-
| 00044900
| EUR
| Generator Rex - Agent of Providence
| v0
|-
| 00044B00
| USA
| Petz Fantasy 3D
| v0
|-
| 00045400
| EUR
| DualPenSports
| v0
|-
| 00045600
| EUR
| LEGO Pirates of the Caribbean - The Video Game
| v0
|-
| 00045F00
| USA
| Bit.Trip Saga
| v0
|-
| 00046500
| USA
| Cubic Ninja
| v0
|-
| 00047900
| USA
| Harvest Moon 3D - The Tale of Two Towns
| v0
|-
| 00047A00
| USA
| FIFA Soccer 12
| v0
|-
| 00047B00
| USA
| Nano Assault
| v0
|-
| 00048100
| JPN
| Monster Hunter 3G
| v0
|-
| 00048C00
| USA
| Nikoli's Pencil Puzzle
| v0
|-
| 00048D00
| USA
| Reel Fishing Paradise 3D
| v0
|-
| 00049000
| USA
| Star Fox 64 3D
| v0
|-
| 00049100
| EUR
| Star Fox 64 3D
| v0
|-
| 0004A100
| USA
| Cave Story 3D
| v0
|-
| 0004A400
| USA
| LEGO Harry Potter - Years 5-7
| v0
|-
| 0004A500
| USA
| Transformers - Dark of the Moon - Stealth Force Edition
| v0
|-
| 0004AC00
| USA
| Blazblue - Continuum Shift II
| v0
|-
| 0004B200
| EUR
| Zoo Resort 3D
| v0
|-
| 0004B300
| EUR
| Cubic Ninja
| v0
|-
| 0004C100
| EUR
| Tetris
| v0
|-
| 0004C400
| USA
| Brunswick Pro Bowling
| v0
|-
| 0004C600
| USA
| Pinball Hall of Fame - The Williams' Collection
| v0
|-
| 0004C800
| EUR
| Dream Trigger 3D
| v0
|-
| 0004D000
| EUR
| Transformers 3 - Dark of the Moon - Stealth Force Edition
| v0
|-
| 0004DA00
| USA
| F1 2011
| v0
|-
| 0004DD00
| USA
| Wipeout 2
| v0
|-
| 0004E400
| USA
| Cooking Mama 4 - Kitchen Magic
| v0
|-
| 0004E900
| EUR
| Marvel Super Hero Squad - The Infinity Gauntlet
| v0
|-
| 0004EA00
| EUR
| SpongeBob SquigglePants
| v0
|-
| 0004EB00
| USA
| Mahjong Cub3D
| v0
|-
| 0004EC00
| USA
| Puzzler Mind Gym 3D
| v0
|-
| 00051100
| EUR
| Blazblue - Continuum Shift II
| v0
|-
| 00051500
| EUR
| Need for Speed - The Run
| v0
|-
| 00052400
| USA
| WWE All Stars
| v0
|-
| 00053F00
| EUR
| Super Mario 3D Land
| v0
|-
| 00054000
| USA
| Super Mario 3D Land
| v0
|-
| 00054000
| USA
| Super Monkey Ball 3D
| v0
|-
| 00054800
| USA
| Mario & Sonic at the London 2012 Olympic Games
| v0
|-
| 00054900
| EUR
| Mario & Sonic at the London 2012 Olympic Games
| v0
|-
| 00055B00
| USA
| Shinobi
| v0
|-
| 00056200
| EUR
| Doctor Lautrec and the Forgotten Knights
| v0
|-
| 00056400
| EUR
| WWE All Stars
| v0
|-
| 0005A300
| USA
| Sims 3, The - Pets
| v0
|-
| 0005AA00
| EUR
| Shinobi
| v0
|-
| 0005D700
| EUR
| Tales of the Abyss
| v0
|-
| 0005EE00
| EUR
| Resident Evil - Revelations
| v0
|-
| 00060200
| USA
| Resident Evil - Revelations
| v0
|-
| 00061100
| EUR
| Cartoon Network - Punch Time Explosion
| v0
|-
| 00061200
| USA
| Nicktoons MLB 3D
| v0
|-
| 00061300
| USA
| Tales of the Abyss
| v0
|-
| 00062000
| USA
| Let's Ride! Best in Breed 3D
| v0
|-
| 00062100
| USA
| Paws & Claws - Pampered Pets Resort 3D
| v0
|-
| 00062200
| EUR
| Sonic Generations
| v0
|-
| 00062300
| USA
| Sonic Generations
| v0
|-
| 00064900
| USA
| Ace Combat - Assault Horizon Legacy
| v0
|-
| 00066C00
| USA
| Pokemon Rumble Blast
| v0
|-
| 00066D00
| EUR
| Super Pokemon Rumble
| v0
|-
| 00067500
| USA
| Pro Evolution Soccer 2012 3D
| v0
|-
| 00068B00
| USA
| Pac-Man Party 3D
| v0
|-
| 0006A600
| EUR
| F1 2011
| v0
|-
| 0006CC00
| EUR
| Ace Combat - Assault Horizon Legacy
| v0
|-
| 00073600
| EUR
| One Piece - Unlimited Cruise SP
| v0
|-
| 0007E900
| EUR
| Tekken 3D - Prime Edition
| v0
|-
| 00080300
| USA
| Tekken 3D - Prime Edition
| v0
|-
| 00081E00
| USA
| Metal Gear Solid 3D - Snake Eater
| v0
|-
| 00082400
| EUR
| Metal Gear Solid 3D - Snake Eater
| v0
|}

== 00040002 - eShop Demos ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00030c01 || EUR || Nintendogs & Cats: Golden Retreiver Demo || v0
|-
| 00030d01 || USA || Nintendogs & Cats: Golden Retreiver Demo || v0
|-
| 00037101 || USA || CRUSH3D Demo || v0
|-
| 00040401 || EUR || CRUSH3D Demo || v0
|-
| 00048101 || JPN || Monster Hunter Tri G Demo || v1
|-
| 00054801 || USA || Mario & Sonic at the London 2012 Olympic games Demo || v0
|-
| 0005ed01 || EUR || Cooking Mama 4 Demo || v0
|-
| 0005ee01 || EUR || Resident Evil Revelations Demo || v0
|-
| 00060201 || USA || Resident Evil Revelations Demo || v0
|-
| 00081e01 || USA || Metal Gear Solid Snake Eater 3D Demo || v0
|-
| 00082401 || EUR || Metal Gear Solid Snake Eater 3D Demo || v0
|}

CXI

2012-04-21T14:23:41Z

Jl12:

[[Category:File formats]]
The following text tries to document the structure of the CTR Executable Image (CXI) format.

=== Overview ===
A CXI file contains the 'application' program code, which runs on a single ARM11 core. It can communicate through SVC calls with the other ARM11 core running the 'system' program code. For reasons of clarity, the ARM11 cores will sometimes be called the 'appcore' and 'syscore' respectively.

The CXI file format contains application ARM11 code, the menu icon, the menu 3D model, and an embedded read-only (ROM) filesystem for external filestorage. In fact, the application ARM11 code, menu icon, and menu 3D model are embedded into its own filesystem too, called the ExeFS.

More specifically, the CXI file format is structured in the following order:
* first an NCCH header,
* followed by an extended header,
* followed by a plain binary region,
* followed by an embedded executable filesystem (ExeFS),
* and finally followed by a read-only filesystem (RomFS).

The extended header contains additional information regarding access control.
The plain binary region is an area specifically stored in plaintext, mostly containing SDK library strings for identification.

The extended header, the ExeFS and the RomFS are encrypted using 128-bit AES CTR.

By default encrypted regions are compressed with an LZ77 variant, then encrypted. The spec allows for both unencrypted and uncompressed regions to exist. System titles expect a fixed system key.

=== NCCH Header ===
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 0x100
| RSA-2048 signature of the NCCH header, using SHA-256.
|-
| 0x100
| 4
| Magic ID, always 'NCCH'
|-
| 0x104
| 4
| Content size, in media units (1 media unit = 0x200 bytes)
|-
| 0x108
| 8
| Partition ID
|-
| 0x110
| 2
| Maker code
|-
| 0x112
| 2
| Version
|-
| 0x114
| 4
| Reserved
|-
| 0x118
| 8
| Program ID
|-
| 0x120
| 1
| Temp flag
|-
| 0x121
| 0x2F
| Reserved
|-
| 0x150
| 0x10
| Product code
|-
| 0x160
| 0x20
| Extended header hash
|-
| 0x180
| 4
| Extended header size
|-
| 0x184
| 4
| Reserved
|-
| 0x188
| 8
| Flags: byte[5]-byte[7] indicate content type ( system update, application, manual, ... ) size of media unit ( 512*2^byte[6] ) and encryption.
|-
| 0x190
| 4
| Plain region offset, in media units
|-
| 0x194
| 4
| Plain region size, in media units
|-
| 0x198
| 8
| Reserved
|-
| 0x1A0
| 4
| ExeFS offset, in media units
|-
| 0x1A4
| 4
| ExeFS size, in media units
|-
| 0x1A8
| 4
| ExeFS hash region size, in media units
|-
| 0x1AC
| 4
| Reserved
|-
| 0x1B0
| 4
| RomFS offset, in media units
|-
| 0x1B4
| 4
| RomFS size, in media units
|-
| 0x1B8
| 4
| RomFS hash region size, in media units
|-
| 0x1BC
| 4
| Reserved
|-
| 0x1C0
| 0x20
| ExeFS superblock hash, over the cleartext ExeFS
|-
| 0x1E0
| 0x20
| RomFS superblock hash
|}

==== NCCH header example for Lego Starwars III ====
Signature: 720FF8F83F2A1E998322A026D1434165
ED19642ABC1CB2722135AA202BEAD60A
80BCD21C768C597B8268FEF2C64EA710
4C9BA5E12CFFBD1D0C619F4EF7B42CA7
DD8482CB4EB26720AD66CDA57ABCBCFB
D63268A6E2896A59B3B744E39E45B88A
ABB4C0980ACC6210818DCE6DAC838A10
95D0F66B352474D4B3DA4B333F49912D
29AF7EA58BC8C890B18C70B7D540A9FB
EBE24A5312055617D3353B28C3EB1D17
61021BEFF6AD22C384835B40BD44DFAD
981F6350F9458B17BCB5F768C92ABC93
2BCE9888855A8998F4CDE40C9543514A
C57B84EB75A680E7C742632614620D1D
A253284DF3DC01091EB3800C36FD62EE
BA15340F1FD498FAB67C0302E9CDA397
Magic: NCCH
Content size: 0x1cfef400
Partition id: 0004000000038c00
Maker code: 3436 ("46")
Version: 0002
Program id: 0004000000038c00
Temp flag: 00
Product code: CTR-P-ALGP
Extended header hash: 0C27E3C1DE7B2AE2D3114F32A4EEBF46
9AFD0CF352C11D4984C2A9F1D2144C63
Extended header size: 00000400
Flags: 0000030100000000
Plain region offset: 0x00004a00
Plain region size: 0x00000200
ExeFS offset: 0x00004c00
ExeFS size: 0x00143800
ExeFS hash region size: 0x00000200
RomFS offset: 0x00148400
RomFS size: 0x1ceab000
RomFS hash region size: 0x00000200
ExeFS Superblock Hash: 130C042615F647C4C63225EA9E67F8A2
7B15246B88FBC7A927257B84977B787B
RomFS Superblock Hash: A65BEE1060BB6A6821BBCEC600035B7E
64FB6EACA7F0960CFB1F5A37087728F7
Note: Offsets and sizes in media units have been converted to byte sizes.

==== Plain region example for Lego Starwars III ====
0004a00: 5b 53 44 4b 2b 4e 49 4e 54 45 4e 44 4f 3a 43 54 [SDK+NINTENDO:CT [SDK+NINTENDO:CTR_SDK-0_14_23_200_none]
0004a10: 52 5f 53 44 4b 2d 30 5f 31 34 5f 32 33 5f 32 30 R_SDK-0_14_23_20
0004a20: 30 5f 6e 6f 6e 65 5d 00 5b 53 44 4b 2b 4e 49 4e 0_none].[SDK+NIN [SDK+NINTENDO:Firmware-02_27]
0004a30: 54 45 4e 44 4f 3a 46 69 72 6d 77 61 72 65 2d 30 TENDO:Firmware-0
0004a40: 32 5f 32 37 5d 00 5b 53 44 4b 2b 4d 6f 62 69 63 2_27].[SDK+Mobic [SDK+Mobiclip:Deblocker_1_0_2]
0004a50: 6c 69 70 3a 44 65 62 6c 6f 63 6b 65 72 5f 31 5f lip:Deblocker_1_
0004a60: 30 5f 32 5d 00 5b 53 44 4b 2b 4d 6f 62 69 63 6c 0_2].[SDK+Mobicl [SDK+Mobiclip:ImaAdpcmDec_1_0_0]
0004a70: 69 70 3a 49 6d 61 41 64 70 63 6d 44 65 63 5f 31 ip:ImaAdpcmDec_1
0004a80: 5f 30 5f 30 5d 00 5b 53 44 4b 2b 4d 6f 62 69 63 _0_0].[SDK+Mobic [SDK+Mobiclip:MobiclipDec_1_0_1]
0004a90: 6c 69 70 3a 4d 6f 62 69 63 6c 69 70 44 65 63 5f lip:MobiclipDec_
0004aa0: 31 5f 30 5f 31 5d 00 5b 53 44 4b 2b 4d 6f 62 69 1_0_1].[SDK+Mobi [SDK+Mobiclip:MoflexDemuxer_1_0_2]
0004ab0: 63 6c 69 70 3a 4d 6f 66 6c 65 78 44 65 6d 75 78 clip:MoflexDemux
0004ac0: 65 72 5f 31 5f 30 5f 32 5d 00 00 00 00 00 00 00 er_1_0_2].......
0004ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0004ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

A tool for parsing this format is available [http://github.com/3dshax/ctr/tree/master/ctrtool here]

==== Example dependency list from the extended header ====
00850 41 50 54 3A 55 00 00 00 24 68 69 6F 46 49 4F 00 APT:U...$hioFIO.
00860 24 68 6F 73 74 69 6F 30 24 68 6F 73 74 69 6F 31 $hostio0$hostio1
00870 61 63 3A 75 00 00 00 00 62 6F 73 73 3A 55 00 00 ac:u....boss:U..
00880 63 61 6D 3A 75 00 00 00 63 65 63 64 3A 75 00 00 cam:u...cecd:u..
00890 63 66 67 3A 75 00 00 00 64 6C 70 3A 46 4B 43 4C cfg:u...dlp:FKCL
008A0 64 6C 70 3A 53 52 56 52 64 73 70 3A 3A 44 53 50 dlp:SRVRdsp::DSP
008B0 66 72 64 3A 75 00 00 00 66 73 3A 55 53 45 52 00 frd:u...fs:USER.
008C0 67 73 70 3A 3A 47 70 75 68 69 64 3A 55 53 45 52 gsp::Gpuhid:USER
008D0 68 74 74 70 3A 43 00 00 6D 69 63 3A 75 00 00 00 http:C..mic:u...
008E0 6E 64 6D 3A 75 00 00 00 6E 65 77 73 3A 75 00 00 ndm:u...<nowiki>news:u..</nowiki>
008F0 6E 77 6D 3A 3A 55 44 53 70 74 6D 3A 75 00 00 00 nwm::UDSptm:u...
00900 70 78 69 3A 64 65 76 00 73 6F 63 3A 55 00 00 00 pxi:dev.soc:U...
00910 73 73 6C 3A 43 00 00 00 79 32 72 3A 75 00 00 00 ssl:C...y2r:u...
00920 69 72 3A 55 53 45 52 00 6C 64 72 3A 72 6F 00 00 ir:USER.ldr:ro..
00930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00940 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00950 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00960 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
... ...
009D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
009E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
009F0 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 02 . .............
00A00 5B 53 44 4B 2B 4E 49 4E 54 45 4E 44 4F 3A 43 54 [SDK+NINTENDO:CT

==== ExeFS filesystem ====

* .code Contains the code binary, which can be optionally reverse-LZSS compressed via an exheader flag.
* [[logo]] Contains distribution licensing Binary data. (Types: Nintendo, Licensed, Published, or Distributed) Additionally it could have no license (type None). System applications and applets that interact with the Home Menu are typically set to type 'none' as they don't display that information.
* [[CBMD|banner]] Contains the banner which homemenu uses for this CXI.
* [[SMDH|icon]] Contains the icon which homemenu displays for this CXI.

User:Matyapiro31

2012-03-19T02:03:38Z

Jl12:

I'm Japanese.
Sorry,I cannot write smart English.
But I bring information written in japanese!
I bought a new one.
:A new 3DS for dumping stuff I guess...?--[[User:Lazymarek9614|Lazymarek9614]] 14:36, 23 November 2011 (CET)

Yes,of cource.
But before dump ram,i will be able to find more info about RAM!
:I also wanted to do a RAM dump, but the pinout on the board is unknown... Why have you bought a new 3DS when you don't know how to do a dump?--[[User:Lazymarek9614|Lazymarek9614]] 17:48, 24 November 2011 (CET)
Here is an excrypted .ctx file.[http://dl.dropbox.com/u/37418652/00000000.ctx] How did you create it?--[[User:Jocopoco|Jocopoco]] 12:42, 14 December 2011 (CET)

Hey Matyapiro31 do you have Japanese 3DS?--[[User:Rikku2000|Rikku2000]]

Yes,I do.But why?--Matyapiro31 16:34, 4 March 2012 (CET)
I ask can you download from japan-eshop the Loveplus tool the link is on my page is an qr code just can with cam
i want try to use it on european 3DS? If its have some fee i will send you the money, thanks.--[[User:Rikku2000|Rikku2000]]
I read the fees are 200Y if you have paypal i will send you the money my email is rikkuff2000@yahoo.de i add you on my 3ds system.--[[User:Rikku2000|Rikku2000]]

Unfortunatery,ordinally 3DS CANNOT play eshop games only copying data.

if you have 3ds common key and development 3ds,you can do it for yourself.(maybe)

so,you buy Japanese 3ds and can ask yellows8 to way to access Japanese eshop in europ

i mean download the game and send me the files from your sd card.--[[User:Rikku2000|Rikku2000]]

:Erm, no... Rikku2000, read the [[SD_Filesystem]] page and others, titles on sdcard are encrypted with an unknown console-unique key.(tik commonkey and other keys used with titles are unknown too, so trying to use it on a dev3ds can't be done at all) "way to access Japanese eshop in europ" You can't.(what would you do with that app anyway?) --[[User:Yellows8|Yellows8]] 18:53, 4 March 2012 (CET)

I want use it try some play with it :P i put on my page the download for Zelda(Nes) maybe you can try the local files on your 3ds.
install in here "(sample):\Nintendo 3DS\1af17845dd3aea1c73c48c69443988c6\912c00ac4760aae4534430320002544d\title\00040000\0006f200"
:...Don't you know what "console-unique key" means? That *will not* work. --[[User:Yellows8|Yellows8]] 19:34, 4 March 2012 (CET)
i know whats that mean, i know it from my caanoo there use drm...

それは良かった。--Matyapiro31 06:13, 6 March 2012 (CET)
: よろしくお願いします！--[[User:Wangxuan8331800|Wangxuan8331800]] 05:43, 7 March 2012 (CET)

It's my blog.

http://n-matya.blogspot.com/ (Japanese)--Matyapiro31 12:45, 12 March 2012 (CET)

Hey Matyapiro31, can you say me the Japanese WiFi ID from NintendoZone US use attwifi but i want connect to Japanese Zone.--[[User:Rikku2000|Rikku2000]]

Check PMs @ n-dev.net plx [[User:jl12|jl12]]

Talk:CiTRUS

2012-03-07T11:05:45Z

Jl12: feedback

About the XBSF format, is it a Nintendo's file format? Will It include an executable image? Are there the sources of CITRUS?--[[User:Jocopoco|Jocopoco]] 08:08, 9 February 2012 (CET)

Not to downplay the usefulness of this program, but what purpose does it serve for people who don't get to play around with dev 3DSes? --[[User:Luigi2us|Luigi2us]] 22:58, 27 February 2012 (CET)

"it can be retail signed, provided the right RSA keys" Which is impossible, not even official devs have that retail RSA private key.(they send their titles to Nintendo to sign, like they *always* have) Therefore the output CXI *is* dev unit only. --[[User:Yellows8|Yellows8]] 03:36, 2 March 2012 (CET)

This application and the linked .CXI are complete crap. The .bcwav file in the application is a mutilated .WAV file, the .ctpk files are just a series of random 0x00 and 0xFF, the .cbmd is another mutilated file (I believe some image file), and the .cxi is complete crap (just look at the file in a hex editor and tell me that's not immediately ridiculous). Calling for deletion of this ridiculous page. --[[User:Trap15|trap15]] 05:59, 2 March 2012 (CET)

Well the files may be legit, but since there's no way to obtain other files than the ones he provided, this is mostly a toy. Have fun creating the same output file over and over again :/ --[[User:Luigi2us|Luigi2us]] 12:21, 2 March 2012 (CET)

Nintendo wouldn't use a bog-standard .WAV with changed header names. I can 100% guarantee you that. I am about 99% sure that this code, and [[User:Xcution|Xcution]] are Complete Bullshit™. --[[User:Trap15|trap15]] 19:12, 2 March 2012 (CET)
:They [http://www.feshrine.net/hacking/doc/nds-sdat.html did] and they do. --[[User:Elisherer|Elisherer]] 19:20, 2 March 2012 (CET)
::@[[User:Trap15|trap15]] We don't need any drama in the 3DS scene, take your flaming/trolling else where.--[[User:3dsguy|3dsguy]] 09:15, 3 March 2012 (CET)

Xcution Is there a way for decrypt your demo?--[[User:Jocopoco|Jocopoco]] 19:11, 2 March 2012 (CET)
:No. --[[User:Trap15|trap15]] 19:12, 2 March 2012 (CET)
Why? Is it a fake? --[[User:Jocopoco|Jocopoco]] 19:20, 2 March 2012 (CET)
:Yes. --[[User:Trap15|trap15]] 20:22, 2 March 2012 (CET)

Xcution, here you can find the reason why none will use your tool for creating homebrew: [[Talk:Homebrew_Format]].--[[User:Lazymarek9614|Lazymarek9614]] 21:17, 2 March 2012 (CET)

If you adopt Nintendo's official software format,maybe some issues will happen.

Official format should be known,cheating,illegal copying probably happen.

This is the reason I suggest Homebrew Format.
The format will be different and developers should able to develop homebrew.
:That was already discussed [[Talk:Homebrew Format|here]]... "Official format should be known" Official format *already* is known. Homebrew has *always* used the same format as official software. Not using NCCH/whatever in homebrew won't slow down piracy much if at all.--[[User:Yellows8|Yellows8]] 16:45, 3 March 2012 (CET)

Feedback:
:1. It puts together banner data for HomeMenu. It outputs a .bnr and .icn, from the settings you chose and a few other files. For what it does, it does work.
:2. The .CTPK / .ICN are fine. I built my own app using his output and the icon is a large black "X" on a square white background. This is what it looks like: http://img195.imageshack.us/img195/687/iconzviacitrustool.png
:Most likely you thought they looked like random FF and 00 because .ctpk is an image format and that is an array of RGB data. What are the RGB values of black and white pixels? (Black and white = xFF + x00)
:3. We've tested apps that used BCWAV format before. Here's one of the sounds converted and tested with a real (dev/test) 3DS: http://www.mediafire.com/?lc1jcqcoxa9vl0m , compare the headers.
:4. CBMD - the model/animation you see on the upper screen when you put in a game/cartridge or hover over icons in Home menu.
:5. The "Chinese" versions of the title and publisher seem to get removed in the "build" process, not sure if that's an issue with my PC or your tool.
:6. Application77.cxi is invalid.
:--[[User:jl12|jl12]]

SVC

2012-01-23T18:57:11Z

Jl12:

{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory
|-
| 0x2
| QueryMemory
|-
| 0x3
| ExitProcess
|-
| 0x4
| GetProcessAffinityMask
|-
| 0x5
| SetProcessAffinityMask
|-
| 0x6
| GetProcessIdealProcessor
|-
| 0x7
| SetProcessIdealProcessor
|-
| 0x8
| CreateThread
|-
| 0x9
| ExitThread
|-
| 0xA
| SleepThread
|-
| 0xB
| GetThreadPriority
|-
| 0xC
| SetThreadPriority
|-
| 0xD
| GetThreadAffinityMask
|-
| 0xE
| SetThreadAffinityMask
|-
| 0xF
| GetThreadIdealProcessor
|-
| 0x10
| SetThreadIdealProcessor
|-
| 0x11
| GetCurrentProcessorNumber
|-
| 0x12
| Run
|-
| 0x13
| CreateMutex
|-
| 0x14
| ReleaseMutex
|-
| 0x15
| CreateSemaphore
|-
| 0x16
| ReleaseSemaphore
|-
| 0x17
| CreateEvent
|-
| 0x18
| SignalEvent
|-
| 0x19
| ClearEvent
|-
| 0x1A
| CreateTimer
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo
|-
| 0x2B
| GetProcessInfo
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort
|-
| 0x2E
| SendSyncRequest1
|-
| 0x2F
| SendSyncRequest2
|-
| 0x30
| SendSyncRequest3
|-
| 0x31
| SendSyncRequest4
|-
| 0x32
| SendSyncRequest
|-
| 0x33
| OpenProcess
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1
|-
| 0x4C
| ReplyAndReceive2
|-
| 0x4D
| ReplyAndReceive3
|-
| 0x4E
| ReplyAndReceive4
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle*, unsigned int)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int*, unsigned int*, int)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6a
| ReadProcessMemory(void*, Handle, unsigned int, unsigned int)
|-
| 0x6b
| WriteProcessMemory(Handle, void const*, unsigned int, unsigned int)
|-
| 0x6c
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6d
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam)
|}

SVC

2012-01-23T18:46:03Z

Jl12:

{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory
|-
| 0x2
| QueryMemory
|-
| 0x3
| ExitProcess
|-
| 0x4
| GetProcessAffinityMask
|-
| 0x5
| SetProcessAffinityMask
|-
| 0x6
| GetProcessIdealProcessor
|-
| 0x7
| SetProcessIdealProcessor
|-
| 0x8
| CreateThread
|-
| 0x9
| ExitThread
|-
| 0xA
| SleepThread
|-
| 0xB
| GetThreadPriority
|-
| 0xC
| SetThreadPriority
|-
| 0xD
| GetThreadAffinityMask
|-
| 0xE
| SetThreadAffinityMask
|-
| 0xF
| GetThreadIdealProcessor
|-
| 0x10
| SetThreadIdealProcessor
|-
| 0x11
| GetCurrentProcessorNumber
|-
| 0x12
| Run
|-
| 0x13
| CreateMutex
|-
| 0x14
| ReleaseMutex
|-
| 0x15
| CreateSemaphore
|-
| 0x16
| ReleaseSemaphore
|-
| 0x17
| CreateEvent
|-
| 0x18
| SignalEvent
|-
| 0x19
| ClearEvent
|-
| 0x1A
| CreateTimer
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo
|-
| 0x2B
| GetProcessInfo
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort
|-
| 0x2E
| SendSyncRequest1
|-
| 0x2F
| SendSyncRequest2
|-
| 0x30
| SendSyncRequest3
|-
| 0x31
| SendSyncRequest4
|-
| 0x32
| SendSyncRequest
|-
| 0x33
| OpenProcess
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1
|-
| 0x4C
| ReplyAndReceive2
|-
| 0x4D
| ReplyAndReceive3
|-
| 0x4E
| ReplyAndReceive4
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x60
| DebugActiveProcess(Handle*, unsigned int)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int*, unsigned int*, int)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6a
| ReadProcessMemory(void*, Handle, unsigned int, unsigned int)
|-
| 0x6b
| WriteProcessMemory(Handle, void const*, unsigned int, unsigned int)
|-
| 0x6c
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6d
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam)
|}

User talk:Xcution

2011-11-30T02:44:19Z

Jl12:

Hi.

Today I bring news of 2 developer applications which I did not see in "3DS Development Unit Software" :

CecLotCheckTool and WM Test

[[File:Ceclotchecktool.jpg|500px|thumb|right|CECLotCheckTool]]

[[File:Devmen2app.jpg|500px|thumb|right|Picture of WM Test (In DevMen)]]

CecLotCheckTool and WM Test tools do not appear to have an icon.

'''Info CecLotCheckTool :'''

First, you may wonder what "CEC" stands for. It means Chance Encounter Communication, AKA StreetPass. It is noted by lib that StreetPass is not possible between a dev unit and a retail system. CECLotCheckTool is used to check StreetPass info. Unfortunately, I only have 1 dev unit =p so I can't really do a whole lot with this, since it's only developer unit -> developer unit. I still think it's interesting though..

'''Info WM Test :'''

Unfortunately I do not have pictures of WM Test as it seems to freeze on my somewhat outdated rev although lib/sdk states it is a TWL program BUT lib states WM Test has 2 unique features :

It runs through DevMen in "TWL Compatibility" mode AND runs in "Noise mode"

And another unfortunate point to bring is I could not find so far information about these 2 modes, which is sort of a let down =/ but interesting that it notes those two things.

Are you Collosalpokemon from GBA Temp, because they look like his(or her) photos--[[User:3dsguy|3dsguy]] 02:54, 27 November 2011 (CET)

Also if you want to test streetpass between dev 3DSs, your best chance of doing this is at a nintendo public event where they are likly to have 3DS demos running on Dev 3DSs.--[[User:3dsguy|3dsguy]] 02:59, 27 November 2011 (CET)

Yes, that's why my pictures are the same. I thought I'd show some stuff that 3DBrew doesn't documented yet. Also I would avoid bringing this to a public event as this is my only copy of the developer 3ds, and if I was caught by a nintendo employee that wouldn't be great :p I came across an interesting format while digging through the lib, it wasn't even mentioned in nintendo's documentation lol so I'm still learning what it does exactly. I'll add my findings to the file format list here, just know it wasn't much yet--[[User:Xcution|Xcution]] 03:50 27 November 2011

Well thanks for the info on CECLotcheckTool, you gave me enough to get me started on working out on what it does, you should see my findings on my 3DS Development Unit Software page soon. Also WM Test is a wireless test app, more info should also appear on my page soon.--[[User:3dsguy|3dsguy]]

Ah, right. WM Test was for wireless according to lib. Also I updated the format list with 3 formats noted in the compiler, but hidden from documentation. I also found 1 more format which I did not list yet, called OLS. It seems to be something similar to a CIA but I remember seeing it somewhere documented in the lib so I'm checking it out. Also, I've figured out the format of RSF so maybe I'll add that to 3DBrew documentations soon.--[[User:Xcution|Xcution]]

[[User:Xcution|Xcution]], can you upload any files with an undocumented format (mentioned in [[File Formats]]) that we can document them successfuly? Maybe we are also able to find out their purpose.--[[User:Lazymarek9614|Lazymarek9614]] 11:29, 27 November 2011 (CET)

[[User:Lazymarek9614|Lazymarek9614]] unfortunately not all of them. The best I could get you guys would be CFA, NSA, RSF, AXF, BCWAV, and DESC files but not the few I've found in the lib. btw RSF and DESC are both in plain text. I could also make you guys some custom CXI's to see but I'm not sure how useful they would be to anyone. Lib references Common Header Keys also. I have successfully generated my own CXI file (Hello World), can I upload it here? It had to be made with a nintendo linker but I made the file so does it count as "copyrighted" by nintendo? they didn't approve of this work so I don't think so but I'd rather be safe than sorry.--[[User:Xcution|Xcution]]

I'm not sure about the copyright... Can you upload the other formats first (if you are allowed to) and wait until you're sure about the copyright stuff. Are the common header keys for 3ds test units only or for the public normal 3ds? I think not all formats are useful for us, but the CXI is.--[[User:Lazymarek9614|Lazymarek9614]] 12:06, 27 November 2011 (CET)

Ah. I'll see about those. The Common Header Keys are likely for both retail and dev 3ds because lib allows building for both retail and dev files using the same keys, however I don't know if they are dummy keys like the RSA are. I'll try to get the format BCWAV (3DS Audio Wave files) soon.--[[User:Xcution|Xcution]]

OK, so please look for the keys you can get & publish legal and upload some files.--[[User:Lazymarek9614|Lazymarek9614]] 16:18, 27 November 2011 (CET)
:I wouldn't recommend uploading anything to 3dbrew because it *might* be illegal. I recommend using the PM in gbatemp to ask. There are only few people here that would benefit from looking at these files (and by saying 'these' i don't mean any specific files). --[[User:Elisherer|Elisherer]] 17:03, 27 November 2011 (CET)
::Yes, it has to be legal! [[User:Xcution|Xcution]], maybe if you want to send me 'these' files, click on my username to see the e-mail contact and don't upload anything illegal on 3dbrew.--[[User:Lazymarek9614|Lazymarek9614]] 18:57, 27 November 2011 (CET)
Can you send me also, please? --[[User:Jocopoco|Jocopoco]] 19:33, 27 November 2011 (CET)
:::Just because Nintendo SDKs can build software for retail doesn't mean they include the retail AES key(s). When devs send binaries for RSA signing Nintendo takes care of encrypting the binaries with the retail keys as well.(AFAIK they have *never* included retail keys in their SDKs) --[[User:Yellows8|Yellows8]] 03:31, 28 November 2011 (CET)
:::: ^ This is true but DSi/Twl development builds actually do run on retail systems. ;P --[[User:Jl12|Jl12]]
:::: Also, I think you mean "release" builds. Development builds have debugging functions enabled and aren't optimized. The SDK can build retail (release) builds that include optimization and are stripped of debugging information and some internal debug flags. This is to get ready for retail ROM mastering. It doesn't mean it uses retail encryption or signing methods. (It doesn't.) --[[User:Jl12|Jl12]]
:::::"DSi/Twl development builds actually do run on retail systems" After those builds are sent to Nintendo for retail RSA signing and modcrypt encryption, sure. --[[User:Yellows8|Yellows8]] 04:41, 30 November 2011 (CET)
:::::: ^ No, I mean that just like it sounds. Development builds can be ran on retail units prior to being mastered by Nintendo. I've tried this. --[[User:Jl12|Jl12]]

I wouldn't think they contained retail keys, Yellow8, just it contained some keys (probably dummy keys) called Common Header Keys and they seemed interesting for a moment imho I didn't see your post there lol I'm still considering whether or not they're legal. In a way, they are legal because I'm not technically hired by Nintendo so the CXIs, CIAs, etc I make are not copyrighted by them like retail or licensed developers, but in another way it's not legal because I am using part of the lib to make the files. Gah!--[[User:Xcution|Xcution]]
:It's not necessary to document *all* the formats their toolchain uses that are *never* used on retail at all IMO.(like those temporary files used during CXI building) --[[User:Yellows8|Yellows8]] 03:31, 28 November 2011 (CET)

Ok, after some thought and looking around here I shouldn't have a problem posting non-commercial (and not copyrighted for developers, ie DevMen or Config) CIAs because user Jl12 has done this without having a problem with copyrights. CFA is essentially a bundle of CIAs so I shouldn't have a copyright issue there as long as the CIAs inside are not commercial and not developer copyrighted (ie I can't post commercial or DevMen/Config/etc), however according to Jl12's upload of his custom CIA it is OK to upload custom CIAs, and in essence CFAs. I'm looking into the legality of other formats, though.--[[User:Xcution|Xcution]]

* Please only post what you've written/compiled yourself, no files from the SDK(s) or that has been mastered by N. ( such as roms, etc. ). --[[User:Jl12|Jl12]]

Today I'll start documenting a little bit of what I find. Currently I'm still learning so this'll probably be amended a lot.

'''CSU : (CTR System Updater)'''

NCSD block starts @ offset 0x00000100

NCCH block starts @ offset 0x00001100

CSU Program ID / Title ID @ offset 0x00001150

NCCH block starts @ offset 0x00004100

CSU Program ID / Title ID @ offset 0x00004150

CSU have Program IDs similar to CIA...(either a name or CTR-X-XXXX)

:Seems just like [[CCI]], maybe CCI isn't really a format, rather then a use for that "multiple CIAs" format. --[[User:Elisherer|Elisherer]] 22:17, 27 November 2011 (CET)

Hi Elisherer, is not exact format as [[CCI]] actually. Just I show the most plain objects. CSU does '''not''' have SDK informations shown (example : [SDK+NINTENDO:CTR_SDK-0_14_23_200_none]) like CCI has, or CSU has not this in plain text like CCI has.. --[[User:Xcution|Xcution]]

* Note, you can't decrypt .CSU with the same development keys a CCI/CIA can be decrypted with, not sure if that's because it has a different set of keys or because of a difference of format though. I admit I haven't dug deeply. CCI/CSU do appear very similar and both need to be burned to a blank cartridge to be ran. --[[User:Jl12|Jl12]]

'''CTR Fun Facts :'''

Before release, CTR was in development back in 2009 under the codename "Horizon". Unfortunately lib doesn't give what "CTR" stands for =p--[[User:Xcution|Xcution]]

* Sup Xcution. this is gshock, though you probably could guess that from the userid. \o/
* Maybe you guys can consider taking this conversation to n-dev.net lol --[[User:Jl12|Jl12]]

Talk:3DSExplorer

2011-11-30T02:41:59Z

Jl12:

Now I figured that I didn't explain the target of this app... It's suppose to be an Explorer like program to see inside the different filesystems that the 3ds has. Now it's the ExeFS, RomFS and SAVE. As knownledge keep flowing i'll continue to develop the application. With the goal of making a full functional drag&drop file explorer for image files. --[[User:Elisherer|Elisherer]] 18:35, 15 September 2011 (CEST)

It fails showing the tmd file content. Have you finshed working on this feature?--[[User:Lazymarek9614|Lazymarek9614]] 15:49, 20 September 2011 (CEST)
:No, I don't have time to work on it..it's not interesting enough --[[User:Elisherer|Elisherer]] 15:36, 21 September 2011 (CEST)
::Yeah, the 3DS doesn't care when the tmd file was modified... it's not useful for hacking.--[[User:Lazymarek9614|Lazymarek9614]] 21:09, 21 September 2011 (CEST)

I downloaded the sources,but I can't find Save.cs and reference "System.Development". Matyapiro31
:You are right... I fixed it.. notice that the source is not the released version it has some experimental stuff in it... --[[User:Elisherer|Elisherer]] 10:53, 30 September 2011 (CEST)

Do you know [http://monodevelop.com/ Mono Develop]?
You can release it as multi-patform,such as Linux,Machitosh,etc.
:I did not know that until now. But I don't have time to make the transition. I'm happy with VS2008 and it's relatively easy to make changes and new features for the app. The source is open and you can make a linux port if you want. --[[User:Elisherer|Elisherer]] 18:16, 30 September 2011 (CEST)
:You need no change.mono can run c# program like Java VM. Matyapiro31
::I tried to compile it,but That was old one,and there is "System.development."
:::[http://stackoverflow.com/questions/5865060/c-on-os-x-and-linux This] says that I need to fix stuff after I convert my project. and then work with the mono app which I don't find very convinient... and about the reference I don't know what it's about..I don't know a namespace called System.Development --[[User:Elisherer|Elisherer]] 17:42, 2 October 2011 (CEST) (P.s you can sign your messages with the quick signature button or 4 tildes: '~' 4 times)

lblBrew_Click() had no exception handler,

you have to change this method in fmExplorer.cs to
private void lblBrew_Click(object sender, EventArgs e)
{
try
{
System.Diagnostics.Process.Start(lblBrew.Text);
}
catch (Exception ex)
{
MessageBox.Show("Cannot open link that was clicled.\n"+ ex.Message);
}
}

Matyapiro31

The algorithm for the Image Hash might be either MD2 or MD4. I found out by using HxD and Notepad. --[[User:Kiddyshaq34|Kiddyshaq34]]
:Ok, but of what? (i know it's suppose to be 128 bit) And why not MD-5? --[[User:Elisherer|Elisherer]] 07:10, 9 October 2011 (CEST)
::Because MD5 is longer and the Image Hash has the same number of bytes as MD2 and MD4.
:::MD2, 4 & 5 are all 128bit which is 0x10 bytes... --[[User:Elisherer|Elisherer]] 20:28, 9 October 2011 (CEST)
::::Oh, I've forgotten about MD5. You are right.

3DS include RSA Securuty 's [http://www.rsa.com/node.aspx?id=1204 BSafe]

from 3DS manual. Matyapiro31
:Thanks Matyapiro31 but I think RSA is used for encryption and *not* hashing. So the RSA might be used for ROMs and WiFi... --[[User:Elisherer|Elisherer]] 14:48, 9 October 2011 (CEST)

あほ。RSA BSafe support all security method.See [http://www.rsa.com/japan/products/bsafe/CRYPTOCJ_DS_1101-J.pdf this.]

I cannot find English version,sorry.
Matyapiro31
:I guess if you mean [http://www.rsa.com/node.aspx?id=3063 this] then the digest algorithms are the ones that we know of..we havn't tried HMAC yet or CNG but from experience we see that nintendo uses regular digest algorithms like CRC16-Modbus and SHA-256. I'll add the HMAC ones to the brute force hash tool to see if it finds something... --[[User:Elisherer|Elisherer]] 22:36, 12 October 2011 (CEST)

I've tried to decrypt 'Super Mario 3D Land' but your tool shows me an 'Corrupt Save File' error.--[[User:Lazymarek9614|Lazymarek9614]] 18:36, 18 November 2011 (CET)
:Corrupted save file might be from 2 reasons: * Size is not right (128K or 512k) * CRC on wearleveling wrong. Both problems occur from NDS adapter plus malfunctioning...try blowing on the cart and the adapter and download the savefile again... --[[User:Elisherer|Elisherer]] 20:16, 18 November 2011 (CET)
::I actually don't use the useless NDS Adapter Plus, but I used DSM and I've tried it two times (always the same data).. I hope Nintendo doesn't use a new encryption now! Shall I send you the sav file?--[[User:Lazymarek9614|Lazymarek9614]] 20:27, 18 November 2011 (CET)
:::Yes please, I could check it within the application... --[[User:Elisherer|Elisherer]] 20:35, 18 November 2011 (CET)
::::Have you found anything?--[[User:Lazymarek9614|Lazymarek9614]] 21:25, 18 November 2011 (CET)
:::::No..it's seems that the key found isn't the right key (even that it appears 4 times in the file). we need to figure out how to decrypt the save files without searching blindly for the key. --[[User:Elisherer|Elisherer]] 21:33, 18 November 2011 (CET)
:::::I got an idea. Xor the image's 0x100-0x103 with every (0x200 block)'s 0x100-0x103 to see if it produces 'DISA' ..it should work with the already known files and might be faster to find. i'll try it tomorrow.. --[[User:Elisherer|Elisherer]] 21:40, 18 November 2011 (CET)
::::::Mind linking to a SM3DL save here so I could look at it?(Btw, you're not looking for a "key", you're looking for an AES-CTR xorpad.) --[[User:Yellows8|Yellows8]] 06:03, 22 November 2011 (CET)
:::::::I'll ask for permission. In the meanwhile, can we talk about it at n-dev.net? I made a [http://n-dev.net/showthread.php?tid=4 thread] there. --[[User:Elisherer|Elisherer]] 16:26, 22 November 2011 (CET)
::::::::Yes, you can share them!--[[User:Lazymarek9614|Lazymarek9614]] 17:24, 22 November 2011 (CET)
:::::::::I'm not going to register on some 3dbrew-related forum not hosted on the server that 3dbrew is.(Also, I already saw that thread) --[[User:Yellows8|Yellows8]] 17:38, 22 November 2011 (CET)
::::::::::If you're worried about email just use mailinator.com and throw it away. If you're worried about the password, the forum is set to mail you a random password it generates, so you don't even enter one unless you change it manually. I don't want to push the issue but I doubt registering there is going to cause any security concerns. I can also turn on HTTPS/SSL but probably overkill. It's really just a place to organize discussions, not host your secure data. --[[User:Jl12|Jl12]]

:::::::Catch the files on my server [http://www.sherer.co.il/saves http://www.sherer.co.il/saves] (Super Mario 3D Land).--[[User:Elisherer|Elisherer]] 17:43, 22 November 2011 (CET)
::::::::I'm stumped too. Since some chunks of data appears several times in these saves, in theory the CTR should still be repeating.(CTR seems to repeat >0x200 bytes now, not sure.) Didn't really manage to decrypt much via xor. --[[User:Yellows8|Yellows8]] 22:08, 22 November 2011 (CET)
::::::::I would guess they finally fixed the bug that limited the xor stream to just 0x200 bytes repeating, and now it behaves more like the data saved to SD cards? --[[User:Neimod|Neimod]] 01:30, 25 November 2011 (CET)
::::::::But you can see that same blocks share the same xorpad in the file...the DISA header is in the file 4 times and encrypted the same all the 4 times.. so the key may not repeat but maybe every block has it's own xorpad based on its offset in the image (my speculation) --[[User:Elisherer|Elisherer]] 09:02, 25 November 2011 (CET)

User talk:Xcution

2011-11-30T01:59:11Z

Jl12:

Hi.

Today I bring news of 2 developer applications which I did not see in "3DS Development Unit Software" :

CecLotCheckTool and WM Test

[[File:Ceclotchecktool.jpg|500px|thumb|right|CECLotCheckTool]]

[[File:Devmen2app.jpg|500px|thumb|right|Picture of WM Test (In DevMen)]]

CecLotCheckTool and WM Test tools do not appear to have an icon.

'''Info CecLotCheckTool :'''

First, you may wonder what "CEC" stands for. It means Chance Encounter Communication, AKA StreetPass. It is noted by lib that StreetPass is not possible between a dev unit and a retail system. CECLotCheckTool is used to check StreetPass info. Unfortunately, I only have 1 dev unit =p so I can't really do a whole lot with this, since it's only developer unit -> developer unit. I still think it's interesting though..

'''Info WM Test :'''

Unfortunately I do not have pictures of WM Test as it seems to freeze on my somewhat outdated rev although lib/sdk states it is a TWL program BUT lib states WM Test has 2 unique features :

It runs through DevMen in "TWL Compatibility" mode AND runs in "Noise mode"

And another unfortunate point to bring is I could not find so far information about these 2 modes, which is sort of a let down =/ but interesting that it notes those two things.

Are you Collosalpokemon from GBA Temp, because they look like his(or her) photos--[[User:3dsguy|3dsguy]] 02:54, 27 November 2011 (CET)

Also if you want to test streetpass between dev 3DSs, your best chance of doing this is at a nintendo public event where they are likly to have 3DS demos running on Dev 3DSs.--[[User:3dsguy|3dsguy]] 02:59, 27 November 2011 (CET)

Yes, that's why my pictures are the same. I thought I'd show some stuff that 3DBrew doesn't documented yet. Also I would avoid bringing this to a public event as this is my only copy of the developer 3ds, and if I was caught by a nintendo employee that wouldn't be great :p I came across an interesting format while digging through the lib, it wasn't even mentioned in nintendo's documentation lol so I'm still learning what it does exactly. I'll add my findings to the file format list here, just know it wasn't much yet--[[User:Xcution|Xcution]] 03:50 27 November 2011

Well thanks for the info on CECLotcheckTool, you gave me enough to get me started on working out on what it does, you should see my findings on my 3DS Development Unit Software page soon. Also WM Test is a wireless test app, more info should also appear on my page soon.--[[User:3dsguy|3dsguy]]

Ah, right. WM Test was for wireless according to lib. Also I updated the format list with 3 formats noted in the compiler, but hidden from documentation. I also found 1 more format which I did not list yet, called OLS. It seems to be something similar to a CIA but I remember seeing it somewhere documented in the lib so I'm checking it out. Also, I've figured out the format of RSF so maybe I'll add that to 3DBrew documentations soon.--[[User:Xcution|Xcution]]

[[User:Xcution|Xcution]], can you upload any files with an undocumented format (mentioned in [[File Formats]]) that we can document them successfuly? Maybe we are also able to find out their purpose.--[[User:Lazymarek9614|Lazymarek9614]] 11:29, 27 November 2011 (CET)

[[User:Lazymarek9614|Lazymarek9614]] unfortunately not all of them. The best I could get you guys would be CFA, NSA, RSF, AXF, BCWAV, and DESC files but not the few I've found in the lib. btw RSF and DESC are both in plain text. I could also make you guys some custom CXI's to see but I'm not sure how useful they would be to anyone. Lib references Common Header Keys also. I have successfully generated my own CXI file (Hello World), can I upload it here? It had to be made with a nintendo linker but I made the file so does it count as "copyrighted" by nintendo? they didn't approve of this work so I don't think so but I'd rather be safe than sorry.--[[User:Xcution|Xcution]]

I'm not sure about the copyright... Can you upload the other formats first (if you are allowed to) and wait until you're sure about the copyright stuff. Are the common header keys for 3ds test units only or for the public normal 3ds? I think not all formats are useful for us, but the CXI is.--[[User:Lazymarek9614|Lazymarek9614]] 12:06, 27 November 2011 (CET)

Ah. I'll see about those. The Common Header Keys are likely for both retail and dev 3ds because lib allows building for both retail and dev files using the same keys, however I don't know if they are dummy keys like the RSA are. I'll try to get the format BCWAV (3DS Audio Wave files) soon.--[[User:Xcution|Xcution]]

OK, so please look for the keys you can get & publish legal and upload some files.--[[User:Lazymarek9614|Lazymarek9614]] 16:18, 27 November 2011 (CET)
:I wouldn't recommend uploading anything to 3dbrew because it *might* be illegal. I recommend using the PM in gbatemp to ask. There are only few people here that would benefit from looking at these files (and by saying 'these' i don't mean any specific files). --[[User:Elisherer|Elisherer]] 17:03, 27 November 2011 (CET)
::Yes, it has to be legal! [[User:Xcution|Xcution]], maybe if you want to send me 'these' files, click on my username to see the e-mail contact and don't upload anything illegal on 3dbrew.--[[User:Lazymarek9614|Lazymarek9614]] 18:57, 27 November 2011 (CET)
Can you send me also, please? --[[User:Jocopoco|Jocopoco]] 19:33, 27 November 2011 (CET)
:::Just because Nintendo SDKs can build software for retail doesn't mean they include the retail AES key(s). When devs send binaries for RSA signing Nintendo takes care of encrypting the binaries with the retail keys as well.(AFAIK they have *never* included retail keys in their SDKs) --[[User:Yellows8|Yellows8]] 03:31, 28 November 2011 (CET)
:::: ^ This is true but DSi/Twl development builds actually do run on retail systems. ;P --[[User:Jl12|Jl12]]
:::: Also, I think you mean "release" builds. Development builds have debugging functions enabled and aren't optimized. The SDK can build retail (release) builds that include optimization and are stripped of debugging information and some internal debug flags. This is to get ready for retail ROM mastering. It doesn't mean it uses retail encryption or signing methods. (It doesn't.) --[[User:Jl12|Jl12]]

I wouldn't think they contained retail keys, Yellow8, just it contained some keys (probably dummy keys) called Common Header Keys and they seemed interesting for a moment imho I didn't see your post there lol I'm still considering whether or not they're legal. In a way, they are legal because I'm not technically hired by Nintendo so the CXIs, CIAs, etc I make are not copyrighted by them like retail or licensed developers, but in another way it's not legal because I am using part of the lib to make the files. Gah!--[[User:Xcution|Xcution]]
:It's not necessary to document *all* the formats their toolchain uses that are *never* used on retail at all IMO.(like those temporary files used during CXI building) --[[User:Yellows8|Yellows8]] 03:31, 28 November 2011 (CET)

Ok, after some thought and looking around here I shouldn't have a problem posting non-commercial (and not copyrighted for developers, ie DevMen or Config) CIAs because user Jl12 has done this without having a problem with copyrights. CFA is essentially a bundle of CIAs so I shouldn't have a copyright issue there as long as the CIAs inside are not commercial and not developer copyrighted (ie I can't post commercial or DevMen/Config/etc), however according to Jl12's upload of his custom CIA it is OK to upload custom CIAs, and in essence CFAs. I'm looking into the legality of other formats, though.--[[User:Xcution|Xcution]]

* Please only post what you've written/compiled yourself, no files from the SDK(s) or that has been mastered by N. ( such as roms, etc. ). --[[User:Jl12|Jl12]]

Today I'll start documenting a little bit of what I find. Currently I'm still learning so this'll probably be amended a lot.

'''CSU : (CTR System Updater)'''

NCSD block starts @ offset 0x00000100

NCCH block starts @ offset 0x00001100

CSU Program ID / Title ID @ offset 0x00001150

NCCH block starts @ offset 0x00004100

CSU Program ID / Title ID @ offset 0x00004150

CSU have Program IDs similar to CIA...(either a name or CTR-X-XXXX)

:Seems just like [[CCI]], maybe CCI isn't really a format, rather then a use for that "multiple CIAs" format. --[[User:Elisherer|Elisherer]] 22:17, 27 November 2011 (CET)

Hi Elisherer, is not exact format as [[CCI]] actually. Just I show the most plain objects. CSU does '''not''' have SDK informations shown (example : [SDK+NINTENDO:CTR_SDK-0_14_23_200_none]) like CCI has, or CSU has not this in plain text like CCI has.. --[[User:Xcution|Xcution]]

* Note, you can't decrypt .CSU with the same development keys a CCI/CIA can be decrypted with, not sure if that's because it has a different set of keys or because of a difference of format though. I admit I haven't dug deeply. CCI/CSU do appear very similar and both need to be burned to a blank cartridge to be ran. --[[User:Jl12|Jl12]]

'''CTR Fun Facts :'''

Before release, CTR was in development back in 2009 under the codename "Horizon". Unfortunately lib doesn't give what "CTR" stands for =p--[[User:Xcution|Xcution]]

* Sup Xcution. this is gshock, though you probably could guess that from the userid. \o/
* Maybe you guys can consider taking this conversation to n-dev.net lol --[[User:Jl12|Jl12]]

Talk:CIA

2011-11-20T07:57:36Z

Jl12:

Good work Lazymarek9614, Now 3dsexplorer on the svn is 0.73 (you can download it from the beta link) supports cia. --[[User:Elisherer|Elisherer]] 21:34, 10 November 2011 (CET)
:@Elisherer where is that beta link?--[[User:3dsguy|3dsguy]] 02:39, 11 November 2011 (CET)
::[[3DSExplorer]], bottom of the bage. --[[User:Elisherer|Elisherer]] 08:09, 11 November 2011 (CET)

"Each section is cleartext for dev CIAs, for retail CIAs the APP data is encrypted."
: Dev/Production CIA use the same specification. So I'm not sure what you mean by this.
: The "ctrtool" on the CXI page already parses the CIA format, why re-invent the wheel?
"CIA files can be created with the Nintendo 3DS SDK and installed on the 3DS test units by the Dev Menu."
: Please keep the focus on documentation of the spec., we don't want to explain things from the perspective of SDK users- but for someone that knows (potentially) nothing about the 3DS. The SDK does not tell the whole story of most file formats, and most people don't need to know what the SDK can do for them but what they can do without the SDK. - [[User:Jl12|Jl12]]
::: "Dev/Production CIA use the same specification. So I'm not sure what you mean by this. " I originally worded it that way on the page because both CIAs [[User:3dsguy|3dsguy]] uploaded had cleartext APP data, thus I wasn't sure if CTR-SDK had an option for encrypting the dev CIAs. I don't get why [[User:Elisherer|Elisherer]] re-implements about everything ctrtool already does either... --[[User:Yellows8|Yellows8]] 05:26, 12 November 2011 (CET)
::: - Depending on which one it was, the link that was removed initially was a old presentation from e3. It's just out dated enough that the cia format probably hadn't been finalized. Anything before firmwares 0.10.0 - 0.11.0 neither use LZ compression nor encrypt (!) but - except the use of keys, the SDK now produces .cia with close to retail specs. [[User:Jl12|Jl12]]
::::If you like working with the windows command line be my guest. I got more progress looking at the files with 3dsexplorer... (And i'm not re-inventing 3dsexplorer didn't support cia so I added it, I will continue fixing the structure to be as accurate it can be) --[[User:Elisherer|Elisherer]] 09:48, 12 November 2011 (CET)
::::: - I was thinking more the wiki and the "documentation" of the structures then 3dsexplorer tool. (I thought this was based on binaries, though) [[User:Jl12|Jl12]]
:::::I personaly like a command line tool more, but it's really annoying to have for each format another tool. Shall I create a new page for the certs and tickets?--[[User:Lazymarek9614|Lazymarek9614]] 15:06, 13 November 2011 (CET)
::::::The format of the certs/tickets seem to be the same as before,(besides the new signature types already described on the TMD page) not really necessary to create pages for those.(Any info on what cert is used to sign what should be on a /sys/cert.sys page or so later IMO) [[User:Elisherer|Elisherer]], you're re-inventing the wheel aka re-implementing CXI/CIA code which ctrtool had for months, which is a waste of time IMO. --[[User:Yellows8|Yellows8]] 19:24, 13 November 2011 (CET)
:::::::[[User:Yellows8|Yellows8]], I didn't write any new code for the CXI/CCI/TMD/CIA opening, I just copied it from the ctrtool (as I mentioned when I just written the app). The rest (which is the SAVE flash) became the prime goal of the app and with it I discovered a lot of new information. I try implementing most of the file structures we know so it would be more accessible to everyone (Hoping it would help solving more mysteries). I know that now it's not clear why 3dsexplorer opens these sort of files but with time more information will come and it will grow to extract more important information. I hope you understand. --[[User:Elisherer|Elisherer]] 20:27, 13 November 2011 (CET)
::::::Sorry guys, this discussion doesn't really has anything to do with the CIA format. Please choose another page for this or stop it now. @ [[User:Yellows8|Yellows8]]: I think it's not important to create a new page for it too, only some links to the TMD format and wiibrew wiki are necessary.--[[User:Lazymarek9614|Lazymarek9614]] 20:44, 13 November 2011 (CET)
:::::::Other than that TMD code, that CXI/CIA code looks nothing like the ctrtool code to me - but whatever. --[[User:Yellows8|Yellows8]] 22:07, 13 November 2011 (CET)

: Maybe you guys would like a forum... it would be less clumsy or interefering to the wiki then plastering talk page with comments. Not to mention we could use pictures and attach files directly. I don't mind setting up something like that if it's actually going to be used. [[User:Jl12|Jl12]]
::I think a forum is not a bad idea, but I also don't mind using the Talk page on the wiki aslong as it is relevant. Maybe [[User:Mha|Mha]] can take a look into setting up a forum on the 3dbrew host? --[[User:Neimod|Neimod]] 21:51, 18 November 2011 (CET)
* http://n-dev.net
[[User:Jl12|Jl12]]
: I prefer having a forum running on the 3dbrew host and managed by the 3dbrew administrators. The forum link above is fine for now as a temporary measure. --[[User:Neimod|Neimod]] 04:48, 20 November 2011 (CET)

Is there any reason it has to be on the 3dbrew host? If it's an issue of forum management I can just move your account(s) to the administrator group. Nobody's forced to use it, of course. [[User:Jl12|Jl12]]

Talk:CIA

2011-11-19T08:21:48Z

Jl12: *forum link: n-dev.net

Talk:CIA

2011-11-14T04:50:26Z

Jl12:

Talk:CIA

2011-11-14T04:33:18Z

Jl12:

Good work Lazymarek9614, Now 3dsexplorer on the svn is 0.73 (you can download it from the beta link) supports cia. --[[User:Elisherer|Elisherer]] 21:34, 10 November 2011 (CET)
:@Elisherer where is that beta link?--[[User:3dsguy|3dsguy]] 02:39, 11 November 2011 (CET)
::[[3DSExplorer]], bottom of the bage. --[[User:Elisherer|Elisherer]] 08:09, 11 November 2011 (CET)

"Each section is cleartext for dev CIAs, for retail CIAs the APP data is encrypted."
: Dev/Production CIA use the same specification. So I'm not sure what you mean by this.
: The "ctrtool" on the CXI page already parses the CIA format, why re-invent the wheel?
"CIA files can be created with the Nintendo 3DS SDK and installed on the 3DS test units by the Dev Menu."
: Please keep the focus on documentation of the spec., we don't want to explain things from the perspective of SDK users- but for someone that knows (potentially) nothing about the 3DS. The SDK does not tell the whole story of most file formats, and most people don't need to know what the SDK can do for them but what they can do without the SDK. - [[User:Jl12|Jl12]]
::: "Dev/Production CIA use the same specification. So I'm not sure what you mean by this. " I originally worded it that way on the page because both CIAs [[User:3dsguy|3dsguy]] uploaded had cleartext APP data, thus I wasn't sure if CTR-SDK had an option for encrypting the dev CIAs. I don't get why [[User:Elisherer|Elisherer]] re-implements about everything ctrtool already does either... --[[User:Yellows8|Yellows8]] 05:26, 12 November 2011 (CET)
::: - Depending on which one it was, the link that was removed at first, was a old presentation from e3. It's just out dated enough that the cia format probably hadn't been finalized. Anything before firmwares 0.10.0 - 0.11.0 neither use LZ compression nor encrypt (!) but - except the use of keys, the SDK now produces .cia with close to retail specs. [[User:Jl12|Jl12]]
::::If you like working with the windows command line be my guest. I got more progress looking at the files with 3dsexplorer... (And i'm not re-inventing 3dsexplorer didn't support cia so I added it, I will continue fixing the structure to be as accurate it can be) --[[User:Elisherer|Elisherer]] 09:48, 12 November 2011 (CET)
::::: - I was thinking more the wiki and the "documentation" of the structures then 3dsexplorer tool. (I thought this was based on binaries, though) [[User:Jl12|Jl12]]
:::::I personaly like a command line tool more, but it's really annoying to have for each format another tool. Shall I create a new page for the certs and tickets?--[[User:Lazymarek9614|Lazymarek9614]] 15:06, 13 November 2011 (CET)
::::::The format of the certs/tickets seem to be the same as before,(besides the new signature types already described on the TMD page) not really necessary to create pages for those.(Any info on what cert is used to sign what should be on a /sys/cert.sys page or so later IMO) [[User:Elisherer|Elisherer]], you're re-inventing the wheel aka re-implementing CXI/CIA code which ctrtool had for months, which is a waste of time IMO. --[[User:Yellows8|Yellows8]] 19:24, 13 November 2011 (CET)
:::::::[[User:Yellows8|Yellows8]], I didn't write any new code for the CXI/CCI/TMD/CIA opening, I just copied it from the ctrtool (as I mentioned when I just written the app). The rest (which is the SAVE flash) became the prime goal of the app and with it I discovered a lot of new information. I try implementing most of the file structures we know so it would be more accessible to everyone (Hoping it would help solving more mysteries). I know that now it's not clear why 3dsexplorer opens these sort of files but with time more information will come and it will grow to extract more important information. I hope you understand. --[[User:Elisherer|Elisherer]] 20:27, 13 November 2011 (CET)
::::::Sorry guys, this discussion doesn't really has anything to do with the CIA format. Please choose another page for this or stop it now. @ [[User:Yellows8|Yellows8]]: I think it's not important to create a new page for it too, only some links to the TMD format and wiibrew wiki are necessary.--[[User:Lazymarek9614|Lazymarek9614]] 20:44, 13 November 2011 (CET)
:::::::Other than that TMD code, that CXI/CIA code looks nothing like the ctrtool code to me - but whatever. --[[User:Yellows8|Yellows8]] 22:07, 13 November 2011 (CET)

Talk:CIA

2011-11-14T04:31:51Z

Jl12:

Good work Lazymarek9614, Now 3dsexplorer on the svn is 0.73 (you can download it from the beta link) supports cia. --[[User:Elisherer|Elisherer]] 21:34, 10 November 2011 (CET)
:@Elisherer where is that beta link?--[[User:3dsguy|3dsguy]] 02:39, 11 November 2011 (CET)
::[[3DSExplorer]], bottom of the bage. --[[User:Elisherer|Elisherer]] 08:09, 11 November 2011 (CET)

"Each section is cleartext for dev CIAs, for retail CIAs the APP data is encrypted."
: Dev/Production CIA use the same specification. So I'm not sure what you mean by this.
: The "ctrtool" on the CXI page already parses the CIA format, why re-invent the wheel?
"CIA files can be created with the Nintendo 3DS SDK and installed on the 3DS test units by the Dev Menu."
: Please keep the focus on documentation of the spec., we don't want to explain things from the perspective of SDK users- but for someone that knows (potentially) nothing about the 3DS. The SDK does not tell the whole story of most file formats, and most people don't need to know what the SDK can do for them but what they can do without the SDK. - [[User:Jl12|Jl12]]
::: "Dev/Production CIA use the same specification. So I'm not sure what you mean by this. " I originally worded it that way on the page because both CIAs [[User:3dsguy|3dsguy]] uploaded had cleartext APP data, thus I wasn't sure if CTR-SDK had an option for encrypting the dev CIAs. I don't get why [[User:Elisherer|Elisherer]] re-implements about everything ctrtool already does either... --[[User:Yellows8|Yellows8]] 05:26, 12 November 2011 (CET)
::: - Depending on which one it was, the link that was removed at first, was a old presentation from e3. It's just out dated enough that the cia format probably hadn't been finalized. Anything before firmwares 0.10.0 - 0.11.0 neither use LZ compression nor encrypt (!) but except the use of keys, the SDK now produces .cia with close to retail specs. - [[User:Jl12|Jl12]]
::::If you like working with the windows command line be my guest. I got more progress looking at the files with 3dsexplorer... (And i'm not re-inventing 3dsexplorer didn't support cia so I added it, I will continue fixing the structure to be as accurate it can be) --[[User:Elisherer|Elisherer]] 09:48, 12 November 2011 (CET)
::::: - I was thinking more the wiki and the "documentation" of the structure then the 3dsexplorer tool. (I thought this was based on binaries, though) - [[User:Jl12|Jl12]]
:::::I personaly like a command line tool more, but it's really annoying to have for each format another tool. Shall I create a new page for the certs and tickets?--[[User:Lazymarek9614|Lazymarek9614]] 15:06, 13 November 2011 (CET)
::::::The format of the certs/tickets seem to be the same as before,(besides the new signature types already described on the TMD page) not really necessary to create pages for those.(Any info on what cert is used to sign what should be on a /sys/cert.sys page or so later IMO) [[User:Elisherer|Elisherer]], you're re-inventing the wheel aka re-implementing CXI/CIA code which ctrtool had for months, which is a waste of time IMO. --[[User:Yellows8|Yellows8]] 19:24, 13 November 2011 (CET)
:::::::[[User:Yellows8|Yellows8]], I didn't write any new code for the CXI/CCI/TMD/CIA opening, I just copied it from the ctrtool (as I mentioned when I just written the app). The rest (which is the SAVE flash) became the prime goal of the app and with it I discovered a lot of new information. I try implementing most of the file structures we know so it would be more accessible to everyone (Hoping it would help solving more mysteries). I know that now it's not clear why 3dsexplorer opens these sort of files but with time more information will come and it will grow to extract more important information. I hope you understand. --[[User:Elisherer|Elisherer]] 20:27, 13 November 2011 (CET)
::::::Sorry guys, this discussion doesn't really has anything to do with the CIA format. Please choose another page for this or stop it now. @ [[User:Yellows8|Yellows8]]: I think it's not important to create a new page for it too, only some links to the TMD format and wiibrew wiki are necessary.--[[User:Lazymarek9614|Lazymarek9614]] 20:44, 13 November 2011 (CET)
:::::::Other than that TMD code, that CXI/CIA code looks nothing like the ctrtool code to me - but whatever. --[[User:Yellows8|Yellows8]] 22:07, 13 November 2011 (CET)

User talk:Yellows8

2011-11-14T03:50:23Z

Jl12:

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]

CIA

2011-11-12T02:06:20Z

Jl12:

=== Overview ===
CIA stands for '''C'''TR '''I'''mportable '''A'''rchive. These files contain a compiled application which can be installed on CTR NAND, TWL NAND (part of the NAND used by DSi applications) and on the SD card.

=== Format ===
The CIA format has a similar structure to the [http://wiibrew.org/wiki/Wad WAD format].

The file is represented in little-endian.

The data is aligned in 64 byte blocks (if a content ends at the middle of the block, the next content will begin from a new block).

== CIA Header ==

This is a 32 bytes long header (8 x uint32).

{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x00
| 0x04
| Archive Header Size (=0x2020 bytes) (Starts with 0x80 @ offset 0x0020)
|-
| 0x04
| 0x04
| Reserved = 0
|-
| 0x08
| 0x04
| Certificate chain size
|-
| 0x0C
| 0x04
| Ticket size
|-
| 0x10
| 0x04
| TMD file size
|-
| 0x14
| 0x04
| Banner size (0 if no banner)
|-
| 0x18
| 0x04
| APP file size
|-
| 0x1C
| 0x04
| 0x80000000
|}

The order of the sections in the header also is the order of them in the CIA file:
* certificate chain
* Ticket
* TMD file data
* APP file data
* banner
Each section is cleartext for dev CIAs, for [[Download_Play|retail]] CIAs the APP data is encrypted.

== Banner ==
The banner starts with a 0xF0 large data block, whose purpose is currently unknown. Then at offset 0x400 into the banner section is the actual banner, which contains information about the creator, the first title and the second title (you can see them in the system settings):
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x00
| 0x04
| Magic: 'SMDH'
|-
| 0x05
| 0x04
| Reserved = 0
|}
This small 'header' is immediately followed by a 0x80 large block for the application name (first title) and then a 0x100 bytes large block for the second title (this title will be shown in the system settings). After that there's alway the same order:
* publisher name (aligned to 0x80 bytes)
* first title (aligned to 0x80 bytes)
* second title (aligned to 0x100 bytes)
This order will repeat 10 times, thus there's a 0x1660 bytes large space for these information.

Talk:CIA

2011-11-12T02:06:04Z

Jl12:

Talk:Hardware

2011-11-07T16:34:32Z

Jl12: *

If the CPU is ARM does it have JTAG or SWD test access points.

We need a datasheet about the ARM11!

I thought the ARM11 has a JTAG support?
How can we dump the NAND, through its pinout yes, but how can we do it exactly? I would like to do some tests on it to see how it works.--[[User:Lazymarek9614|Lazymarek9614]] 23:36, 10 September 2011 (CEST)
:The ARM11 IP (intellectual property) has JTAG support, however this port can probably be permanently disabled internally. So there is no way of knowing if this port even still works or exists in the first place.
:For dumping NAND, you need to hook up the NAND pins to an FPGA or microcontroller. Then you need to follow the eMMC hardware protocol to read out the data in the various sectors. --[[User:Neimod|Neimod]] 07:06, 11 September 2011 (CEST)
:- Was there data on the raw NAND dumps that wasn't encrypted? Also, was it from a retail unit?
:- Are pins exposed underneath the white-banding on the edges of the 3 largest chips? thx [[User talk:Jl12|Jl12]]

Are there any photos of the back of the 3DS's PCB? Anything available in a higher resolution (front or back)? Closeups of the SoC and surrounding components (front and back)? Any help greatly appreciated, thanks! --[[User:CHR15x94|CHR15x94]] 00:35, 13 September 2011 (CEST)
:You could ask the [http://www.youtube.com/watch?v=OFoZGt8tCNw&feature=related Doctor] --[[User:Elisherer|Elisherer]] 19:16, 13 September 2011 (CEST)
::Hop... found [http://tvgzone.com/viewthread.php?tid=6136&highlight=3ds some]. Maybe we should add them to our page? --[[User:Elisherer|Elisherer]] 19:23, 13 September 2011 (CEST)
:::That's [http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/2 from] [http://guide-images.ifixit.net/igi/IkjXAUHUgmdZch6A.large iFixit], which is already linked to on the page. --[[User:Yellows8|Yellows8]] 20:50, 13 September 2011 (CEST)
::::Crap, I always manage to miss things like that... >_< Anyway, thanks Elisherer and Yellows8. --[[User:CHR15x94|CHR15x94]] 21:11, 13 September 2011 (CEST)

Yes, please add them or replace the existing ones if nesessary.--[[User:Lazymarek9614|Lazymarek9614]]

Talk:Hardware

2011-11-07T15:18:06Z

Jl12:

If the CPU is ARM does it have JTAG or SWD test access points.

We need a datasheet about the ARM11!

I thought the ARM11 has a JTAG support?
How can we dump the NAND, through its pinout yes, but how can we do it exactly? I would like to do some tests on it to see how it works.--[[User:Lazymarek9614|Lazymarek9614]] 23:36, 10 September 2011 (CEST)
:The ARM11 IP (intellectual property) has JTAG support, however this port can probably be permanently disabled internally. So there is no way of knowing if this port even still works or exists in the first place.
:For dumping NAND, you need to hook up the NAND pins to an FPGA or microcontroller. Then you need to follow the eMMC hardware protocol to read out the data in the various sectors. --[[User:Neimod|Neimod]] 07:06, 11 September 2011 (CEST)
:- Is there data on the raw NAND dump that '''wasn't''' encrypted? Also was it from a retail unit?
:- Are there actual pins underneath the white-banding (it looks like) on the edges of the 3 largest chips? thx [[User talk:Jl12|Jl12]]

Are there any photos of the back of the 3DS's PCB? Anything available in a higher resolution (front or back)? Closeups of the SoC and surrounding components (front and back)? Any help greatly appreciated, thanks! --[[User:CHR15x94|CHR15x94]] 00:35, 13 September 2011 (CEST)
:You could ask the [http://www.youtube.com/watch?v=OFoZGt8tCNw&feature=related Doctor] --[[User:Elisherer|Elisherer]] 19:16, 13 September 2011 (CEST)
::Hop... found [http://tvgzone.com/viewthread.php?tid=6136&highlight=3ds some]. Maybe we should add them to our page? --[[User:Elisherer|Elisherer]] 19:23, 13 September 2011 (CEST)
:::That's [http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/2 from] [http://guide-images.ifixit.net/igi/IkjXAUHUgmdZch6A.large iFixit], which is already linked to on the page. --[[User:Yellows8|Yellows8]] 20:50, 13 September 2011 (CEST)
::::Crap, I always manage to miss things like that... >_< Anyway, thanks Elisherer and Yellows8. --[[User:CHR15x94|CHR15x94]] 21:11, 13 September 2011 (CEST)

Yes, please add them or replace the existing ones if nesessary.--[[User:Lazymarek9614|Lazymarek9614]]

User talk:Yellows8

2011-11-07T15:09:09Z

Jl12:

User:3dsguy

2011-11-05T14:21:21Z

Jl12:

Hi its me. Hello :)

I have a 3DS Test Unit, which is capable of installing 3DS/DSi applications compiled in the .cia format from an SD card. So while a way to install applications you create yourself, for normal 3DSs is not possible (i.e. homebrew for 3DS is not yet possible), I am willing to test them for you. If you do make any applications you want me to test, send them in an email with a description of what the application is suppose to do and any instructions. And if you want I can send screenshots and feedback (as detailed as I can) I make about the applications you or others may send. You can send them to "devguy@hotmail.com.au".

Please can you post a link to an uploaded example CIA fie?-[[User:Lazymarek9614|Lazymarek9614]] 13:30, 1 November 2011 (CET)

Do you mean one, that someone has sent me? As I do not have any of my own. By the way I will only post links to .cia files if the sender gives me permission.(I have sent an email asking for permission about 5 minutes ago, so I will or will not give a link depending on their response)--[[User:3dsguy|3dsguy]] 14:21, 1 November 2011 (CET)

Yes, that's exactly what I mean. Is there actually a way that I can create CIA files too?--[[User:Lazymarek9614|Lazymarek9614]] 15:54, 1 November 2011 (CET)

I do not know a way of creating .CIA files. its just that [[Jl12]] asked me as part of a set of questions on my talk page:
*"Would you be willing to run pre-compiled apps imported through your dev menu on your test unit? [and if so do you have an email to send them to]"
I said of course, and gave some details. Then, to my surprise, someone responded to that yesterday, emailing me 3 apps to test. This person on the other hand does know how to compile apps in the .cia format and appeared to have access to the DSi SDK from what i gathered from the email. I can tell you that they did not work once installed from the .cia file, but they did install which I was impressed about. But like I said before I'm waiting on a reply on whether I can distribute the .cia files he/she sent me.--[[User:3dsguy|3dsguy]] 22:37, 1 November 2011 (CET)
:This is the problem many people seem to have with the test units. From what I can tell, the only way to actually run some unsigned application (not created by Nintendo) is by programming it on a development flashcard. --[[User:Neimod|Neimod]] 01:11, 2 November 2011 (CET)
:I'm not sure why you deleted your previous post, but I agree that there are '''supposed''' to be different kinds of media (development flashcard, and copying from SD card to internal NAND) that allow running applications on a test unit. However, of these methods, only so far the development flashcard has proven to work with '''unsigned''' code. The problem lies in the fact that the unsigned development CXI image uses a dummy RSA private key to create the RSA signature, while official Nintendo development CXI images use the real deal. So as it stands, no developer can create proper CXI images for CIA importing. --[[User:Neimod|Neimod]] 14:11, 2 November 2011 (CET)
* I sent him 3 pre-compiled apps at first. ( all by Nintendo ). The first two don't boot because they're not compiled with the libs/firmware running on his test-unit. The 3rd TWL NAND app, doesn't have any icon/banner/title to identify itself after being installed, and although it imports/installs succesfully, it can't be selected or launched from Dev Menu or the Home Menu. Later, I sent him a self-built application ( one not by Nint. ), it installs, boots and runs properly and it just displays some information on the screens; those are the files and images he's linked to here. [the "Hello Galaxy!!!" test-application.]
* They're not unsigned. Dev/test units use a different set of keys then the retail/production units do.
* ''So as it stands, no developer can create proper CXI images for CIA importing.'' - What. I've sent self-built apps to test to 3dsguy and somebody else who owns a test unit running on a different firmware. They work fine. ( Although it's difficult to line up firmware revisions. )
* The one that runs was made (compiled/built) using the SDK/firmware revision matching his test-unit.
* He probably removed the 1st link because I asked him not to post anything with ( even potentially ) copyrighted contents for the sake of not getting this wiki associated with it, the binaries contained code from an e3 demo and the TWL/DSi SDK, we're not doing ourselves any benefit by posting it. The app that runs ( 'Hello Galaxy' ) is a self-compiled application, so it's probably not going to be mistaken for a game or another commercial application. [thus probably safe for wiki.] [[User:Jl12|Jl12]]
::Interesting. That's the first I hear about running self compiled CIA's on a test unit. And yes, sorry I said unsigned application, but I meant signed with the development RSA private key provided by the SDK. The official Nintendo development CIA's do not use keys from the SDK, but rather, a private one that is not distributed. --[[User:Neimod|Neimod]] 02:17, 4 November 2011 (CET)

I had a look at your previous post, 3dsguy, where you have posted a download link for a CIA file. We don't know much about CIA files so it was interesting to see a file and look into it. The actual data for the app/tmd/cmd files seems to be encrypted (expected that) there's only some plain text like "Root"", "CA00000004" and "Root-CA00000004" to name a few (...) which obviously are paths on the NAND FS. However, I've found out that the name of the files/directories (eg name of the app file:"ad7e6744") which are saved on the SD card after installing the archieve seem to be in the CIA file: Not as plain text, they're actually hex values. I'm not really sure about that. It would be nice if you could post another CIA file, 3dsguy, that we can compare them and find out more about it. Shall we actually create a new page about CIA files?--[[User:Lazymarek9614|Lazymarek9614]] 21:48, 2 November 2011 (CET)
: They're certificates.
: It's mentioned partially under "[[Download Play]]", because it's another use of the same file format. [[User:Jl12|Jl12]]

Yes I think we should create another page made for .CIA file and move some of this page to its discussion page. But I've got another .cia file and and boots. see [[http://121.215.146.1/3ds/more_cia_stuff.rar]] for everything you may want to know about it and perhaps from this we can start a new page.--[[User:3dsguy|3dsguy]] 07:52, 3 November 2011 (CET)
: I think this is more about getting our own code running on the 3DS/CTR then it is about CIA. [[User:Jl12|Jl12]]

Lazymarek9614, those "paths" are from the cert chain and the ticket. CIA is based on WAD. --[[User:Yellows8|Yellows8]] 16:25, 3 November 2011 (CET)
: If you are right and the format is based on WAD, then it might be little endian (unlike WAD). First there's an unknown byte (0x20) and then 4 bytes (0x20000000), which looks a lot like the header size in WAD (which is 'always' 32, in BE). So if this is the same field, I'm pretty sure it's LE. --[[User:Lesderid|lesderid]] 19:45, 3 November 2011 (CET)

@3dsguy - if the situation changes about being able to get any other test-units please let me know, thanks. [[User:Jl12|Jl12]]

@[[User:Jl12|Jl12]]: Do you have the Nintendo SDK? If so, can you upload it (correct me if this is a crime)?
: If I did, I wouldn't be posting it here, see bullet #5 above. -[[User:Jl12|Jl12]]

@--[[User:Lesderid|lesderid]]: "So if this is the same field, I'm pretty sure it's LE." I think it's HE. Is the header size actually 0x20 large? There's always a 0x80 byte after 0x20 bytes...--[[User:Lazymarek9614|Lazymarek9614]] 22:09, 4 November 2011 (CET)

Who ever has the ip "151.26.190.77" living in Campobasso, Italy, stop probing the website where I've hosted the files. There are no SDKs on that website so stop trying find something that does not exist.--[[User:3dsguy|3dsguy]] 13:13, 5 November 2011 (CET)

Flash Filesystem

2011-11-05T13:54:12Z

Jl12: FAT partition name

===Format===
The format of the Nintendo 3DS's flash filesystem is currently undocumented. Reading of the flash chip is possible through pinouts on the motherboard and has been performed successfully but the data is encrypted and can't be understood without first decrypting it.

===File System===

Each NAND partition is formatted by a FAT file system.

===Encryption===

The NAND file system appears to be encrypted using AES.

===Partitions===

{| class="wikitable" border="1"
|-
! Name
! Description
|-
| firm0
| Firmware partition.
|-
| firm1
| Firmware partition.
|-
| nand
| CTR-NAND File System. (3DS)
|-
| twln
| TWL-NAND File System. (DSi)
|}

Talk:Gamecards

2011-11-03T17:23:49Z

Jl12:

This could be confused for the augmented reality cards. I think they are called cartridges.--[[User:T3a|T3a]] 18:08, 8 April 2011 (CEST)

^ should at least be a redirect ( "Game Cartridges, Game Cart Hardware, Game Carts" )

* 90 00 00 00 00 00 00 00 ... => 45F80090 for SSFIV, C2FF0090 on Rayman3d.
* Is it just me or do these byte orders keep changing. 9000000000000000 corresponds with "C2FE0090" not "9000FEC2".
* ''"header command has some initial dummy bytes, and eventually responds with a 0x200 byte header."''. Dummy bytes, Where? The redundant A500 cmds? --[[User:Jl12|Jl12]]
:You need to endian swap the data. 9000xxxx is the correct form. The upper bits specify information about the intended platform for the gamecard, and the lower bits specify the media size of the card.
:There are dummy bytes in the response for each 16-byte command. In the wiki these dummy bytes have already been stripped. --[[User:Neimod|Neimod]] 17:41, 3 June 2011 (CEST)
Could you post the size of the original header reply with the dummy bytes. I'm trying to inject logic ( send raw commands ) with a 3DS card. It works well up to the 3E 00 00 00 00 00 00 00 command, I get 'data' returned from the header packet as well but only 00 bytes. --[[User:Jl12|Jl12]]
: The size depends on what speed you are clocking out. Just keep reading until you get something that is non-zero. Also, what device are you using for reading out the data? --[[User:Neimod|Neimod]] 09:09, 4 June 2011 (CEST)

http://pastebin.com/y22zZcZN - That's for 'Street Fighter IV 3D'. There's an NCCH header and cartridge ID. The same method returned x00 00... with a different cart, though. Not sure why there's a difference. I actually have it hooked up to a laptop, where a device over USB reads the pins and the 3DS cart is connected to it there. ( ie. the laptop acts as the 3DS. )

http://pastebin.com/38QxNGqn - That's the cart that was returning an empty header. ( "rayman 3D" ). Seems to work, now.

How did you actually decrypt the encrypted commands, Neimod?--[[User:Lazymarek9614|Lazymarek9614]] 21:06, 1 November 2011 (CET)
: Sorry, it is a little too soon to reveal that. --[[User:Neimod|Neimod]] 02:00, 2 November 2011 (CET)
::I think the 3dbrew members are one team, why do you want to hide it?--[[User:Lazymarek9614|Lazymarek9614]] 21:23, 2 November 2011 (CET)

::I see the two sides of the problem here Neimod and Lazymarek9614. This forum like many public homebrew forum,s are there to try to find a way to load Homebrew. Letting everyone know your progress on what you are doing lets people understand how the scene is performing and people who have the knowhow can possibly help. But the downside to this is if Nintendo gets the drift on what you trying to do, they have the advantage, they know how the 3DS better than anyone, so releasing data on some exploits and WIP could lead to Nintendo patching it before it is finalised. Thats the decision the homebrew devs have to make.
::It would cause more harm than good at this point. Showing that progress is being made keeps the community active, but public understanding of the encryption of the gamecard protocol is not vital for the pursuit of homebrew. It would only advance the pursuit of piracy. --[[User:Neimod|Neimod]] 02:47, 3 November 2011 (CET)

* Responsible disclosure. Try not to devalue the 3DS. Nintendo succeeding is also in our best interest, longevity/software wise.
* Don't bolt doors shut before you open them for yourselves. Remember N can patch or change or obfuscate anything posted here.

* Despite what I said. lol. If you can disclose the method without any specific technical information that would be nice. Privately if necessary.

* About the discussion further up on this page, I was able to inject logic. With a laptop and hcs microcontroller. ( microcontroller -> usb -> CTR cartridge ). I can obviously only get as far as what I can do without encryption, as I don't know how to encrypt or decrypt for now. [[User:Jl12|Jl12]]

Talk:Gamecards

2011-11-03T17:18:11Z

Jl12:

This could be confused for the augmented reality cards. I think they are called cartridges.--[[User:T3a|T3a]] 18:08, 8 April 2011 (CEST)

^ should at least be a redirect ( "Game Cartridges, Game Cart Hardware, Game Carts" )

* 90 00 00 00 00 00 00 00 ... => 45F80090 for SSFIV, C2FF0090 on Rayman3d.
* Is it just me or do these byte orders keep changing. 9000000000000000 corresponds with "C2FE0090" not "9000FEC2".
* ''"header command has some initial dummy bytes, and eventually responds with a 0x200 byte header."''. Dummy bytes, Where? The redundant A500 cmds? --[[User:Jl12|Jl12]]
:You need to endian swap the data. 9000xxxx is the correct form. The upper bits specify information about the intended platform for the gamecard, and the lower bits specify the media size of the card.
:There are dummy bytes in the response for each 16-byte command. In the wiki these dummy bytes have already been stripped. --[[User:Neimod|Neimod]] 17:41, 3 June 2011 (CEST)
Could you post the size of the original header reply with the dummy bytes. I'm trying to inject logic ( send raw commands ) with a 3DS card. It works well up to the 3E 00 00 00 00 00 00 00 command, I get 'data' returned from the header packet as well but only 00 bytes. --[[User:Jl12|Jl12]]
: The size depends on what speed you are clocking out. Just keep reading until you get something that is non-zero. Also, what device are you using for reading out the data? --[[User:Neimod|Neimod]] 09:09, 4 June 2011 (CEST)

http://pastebin.com/y22zZcZN - That's for 'Street Fighter IV 3D'. There's an NCCH header and cartridge ID. The same method returned x00 00... with a different cart, though. Not sure why there's a difference. I actually have it hooked up to a laptop, where a device over USB reads the pins and the 3DS cart is connected to it there. ( ie. the laptop acts as the 3DS. )

http://pastebin.com/38QxNGqn - That's the cart that was returning an empty header. ( "rayman 3D" ). Seems to work, now.

How did you actually decrypt the encrypted commands, Neimod?--[[User:Lazymarek9614|Lazymarek9614]] 21:06, 1 November 2011 (CET)
: Sorry, it is a little too soon to reveal that. --[[User:Neimod|Neimod]] 02:00, 2 November 2011 (CET)
::I think the 3dbrew members are one team, why do you want to hide it?--[[User:Lazymarek9614|Lazymarek9614]] 21:23, 2 November 2011 (CET)

::I see the two sides of the problem here Neimod and Lazymarek9614. This forum like many public homebrew forum,s are there to try to find a way to load Homebrew. Letting everyone know your progress on what you are doing lets people understand how the scene is performing and people who have the knowhow can possibly help. But the downside to this is if Nintendo gets the drift on what you trying to do, they have the advantage, they know how the 3DS better than anyone, so releasing data on some exploits and WIP could lead to Nintendo patching it before it is finalised. Thats the decision the homebrew devs have to make.
::It would cause more harm than good at this point. Showing that progress is being made keeps the community active, but public understanding of the encryption of the gamecard protocol is not vital for the pursuit of homebrew. It would only advance the pursuit of piracy. --[[User:Neimod|Neimod]] 02:47, 3 November 2011 (CET)

- Responsible disclosure.

- Don't bolt doors shut before you open them for yourselves.

- Try not to devalue the 3DS unnecessarily. Nintendo succeeding is also in our best interests, software/longevity wise.

- Despite what I just said (lol). If you can disclose the method without any specific technical information that would be nice. Privately if necessary.

- About the discussion further up on this page, I was able to inject logic. With a laptop and hcs microcontroller. ( microcontroller -> usb -> CTR cartridge ). I can obviously only get as far as what I can do without encryption, as I don't know how to encrypt or decrypt for now. [[User:Jl12|Jl12]]

Talk:Gamecards

2011-11-03T17:17:24Z

Jl12:

This could be confused for the augmented reality cards. I think they are called cartridges.--[[User:T3a|T3a]] 18:08, 8 April 2011 (CEST)

^ should at least be a redirect ( "Game Cartridges, Game Cart Hardware, Game Carts" )

* 90 00 00 00 00 00 00 00 ... => 45F80090 for SSFIV, C2FF0090 on Rayman3d.
* Is it just me or do these byte orders keep changing. 9000000000000000 corresponds with "C2FE0090" not "9000FEC2".
* ''"header command has some initial dummy bytes, and eventually responds with a 0x200 byte header."''. Dummy bytes, Where? The redundant A500 cmds? --[[User:Jl12|Jl12]]
:You need to endian swap the data. 9000xxxx is the correct form. The upper bits specify information about the intended platform for the gamecard, and the lower bits specify the media size of the card.
:There are dummy bytes in the response for each 16-byte command. In the wiki these dummy bytes have already been stripped. --[[User:Neimod|Neimod]] 17:41, 3 June 2011 (CEST)
Could you post the size of the original header reply with the dummy bytes. I'm trying to inject logic ( send raw commands ) with a 3DS card. It works well up to the 3E 00 00 00 00 00 00 00 command, I get 'data' returned from the header packet as well but only 00 bytes. --[[User:Jl12|Jl12]]
: The size depends on what speed you are clocking out. Just keep reading until you get something that is non-zero. Also, what device are you using for reading out the data? --[[User:Neimod|Neimod]] 09:09, 4 June 2011 (CEST)

http://pastebin.com/y22zZcZN - That's for 'Street Fighter IV 3D'. There's an NCCH header and cartridge ID. The same method returned x00 00... with a different cart, though. Not sure why there's a difference. I actually have it hooked up to a laptop, where a device over USB reads the pins and the 3DS cart is connected to it there. ( ie. the laptop acts as the 3DS. )

http://pastebin.com/38QxNGqn - That's the cart that was returning an empty header. ( "rayman 3D" ). Seems to work, now.

How did you actually decrypt the encrypted commands, Neimod?--[[User:Lazymarek9614|Lazymarek9614]] 21:06, 1 November 2011 (CET)
: Sorry, it is a little too soon to reveal that. --[[User:Neimod|Neimod]] 02:00, 2 November 2011 (CET)
::I think the 3dbrew members are one team, why do you want to hide it?--[[User:Lazymarek9614|Lazymarek9614]] 21:23, 2 November 2011 (CET)

::I see the two sides of the problem here Neimod and Lazymarek9614. This forum like many public homebrew forum,s are there to try to find a way to load Homebrew. Letting everyone know your progress on what you are doing lets people understand how the scene is performing and people who have the knowhow can possibly help. But the downside to this is if Nintendo gets the drift on what you trying to do, they have the advantage, they know how the 3DS better than anyone, so releasing data on some exploits and WIP could lead to Nintendo patching it before it is finalised. Thats the decision the homebrew devs have to make.
::It would cause more harm than good at this point. Showing that progress is being made keeps the community active, but public understanding of the encryption of the gamecard protocol is not vital for the pursuit of homebrew. It would only advance the pursuit of piracy. --[[User:Neimod|Neimod]] 02:47, 3 November 2011 (CET)

- Responsible disclosure.

- Don't bolt doors shut before you open them for yourselves.

- Try not to devalue the 3DS unnecessarily. Nintendo succeeding is also in our best interests, software/longevity wise.

- Despite what I just said (lol). If you can disclose the method without any specific technical information that would be nice. Privately if necessary.

- About the discussion further up on this page, I was able to inject logic. With a laptop and hcs microcontroller. ( microcontroller -> usb -> CTR cartridge ). I can obviously only get as far as what I can do without encryption, as I don't know how to encrypt or decrypt for now. [[User:Jl12:Jl12]]

User:3dsguy

2011-11-03T17:01:09Z

Jl12:

Hi its me. Hello :)

I have a 3DS Test Unit, which is capable of installing 3DS/DSi applications compiled in the .cia format from an SD card. So while a way to install applications you create yourself, for normal 3DSs is not possible (i.e. homebrew for 3DS is not yet possible), I am willing to test them for you. If you do make any applications you want me to test, send them in an email with a description of what the application is suppose to do and any instructions. And if you want I can send screenshots and feedback (as detailed as I can) I make about the applications you or others may send. You can send them to "devguy@hotmail.com.au".

Please can you post a link to an uploaded example CIA fie?-[[User:Lazymarek9614|Lazymarek9614]] 13:30, 1 November 2011 (CET)

Do you mean one, that someone has sent me? As I do not have any of my own. By the way I will only post links to .cia files if the sender gives me permission.(I have sent an email asking for permission about 5 minutes ago, so I will or will not give a link depending on their response)--[[User:3dsguy|3dsguy]] 14:21, 1 November 2011 (CET)

Yes, that's exactly what I mean. Is there actually a way that I can create CIA files too?--[[User:Lazymarek9614|Lazymarek9614]] 15:54, 1 November 2011 (CET)

I do not know a way of creating .CIA files. its just that [[Jl12]] asked me as part of a set of questions on my talk page:
*"Would you be willing to run pre-compiled apps imported through your dev menu on your test unit? [and if so do you have an email to send them to]"
I said of course, and gave some details. Then, to my surprise, someone responded to that yesterday, emailing me 3 apps to test. This person on the other hand does know how to compile apps in the .cia format and appeared to have access to the DSi SDK from what i gathered from the email. I can tell you that they did not work once installed from the .cia file, but they did install which I was impressed about. But like I said before I'm waiting on a reply on whether I can distribute the .cia files he/she sent me.--[[User:3dsguy|3dsguy]] 22:37, 1 November 2011 (CET)
:This is the problem many people seem to have with the test units. From what I can tell, the only way to actually run some unsigned application (not created by Nintendo) is by programming it on a development flashcard. --[[User:Neimod|Neimod]] 01:11, 2 November 2011 (CET)
:I'm not sure why you deleted your previous post, but I agree that there are '''supposed''' to be different kinds of media (development flashcard, and copying from SD card to internal NAND) that allow running applications on a test unit. However, of these methods, only so far the development flashcard has proven to work with '''unsigned''' code. The problem lies in the fact that the unsigned development CXI image uses a dummy RSA private key to create the RSA signature, while official Nintendo development CXI images use the real deal. So as it stands, no developer can create proper CXI images for CIA importing. --[[User:Neimod|Neimod]] 14:11, 2 November 2011 (CET)
* I sent him 3 pre-compiled apps at first. ( all by Nintendo ). The first two don't boot because they're not compiled with the libs/firmware running on his test-unit. The 3rd TWL NAND app, doesn't have any icon/banner/title to identify itself after being installed, and although it imports/installs succesfully, it can't be selected or launched from Dev Menu or the Home Menu. Later, I sent him a self-built application ( one not by Nint. ), it installs, boots and runs properly and it just displays some information on the screens; those are the files and images he's linked to here. [the "Hello Galaxy!!!" test-application.]
* They're not unsigned. Dev/test units use a different set of keys then the retail/production units do.
* ''So as it stands, no developer can create proper CXI images for CIA importing.'' - What. I've sent self-built apps to test to 3dsguy and somebody else who owns a test unit running on a different firmware. They work fine. ( Although it's difficult to line up firmware revisions. )
* The one that runs was made (compiled/built) using the SDK/firmware revision matching his test-unit.
* He probably removed the 1st link because I asked him not to post anything with ( even potentially ) copyrighted contents for the sake of not getting this wiki associated with it, the binaries contained code from an e3 demo and the TWL/DSi SDK, we're not doing ourselves any benefit by posting it. The app that runs ( 'Hello Galaxy' ) is a self-compiled application, so it's probably not going to be mistaken for a game or another commercial application. [thus probably safe for wiki.] [[User:Jl12|Jl12]]

I had a look at your previous post, 3dsguy, where you have posted a download link for a CIA file. We don't know much about CIA files so it was interesting to see a file and look into it. The actual data for the app/tmd/cmd files seems to be encrypted (expected that) there's only some plain text like "Root"", "CA00000004" and "Root-CA00000004" to name a few (...) which obviously are pathes on the NAND FS. However, I've found out that the name of the files/directories (eg name of the app file:"ad7e6744") which are saved on the SD card after installing the archieve seem to be in the CIA file: Not as plain text, they're actually hex values. I'm not really sure about that. It would be nice if you could post another CIA file, 3dsguy, that we can compare them and find out more about it. Shall we actually create a new page about CIA files?--[[User:Lazymarek9614|Lazymarek9614]] 21:48, 2 November 2011 (CET)
: They're certificates.
: It's mentioned partially under "[[Download Play]]", because it's another use of the same file format. [[User:Jl12|Jl12]]

Yes I think we should create another page made for .CIA file and move some of this page to its discussion page. But I've got another .cia file and and boots. see [[http://121.215.146.1/3ds/more_cia_stuff.rar]] for everything you may want to know about it and perhaps from this we can start a new page.--[[User:3dsguy|3dsguy]] 07:52, 3 November 2011 (CET)
: I think this is more about getting our own code running on the 3DS/CTR then it is about CIA. [[User:Jl12|Jl12]]

Lazymarek9614, those "paths" are from the cert chain and the ticket. CIA is based on WAD. --[[User:Yellows8|Yellows8]] 16:25, 3 November 2011 (CET)

@3dsguy - if the situation changes about being able to get any other test-units please let me know, thanks. [[User:Jl12|Jl12]]

Hardware

2011-11-03T16:56:30Z

Jl12:

{{stub}}

== Specifications ==

{| class="wikitable"
! Type !! Name !! Datasheet !! Source
|-
| SoC || Nintendo 1048 0H (Custom): CPU, GPU, VRAM & DSP all on one chip. || N/A || N/A
|-
| Processor Core || ARM11 MPCore 2x 268MHz & 2x VFP Co-Processor || [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0360f/index.html] || [11]
|-
| GPU || [http://en.wikipedia.org/wiki/PICA200 DMP PICA] 268MHz || N/A || [11]
|-
| DSP || 134Mhz. 24ch 32728Hz sampling rates. || N/A || [11]
|-
| VRAM || 6 MB within SoC. Independent of system memory (FCRAM). || N/A || [11]
|-
| FCRAM || 2x64MB Fujitsu MB82M8080-07L ||[http://crediar.no-ip.com/sg_/download.php?id=d67d1c][http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511463.pdf][http://edevice.fujitsu.com/jp/datasheet/j-ds/j511463.pdf]|| [5]
|-
| Storage || Toshiba THGBM2G3P1FBAI8 1GB NAND Flash || N/A || N/A
|-
| Power Management || Texas Instruments PAIC3010B 0AA37DW || N/A || FCC filing
|-
| Gyroscope || Invensense ITG-3270 MEMS Gyroscope || [http://dl-web.dropbox.com/u/20520664/references/PS-ITG-3200-00-01.4.pdf] || N/A
|-
| Accelerometer || ST Micro 2048 33DH X1MAQ Accelerometer Model LIS331DH || [http://dl.dropbox.com/u/20520664/references/CD00213470.pdf] || N/A
|-
| Wifi || 802.11b/g Atheros AR6014 || [http://www.db.pokestation.net/3DS/Wi-Fi%20module%20pinouts.pdf] || N/A
|-
| Infrared IC || NXP infrared IC, "S750 0803 TSD031C" || N/A || [10]
|-
| Auxiliary Microcontroller || UC CTR, custom Nintendo microcontroller || N/A || N/A
|}

* [11] Official Documentation

* [5],[10] According to iFixit.com ([http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/1#s22696 source]):

* Datasheet for memory is for a chip in the same series, it has less memory than the one inside the 3DS (128mbits vs 512mbits).

* There is a trove of data on the FCC website at [https://fjallfoss.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=462292&fcc_id=%27EW4DWMW028%27].

== FCRAM ==

There is one FCRAM(Fast Cycle RAM) in the 3DS.
== DESCRIPTION ==
The Fujitsu MB82M8080-07L chip internally contains 2 dies, where each die is branded MB81EDS516545 and MB82DBS08645. The MB81EDS516545 die is a CMOS Fast Cycle Random Access Memory (FCRAM*) with Low Power Double Data Rate (LPDDR) SDRAM Interface containing 512MBit storage accessible in a 64-bit format.
MB81EDS516545 is suited for consumer application requiring high data band width with low power consumption.

== Images ==

=== Front ===

[[Image:CTR_Front.jpg|600px]]

[http://guide-images.ifixit.net/igi/ishJaSCOwLkvbLYK High Resolution]

=== Back ===

[[Image:CTR_Back.jpg]]

[http://guide-images.ifixit.net/igi/n1CKAdbPrHyNPNuW High Resolution]

=== NAND pinout ===
[[Image:CTR_NAND_pinout.png]]

NAND dumping has been successful, but the image is encrypted.

=== WiFi dongle pinout ===
[[Image:CTR_WiFiDongle_pinout.png|600px]]

SDIO interface is colored red:
* CLK
* CMD
* D0, D1, D2, D3

This is the interface for the 'NEW' WiFi module (based on Atheros AR6002) first included in DSi.

The proprietary and by now ancient DS-mode WiFi is colored yellow, pins are unknown.

I2C eeprom is colored blue:
* SCL
* SDA

SPI Flash is colored purple:
* CLK
* CS#
* SI
* SO
* WP#
* NC

=== Auxiliary Microntroller ===
[[Image:CTR_UC.png|600px]]

Monitors HOME button, WiFi switch, 3D slider, volume control slider.
Controls LEDs, various power supplies.

Devices attached to I2C bus:
* UC (master?)
* Accelerometer (slave address 0x18)
* SoC (master? slave?)

Download Play

2011-11-03T16:55:20Z

Jl12:

The 3DS dlplay title has two dlplay modes: 3DS and DS. DS dlplay is just regular dsmode dlplay, same interface and protocol as before. Like DS gamecards, holding down start+select while starting the dsmode dlplay client will disable stretching the screens.

== Download Play protocol ==

The Download Play protocol for 3DS is completely different from the DS Wireless Multiboot (WMB) protocol. While the DS WMB protocol used to send program code in plaintext over wireless, the Download Play protocol is now using WPA2 encryption with 128-bit AES CTR to broadcast the application.

Cleartext beacons have static Nintendo tag data, broadcasted at a rate of 0.102400/s. WPA2 data frames are broadcasted as well, the size of these varies.
After a client authenticates to the host, the host sends an association response, with a random ASCII hex SSID, like: "EB6FAB77". After that the systems communicate and transfer the binary with WPA2 encrypted data frames.

This is a dump of the Nintendo tag of the cleartext beacon from Monkey ball 3D, with vendor 001f32:
000: 18 05 9f ae 17 c8 a5 1d 0b 81 28 be 74 0f d4 af
010: 97 30 04 60 fd 2d f3 d9 8d bc 22 80 51 60 3c 75
020: d9 89 6d 16 c4 f3 aa 89 26 d4 14 25 67 75 8e 4b
030: 3c 97 85 c9 83 15 d4 96 06 b1 29 b6 f5 51 57 71
040: cc b6 1f 4a c8 bd 4f c0 57 43 cb ab fa 37 74 b0
050: 64 6b 87 69 a1 de a4 05 7c 7c 49 5d f5 21 25 83
060: 4c f2 d0 70 38 14 7b 0f f4 97 f7 ff f3 ff 36 cd
070: c2 e2 c0 78 98 d1 d5 4d 3d d4 9b 57 84 6c e2 4f
080: 25 f2 56 c4 19 88 64 13 78 68 e2

== Broadcasted application data ==
The Download Play protocol broadcasts 3DS application data in a format similar to the [http://wiibrew.org/wiki/Wad WAD format] for the Nintendo Wii. ( this is also the .CIA format internally. )
The broadcasted application data is an archive file format, which contains a certificate chain, a ticket, a TMD, and the actual application itself, in [[CXI|CXI format]]. The broadcasted archive data is temporarily stored as a file on the internal NAND Flash storage, and is kept there until new archive data from a different game is received through the Download Play protocol.

The CXI application content is again encrypted, this time using 128-bit AES CBC. The encryption uses the decrypted titlekey of the ticket, and the titleid padded with zeros as the IV. To get the decrypted titlekey, the titlekey stored in the ticket must be decrypted using 128-bit AES-CBC with the 3DS common key, and the same IV as mentioned previously.

So in actuality, the 3DS application code, as it is being transmitted wirelessly has been encrypted 3 times:
* The first time is using 128-bit AES CTR encryption for the ExeFS of the CXI format,
* the second time is using 128-bit AES CBC encryption in the archive data,
* and the third time is using 128-bit AES CTR for the WPA2 encryption.

== Remote Distribution of System-Updates ==

As part of the child distribution process, a 3DS acting as the server in a local Download Play session, can send firmware updates to another 3DS unit acting as the client, through first sending the system update package then instructing the client to install reboot and reinstantiate a connection (which it caches information about temporarily) remotely, if it finds system updates are necessary before distributing the child-application. ( eg. multiplayer game or a demo. ) Like "update" partitions on CTR Cards, this is not an "automatic feature" and not implemented for all Download Play titles.

User:3dsguy

2011-11-03T16:53:59Z

Jl12: z

Hi its me. Hello :)

I have a 3DS Test Unit, which is capable of installing 3DS/DSi applications compiled in the .cia format from an SD card. So while a way to install applications you create yourself, for normal 3DSs is not possible (i.e. homebrew for 3DS is not yet possible), I am willing to test them for you. If you do make any applications you want me to test, send them in an email with a description of what the application is suppose to do and any instructions. And if you want I can send screenshots and feedback (as detailed as I can) I make about the applications you or others may send. You can send them to "devguy@hotmail.com.au".

Please can you post a link to an uploaded example CIA fie?-[[User:Lazymarek9614|Lazymarek9614]] 13:30, 1 November 2011 (CET)

Do you mean one, that someone has sent me? As I do not have any of my own. By the way I will only post links to .cia files if the sender gives me permission.(I have sent an email asking for permission about 5 minutes ago, so I will or will not give a link depending on their response)--[[User:3dsguy|3dsguy]] 14:21, 1 November 2011 (CET)

Yes, that's exactly what I mean. Is there actually a way that I can create CIA files too?--[[User:Lazymarek9614|Lazymarek9614]] 15:54, 1 November 2011 (CET)

I do not know a way of creating .CIA files. its just that [[Jl12]] asked me as part of a set of questions on my talk page:
*"Would you be willing to run pre-compiled apps imported through your dev menu on your test unit? [and if so do you have an email to send them to]"
I said of course, and gave some details. Then, to my surprise, someone responded to that yesterday, emailing me 3 apps to test. This person on the other hand does know how to compile apps in the .cia format and appeared to have access to the DSi SDK from what i gathered from the email. I can tell you that they did not work once installed from the .cia file, but they did install which I was impressed about. But like I said before I'm waiting on a reply on whether I can distribute the .cia files he/she sent me.--[[User:3dsguy|3dsguy]] 22:37, 1 November 2011 (CET)
:This is the problem many people seem to have with the test units. From what I can tell, the only way to actually run some unsigned application (not created by Nintendo) is by programming it on a development flashcard. --[[User:Neimod|Neimod]] 01:11, 2 November 2011 (CET)
:I'm not sure why you deleted your previous post, but I agree that there are '''supposed''' to be different kinds of media (development flashcard, and copying from SD card to internal NAND) that allow running applications on a test unit. However, of these methods, only so far the development flashcard has proven to work with '''unsigned''' code. The problem lies in the fact that the unsigned development CXI image uses a dummy RSA private key to create the RSA signature, while official Nintendo development CXI images use the real deal. So as it stands, no developer can create proper CXI images for CIA importing. --[[User:Neimod|Neimod]] 14:11, 2 November 2011 (CET)
* I sent him 3 pre-compiled apps at first. ( all by Nintendo ). The first two don't boot because they're not compiled with the libs/firmware running on his test-unit. The 3rd TWL NAND app, doesn't have any icon/banner/title to identify itself after being installed, and although it imports/installs succesfully, it can't be selected or launched from Dev Menu or the Home Menu. Later, I sent him a self-built application ( one not by Nint. ), it installs, boots and runs properly and it just displays some information on the screens; those are the files and images he's linked to here. [the "Hello Galaxy!!!" test-application.]
* They're not unsigned. Dev/test units use a different set of keys then the retail/production units do.
* ''So as it stands, no developer can create proper CXI images for CIA importing.'' - What. I've sent self-built apps to test to 3dsguy and somebody else who owns a test unit running on a different firmware. They work fine. ( Although it's difficult to line up firmware revisions. )
* The one that actually runs was made (compiled/built) using the SDK/firmware revision matching his test-unit.
* He probably removed the 1st link because I asked him not to post anything with ( even potentially ) copyrighted contents for the sake of not getting this wiki associated with it, the binaries contained code from an e3 demo and the TWL/DSi SDK, we're not doing ourselves any benefit by posting it. The app that runs ( 'Hello Galaxy' ) is a self-compiled application, so it's probably not going to be mistaken for a game or other commercial application. [thus probably safe for wiki.] [[User:Jl12|Jl12]]

I had a look at your previous post, 3dsguy, where you have posted a download link for a CIA file. We don't know much about CIA files so it was interesting to see a file and look into it. The actual data for the app/tmd/cmd files seems to be encrypted (expected that) there's only some plain text like "Root"", "CA00000004" and "Root-CA00000004" to name a few (...) which obviously are pathes on the NAND FS. However, I've found out that the name of the files/directories (eg name of the app file:"ad7e6744") which are saved on the SD card after installing the archieve seem to be in the CIA file: Not as plain text, they're actually hex values. I'm not really sure about that. It would be nice if you could post another CIA file, 3dsguy, that we can compare them and find out more about it. Shall we actually create a new page about CIA files?--[[User:Lazymarek9614|Lazymarek9614]] 21:48, 2 November 2011 (CET)
: They're certificates.
: It's mentioned partially under "[[Download Play]]", because it's another use of the same file format. [[User:Jl12|Jl12]]

Yes I think we should create another page made for .CIA file and move some of this page to its discussion page. But I've got another .cia file and and boots. see [[http://121.215.146.1/3ds/more_cia_stuff.rar]] for everything you may want to know about it and perhaps from this we can start a new page.--[[User:3dsguy|3dsguy]] 07:52, 3 November 2011 (CET)
: I think this is more about getting our own code running on the 3DS/CTR then it is about CIA. [[User:Jl12|Jl12]]

Lazymarek9614, those "paths" are from the cert chain and the ticket. CIA is based on WAD. --[[User:Yellows8|Yellows8]] 16:25, 3 November 2011 (CET)

@3dsguy - if the situation changes about being able to get any other test-units please let me know, thanks. [[User:Jl12|Jl12]]

Hardware

2011-11-03T16:52:08Z

Jl12:

{{stub}}

== Specifications ==

{| class="wikitable"
! Type !! Name !! Datasheet !! Source
|-
| SoC || Nintendo 1048 0H (Custom): CPU, GPU, VRAM & DSP all on one chip. || N/A || N/A
|-
| Processor Core || ARM11 MPCore 2x 268 MHz & 2x VFP Co-Processor || [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0360f/index.html] || [11]
|-
| GPU || [http://en.wikipedia.org/wiki/PICA200 DMP PICA] 268MHz || N/A || [11]
|-
| DSP || 134Mhz. 24ch 32728Hz sampling rates. || N/A || [11]
|-
| VRAM || 6 MB within SoC. Independent of system memory (FCRAM). || N/A || [11]
|-
| FCRAM || 2x64MB Fujitsu MB82M8080-07L ||[http://crediar.no-ip.com/sg_/download.php?id=d67d1c][http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511463.pdf][http://edevice.fujitsu.com/jp/datasheet/j-ds/j511463.pdf]|| [5]
|-
| Storage || Toshiba THGBM2G3P1FBAI8 1GB NAND Flash || N/A || N/A
|-
| Power Management || Texas Instruments PAIC3010B 0AA37DW || N/A || FCC filing
|-
| Gyroscope || Invensense ITG-3270 MEMS Gyroscope || [http://dl-web.dropbox.com/u/20520664/references/PS-ITG-3200-00-01.4.pdf] || N/A
|-
| Accelerometer || ST Micro 2048 33DH X1MAQ Accelerometer Model LIS331DH || [http://dl.dropbox.com/u/20520664/references/CD00213470.pdf] || N/A
|-
| Wifi || 802.11b/g Atheros AR6014 || [http://www.db.pokestation.net/3DS/Wi-Fi%20module%20pinouts.pdf] || N/A
|-
| Infrared IC || NXP infrared IC, "S750 0803 TSD031C" || N/A || [10]
|-
| Auxiliary Microcontroller || UC CTR, custom Nintendo microcontroller || N/A || N/A
|}

* [11] Official Documentation

* [5],[10] According to iFixit.com ([http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/1#s22696 source]):

* Datasheet for memory is for a chip in the same series, it has less memory than the one inside the 3DS (128mbits vs 512mbits).

* There is a trove of data on the FCC website at [https://fjallfoss.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=462292&fcc_id=%27EW4DWMW028%27].

== FCRAM ==

There is one FCRAM(Fast Cycle RAM) in the 3DS.
== DESCRIPTION ==
The Fujitsu MB82M8080-07L chip internally contains 2 dies, where each die is branded MB81EDS516545 and MB82DBS08645. The MB81EDS516545 die is a CMOS Fast Cycle Random Access Memory (FCRAM*) with Low Power Double Data Rate (LPDDR) SDRAM Interface containing 512MBit storage accessible in a 64-bit format.
MB81EDS516545 is suited for consumer application requiring high data band width with low power consumption.

== Images ==

=== Front ===

[[Image:CTR_Front.jpg|600px]]

[http://guide-images.ifixit.net/igi/ishJaSCOwLkvbLYK High Resolution]

=== Back ===

[[Image:CTR_Back.jpg]]

[http://guide-images.ifixit.net/igi/n1CKAdbPrHyNPNuW High Resolution]

=== NAND pinout ===
[[Image:CTR_NAND_pinout.png]]

NAND dumping has been successful, but the image is encrypted.

=== WiFi dongle pinout ===
[[Image:CTR_WiFiDongle_pinout.png|600px]]

SDIO interface is colored red:
* CLK
* CMD
* D0, D1, D2, D3

This is the interface for the 'NEW' WiFi module (based on Atheros AR6002) first included in DSi.

The proprietary and by now ancient DS-mode WiFi is colored yellow, pins are unknown.

I2C eeprom is colored blue:
* SCL
* SDA

SPI Flash is colored purple:
* CLK
* CS#
* SI
* SO
* WP#
* NC

=== Auxiliary Microntroller ===
[[Image:CTR_UC.png|600px]]

Monitors HOME button, WiFi switch, 3D slider, volume control slider.
Controls LEDs, various power supplies.

Devices attached to I2C bus:
* UC (master?)
* Accelerometer (slave address 0x18)
* SoC (master? slave?)

Download Play

2011-11-03T16:51:13Z

Jl12:

The 3DS dlplay title has two dlplay modes: 3DS and DS. DS dlplay is just regular dsmode dlplay, same interface and protocol as before. Like DS gamecards, holding down start+select while starting the dsmode dlplay client will disable stretching the screens.

== Download Play protocol ==

The Download Play protocol for 3DS is completely different from the DS Wireless Multiboot (WMB) protocol. While the DS WMB protocol used to send program code in plaintext over wireless, the Download Play protocol is now using WPA2 encryption with 128-bit AES CTR to broadcast the application.

Cleartext beacons have static Nintendo tag data, broadcasted at a rate of 0.102400/s. WPA2 data frames are broadcasted as well, the size of these varies.
After a client authenticates to the host, the host sends an association response, with a random ASCII hex SSID, like: "EB6FAB77". After that the systems communicate and transfer the binary with WPA2 encrypted data frames.

This is a dump of the Nintendo tag of the cleartext beacon from Monkey ball 3D, with vendor 001f32:
000: 18 05 9f ae 17 c8 a5 1d 0b 81 28 be 74 0f d4 af
010: 97 30 04 60 fd 2d f3 d9 8d bc 22 80 51 60 3c 75
020: d9 89 6d 16 c4 f3 aa 89 26 d4 14 25 67 75 8e 4b
030: 3c 97 85 c9 83 15 d4 96 06 b1 29 b6 f5 51 57 71
040: cc b6 1f 4a c8 bd 4f c0 57 43 cb ab fa 37 74 b0
050: 64 6b 87 69 a1 de a4 05 7c 7c 49 5d f5 21 25 83
060: 4c f2 d0 70 38 14 7b 0f f4 97 f7 ff f3 ff 36 cd
070: c2 e2 c0 78 98 d1 d5 4d 3d d4 9b 57 84 6c e2 4f
080: 25 f2 56 c4 19 88 64 13 78 68 e2

== Broadcasted application data ==
The Download Play protocol broadcasts 3DS application data in a format similar to the [http://wiibrew.org/wiki/Wad WAD format] for the Nintendo Wii. ( this is also the .CIA format internally. )
The broadcasted application data is an archive file format, which contains a certificate chain, a ticket, a TMD, and the actual application itself, in [[CXI|CXI format]]. The broadcasted archive data is temporarily stored as a file on the internal NAND Flash storage, and is kept there until new archive data from a different game is received through the Download Play protocol.

The CXI application content is again encrypted, this time using 128-bit AES CBC. The encryption uses the decrypted titlekey of the ticket, and the titleid padded with zeros as the IV. To get the decrypted titlekey, the titlekey stored in the ticket must be decrypted using 128-bit AES-CBC with the 3DS common key, and the same IV as mentioned previously.

So in actuality, the 3DS application code, as it is being transmitted wirelessly has been encrypted 3 times:
* The first time is using 128-bit AES CTR encryption for the ExeFS of the CXI format,
* the second time is using 128-bit AES CBC encryption in the archive data,
* and the third time is using 128-bit AES CTR for the WPA2 encryption.

== Remote Distribution and Initiation of System-Updates ==

As part of the child distribution process, a 3DS acting as the server in a local Download Play session, can send firmware updates to another 3DS unit acting as the client, through first sending the system update package then instructing the client to install reboot and reinstantiate a connection (which it caches information about temporarily) remotely, if it finds system updates are necessary before distributing the child-application. ( eg. multiplayer game or a demo. ) Like "update" partitions on CTR Cards, this is not an "automatic feature" and not implemented for all Download Play titles.

Download Play

2011-11-03T16:50:37Z

Jl12: dlp sys updates text blurb

The 3DS dlplay title has two dlplay modes: 3DS and DS. DS dlplay is just regular dsmode dlplay, same interface and protocol as before. Like DS gamecards, holding down start+select while starting the dsmode dlplay client will disable stretching the screens.

== Download Play protocol ==

The Download Play protocol for 3DS is completely different from the DS Wireless Multiboot (WMB) protocol. While the DS WMB protocol used to send program code in plaintext over wireless, the Download Play protocol is now using WPA2 encryption with 128-bit AES CTR to broadcast the application.

Cleartext beacons have static Nintendo tag data, broadcasted at a rate of 0.102400/s. WPA2 data frames are broadcasted as well, the size of these varies.
After a client authenticates to the host, the host sends an association response, with a random ASCII hex SSID, like: "EB6FAB77". After that the systems communicate and transfer the binary with WPA2 encrypted data frames.

This is a dump of the Nintendo tag of the cleartext beacon from Monkey ball 3D, with vendor 001f32:
000: 18 05 9f ae 17 c8 a5 1d 0b 81 28 be 74 0f d4 af
010: 97 30 04 60 fd 2d f3 d9 8d bc 22 80 51 60 3c 75
020: d9 89 6d 16 c4 f3 aa 89 26 d4 14 25 67 75 8e 4b
030: 3c 97 85 c9 83 15 d4 96 06 b1 29 b6 f5 51 57 71
040: cc b6 1f 4a c8 bd 4f c0 57 43 cb ab fa 37 74 b0
050: 64 6b 87 69 a1 de a4 05 7c 7c 49 5d f5 21 25 83
060: 4c f2 d0 70 38 14 7b 0f f4 97 f7 ff f3 ff 36 cd
070: c2 e2 c0 78 98 d1 d5 4d 3d d4 9b 57 84 6c e2 4f
080: 25 f2 56 c4 19 88 64 13 78 68 e2

== Broadcasted application data ==
The Download Play protocol broadcasts 3DS application data in a format similar to the [http://wiibrew.org/wiki/Wad WAD format] for the Nintendo Wii. ( this is also the .CIA format internally. )
The broadcasted application data is an archive file format, which contains a certificate chain, a ticket, a TMD, and the actual application itself, in [[CXI|CXI format]]. The broadcasted archive data is temporarily stored as a file on the internal NAND Flash storage, and is kept there until new archive data from a different game is received through the Download Play protocol.

The CXI application content is again encrypted, this time using 128-bit AES CBC. The encryption uses the decrypted titlekey of the ticket, and the titleid padded with zeros as the IV. To get the decrypted titlekey, the titlekey stored in the ticket must be decrypted using 128-bit AES-CBC with the 3DS common key, and the same IV as mentioned previously.

So in actuality, the 3DS application code, as it is being transmitted wirelessly has been encrypted 3 times:
* The first time is using 128-bit AES CTR encryption for the ExeFS of the CXI format,
* the second time is using 128-bit AES CBC encryption in the archive data,
* and the third time is using 128-bit AES CTR for the WPA2 encryption.

== Remote Distribution and Initiation of System-Updates ==

As part of the data/child distribution process, a 3DS acting as the server in a local Download Play session, can send firmware updates to another 3DS unit acting as the client, through first sending the system update package then instructing the client to install reboot and reinstantiate a connection (which it caches information about temporarily) remotely, if it finds system updates are necessary before distributing the child-application. ( eg. multiplayer game or a demo. ) Like "update" partitions on CTR Cards, this is not an "automatic feature" and not implemented for all Download Play titles.

User talk:3dsguy

2011-10-27T10:55:16Z

Jl12: q's

Thanks,3dsguy.
How did you get it? Matyapiro31

As much as I'd like to say, I can't tell you where i got it. But i'm trying to post info as much about Dev 3DS as possible

Does your development 3DS appear to be same hardware as ordinary one? --Matyapiro31 16:10, 18 October 2011 (CEST)

Yes, Matyapiro31, it seems to be that way, i was surprised when i got it, that it did not have parts of the case in red like a panda dev unit, but it had the sticker on the back saying it was a "Development Unit". Also the FCC id does not differ between my Development Unit and a Retail Unit. This probably explains why in the Config menu, the "System Mode" (which I believe is memory allowance) is stuck on "Prod". For some reason Prod mode is 64mb. Why do you ask?

Hi 3dsguy, maybe you have something like a kiosk "demo unit" used at stores (like GameStop, etc.).

* Do you have a retail 3DS unit? I'm curious if your test unit will communicate with a retail 3DS unit. ( downloadplay, street-pass, etc. )
* Does it connect to (production) nusd update servers for any updates?
* Do you have any other software or hardware with it? ( firmware updates? rewritable CTR cards? etc. )
* Can you get more of them however/wherever you received yours from?
* Would you be willing to run pre-compiled apps imported through your dev menu on your test unit? [and if so do you have an email to send them to]
* Would you be willing to lend or rent your unit out? I'm pretty sure you won't but it wouldn't hurt to ask.
- [[User:Jl12|Jl12]]

CCI

2011-08-29T21:32:30Z

Jl12:

This document is about the format of CTR cart images (CCI), which is also the format of 3DS ROM dumps.

=== Overview ===
CCI files start with a NCSD header, followed by up to a maximum of 8 NCCH blocks according to spec. The first block usually starts at 0x4000. In most carts the first block contains game code/data, the second block contains the download play "child" and the third block contains potential system updates. The exact contents of NCCH blocks can be determined by looking at the flags.

The NCCH blocks are in the same format as [[CXI]] files.

=== NCSD header ===
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 0x100
| RSA-2048 signature of the NCSD header, using SHA-256 (needs to be confirmed)
|-
| 0x100
| 4
| Magic ID, always 'NCSD'
|-
| 0x104
| 4
| Size of the CCI image, in media units (1 media unit = 0x200 bytes)
|-
| 0x108
| 8
| Title/Program ID
|-
| 0x120
| 4
| Offset to the first NCCH in media units
|-
| 0x124
| 4
| Size of the first NCCH
|-
| 0x130
| 4
| Offset to the second NCCH
|-
| 0x134
| 4
| Size of the second NCCH
|-
| 0x158
| 4
| Offset to the third NCCH
|-
| 0x15C
| 4
| Size of the third NCCH
|-
| 0x188
| 8
| NCCH Flags: byte[5]-byte[7] indicate content type ( system update, application, ... ) size of media units ( 512*2^byte[6] ) and encryption.
|-
| 0x190
| 8
| Partition ID of the first NCCH
|-
| 0x1A0
| 8
| Partition ID of the second NCCH
|-
| 0x1C8
| 8
| Partition ID of the third NCCH
|-
| 0x200
| 4
| Always 0xFFFFFFFF
|-
| 0x300
| 4
| Used ROM size in bytes
|-
| 0x320
| 16
| Unknown
|}

Parts of the first NCCH block's header are found around 0x1000 for whatever reason.

CCI images may not include all three NCCH blocks. For example, Ghost Recon: Shadow Wars lacks the second NCCH. Entries at 0x130, 0x134 and 0x1A0 in its NCSD header are zero.

Talk:Testpoints

2011-08-19T07:59:16Z

Jl12:

* Are there test points for accessing the FCRAM

Download Play

2011-08-19T07:51:06Z

Jl12:

Talk:Flash Filesystem

2011-08-16T23:47:59Z

Jl12: Created page with "* Can't help with nand reading but lib references give some indication of the filesystem. {| class="wikitable" border="1" |- |nand:/extdata |- |nand:/ro/ |- |nand:/ro/sys/HWCAL0..."

Title list

2011-08-16T18:00:19Z

Jl12:

CXI

2011-08-15T19:45:16Z

Jl12:

The following text tries to document the structure of the CTR Executable Image (CXI) format.

=== Overview ===
A CXI file contains the 'application' program code, which runs on a single ARM11 core. It can communicate through SVC calls with the other ARM11 core running the 'system' program code. For reasons of clarity, the ARM11 cores will sometimes be called the 'appcore' and 'syscore' respectively.

The CXI file format contains application ARM11 code, the menu icon, the menu 3D model, and an embedded read-only (ROM) filesystem for external filestorage. In fact, the application ARM11 code, menu icon, and menu 3D model are embedded into its own filesystem too, called the ExeFS.

More specifically, the CXI file format is structured in the following order:
* first an NCCH header,
* followed by an extended header,
* followed by a plain binary region,
* followed by an embedded executable filesystem (ExeFS),
* and finally followed by a read-only filesystem (RomFS).

The extended header contains additional information regarding access control.
The plain binary region is an area specifically stored in plaintext, mostly containing SDK library strings for identification.

The extended header, the ExeFS and the RomFS are encrypted using 128-bit AES CTR.

By default encrypted regions are compressed with a LZ77 variant, then encrypted. The spec allows for both unencrypted and uncompressed regions to exist. System titles expect a fixed system key.

=== NCCH Header ===
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 0x100
| RSA-2048 signature of the NCCH header, using SHA-256.
|-
| 0x100
| 4
| Magic ID, always 'NCCH'
|-
| 0x104
| 4
| Content size, in media units (1 media unit = 0x200 bytes)
|-
| 0x108
| 8
| Partition ID
|-
| 0x110
| 2
| Maker code
|-
| 0x112
| 2
| Version
|-
| 0x114
| 4
| Reserved
|-
| 0x118
| 8
| Program ID
|-
| 0x120
| 1
| Temp flag
|-
| 0x121
| 0x2F
| Reserved
|-
| 0x150
| 0x10
| Product code
|-
| 0x160
| 0x20
| Extended header hash
|-
| 0x180
| 4
| Extended header size
|-
| 0x184
| 4
| Reserved
|-
| 0x188
| 8
| Flags: byte[5]-byte[7] indicate content type ( system update, application, ... ) size of media unit ( 512*2^byte[6] ) and encryption.
|-
| 0x190
| 4
| Plain region offset, in media units
|-
| 0x194
| 4
| Plain region size, in media units
|-
| 0x198
| 8
| Reserved
|-
| 0x1A0
| 4
| ExeFS offset, in media units
|-
| 0x1A4
| 4
| ExeFS size, in media units
|-
| 0x1A8
| 4
| ExeFS hash region size, in media units
|-
| 0x1AC
| 4
| Reserved
|-
| 0x1B0
| 4
| RomFS offset, in media units
|-
| 0x1B4
| 4
| RomFS size, in media units
|-
| 0x1B8
| 4
| RomFS hash region size, in media units
|-
| 0x1BC
| 4
| Reserved
|-
| 0x1C0
| 0x20
| ExeFS superblock hash
|-
| 0x1E0
| 0x20
| RomFS superblock hash
|}

==== NCCH header example for Lego Starwars III ====
Signature: 720FF8F83F2A1E998322A026D1434165
ED19642ABC1CB2722135AA202BEAD60A
80BCD21C768C597B8268FEF2C64EA710
4C9BA5E12CFFBD1D0C619F4EF7B42CA7
DD8482CB4EB26720AD66CDA57ABCBCFB
D63268A6E2896A59B3B744E39E45B88A
ABB4C0980ACC6210818DCE6DAC838A10
95D0F66B352474D4B3DA4B333F49912D
29AF7EA58BC8C890B18C70B7D540A9FB
EBE24A5312055617D3353B28C3EB1D17
61021BEFF6AD22C384835B40BD44DFAD
981F6350F9458B17BCB5F768C92ABC93
2BCE9888855A8998F4CDE40C9543514A
C57B84EB75A680E7C742632614620D1D
A253284DF3DC01091EB3800C36FD62EE
BA15340F1FD498FAB67C0302E9CDA397
Magic: NCCH
Content size: 0x1cfef400
Partition id: 0004000000038c00
Maker code: 3436 ("46")
Version: 0002
Program id: 0004000000038c00
Temp flag: 00
Product code: CTR-P-ALGP
Extended header hash: 0C27E3C1DE7B2AE2D3114F32A4EEBF46
9AFD0CF352C11D4984C2A9F1D2144C63
Extended header size: 00000400
Flags: 0000030100000000
Plain region offset: 0x00004a00
Plain region size: 0x00000200
ExeFS offset: 0x00004c00
ExeFS size: 0x00143800
ExeFS hash region size: 0x00000200
RomFS offset: 0x00148400
RomFS size: 0x1ceab000
RomFS hash region size: 0x00000200
ExeFS Superblock Hash: 130C042615F647C4C63225EA9E67F8A2
7B15246B88FBC7A927257B84977B787B
RomFS Superblock Hash: A65BEE1060BB6A6821BBCEC600035B7E
64FB6EACA7F0960CFB1F5A37087728F7
Note: Offsets and sizes in media units have been converted to byte sizes.

==== Plain region example for Lego Starwars III ====
0004a00: 5b 53 44 4b 2b 4e 49 4e 54 45 4e 44 4f 3a 43 54 [SDK+NINTENDO:CT [SDK+NINTENDO:CTR_SDK-0_14_23_200_none]
0004a10: 52 5f 53 44 4b 2d 30 5f 31 34 5f 32 33 5f 32 30 R_SDK-0_14_23_20
0004a20: 30 5f 6e 6f 6e 65 5d 00 5b 53 44 4b 2b 4e 49 4e 0_none].[SDK+NIN [SDK+NINTENDO:Firmware-02_27]
0004a30: 54 45 4e 44 4f 3a 46 69 72 6d 77 61 72 65 2d 30 TENDO:Firmware-0
0004a40: 32 5f 32 37 5d 00 5b 53 44 4b 2b 4d 6f 62 69 63 2_27].[SDK+Mobic [SDK+Mobiclip:Deblocker_1_0_2]
0004a50: 6c 69 70 3a 44 65 62 6c 6f 63 6b 65 72 5f 31 5f lip:Deblocker_1_
0004a60: 30 5f 32 5d 00 5b 53 44 4b 2b 4d 6f 62 69 63 6c 0_2].[SDK+Mobicl [SDK+Mobiclip:ImaAdpcmDec_1_0_0]
0004a70: 69 70 3a 49 6d 61 41 64 70 63 6d 44 65 63 5f 31 ip:ImaAdpcmDec_1
0004a80: 5f 30 5f 30 5d 00 5b 53 44 4b 2b 4d 6f 62 69 63 _0_0].[SDK+Mobic [SDK+Mobiclip:MobiclipDec_1_0_1]
0004a90: 6c 69 70 3a 4d 6f 62 69 63 6c 69 70 44 65 63 5f lip:MobiclipDec_
0004aa0: 31 5f 30 5f 31 5d 00 5b 53 44 4b 2b 4d 6f 62 69 1_0_1].[SDK+Mobi [SDK+Mobiclip:MoflexDemuxer_1_0_2]
0004ab0: 63 6c 69 70 3a 4d 6f 66 6c 65 78 44 65 6d 75 78 clip:MoflexDemux
0004ac0: 65 72 5f 31 5f 30 5f 32 5d 00 00 00 00 00 00 00 er_1_0_2].......
0004ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0004ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

A tool for parsing this format is available [http://github.com/neimod/ctr/tree/master/ctrtool here]

==== Example dependency list from the extended header ====

00850 41 50 54 3A 55 00 00 00 24 68 69 6F 46 49 4F 00 APT:U...$hioFIO.
00860 24 68 6F 73 74 69 6F 30 24 68 6F 73 74 69 6F 31 $hostio0$hostio1
00870 61 63 3A 75 00 00 00 00 62 6F 73 73 3A 55 00 00 ac:u....boss:U..
00880 63 61 6D 3A 75 00 00 00 63 65 63 64 3A 75 00 00 cam:u...cecd:u..
00890 63 66 67 3A 75 00 00 00 64 6C 70 3A 46 4B 43 4C cfg:u...dlp:FKCL
008A0 64 6C 70 3A 53 52 56 52 64 73 70 3A 3A 44 53 50 dlp:SRVRdsp::DSP
008B0 66 72 64 3A 75 00 00 00 66 73 3A 55 53 45 52 00 frd:u...fs:USER.
008C0 67 73 70 3A 3A 47 70 75 68 69 64 3A 55 53 45 52 gsp::Gpuhid:USER
008D0 68 74 74 70 3A 43 00 00 6D 69 63 3A 75 00 00 00 http:C..mic:u...
008E0 6E 64 6D 3A 75 00 00 00 6E 65 77 73 3A 75 00 00 ndm:u...news:u..
008F0 6E 77 6D 3A 3A 55 44 53 70 74 6D 3A 75 00 00 00 nwm::UDSptm:u...
00900 70 78 69 3A 64 65 76 00 73 6F 63 3A 55 00 00 00 pxi:dev.soc:U...
00910 73 73 6C 3A 43 00 00 00 79 32 72 3A 75 00 00 00 ssl:C...y2r:u...
00920 69 72 3A 55 53 45 52 00 6C 64 72 3A 72 6F 00 00 ir:USER.ldr:ro..
00930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00940 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00950 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00960 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
... ...
009D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
009E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
009F0 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 02 . .............
00A00 5B 53 44 4B 2B 4E 49 4E 54 45 4E 44 4F 3A 43 54 [SDK+NINTENDO:CT

CCI

2011-08-14T22:23:21Z

Jl12:

This document is about the format of CTR cart images (CCI), which is also the format of 3DS ROM dumps.

=== Overview ===
CCI files start with a NCSD header, followed by 3 NCCH blocks. The first block usually starts at 0x4000. While it is unknown what each NCCH block is for, the first one is most likely the main program code since it is much bigger than the others.

The NCCH blocks are in the same format as [[CXI]] files.

=== NCSD header ===
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 0x100
| RSA-2048 signature of the NCSD header, using SHA-256 (needs to be confirmed)
|-
| 0x100
| 4
| Magic ID, always 'NCSD'
|-
| 0x104
| 4
| Size of the CCI image, in media units (1 media unit = 0x200 bytes)
|-
| 0x108
| 8
| Title/Program ID
|-
| 0x120
| 4
| Offset to the first NCCH in media units
|-
| 0x124
| 4
| Size of the first NCCH
|-
| 0x130
| 4
| Offset to the second NCCH
|-
| 0x134
| 4
| Size of the second NCCH
|-
| 0x158
| 4
| Offset to the third NCCH
|-
| 0x15C
| 4
| Size of the third NCCH
|-
| 0x188
| 8
| NCCH Flags: byte[5]-byte[7] indicate content type ( system update, application, ... ) size of media units ( 512*2^byte[6] ) and encryption.
|-
| 0x190
| 8
| Partition ID of the first NCCH
|-
| 0x1A0
| 8
| Partition ID of the second NCCH
|-
| 0x1C8
| 8
| Partition ID of the third NCCH
|-
| 0x200
| 4
| Always 0xFFFFFFFF
|-
| 0x300
| 4
| Used ROM size in bytes
|-
| 0x320
| 16
| Unknown
|}

Parts of the first NCCH block's header are found around 0x1000 for whatever reason.

CCI images may not include all three NCCH blocks. For example, Ghost Recon: Shadow Wars lacks the second NCCH. Entries at 0x130, 0x134 and 0x1A0 in its NCSD header are zero.

CCI

2011-08-14T20:32:35Z

Jl12: ncch flag byte[5]-byte[7]

This document is about the format of CTR cart images (CCI), which is also the format of 3DS ROM dumps.

=== Overview ===
CCI files start with a NCSD header, followed by 3 NCCH blocks. The first block usually starts at 0x4000. While it is unknown what each NCCH block is for, the first one is most likely the main program code since it is much bigger than the others.

The NCCH blocks are in the same format as [[CXI]] files.

=== NCSD header ===
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 0x100
| RSA-2048 signature of the NCSD header, using SHA-256 (needs to be confirmed)
|-
| 0x100
| 4
| Magic ID, always 'NCSD'
|-
| 0x104
| 4
| Size of the CCI image, in media units (1 media unit = 0x200 bytes)
|-
| 0x108
| 8
| Title/Program ID
|-
| 0x120
| 4
| Offset to the first NCCH in media units
|-
| 0x124
| 4
| Size of the first NCCH
|-
| 0x130
| 4
| Offset to the second NCCH
|-
| 0x134
| 4
| Size of the second NCCH
|-
| 0x158
| 4
| Offset to the third NCCH
|-
| 0x15C
| 4
| Size of the third NCCH
|-
| 0x188
| 8
| NCCH Flags: byte[5]-byte[7] indicate content type ( system update, application, ... ) size of media units ( 256*n^byte[6] ) and encryption.
|-
| 0x190
| 8
| Partition ID of the first NCCH
|-
| 0x1A0
| 8
| Partition ID of the second NCCH
|-
| 0x1C8
| 8
| Partition ID of the third NCCH
|-
| 0x200
| 4
| Always 0xFFFFFFFF
|-
| 0x300
| 4
| Used ROM size in bytes
|-
| 0x320
| 16
| Unknown
|}

Parts of the first NCCH block's header are found around 0x1000 for whatever reason.

CCI images may not include all three NCCH blocks. For example, Ghost Recon: Shadow Wars lacks the second NCCH. Entries at 0x130, 0x134 and 0x1A0 in its NCSD header are zero.

Talk:CXI

2011-06-20T18:29:13Z

Jl12:

Talk:CXI

2011-06-20T18:28:15Z

Jl12:

How 3DS system judge encryption type? [[User_talk:Matyapiro|Matyapiro]]

Sorry the question is not understood. What do you mean? [[User:Neimod|Neimod]]

I think that he means "How does the 3DS decide what encryption method must be used" --[[User:Quincy|Quincy]] 23:47, 29 May 2011 (CEST)

That question does not make sense. There are no decisions. It is always AES CTR. [[User:Neimod|Neimod]]

Sorry,how does the 3DS decide what key to use for encryption?
[[User_talk:Matyapiro|Matyapiro]]
:If you figure that out, let us know, thanks. [[User:Neimod|Neimod]] 02:45, 1 June 2011 (CEST)
There's a common key used to generate output at compile time, when the cci/ctx files are made. Why do you say 128 bit AES CTR though? [[User:Jl12|Jl12]]
: Because 128-bit AES CTR is used to encrypt those formats. --[[User:Neimod|Neimod]] 15:40, 18 June 2011 (CEST)

I know *something* is used to encrypt but do we know it is 128 bit AES CTR? [[User:Jl12|Jl12]]

Frankly I don't think it was AES. I think it's using RSA for encryption. Besides it already used it once for the 2048-bit signature as you said. Wouldn't it make way more sense to also use it for the encryption scheme. [[User:Jl12|Jl12]]
: Lol. --[[User:Neimod|Neimod]] 16:06, 20 June 2011 (CEST)
: And what's funny? So I guess it's just based purely on speculation? You should say so. That way nobody believes something that isn't right. [[User:Jl12|Jl12]] 22:28, 20 June 2011 (CEST)

How did you get this data? Did you find some way to dump 3DS cartridges? --[[User:Popoffka|Popoffka]] 09:15, 1 June 2011 (CEST)
:Yes, someone found a way to dump the data on 3DS cards. Unfortunately the method cannot be disclosed, and at this point dumping is not really useful since most of the information is encrypted. [[User:Neimod|Neimod]] 10:03, 1 June 2011 (CEST)

- CCI files are 'CTR card images', which are burned to ROM. If the application is ran from NAND then a CXI file is generated instead. CIA files are installed to NAND after they are imported or loaded from a external source first ( the SD card ). CXI are required to make a CIA file.[[User:Jl12|Jl12]]

I want you to write express about key words when you change the page...

I can understand what you say,but someone visit this wiki first will probably give up,I think...[[User_talk:Matyapiro|Matyapiro]]

- What?

- CXI == ran from NAND.

- CCI == cart/ROM format.

- CIA == imported from an external source. *Then* executed from NAND. "external source" is either an SD card or (official) debugging hardware.

I'm just explaining there are many analogues to the CXI format and they're all similar to each other but compiled/linked for different purposes mostly. (It isn't a comprehensive list, either. )

File Formats

2011-06-19T19:20:57Z

Jl12:

The following is a list of known file formats used by the 3DS.

=== Applications ( any executable code ) ===

.CCI - Cart image. Burned into a ROM (or loaded by official debugging hardware). These are also the actual format of ROM dumps, and the response of read requests between a 3DS and a cartridge.

.CXI - Executable image. Similar to above. The difference is CXI applications are installed onto [thus ran from] NAND. See http://3dbrew.org/wiki/CXI.

.CIA - Importable/installable application. An application ran from NAND after being loaded from an external [not NAND] source. The CIA format allows the CXI image to be imported/installed properly.

.CSU - System Update. Format varies slightly with revisions.

.CFA - Externalized ROM-FS. CXI data and ROMFS data can be separated into a list of external files instead of compiled into just 1 CXI image. (Normally not used.)

.NSA - Archive used by several of the communication protocols in the 3DS.

.RSF - Descriptive data used when outputting a CCI/CXI file. Specifies options such as: title, save type, and so on.

.AXF - Pre-assembled ARM code. before being linked into a CCI/CXI format.

=== Filesystem ===

The 3DS filesystem requires absolute paths. It can handle either short (8.3) and long (255 char maximum) file names.

== MPO (Multi-Picture Format) ==
Document describing the file format used in mpo files:
http://www.cipa.jp/english/hyoujunka/kikaku/pdf/DC-007_E.pdf

File Formats

2011-06-19T18:41:07Z

Jl12:

The following is a list of known file formats used by the 3DS.

=== Applications ( any executable code ) ===

.CCI - Cart image. Burned into a ROM (or loaded by official debugging hardware). These are also the actual format of ROM dumps, and the response of read requests between a 3DS and a cartridge.

.CXI - Executable image. Similar to above. The difference is CXI applications are installed onto [thus ran from] NAND. See http://3dbrew.org/wiki/CXI.

.CIA - Importable/installable application. An application ran from NAND after being loaded from an external [not NAND] source. The CIA format allows the CXI image to be imported/installed properly.

.CSU - System Update. Format varies slightly with revisions.

.CFA - Externalized ROM-FS. CXI data and ROMFS data can be separated into a list of external files instead of compiled into just 1 CXI image. (Normally not used.)

.NSA - Archive used by several of the communication protocols in the 3DS.

.RSF - Descriptive data used when outputting a CCI/CXI file. Specifies options such as: title, save type, and so on.

.RXF - Pre-assembled ARM code. before being linked into a CCI/CXI format.

=== Filesystem ===

The 3DS filesystem requires absolute paths. It can handle either short (8.3) and long (255 char maximum) file names.

== MPO (Multi-Picture Format) ==
Document describing the file format used in mpo files:
http://www.cipa.jp/english/hyoujunka/kikaku/pdf/DC-007_E.pdf

Talk:CXI

2011-06-19T17:04:57Z

Jl12:

How 3DS system judge encryption type? [[User_talk:Matyapiro|Matyapiro]]

Sorry the question is not understood. What do you mean? [[User:Neimod|Neimod]]

I think that he means "How does the 3DS decide what encryption method must be used" --[[User:Quincy|Quincy]] 23:47, 29 May 2011 (CEST)

That question does not make sense. There are no decisions. It is always AES CTR. [[User:Neimod|Neimod]]

Sorry,how does the 3DS decide what key to use for encryption?
[[User_talk:Matyapiro|Matyapiro]]
:If you figure that out, let us know, thanks. [[User:Neimod|Neimod]] 02:45, 1 June 2011 (CEST)
There's a common key used to generate output at compile time, when the cci/ctx files are made. Why do you say 128 bit AES CTR though? [[User:Jl12|Jl12]]
: Because 128-bit AES CTR is used to encrypt those formats. --[[User:Neimod|Neimod]] 15:40, 18 June 2011 (CEST)

I know *something* is used to encrypt but do we know it is 128 bit AES CTR? [[User:Jl12|Jl12]]

Frankly I don't think it was AES. I think it's using RSA for encryption. Besides it already used it once for the 2048-bit signature as you said. Wouldn't it make way more sense to also use it for the encryption scheme. [[User:Jl12|Jl12]]

How did you get this data? Did you find some way to dump 3DS cartridges? --[[User:Popoffka|Popoffka]] 09:15, 1 June 2011 (CEST)
:Yes, someone found a way to dump the data on 3DS cards. Unfortunately the method cannot be disclosed, and at this point dumping is not really useful since most of the information is encrypted. [[User:Neimod|Neimod]] 10:03, 1 June 2011 (CEST)

- CCI files are 'CTR card images', which are burned to ROM. If the application is ran from NAND then a CXI file is generated instead. CIA files are installed to NAND after they are imported or loaded from a external source first ( the SD card ). CXI are required to make a CIA file.[[User:Jl12|Jl12]]

I want you to write express about key words when you change the page...

I can understand what you say,but someone visit this wiki first will probably give up,I think...[[User_talk:Matyapiro|Matyapiro]]

- What?

- CXI == ran from NAND.

- CCI == cart/ROM format.

- CIA == imported from an external source. *Then* executed from NAND. "external source" is either an SD card or (official) debugging hardware.

I'm just explaining there are many analogues to the CXI format and they're all similar to each other but compiled/linked for different purposes mostly. (It isn't a comprehensive list, either. )

Talk:CXI

2011-06-19T17:02:53Z

Jl12:

How 3DS system judge encryption type? [[User_talk:Matyapiro|Matyapiro]]

Sorry the question is not understood. What do you mean? [[User:Neimod|Neimod]]

I think that he means "How does the 3DS decide what encryption method must be used" --[[User:Quincy|Quincy]] 23:47, 29 May 2011 (CEST)

That question does not make sense. There are no decisions. It is always AES CTR. [[User:Neimod|Neimod]]

Sorry,how does the 3DS decide what key to use for encryption?
[[User_talk:Matyapiro|Matyapiro]]
:If you figure that out, let us know, thanks. [[User:Neimod|Neimod]] 02:45, 1 June 2011 (CEST)
There's a common key used to generate output at compile time, when the cci/ctx files are made. Why do you say 128 bit AES CTR though? [[User:Jl12|Jl12]]
: Because 128-bit AES CTR is used to encrypt those formats. --[[User:Neimod|Neimod]] 15:40, 18 June 2011 (CEST)

I know *something* is used to encrypt but do we know it is 128 bit AES CTR? [[User:Jl12|Jl12]]

Frankly I don't think it was AES. I think it's using RSA for encryption. Besides it already used it once for the 2048-bit signature as you said. Wouldn't it make way more sense to also use it for the encryption scheme. [[User:Jl12|Jl12]]

How did you get this data? Did you find some way to dump 3DS cartridges? --[[User:Popoffka|Popoffka]] 09:15, 1 June 2011 (CEST)
:Yes, someone found a way to dump the data on 3DS cards. Unfortunately the method cannot be disclosed, and at this point dumping is not really useful since most of the information is encrypted. [[User:Neimod|Neimod]] 10:03, 1 June 2011 (CEST)

- CCI files are 'CTR card images', which are burned to ROM. If the application is ran from NAND then a CXI file is generated instead. CIA files are installed to NAND after they are imported or loaded from a external source first ( the SD card ). CXI are required to make a CIA file.[[User:Jl12|Jl12]]

I want you to write express about key words when you change the page...

I can understand what you say,but someone visit this wiki first will probably give up,I think...[[User_talk:Matyapiro|Matyapiro]]

- What?

- CXI == ran from NAND.

- CCI == cart/ROM format.

- CIA first imported from an external source. *Then* executed from NAND. "external source" = either an SD card or (official) debugging hardware.

I'm just explaining there are many analogues to the CXI format and they're all similar to each other but compiled/linked for different purposes mostly. (It isn't a comprehensive list, either. )