CIA stands for CTR Importable Archive. These files contain a compiled application which can be installed on CTR NAND, TWL NAND (part of the NAND used by DSi applications) and on the SD card.
The CIA format has a similar structure to the WAD format.
The file is represented in little-endian.
The data is aligned in 64 byte blocks (if a content ends at the middle of the block, the next content will begin from a new block).
This is a 32 bytes long header (8 x uint32).
|0x00||0x04||Archive Header Size (=0x2020 bytes) (Starts with 0x80 @ offset 0x0020)|
|0x08||0x04||Certificate chain size|
|0x10||0x04||TMD file size|
|0x14||0x04||Icon size (0 if no icon)|
|0x18||0x04||APP file size|
The order of the sections in the header also is the order of them in the CIA file:
- certificate chain
- TMD file data
- APP file data
- Icon - (is not a necessary component and can be removed without altering the validity of the file)
The APP data can be either encrypted or cleartext, retail Download Play CIAs' APP data is always encrypted.
The actual icon is located at offset 0x400 in the icon data.