Mii Maker

From 3dbrew
Jump to: navigation, search

Mii Maker lets you create Miis, and is the successor of the Wii's Mii Channel.

It can transfer Miis over local wireless from other systems running Mii Maker (3DS/Wii U), or receive, but not send, from Mii Channel.

Wii Mii Channel transfer protocol[edit]

The Wii beacons are similar to the usual multi-cart NDS beacons, except: beacon_type is zero, and payload size is 0x14. The payload data is just the Wii UTF-16 nickname, with some extra unused zero data. The usual multi-cast NDS protocol is used for sending the 3DS nick to the Wii. After many keep-alive frames, it eventually sends a bunch of frames, each containing the whole Mii. There's a 6-byte header, followed by Mii data. At the end of these frames like most NDS frames is the 0200 byte marker.

Mii QR Code format[edit]

3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to Denso-Wave Inc web site for QR Code format specifications). It contains 0x70-bytes of binary data. 3DS seems to have a fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code.

The data itself is encrypted with AES-CCM, xorpads can be determined from known plaintext here. The Mii Maker application uses the NS APT Wrap/Unwrap commands to encrypt/decrypt this Mii data. For the NS Unwrap command, the Mii Maker application uses blocksize=12, noncesize=10, and inputbuffer-size=0x60. The first 8-bytes(cleartext MiiID+MAC address) in the below Mii data is the nonce used with the NS Unwrap/Wrap commands, the rest of the data at 0x8-0x5F is encrypted.

Offset Length
0x0 0x4 Mii ID (big-endian 32-bit unsigned integer)
The most significant 3 bits determine whether the Mii is Special, Foreign, or Normal [1]
time_offset = (mii_id & 0x0FFFFFFF) * 2;
time_offset is the time the Mii was created, represented as the number of seconds since 01/01/2010 00:00:00
0x4 0x4 High 4 octets of MAC address [2]
0x8 0x1 Unknown, the encrypted data begins here.
0x9 0x1 Allow Copying
0xA 0xE unknown
0x18 0x2 Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt, ??
0x1A 0x14 UTF-16 Mii Name (10 chars max)
0x2E 0x2 width & height
0x30 0x1 bit 0: disable sharing
bit 1-4: face shape
bit 5-7: skin color
0x31 0x1 bit 0-3: wrinkles
bit 4-7: makeup
0x32 0x1 hair style
0x33 0x1 bit 0-2: hair color
bit 3: flip hair
0x34 0x4 unknown
0x38 0x1 bit 0-4: eyebrow style
bit 5-7: eyebrow color
0x39 0x1 bit 0-3: eyebrow scale
bit 4-6: eyebrow yscale
0x3A 0x2 note that the bytes are swapped over (little-endian layout)
bit 0-3: eyebrow rotation
bit 5-8: eyebrow x spacing
bit 9-13: eyebrow y position
0x3C 0x1 Allow Copying
0x3D 0x3 unknown
0x40 0x1 Mii Sharing Value
0x41 0x7 unknown
0x48 0x14 UTF-16 Author Name (10 chars max)
0x5C 0x2 unknown
0x5E 0x2 unknown
0x60 0x10 AES-CCM MAC
  • QR codes made from the same 3DS for the same Mii are use the same AES-CCM nonce (you can recreate the xorpad by xoring with known values from this table).

Mii Database[edit]

Created, received, or even met-in-multiplayer Miis are saved in CFL_DB.dat.


The ExtData File System for Mii Maker is as follows:

├── icon
├── boss
└── user
    └── ExBanner
        └── COMMON.bin
File Details Size FW Introduced Plaintext
icon Duplicate from Application ExeFS. Always image 00000002. 0x36c0 Bytes 1.0.0-0 Download
COMMON.bin Extended Banner for Home Menu. Always image 00000003. 0x20224 Bytes 1.0.0-0 Download