https://www.3dbrew.org/w/api.php?action=feedcontributions&user=Duke+srg&feedformat=atom3dbrew - User contributions [en]2024-03-29T08:29:46ZUser contributionsMediaWiki 1.35.8https://www.3dbrew.org/w/index.php?title=Title_Database&diff=20100Title Database2017-06-22T09:49:48Z<p>Duke srg: ticket.db content format description added</p>
<hr />
<div>These files contain data relating to install/usage/management of installed 3DS titles. The database files are located at:<br />
<br />
* nand/dbs<br />
* sdmc/Nintendo 3DS/<ID0>/<ID1>/dbs<br />
<br />
ID0 is the first 0x10-bytes from a SHA256 [[nand/private/movable.sed|hash]]. The installation of [[SD Filesystem|SD Card]] titles was introduced in the [[2.0.0-2]] update and the SD dbs files are encrypted. These files are [[extdata]] images. The NAND extdata images are cleartext, however some of the images contain data encrypted with a console-unique keyslot.<br />
<br />
These files are only created on SD (via [[Application_Manager_Services|AM]]) if they don't exist when the [[eShop]] application is starting up, during network init etc (prior to showing the "system update required" dialog).<br />
<br />
These files are stored under this directory:<br />
{| class="wikitable" border="1"<br />
|-<br />
! Stored on SD card<br />
! Stored in CTR-NAND<br />
! Filename<br />
! [[Savegames#AES_MAC_header|CTR-9DB0]] ID<br />
! Description<br />
|-<br />
| No<br />
| Yes<br />
| ticket.db<br />
| 0x0<br />
| This contains the installed tickets (NAND and SD).<br />
|-<br />
| No<br />
| Yes<br />
| certs.db<br />
| 0x1<br />
| This contains the certificate chain used to verify TMDs and other certificates.<br />
|-<br />
| Yes<br />
| Yes<br />
| title.db<br />
| 0x2<br />
| Title database, this contains entries for all installed titles (TWL & CTR) on the 3DS (Each database is responsible for titles installed on its medium).<br />
|-<br />
| Yes<br />
| Yes<br />
| import.db<br />
| 0x3<br />
| This is an Import Database, it contains entries for titles (or versions of titles) not yet installed, ready for transferring to the title.db. (Automatic Update uses this, so completing the update takes seconds.)<br />
|-<br />
| No<br />
| Yes<br />
| tmp_t.db<br />
| 0x4<br />
| This is the temporary Title database containing one entry for the currently installed [[Download Play]] Child.<br />
|-<br />
| No<br />
| Yes<br />
| tmp_i.db<br />
| 0x5<br />
| Similar to import.db, except it's used in conjunction with tmp_t.db, for installing [[Download Play]] Children.<br />
|}<br />
<br />
The SD dbs images use the same [[nand/private/movable.sed|keyslot]] as the other SD/NAND savedata images for the AES-MAC. The NAND dbs images for the AES-MAC use a console-unique keyslot where the keyX and keyY for it are initialized by bootrom.<br />
<br />
The *.db [[extdata|Extdata]] images do not use a DATA partition, so there are two versions of the database in the image, an active and old version (the active one is defined by the DIFF header). These database files consist of a pre-header with size of 0x80 identifying the Database Type, followed by a BDRI container. The offsets in the BDRI header are usually relative to the offset to the start of the BDRI header (0x80 in the file)<br />
<br />
== Pre Header ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x00<br />
| 8<br />
| Database Type "Magic" (see below)<br />
|-<br />
| 0x08<br />
| 0x78<br />
| Reserved<br />
|}<br />
<br />
For ticket.db different pre header is used:<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x00<br />
| 4<br />
| Database Type "Magic" (see below)<br />
|-<br />
| 0x04<br />
| 0x04<br />
| Unknown (always 0x00000001 ?)<br />
|-<br />
| 0x08<br />
| 0x04<br />
| Unknown<br />
|-<br />
| 0x0C<br />
| 0x04<br />
| Unknown (0x30 smaller than previous one)<br />
|}<br />
<br />
=== Database Magic ===<br />
<br />
{| class="wikitable"<br />
|-<br />
! Database Type<br />
! Magic<br />
|-<br />
| CTR-NAND ticket.db<br />
| TICK<br />
|-<br />
| CTR-NAND import.db<br />
| NANDIDB<br />
|-<br />
| CTR-NAND title.db<br />
| NANDTDB<br />
|-<br />
| CTR-NAND tmp_i.db<br />
| TEMPIDB<br />
|-<br />
| CTR-NAND tmp_t.db<br />
| TEMPIDB<br />
|-<br />
| SD Card import.db<br />
| TEMPTDB<br />
|-<br />
| SD Card title.db<br />
| TEMPTDB<br />
|}<br />
<br />
== BDRI ==<br />
<br />
Information stored about titles in these Title Database files are stored in two parts in a BDRI partition. Firstly in a Title Entry Table, and secondly in a Title Info Table. <br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x0<br />
| 4<br />
| Database Magic ("BDRI")<br />
|-<br />
| 0x4<br />
| 4<br />
| File Format Version (0x30000)<br />
|-<br />
| 0x8<br />
| 8<br />
| Unknown<br />
|-<br />
| 0x10<br />
| 8<br />
| File Size (including pre header), in blocks (see next field)<br />
|-<br />
| 0x18<br />
| 4<br />
| Block Size (Usually 0x80; 0x200 for ticket.db)<br />
|-<br />
| 0x1C<br />
| 4<br />
| Reserved<br />
|-<br />
| 0x20<br />
| 0x20<br />
| Unknown/Constant<br />
|-<br />
| 0x40<br />
| 0x18<br />
| Unknown<br />
|-<br />
| 0x58<br />
| 8<br />
| Relative Title Entry Table Offset<br />
|-<br />
| 0x60<br />
| 0x20<br />
| Unknown<br />
|}<br />
<br />
== Title Entry Table ==<br />
<br />
This contains 'Entries' for all the titles stored in the database. However this just appears to be an indexing table, the majority of title information is kept in a Title Info Table, which these index entries point to. Title Entries start immediately after the Title Entry Table Header. And there is no padding between entries.<br />
<br />
=== Header ===<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x0<br />
| 4<br />
| Unknown/Magic? (usually = 0x2)<br />
|-<br />
| 0x4<br />
| 4<br />
| Unknown/Magic? (usually = 0x3)<br />
|-<br />
| 0x8<br />
| 0x24<br />
| Reserved<br />
|-<br />
| 0x2C<br />
| 4<br />
| Number of used Title Entries<br />
|-<br />
| 0x30<br />
| X - 0x30<br />
| Alignment padding for X = BDRI Block Size<br />
|-<br />
| X<br />
| 4<br />
| MAX Number of Title Entries<br />
|-<br />
| X + 0x04<br />
| 4<br />
| Unknown<br />
|-<br />
| X + 0x08<br />
| 0x20<br />
| Reserved<br />
|}<br />
<br />
=== Title Entry Format ===<br />
<br />
The entries are 0x2C bytes long.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
! ticket.db only<br />
|-<br />
| 0x0<br />
| 4<br />
| Unknown<br />
| Unknown (0)<br />
|-<br />
| 0x4<br />
| 4<br />
| Active Flag. If this isn't = 0x1, then this entry slot is unused<br />
| same<br />
|-<br />
| 0x8<br />
| 0x8<br />
| Title ID<br />
| same<br />
|-<br />
| 0x10<br />
| 4<br />
| Title Entry Index<br />
| same<br />
|-<br />
| 0x14<br />
| 4<br />
| Relative Title Info Offset, in blocks (see next field)<br />
| Unknown<br />
|-<br />
| 0x18<br />
| 0x4<br />
| Block Size (Usually 0x80; 0x200 for ticket.db)<br />
| Relative Title Info Offset, in BDRI blocks<br />
|-<br />
| 0x1c<br />
| 4<br />
| Reserved<br />
| Title Info size, in bytes<br />
|-<br />
| 0x20<br />
| 4<br />
| Unknown, occasionally this value is the title's "Title ID lower" <br />
| Unknown (0)<br />
|-<br />
| 0x24<br />
| 0x4<br />
| Unknown<br />
| same<br />
|-<br />
| 0x28<br />
| 0x4<br />
| Unknown<br />
| same<br />
|}<br />
<br />
* The actual Title Info offset is calculated by the following: Offset of BDRI Header + Relative Offset of Title Entry Table + Relative Title Info Offset<br />
<br />
== Title Info Table ==<br />
<br />
These consist of 0x80 byte long entries, pointed to by the title index entries. They contain information taken from both the application NCCH file(s) and TMD.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x0<br />
| 8<br />
| Title Size<br />
|-<br />
| 0x8<br />
| 4<br />
| Title Type(usually 0x40)<br />
|-<br />
| 0xC<br />
| 4<br />
| Title Version<br />
|-<br />
| 0x10<br />
| 4<br />
| Flags_0<br />
|-<br />
| 0x14<br />
| 4<br />
| TMD Content ID<br />
|-<br />
| 0x18<br />
| 4<br />
| CMD Content ID<br />
|-<br />
| 0x1c<br />
| 4<br />
| Flags_1<br />
|-<br />
| 0x20<br />
| 4<br />
| ExtdataID low (zero if title doesn't use Extdata)<br />
|-<br />
| 0x24<br />
| 4<br />
| Reserved<br />
|-<br />
| 0x28<br />
| 8<br />
| Flags_2<br />
|-<br />
| 0x30<br />
| 0x10<br />
| Product Code<br />
|-<br />
| 0x40<br />
| 0x10<br />
| Reserved<br />
|-<br />
| 0x50<br />
| 0x4<br />
| Unknown<br />
|-<br />
| 0x54<br />
| 0x2c<br />
| Reserved<br />
|}<br />
<br />
For ticket.db title info contains a small header and actual ticket data:<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x0<br />
| 4<br />
| Unknown (always 0x00000001?)<br />
|-<br />
| 0x4<br />
| 4<br />
| Ticket data size X (=0x530)<br />
|-<br />
| 0x8<br />
| X<br />
| [[Ticket|Ticket]] data<br />
|}<br />
<br />
==== Flags_0 ====<br />
<br />
{| class="wikitable"<br />
|-<br />
! Index<br />
! Description<br />
|-<br />
| 0<br />
| Electronic Manual<br />
|-<br />
| 1<br />
| ?<br />
|-<br />
| 2<br />
| ?<br />
|-<br />
| 3<br />
| ?<br />
|}<br />
<br />
==== Flags_1 ====<br />
<br />
{| class="wikitable"<br />
|-<br />
! Index<br />
! Description<br />
|-<br />
| 0<br />
| SD Save Data<br />
|-<br />
| 1<br />
| ?<br />
|-<br />
| 2<br />
| ?<br />
|-<br />
| 3<br />
| ?<br />
|}<br />
<br />
==== Flags_2 ====<br />
<br />
{| class="wikitable"<br />
|-<br />
! Index<br />
! Description<br />
|-<br />
| 0<br />
| DSiWare Related (Visibility on Home Menu/Export Flag?)<br />
|-<br />
| 1<br />
| ?<br />
|-<br />
| 2<br />
| ?<br />
|-<br />
| 3<br />
| ?<br />
|-<br />
| 4<br />
| Found with DSiWare Titles and titles with an 'Application' Title ID<br />
|-<br />
| 5<br />
| DSiWare Related (Visibility on Home Menu/Export Flag?)<br />
|-<br />
| 6<br />
| ?<br />
|-<br />
| 7<br />
| ?<br />
|}<br />
<br />
'''NOTES:'''<br />
<br />
It is important to note the database doesn't contain a hash of the [[Title Data Structure|.cmd]]. So if a user has more than one valid set of [[Title Data Structure|application data]] for a given .cmd Content ID they can be manually interchanged without issue. Though renaming a .cmd file to match the Content ID which the title.db is expecting will result in an error, as the CTR for the per-console encryption layer changes depending on the file path, and the MAC of the .cmd is probably generated with the .cmd Content ID in mind.<br />
<br />
These NAND/SD /dbs images seem to be loaded by the ARM9 while NATIVE_FIRM is booting.<br />
<br />
Removing ticket.db from a New-3DS with signature checks disabled will not result in an unbootable system, however all icons except Slot-1 will disappear from Home. Applets can however still be used. Recovery can be accomplished via [[Hardware|hardmod]] or [[arm9loaderhax]] plus a known good backup of the file (or the whole partition or disk); Gamecard exploits were not tested, and Browserhax did not work.<br />
<br />
== Tools ==<br />
<br />
[https://github.com/ps3hen/ctr_toolkit/tree/master/extdata_tool extdata_tool] - parsing cleartext .db extdata images</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Title_Database&diff=20099Title Database2017-06-20T20:59:21Z<p>Duke srg: Title Entry Table header alignment</p>
<hr />
<div>These files contain data relating to install/usage/management of installed 3DS titles. The database files are located at:<br />
<br />
* nand/dbs<br />
* sdmc/Nintendo 3DS/<ID0>/<ID1>/dbs<br />
<br />
ID0 is the first 0x10-bytes from a SHA256 [[nand/private/movable.sed|hash]]. The installation of [[SD Filesystem|SD Card]] titles was introduced in the [[2.0.0-2]] update and the SD dbs files are encrypted. These files are [[extdata]] images. The NAND extdata images are cleartext, however some of the images contain data encrypted with a console-unique keyslot.<br />
<br />
These files are only created on SD (via [[Application_Manager_Services|AM]]) if they don't exist when the [[eShop]] application is starting up, during network init etc (prior to showing the "system update required" dialog).<br />
<br />
These files are stored under this directory:<br />
{| class="wikitable" border="1"<br />
|-<br />
! Stored on SD card<br />
! Stored in CTR-NAND<br />
! Filename<br />
! [[Savegames#AES_MAC_header|CTR-9DB0]] ID<br />
! Description<br />
|-<br />
| No<br />
| Yes<br />
| ticket.db<br />
| 0x0<br />
| This contains the installed tickets (NAND and SD).<br />
|-<br />
| No<br />
| Yes<br />
| certs.db<br />
| 0x1<br />
| This contains the certificate chain used to verify TMDs and other certificates.<br />
|-<br />
| Yes<br />
| Yes<br />
| title.db<br />
| 0x2<br />
| Title database, this contains entries for all installed titles (TWL & CTR) on the 3DS (Each database is responsible for titles installed on its medium).<br />
|-<br />
| Yes<br />
| Yes<br />
| import.db<br />
| 0x3<br />
| This is an Import Database, it contains entries for titles (or versions of titles) not yet installed, ready for transferring to the title.db. (Automatic Update uses this, so completing the update takes seconds.)<br />
|-<br />
| No<br />
| Yes<br />
| tmp_t.db<br />
| 0x4<br />
| This is the temporary Title database containing one entry for the currently installed [[Download Play]] Child.<br />
|-<br />
| No<br />
| Yes<br />
| tmp_i.db<br />
| 0x5<br />
| Similar to import.db, except it's used in conjunction with tmp_t.db, for installing [[Download Play]] Children.<br />
|}<br />
<br />
The SD dbs images use the same [[nand/private/movable.sed|keyslot]] as the other SD/NAND savedata images for the AES-MAC. The NAND dbs images for the AES-MAC use a console-unique keyslot where the keyX and keyY for it are initialized by bootrom.<br />
<br />
The *.db [[extdata|Extdata]] images do not use a DATA partition, so there are two versions of the database in the image, an active and old version (the active one is defined by the DIFF header). These database files consist of a pre-header with size of 0x80 identifying the Database Type, followed by a BDRI container. The offsets in the BDRI header are usually relative to the offset to the start of the BDRI header (0x80 in the file)<br />
<br />
== Pre Header ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x00<br />
| 8<br />
| Database Type "Magic" (see below)<br />
|-<br />
| 0x08<br />
| 0x78<br />
| Reserved<br />
|}<br />
<br />
=== Database Magic ===<br />
<br />
{| class="wikitable"<br />
|-<br />
! Database Type<br />
! Magic<br />
|-<br />
| CTR-NAND import.db<br />
| NANDIDB<br />
|-<br />
| CTR-NAND title.db<br />
| NANDTDB<br />
|-<br />
| CTR-NAND tmp_i.db<br />
| TEMPIDB<br />
|-<br />
| CTR-NAND tmp_t.db<br />
| TEMPIDB<br />
|-<br />
| SD Card import.db<br />
| TEMPTDB<br />
|-<br />
| SD Card title.db<br />
| TEMPTDB<br />
|}<br />
<br />
== BDRI ==<br />
<br />
Information stored about titles in these Title Database files are stored in two parts in a BDRI partition. Firstly in a Title Entry Table, and secondly in a Title Info Table. <br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x0<br />
| 4<br />
| Database Magic ("BDRI")<br />
|-<br />
| 0x4<br />
| 4<br />
| File Format Version (0x30000)<br />
|-<br />
| 0x8<br />
| 8<br />
| Unknown<br />
|-<br />
| 0x10<br />
| 8<br />
| File Size (including pre header), in blocks (see next field)<br />
|-<br />
| 0x18<br />
| 4<br />
| Block Size (Usually 0x80; 0x200 for ticket.db)<br />
|-<br />
| 0x1C<br />
| 4<br />
| Reserved<br />
|-<br />
| 0x20<br />
| 0x20<br />
| Unknown/Constant<br />
|-<br />
| 0x40<br />
| 0x18<br />
| Unknown<br />
|-<br />
| 0x58<br />
| 8<br />
| Relative Title Entry Table Offset<br />
|-<br />
| 0x60<br />
| 0x20<br />
| Unknown<br />
|}<br />
<br />
== Title Entry Table ==<br />
<br />
This contains 'Entries' for all the titles stored in the database. However this just appears to be an indexing table, the majority of title information is kept in a Title Info Table, which these index entries point to. Title Entries start immediately after the Title Entry Table Header. And there is no padding between entries.<br />
<br />
=== Header ===<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x0<br />
| 4<br />
| Unknown/Magic? (usually = 0x2)<br />
|-<br />
| 0x4<br />
| 4<br />
| Unknown/Magic? (usually = 0x3)<br />
|-<br />
| 0x8<br />
| 0x24<br />
| Reserved<br />
|-<br />
| 0x2C<br />
| 4<br />
| Number of used Title Entries<br />
|-<br />
| 0x30<br />
| X - 0x30<br />
| Alignment padding for X = BDRI Block Size<br />
|-<br />
| X<br />
| 4<br />
| MAX Number of Title Entries<br />
|-<br />
| X + 0x04<br />
| 4<br />
| Unknown<br />
|-<br />
| X + 0x08<br />
| 0x20<br />
| Reserved<br />
|}<br />
<br />
=== Title Entry Format ===<br />
<br />
The entries are 0x2C bytes long.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x0<br />
| 4<br />
| Unknown<br />
|-<br />
| 0x4<br />
| 4<br />
| Active Flag. If this isn't = 0x1, then this entry slot is unused<br />
|-<br />
| 0x8<br />
| 0x8<br />
| Title ID<br />
|-<br />
| 0x10<br />
| 4<br />
| Title Entry Index<br />
|-<br />
| 0x14<br />
| 4<br />
| Relative Title Info Offset, in blocks (see next field)<br />
|-<br />
| 0x18<br />
| 0x4<br />
| Block Size (Usually 0x80; 0x200 for ticket.db)<br />
|-<br />
| 0x1c<br />
| 4<br />
| Reserved<br />
|-<br />
| 0x20<br />
| 4<br />
| Unknown, occasionally this value is the title's "Title ID lower" <br />
|-<br />
| 0x24<br />
| 0x4<br />
| Unknown<br />
|-<br />
| 0x28<br />
| 0x4<br />
| Unknown<br />
|}<br />
<br />
* The actual Title Info offset is calculated by the following: Offset of BDRI Header + Relative Offset of Title Entry Table + Relative Title Info Offset<br />
<br />
== Title Info Table ==<br />
<br />
These consist of 0x80 byte long entries, pointed to by the title index entries. They contain information taken from both the application NCCH file(s) and TMD.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x0<br />
| 8<br />
| Title Size<br />
|-<br />
| 0x8<br />
| 4<br />
| Title Type(usually 0x40)<br />
|-<br />
| 0xC<br />
| 4<br />
| Title Version<br />
|-<br />
| 0x10<br />
| 4<br />
| Flags_0<br />
|-<br />
| 0x14<br />
| 4<br />
| TMD Content ID<br />
|-<br />
| 0x18<br />
| 4<br />
| CMD Content ID<br />
|-<br />
| 0x1c<br />
| 4<br />
| Flags_1<br />
|-<br />
| 0x20<br />
| 4<br />
| ExtdataID low (zero if title doesn't use Extdata)<br />
|-<br />
| 0x24<br />
| 4<br />
| Reserved<br />
|-<br />
| 0x28<br />
| 8<br />
| Flags_2<br />
|-<br />
| 0x30<br />
| 0x10<br />
| Product Code<br />
|-<br />
| 0x40<br />
| 0x10<br />
| Reserved<br />
|-<br />
| 0x50<br />
| 0x4<br />
| Unknown<br />
|-<br />
| 0x54<br />
| 0x2c<br />
| Reserved<br />
|}<br />
<br />
==== Flags_0 ====<br />
<br />
{| class="wikitable"<br />
|-<br />
! Index<br />
! Description<br />
|-<br />
| 0<br />
| Electronic Manual<br />
|-<br />
| 1<br />
| ?<br />
|-<br />
| 2<br />
| ?<br />
|-<br />
| 3<br />
| ?<br />
|}<br />
<br />
==== Flags_1 ====<br />
<br />
{| class="wikitable"<br />
|-<br />
! Index<br />
! Description<br />
|-<br />
| 0<br />
| SD Save Data<br />
|-<br />
| 1<br />
| ?<br />
|-<br />
| 2<br />
| ?<br />
|-<br />
| 3<br />
| ?<br />
|}<br />
<br />
==== Flags_2 ====<br />
<br />
{| class="wikitable"<br />
|-<br />
! Index<br />
! Description<br />
|-<br />
| 0<br />
| DSiWare Related (Visibility on Home Menu/Export Flag?)<br />
|-<br />
| 1<br />
| ?<br />
|-<br />
| 2<br />
| ?<br />
|-<br />
| 3<br />
| ?<br />
|-<br />
| 4<br />
| Found with DSiWare Titles and titles with an 'Application' Title ID<br />
|-<br />
| 5<br />
| DSiWare Related (Visibility on Home Menu/Export Flag?)<br />
|-<br />
| 6<br />
| ?<br />
|-<br />
| 7<br />
| ?<br />
|}<br />
<br />
'''NOTES:'''<br />
<br />
It is important to note the database doesn't contain a hash of the [[Title Data Structure|.cmd]]. So if a user has more than one valid set of [[Title Data Structure|application data]] for a given .cmd Content ID they can be manually interchanged without issue. Though renaming a .cmd file to match the Content ID which the title.db is expecting will result in an error, as the CTR for the per-console encryption layer changes depending on the file path, and the MAC of the .cmd is probably generated with the .cmd Content ID in mind.<br />
<br />
These NAND/SD /dbs images seem to be loaded by the ARM9 while NATIVE_FIRM is booting.<br />
<br />
Removing ticket.db from a New-3DS with signature checks disabled will not result in an unbootable system, however all icons except Slot-1 will disappear from Home. Applets can however still be used. Recovery can be accomplished via [[Hardware|hardmod]] or [[arm9loaderhax]] plus a known good backup of the file (or the whole partition or disk); Gamecard exploits were not tested, and Browserhax did not work.<br />
<br />
== Tools ==<br />
<br />
[https://github.com/ps3hen/ctr_toolkit/tree/master/extdata_tool extdata_tool] - parsing cleartext .db extdata images</div>Duke srghttps://www.3dbrew.org/w/index.php?title=CONFIG11_Registers&diff=20092CONFIG11 Registers2017-06-19T09:37:29Z<p>Duke srg: CFG11_SOCINFO rename type fix</p>
<hr />
<div>= Registers =<br />
{| class="wikitable" border="1"<br />
! Old3DS<br />
! Name<br />
! Address<br />
! Width<br />
! Used by<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_SHAREDWRAM_32K_DATA|CFG11_SHAREDWRAM_32K_DATA]]<0-7><br />
| 0x10140000<br />
| 1*8<br />
| Boot11, Process9, [[DSP Services]]<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_SHAREDWRAM_32K_CODE|CFG11_SHAREDWRAM_32K_CODE]]<0-7><br />
| 0x10140008<br />
| 1*8<br />
| Boot11, Process9, [[DSP Services]]<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10140100<br />
| 2<br />
|<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10140102<br />
| 2<br />
|<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_FIQ_CNT|CFG11_FIQ_CNT]]<br />
| 0x10140104<br />
| 1<br />
| Kernel11.<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10140105<br />
| 1<br />
| Kernel11.<br />
|-<br />
| style="background: green" | Yes<br />
| Related to [[HID_Registers|HID_?]]<br />
| 0x10140108<br />
| 2<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| Related to [[HID_Registers|HID_?]]<br />
| 0x1014010C<br />
| 2<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_GPUPROT|CFG11_GPUPROT]]<br />
| 0x10140140<br />
| 4<br />
| Kernel11<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_WIFICNT|CFG11_WIFICNT]]<br />
| 0x10140180<br />
| 1<br />
| TwlBg, [[NWM Services]]<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_SPI_CNT|CFG11_SPI_CNT]]<br />
| 0x101401C0<br />
| 4<br />
| [[SPI Services]], TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10140200<br />
| 4<br />
|<br />
|-style="border-top: double"<br />
| style="background: red" | No<br />
| Clock related?<br />
| 0x10140400<br />
| 1<br />
| NewKernel11<br />
|-<br />
| style="background: red" | No<br />
| Clock related?<br />
| 0x10140410<br />
| 4<br />
| NewKernel11<br />
|-<br />
| style="background: red" | No<br />
| [[#CFG11_BOOTROM_OVERLAY_CNT|CFG11_BOOTROM_OVERLAY_CNT]]<br />
| 0x10140420<br />
| 1<br />
| NewKernel11<br />
|-<br />
| style="background: red" | No<br />
| [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]<br />
| 0x10140424<br />
| 4<br />
| NewKernel11<br />
|-<br />
| style="background: red" | No<br />
| ?<br />
| 0x10140428<br />
| 4<br />
|<br />
|-style="border-top: double"<br />
| style="background: green" | Yes<br />
| [[#CFG11_SOCINFO|CFG11_SOCINFO]]<br />
| 0x10140FFC<br />
| 2<br />
| Boot11, Kernel11<br />
|-style="border-top: double"<br />
| style="background: green" | Yes<br />
| CFG11_GPU_STATUS<br />
| 0x10141000<br />
| 2<br />
| Kernel11, TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| CFG11_PTM_0<br />
| 0x10141008<br />
| 4<br />
| [[PTM Services]], [[PDN Services]]<br />
|-<br />
| style="background: green" | Yes<br />
| CFG11_PTM_1<br />
| 0x1014100C<br />
| 4<br />
| [[PTM Services]], TwlBg, [[PDN Services]]<br />
|-style="border-top: double"<br />
| style="background: green" | Yes<br />
| [[#CFG11_TWLMODE_0|CFG11_TWLMODE_0]]<br />
| 0x10141100<br />
| 2<br />
| TwlProcess9, TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_TWLMODE_1|CFG11_TWLMODE_1]]<br />
| 0x10141104<br />
| 2<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_TWLMODE_2|CFG11_TWLMODE_2]]<br />
| 0x10141108<br />
| 2<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_TWLMODE_HID|CFG11_TWLMODE_HID]]<br />
| 0x1014110A<br />
| 2<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_WIFIUNK|CFG11_WIFIUNK]]<br />
| 0x1014110C<br />
| 1<br />
| [[NWM Services]]<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10141110<br />
| 2<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10141112<br />
| 2<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_CODEC|CFG11_CODEC_0]]<br />
| 0x10141114<br />
| 2<br />
| [[Codec Services]], TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_CODEC|CFG11_CODEC_1]]<br />
| 0x10141116<br />
| 2<br />
| [[Codec Services]], TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10141118<br />
| 1<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10141119<br />
| 1<br />
| TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| ?<br />
| 0x10141120<br />
| 1<br />
| TwlBg<br />
|-<br />
|-style="border-top: double"<br />
| style="background: green" | Yes<br />
| [[#CFG11_GPU_CNT|CFG11_GPU_CNT]]<br />
| 0x10141200<br />
| 4<br />
| Boot11, Kernel11, [[PDN Services]]<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_GPU_CNT2|CFG11_GPU_CNT2]]<br />
| 0x10141204<br />
| 4<br />
| Boot11, Kernel11<br />
|-<br />
| style="background: green" | Yes<br />
| CFG11_GPU_FCRAM_CNT<br />
| 0x10141210<br />
| 2<br />
| Kernel11, TwlBg<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_CODEC_CNT|CFG11_CODEC_CNT]]<br />
| 0x10141220<br />
| 1<br />
| Boot11, TwlBg, [[PDN Services]]<br />
|-<br />
| style="background: green" | Yes<br />
| [[#CFG11_CAMERA_CNT|CFG11_CAMERA_CNT]]<br />
| 0x10141224<br />
| 1<br />
| [[PDN Services]]<br />
|-<br />
| style="background: green" | Yes<br />
| CFG11_DSP_CNT<br />
| 0x10141230<br />
| 1<br />
| Process9, [[PDN Services]]<br />
|-style="border-top: double"<br />
| style="background: red" | No<br />
| [[#CFG11_MPCORE_CLKCNT|CFG11_MPCORE_CLKCNT]]<br />
| 0x10141300<br />
| 2<br />
| NewKernel11<br />
|-<br />
| style="background: red" | No<br />
| [[#CFG11_MPCORE_CNT|CFG11_MPCORE_CNT]]<br />
| 0x10141304<br />
| 2<br />
| NewKernel11<br />
|-<br />
| style="background: red" | No<br />
| [[#CFG11_MPCORE_BOOTCNT<0-3>|CFG11_MPCORE_BOOTCNT]]<0-3><br />
| 0x10141310<br />
| 1*4<br />
| NewKernel11<br />
|}<br />
<br />
== CFG11_SHAREDWRAM_32K_DATA ==<br />
Used for mapping 32K chunks of shared WRAM for DSP data.<br />
<br />
{| class="wikitable" border="1"<br />
! Bits<br />
! Description<br />
|-<br />
| 0-1<br />
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/data)<br />
|-<br />
| 2-4<br />
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)<br />
|-<br />
| 5-6<br />
| Not used (0)<br />
|-<br />
| 7<br />
| Enable (0=Disable, 1=Enable)<br />
|}<br />
<br />
== CFG11_SHAREDWRAM_32K_CODE ==<br />
Used for mapping 32K chunks of shared WRAM for DSP data.<br />
<br />
{| class="wikitable" border="1"<br />
! Bits<br />
! Description<br />
|-<br />
| 0-1<br />
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/code)<br />
|-<br />
| 2-4<br />
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)<br />
|-<br />
| 5-6<br />
| Not used (0)<br />
|-<br />
| 7<br />
| Enable (0=Disable, 1=Enable)<br />
|}<br />
<br />
== CFG11_FIQ_CNT ==<br />
Writing bit1 to this register disables FIQ interrupts.<br />
<br />
This bit is set upon receipt of a FIQ interrupt and when [[SVC|svcUnbindInterrupt]] is called on the FIQ-abstraction [[ARM11_Interrupts#Private_Interrupts|software interrupt]] for the current core.<br />
It is cleared when binding that software interrupt to an event and just before that event is signaled.<br />
<br />
== CFG11_SPI_CNT ==<br />
When the corresponding bit is 0, the bus has to be accessed using the DS SPI registers. Otherwise it has to be accessed using the 3DS SPI registers.<br />
{| class="wikitable" border="1"<br />
! Bit<br />
! Description<br />
|-<br />
| 0<br />
| Enable [[SPI Registers]] 0x10160000.<br />
|-<br />
| 1<br />
| Enable [[SPI Registers]] 0x10142000.<br />
|-<br />
| 2<br />
| Enable [[SPI Registers]] 0x10143000.<br />
|}<br />
<br />
== CFG11_BOOTROM_OVERLAY_CNT ==<br />
Bit0: Enable bootrom overlay functionality.<br />
<br />
== CFG11_BOOTROM_OVERLAY_VAL ==<br />
The 32-bit value to overlay data-reads to bootrom with. See [[#CFG11_MPCORE_BOOTCNT|CFG11_MPCORE_BOOTCNT]].<br />
<br />
== CFG11_SOCINFO ==<br />
Read-only register.<br />
<br />
{| class="wikitable" border="1"<br />
! Bits<br />
! Description<br />
! Used by<br />
|-<br />
| 0<br />
| 1 on both Old3DS and New3DS.<br />
| Boot11<br />
|-<br />
| 1<br />
| 1 on New3DS.<br />
| Kernel11<br />
|-<br />
| 2<br />
| Clock modifier: if set, use a 3x multiplier, otherwise 2x<br />
| Kernel11<br />
|}<br />
<br />
== CFG11_MPCORE_CLKCNT ==<br />
This is used for configuring the New3DS ARM11 CPU clock-rate. This register is New3DS-only: reading from here on Old3DS always returns all-zeros even when one tried writing data here prior to the read.<br />
<br />
{| class="wikitable" border="1"<br />
! Bits<br />
! Description<br />
|-<br />
| 0<br />
| Enable clock multiplier? This must be set to 1 before writing a non-zero value to bit1-2, otherwise freeze.<br />
|-<br />
| 1-2<br />
| Clock multiplier (0=1x, 1=2x, 2=3x, 3=hang)<br />
|-<br />
| 15<br />
| Busy<br />
|}<br />
<br />
[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. That code writes the following values to this register, depending on the input Param0 bit0 state, and the state of CFG11_SOCINFO:<br />
{| class="wikitable" border="1"<br />
! Register value<br />
! Higher-clockrate bit set in svcKernelSetState Param0<br />
! CFG11_SOCINFO bit2 set<br />
! MPCore timer/watchdog prescaler value, prior to subtracting it by 0x1 when writing it into hw/state<br />
! Clock-rate multiplier<br />
! Description<br />
|-<br />
| 0x01<br />
| No<br />
| Yes<br />
| 0x01<br />
| 1x<br />
| 268MHz<br />
|-<br />
| 0x02<br />
| No<br />
| No<br />
| 0x01<br />
| 1x<br />
| 268MHz<br />
|-<br />
| 0x05<br />
| Yes<br />
| Yes<br />
| 0x03<br />
| 3x<br />
| 804MHz<br />
|-<br />
| 0x03<br />
| Yes<br />
| No<br />
| 0x02<br />
| 2x<br />
| 536MHz (tested on New3DS)<br />
|}<br />
<br />
Note that the above CFG11_SOCINFO bit is 1 on New3DS, and 0 on Old3DS. Since this SVC is only available with the New3DS ARM11-kernel, the only additional available clock-rate is 804MHz when running on New3DS(with official kernel code).<br />
<br />
The following register value(s) were tested on New3DS by patching the kernel:<br />
* 0x00: Entire system hangs.<br />
* 0x02: Entire system hangs.<br />
* 0x03: ARM11 runs at 536MHz.<br />
* 0x04: Entire system hangs.<br />
* 0x06: Entire system hangs.<br />
* 0x07: Same result as 0x05.<br />
* 0x08: Entire system hangs.<br />
* 0x09: Entire system hangs.<br />
* 0x0A: Entire system hangs.<br />
* 0x0B: Same result as 0x03.<br />
* 0x0C: Entire system hangs.<br />
* 0x0D: Same result as 0x05.<br />
* 0x0E: Entire system hangs.<br />
* 0x0F: Same result as 0x05.<br />
* 0x1F, 0x2F, 0x4F, 0x8F, 0xFF: Same result as 0x05.<br />
<br />
== CFG11_MPCORE_CNT ==<br />
{| class="wikitable" border="1"<br />
! Bits<br />
! Description<br />
|-<br />
| 0<br />
| Power on 3rd ARM11 MPCore maybe?<br />
|-<br />
| 8<br />
| Power on 4th ARM11 MPCore maybe?<br />
|}<br />
<br />
== CFG11_MPCORE_BOOTCNT<0-3> ==<br />
{| class="wikitable" border="1"<br />
! Bits<br />
! Description<br />
|-<br />
| 0<br />
| Enable bootrom instruction overlay, maybe? This bit is only writable for core2 and core3.<br />
|-<br />
| 1<br />
| Enable bootrom data overlay. This bit is only writable for core2 and core3.<br />
|-<br />
| 4<br />
| Has core booted maybe?<br />
|-<br />
| 5<br />
| Always 1?<br />
|}<br />
<br />
The normal ARM11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS ARM11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.<br />
<br />
Bit1 in register above enables a bootrom data-override for physical addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000. All _data reads_ made to those regions now read the 32-bit value provided in [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].<br />
<br />
Bit0 enables a bootrom instruction-overlay which means that _instruction reads_ made to the bootrom region are overridden. We have not been able to dump what instructions are actually placed at bootrom by this switch (because reading the area only yields data-reads). Jumping randomly into the 0xFFFF0000-0xFFFF1000 region works fine and jumps to the value provided by the data overlay [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]. Thus we may predict that the entire bootrom region is filled by:<br />
ldr pc, [pc]<br />
<br />
Or equivalent. However, jumping to some high addresses such as 0xFFFF0FF0+ will crash the core. This may be explained by prefetching in the ARM pipeline, and might help us identify what instructions are placed by the instruction-overlay.<br />
<br />
==CFG11_GPUPROT==<br />
{| class="wikitable" border="1"<br />
! Old3DS<br />
! Bits<br />
! Description<br />
|-<br />
| style="background: green" | Yes<br />
| 3-0<br />
| Old FCRAM DMA cutoff size, 0 = no protection.<br />
|-<br />
| style="background: red" | No<br />
| 7-4<br />
| New FCRAM DMA cutoff size, 0 = no protection.<br />
|-<br />
| style="background: green" | Yes<br />
| 8<br />
| AXIWRAM protection, 0 = accessible.<br />
|-<br />
| style="background: red" | No<br />
| 10-9<br />
| QTM DMA cutoff size<br />
|-<br />
| style="background: green" | Yes<br />
| 31-11<br />
| Zeroes<br />
|}<br />
<br />
For the old FCRAM DMA cutoff, it protects starting from 0x28000000-(0x800000*x) until end of FCRAM. There is no way to protect the first 0x800000-bytes.<br />
<br />
For the new FCRAM DMA cutoff, it protects starting from 0x30000000-(0x800000*x) until end of FCRAM. When the old FCRAM cutoff is set to non-zero, the first 0x800000-bytes bytes of new FCRAM are protected.<br />
<br />
On New3DS the old+new FCRAM cutoff can be used at the same time, however this isn't done officially.<br />
<br />
For the QTM DMA cutoff, it protects starting from 0x1F400000-(0x100000*x) until end of QTM mem.<br />
<br />
On cold boot this reg is set to 0.<br />
<br />
When this register is set to value 0, the GPU can access the entire FCRAM, AXIWRAM, and on New3DS all QTM-mem.<br />
<br />
[[SVC|Initialized]] during kernel boot, and used with [[SVC]] 0x59 which was implemented with [[11.3.0-36|v11.3]].<br />
<br />
==CFG11_WIFICNT==<br />
{| class="wikitable" border="1"<br />
! Old3DS<br />
! Bits<br />
! Description<br />
|-<br />
| style="background: green" | Yes<br />
| 0<br />
| Enable wifi subsystem<br />
|}<br />
<br />
==CFG11_TWLMODE_0==<br />
Observed 0x8001 when running under TWL_ and AGB_FIRM, 0 NATIVE_FIRM.<br />
<br />
This address is poked from ARM7 to signal that it has booted and begun executing code. The ARM7-mode address for this register is 0x4700000.<br />
<br />
The very last 3DS-mode register poke the [[FIRM|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.<br />
<br />
Writing 0x8000 to here from the ARM9 with NATIVE_FIRM running doesn't seem to do anything, other reg-pokes likely need done first.<br />
<br />
==CFG11_TWLMODE_1==<br />
Observed 0x8000 when running under TWL_FIRM, 0 NATIVE_FIRM.<br />
<br />
==CFG11_TWLMODE_2==<br />
Bitfield.<br />
<br />
==CFG11_TWLMODE_HID==<br />
The value of this register is copied to [[HID_Registers|HID_?]] under certain conditions.<br />
<br />
==CFG11_WIFIUNK==<br />
{| class="wikitable" border="1"<br />
! Old3DS<br />
! Bits<br />
! Description<br />
|-<br />
| style="background: green" | Yes<br />
| 4<br />
| Wifi-related? Set to 1 very early in NWM-module.<br />
|}<br />
<br />
==CFG11_GPU_CNT==<br />
This one seems to control the LCD/GPU/Backlight.<br />
<br />
Bit0: Enable GPU registers at 0x10400000+.<br />
Bit16: Turn on LCD backlight.<br />
<br />
==CFG11_GPU_CNT2==<br />
Bit0: Power on GPU?<br />
<br />
==CFG11_GPU_FCRAM_CNT==<br />
Bit1: Enable/disable FCRAM.<br />
Bit2: Enable/disable operation in progress.<br />
<br />
==CFG11_CODEC==<br />
The following is the only time the ARM11 CODEC module uses any 0x1EC41XXX registers. In one case CODEC module clears bit1 in register 0x1EC41114, in the other case CODEC module sets bit1 in registers 0x1EC41114 and 0x1EC41116.<br />
<br />
==CFG11_CODEC_CNT==<br />
This is the power register used for the [[CFG11_Services|PDN]] CODEC service.<br />
<br />
bit0 = unknown, bit1 = turn on/off DSP, rest = always 0.<br />
<br />
==CFG11_CAMERA_CNT==<br />
This is the power register used for the [[CFG11_Services|PDN]] camera service.<br />
<br />
bit0 = unknown, bit1 = turn on/off cameras, rest = always 0.</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:AES_Registers&diff=17196Talk:AES Registers2016-04-27T14:41:11Z<p>Duke srg: Created page with "Referenced 128-bytes buffer of AES_RDFIFO and AES_CNT Read FIFO count range of 0 to 16 doesn't match with each other. So, what is the actual FIFO length and what is the unit s..."</p>
<hr />
<div>Referenced 128-bytes buffer of AES_RDFIFO and AES_CNT Read FIFO count range of 0 to 16 doesn't match with each other.<br />
So, what is the actual FIFO length and what is the unit size of Read/Write FIFO count fields?<br />
Having a byte-wide FIFO for a block cypher is a bit weird. --[[User:Duke srg|Duke srg]] ([[User talk:Duke srg|talk]]) 16:40, 27 April 2016 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Savegames&diff=11740Talk:Savegames2015-02-23T09:43:36Z<p>Duke srg: /* Savegame keyY CardId */ new section</p>
<hr />
<div>Unknowns:<br />
* Hashes at the end of each DIFI blob.<br />
* How order / location of hash vs. partitioned blocks is determined. (since not sequentially).<br />
<br />
<br />
I think there should be a page with infos on how to dump/restore saves.<br />
[[メインページ|Matyapiro]]:So then,I show you how to do dump and restore saves.<br />
First,you should have either Nintendo DS/Lite or NDS Adapter a tool to dump DS saves.<br />
It can restore saves,but Almost saves cannot dump with NDS Adapter,but some of them can.<br />
If you have Nintendo DS or DS Lite,you should try DSaveManager.<br />
It uses FTP to dump saves,only dump. Last,I show you another save backup tool for DS. NDS Backup Tool by Rudolph. Eepinator by WinterMute<br />
<br />
<br />
Hardware:<br />
* NDS Adapter Plus (by hkems)<br />
* DS/DSLite & DSaveManager<br />
* Neo SMS4 (by neoflash, untested)<br />
<br />
But I cannot find any key word like player name,high score or play time<br />
if I decrypt the save.<br />
<br />
How do you think about whether any other encryption or special way to read/write save used ?[[User talk:Matyapiro31|Matyapiro]]<br />
<br />
* I found those things in a SSFIV saved game...<br />
<br />
The important offsets are usually constant, the values change, it's not hard to look for an offset of data that's changing predictably after you re-save. <br />
<br />
Sometimes you have to use your imagination. To find 20,000 points in SSFIV, you'd search for "0xC8" ( 200 in decimal == "20,000" in game ) because it stores the points in multiples of 100. It's easier to see if you're editing saves in front of yourself and constantly making minor changes to it - to see where those changes show up later. --jl<br />
<br />
So we need analyze project with each save.?[[User talk:Matyapiro31|Matyapiro]]<br />
* Only if you're trying to figure out where the game data is. Just common sense.<br />
* You can examine each save manually after making small changes ( while playing with it on the 3DS ) but we still don't know what all the hashes are being used for.<br />
<br />
spell error?What's this?<br />
~Partitions are "catted" together <br />
[[User talk:Matyapiro31|Matyapiro]]<br />
* Con'''cat'''enated. Attached, joined, appended. One follows after the other. lol.<br />
<br />
<br />
I looked into that blockmap structure thing, but I fear I didn't get it right...<br />
* sectors would be 4096 bytes. The Rayman 3D save is 128mb and has 31 blockmap entries; the Ridge Racer 3D save is 1mb but only has 127 blockmap entries (however the second half of that save is mostly a mirror of the first half, except for the first (special) sector).<br />
* the dword at the beginning of the image tells the sector size (1<<val = sector size)?<br />
* blockmap entries are phys_sec,alloc_cnt,checksum instead of checksum,phys_sec,alloc_cnt. There are then two spare bytes between the blockmap and the journal.<br />
* bit7 of phys_sec in blockmap entries is set when the entry's checksum isn't zero<br />
--[[User:Luigi2us|Luigi2us]] 18:29, 4 August 2011 (CEST)<br />
<br />
<br />
3DS Save De/Encrypter<br />
<br />
3DS Save De/Encrypter application needs useful info on the header Blockmap\Journal foe save modification. I'm so close i can feel it.<br />
--[[User:Immortal|Immortal]] 10:10, 18 August 2011 (GMT)<br />
<br />
<br />
Let's look into those blockmap/journal checksums<br />
* there's one 8bit checksum per 0x200 block<br />
* blocks containing only 0xFF yield a checksum of 0x0F<br />
* blocks containing only 0x00 yield a checksum of 0xB9<br />
* checksums seem to apply to encrypted blocks. In the case of Ridge Racer, all-zero 0x200 blocks yield 0xE4 instead of Rayman3D's 0xB9. However, all-FF blocks always yield 0x0F since they aren't encrypted.<br />
<br />
<del>This is most likely a custom checksum algorithm. Standard CRC8 would yield zero for a zero block.</del> Wrong. Checksums of zero blocks are actually equivalent to the checksum of the game's XOR key.<br />
<br />
--[[User:Luigi2us|Luigi2us]] 19:59, 28 August 2011 (CEST)<br />
<br />
@Luigi2us the checksum algorithm can be a crc because XorIn as well as XorOut can be use that result in non zero results<br />
<br />
there is a way to find out if it is a crc or something like that or something simple<br />
<br />
xor the message by B1 than the checkbit change by C1 xor the message with B2 and the checkbyte change by C2 xor the message by (B1 xor B2) and the checkbyte should change by (C1 xor C2)<br />
<br />
example crc in this case crc-16 but also work with crc-8<br />
<br />
06 06 01 05 crc is 1A21<br />
<br />
06 06 01 05 xor 01 02 03 04 = 07 04 02 01 crc is 1580<br />
<br />
06 06 01 05 xor 08 09 01 02 = 0E 0F 00 07 crc is 2973<br />
<br />
06 06 01 05 xor 01 02 03 04 xor 08 09 01 02 = 0F 0D 03 03 crc is 26D2 (2973 xor 1580 xor 1A21)<br />
<br />
that also work if a unknown XorIn or XorOut is used<br />
<br />
<br />
that don't work for most hash functions<br />
<br />
ADD:Sorry for my bad English<br />
<br />
--[[User:ichfly|ichfly]]<br />
<br />
Sounds like a good idea. We just need to find 4 blocks A,B,C,D in one save so that B=A^x, C=A^y and D=A^x^y. --[[User:Luigi2us|Luigi2us]] 22:54, 29 August 2011 (CEST)<br />
<br />
Hi everyone...<br />
I'm adding save opening support to [[3DSExplorer]] and i'm having trouble understanding the SAVE filesystem.<br />
btw Thanks [[CHR15x94]] for the effort but I don't want to search the "SAVE" string. I want to find it programmaticaly. I'm using the DIFI blob as a reference, starting from [0x2000 + DIFI's Paritition Hash Length] the SAVE should be there and it is for all files at the first partition.<br />
but the second partition I can't always find. I'm using the 3 encrypted saves in the [[Games]] page. --[[User:Elisherer|Elisherer]] 08:43, 19 September 2011 (CEST)<br />
<br />
When I search for the journal's magic (0x080d6ce0) I can't find anything in all saves..? Is it an endian problem?--[[User:Lazymarek9614|Lazymarek9614]] 14:29, 30 September 2011 (CEST)<br />
:After many files I looked at...There's no such thing as journal's magic..it's just the same as the first one. and it can be sometimes 0xffffffff so i wouldn't count on it as a stop flag for reading the journal. just use logic...you can see an example at 3dsexplorer source. --[[User:Elisherer|Elisherer]] 18:19, 30 September 2011 (CEST)<br />
<br />
Magic isn't always 0x080D6CE0, sometimes it is 0x080D6C80 or something in the like...<br />
Unrelatedly, I wonder what kind of data unused blocks are mapped to (zeros or FF). Because those Rayman3D saves say that data goes up to 0xF000 (the end of the dewearleveled image), however there are usually no more than 4 blocks in use. --[[User:Luigi2us|Luigi2us]] 00:05, 1 February 2012 (CET)<br />
<br />
[http://dl.dropbox.com/u/37418652/3DS/MH3G.sav|MH3G save file]<br />
<br />
I think this game is also using the new save encryption.--Matyapiro31 09:47, 19 February 2012 (CET)<br />
<br />
== Encryption method ==<br />
<br />
@Yellows8, I think the old encryption is just [http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Electronic_codebook_.28ECB.29 AES-ECB] which is the same as AES-CTR whose counter isn't progressing... --[[User:Elisherer|Elisherer]] 15:07, 25 March 2012 (CEST)<br />
:It is *not* AES-ECB. If it were,(and Nintendo has *never* used AES-ECB *directly*) you would see the same encrypted 16-byte block for *every* all-zero 16-byte block. The CTR *does* increase, it just gets reset every X bytes. An encryption method only counts as direct AES-ECB only if the encrypted data is used as the AES input block, and the output block is used as the strait decrypted block. --[[User:Yellows8|Yellows8]] 18:31, 25 March 2012 (CEST)<br />
<br />
== Hashes ==<br />
<br />
@Yellows8, That's awesome! Can you explain a bit more about the buffer padding (maybe give an example) I want to add the foundings to 3dsexplorer and complete the saving algorithm (without the MAC signing ofcourse) --[[User:Elisherer|Elisherer]] 07:12, 3 September 2012 (CEST)<br />
:Is it more clear with my last edit? The RomFS [https://github.com/3dshax/ctr/blob/master/ctrtool/ivfc.c IVFC] is basically identical to savegames, except savegames have the additional filesystem level.(Didn't realize that when I figured out the savegame hashes though) And it's not actually possible to generate the MAC yet with the AES engine, since the keyY for gamecard savegames is currently unknown. --[[User:Yellows8|Yellows8]] 16:57, 3 September 2012 (CEST)<br />
::That's really interesting. I wonder what is the general idea here...Do savegames use the romFS structure.. --[[User:Elisherer|Elisherer]] 00:00, 4 September 2012 (CEST)<br />
<br />
== Savegame keyY CardId ==<br />
<br />
Are those two u32 cardIDs mentiond in keyY generation for the first version of savegamy encryption just ROM chip type ID repeated twice, like 45FA009045FA0090 or ROMID/EEPROMID combination? --[[User:Duke srg|Duke srg]] 10:43, 23 February 2015 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11061Talk:Nintendo Zone2014-12-11T17:57:35Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
:: I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online or provide it for you to use on that host. I actually do not have any exploitable or dev unit to rip the actual data. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. Diff patch from the previous version will be enough --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)<br />
::: Paste your script then. --[[User:Yellows8|Yellows8]] 17:35, 11 December 2014 (CET)<br />
::::<br />
#!/usr/bin/perl<br />
use strict;<br />
use MIME::Base64 qw( decode_base64 );<br />
open INFILE,$ARGV[0] or die;<br />
my @res;<br />
while (<INFILE>) {<br />
if ($_ =~ /.*,\d,\d$/) {<br />
@res = split(',',$_);<br />
$res[3] =~ s/\./+/gs;<br />
$res[3] =~ s/-/\//gs;<br />
$res[3] =~ s/\*/=/gs;<br />
$res[3] = decode_base64($res[3]);<br />
$res[3] =~ s/(.)/sprintf("%02X",ord($1))/egs;<br />
$res[3] = "";<br />
$res[5] = "";<br />
printf "%s,%s,%s,%s", decode_base64(shift(@res)),decode_base64(shift(@res)),decode_base64(shift(@res)),join(',',@res);<br />
}else{<br />
print $_;<br />
}<br />
}<br />
close INFILE;<br />
Will open file specified as a parameter and print the result with base64 decoded strings and key date inf hex string format. --[[User:Duke srg|Duke srg]] 18:18, 11 December 2014 (CET)<br />
:"with certain data stripped out" <- I was referring to the ApNum and SecurityKey field values. --[[User:Yellows8|Yellows8]] 18:42, 11 December 2014 (CET)<br />
:: Fixed with blank values --[[User:Duke srg|Duke srg]] 18:57, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11060Talk:Nintendo Zone2014-12-11T17:56:43Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
:: I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online or provide it for you to use on that host. I actually do not have any exploitable or dev unit to rip the actual data. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. Diff patch from the previous version will be enough --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)<br />
::: Paste your script then. --[[User:Yellows8|Yellows8]] 17:35, 11 December 2014 (CET)<br />
::::<br />
#!/usr/bin/perl<br />
use strict;<br />
use MIME::Base64 qw( decode_base64 );<br />
open INFILE,$ARGV[0] or die;<br />
my @res;<br />
while (<INFILE>) {<br />
if ($_ =~ /.*,\d,\d$/) {<br />
@res = split(',',$_);<br />
$res[3] =~ s/\./+/gs;<br />
$res[3] =~ s/-/\//gs;<br />
$res[3] =~ s/\*/=/gs;<br />
$res[3] = decode_base64($res[3]);<br />
$res[3] =~ s/(.)/sprintf("%02X",ord($1))/egs;<br />
$res[3] = "";<br />
$res[5] = "";<br />
printf "%s,%s,%s,%s", decode_base64(shift(@res)),decode_base64(shift(@res)),decode_base64(shift(@res)),join(',',@res);<br />
}else{<br />
print $_;<br />
}<br />
}<br />
close INFILE;<br />
Will open file specified as a parameter and print the result with base64 decoded strings and key date inf hex string format. --[[User:Duke srg|Duke srg]] 18:18, 11 December 2014 (CET)<br />
:"with certain data stripped out" <- I was referring to the ApNum and SecurityKey field values. --[[User:Yellows8|Yellows8]] 18:42, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11057Talk:Nintendo Zone2014-12-11T17:20:31Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
:: I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online or provide it for you to use on that host. I actually do not have any exploitable or dev unit to rip the actual data. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. Diff patch from the previous version will be enough --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)<br />
::: Paste your script then. --[[User:Yellows8|Yellows8]] 17:35, 11 December 2014 (CET)<br />
::::<br />
#!/usr/bin/perl<br />
use strict;<br />
use MIME::Base64 qw( decode_base64 );<br />
open INFILE,$ARGV[0] or die;<br />
my @res;<br />
while (<INFILE>) {<br />
if ($_ =~ /.*,\d,\d$/) {<br />
@res = split(',',$_);<br />
$res[3] =~ s/\./+/gs;<br />
$res[3] =~ s/-/\//gs;<br />
$res[3] =~ s/\*/=/gs;<br />
$res[3] = decode_base64($res[3]);<br />
$res[3] =~ s/(.)/sprintf("%02X",ord($1))/egs;<br />
printf "%s,%s,%s,%s", decode_base64(shift(@res)),decode_base64(shift(@res)),decode_base64(shift(@res)),join(',',@res);<br />
}else{<br />
print $_<br />
}<br />
}<br />
close INFILE;<br />
Will open file specified as a parameter and print the result with base64 decoded strings and key date inf hex string format. --[[User:Duke srg|Duke srg]] 18:18, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11056Talk:Nintendo Zone2014-12-11T17:20:04Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
:: I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online or provide it for you to use on that host. I actually do not have any exploitable or dev unit to rip the actual data. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. Diff patch from the previous version will be enough --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)<br />
::: Paste your script then. --[[User:Yellows8|Yellows8]] 17:35, 11 December 2014 (CET)<br />
::::<br />
{<br />
#!/usr/bin/perl<br />
use strict;<br />
use MIME::Base64 qw( decode_base64 );<br />
open INFILE,$ARGV[0] or die;<br />
my @res;<br />
while (<INFILE>) {<br />
if ($_ =~ /.*,\d,\d$/) {<br />
@res = split(',',$_);<br />
$res[3] =~ s/\./+/gs;<br />
$res[3] =~ s/-/\//gs;<br />
$res[3] =~ s/\*/=/gs;<br />
$res[3] = decode_base64($res[3]);<br />
$res[3] =~ s/(.)/sprintf("%02X",ord($1))/egs;<br />
printf "%s,%s,%s,%s", decode_base64(shift(@res)),decode_base64(shift(@res)),decode_base64(shift(@res)),join(',',@res);<br />
}else{<br />
print $_<br />
}<br />
}<br />
close INFILE;<br />
}<br />
Will open file specified as a parameter and print the result with base64 decoded strings and key date inf hex string format. --[[User:Duke srg|Duke srg]] 18:18, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11055Talk:Nintendo Zone2014-12-11T17:19:16Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
:: I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online or provide it for you to use on that host. I actually do not have any exploitable or dev unit to rip the actual data. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. Diff patch from the previous version will be enough --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)<br />
::: Paste your script then. --[[User:Yellows8|Yellows8]] 17:35, 11 December 2014 (CET)<br />
::::<br />
{<br />
#!/usr/bin/perl<br />
use strict;<br />
use MIME::Base64 qw( decode_base64 );<br />
open INFILE,$ARGV[0] or die;<br />
my @res;<br />
while (<INFILE>) {<br />
if ($_ =~ /.*,\d,\d$/) {<br />
@res = split(',',$_);<br />
$res[3] =~ s/\./+/gs;<br />
$res[3] =~ s/-/\//gs;<br />
$res[3] =~ s/\*/=/gs;<br />
$res[3] = decode_base64($res[3]);<br />
$res[3] =~ s/(.)/sprintf("%02X",ord($1))/egs;<br />
printf "%s,%s,%s,%s", decode_base64(shift(@res)),decode_base64(shift(@res)),decode_base64(shift(@res)),join(',',@res);<br />
}else{<br />
print $_<br />
}<br />
}<br />
close INFILE;<br />
}<br />
Will open file specified as a parameter and print the result with base64 decoded strings and key date inf hex string format. --[[User:Duke srg|Duke srg]] 18:18, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11054Talk:Nintendo Zone2014-12-11T17:18:41Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
:: I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online or provide it for you to use on that host. I actually do not have any exploitable or dev unit to rip the actual data. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. Diff patch from the previous version will be enough --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)<br />
::: Paste your script then. --[[User:Yellows8|Yellows8]] 17:35, 11 December 2014 (CET)<br />
::::<br />
#!/usr/bin/perl<br />
use strict;<br />
use MIME::Base64 qw( decode_base64 );<br />
open INFILE,$ARGV[0] or die;<br />
my @res;<br />
while (<INFILE>) {<br />
if ($_ =~ /.*,\d,\d$/) {<br />
@res = split(',',$_);<br />
$res[3] =~ s/\./+/gs;<br />
$res[3] =~ s/-/\//gs;<br />
$res[3] =~ s/\*/=/gs;<br />
$res[3] = decode_base64($res[3]);<br />
$res[3] =~ s/(.)/sprintf("%02X",ord($1))/egs;<br />
printf "%s,%s,%s,%s", decode_base64(shift(@res)),decode_base64(shift(@res)),decode_base64(shift(@res)),join(',',@res);<br />
}else{<br />
print $_<br />
}<br />
}<br />
close INFILE;<br />
Will open file specified as a parameter and print the result with base64 decoded strings and key date inf hex string format. --[[User:Duke srg|Duke srg]] 18:18, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11051Talk:Nintendo Zone2014-12-11T09:59:44Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
:: I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online or provide it for you to use on that host. I actually do not have any exploitable or dev unit to rip the actual data. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. Diff patch from the previous version will be enough --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11050Talk:Nintendo Zone2014-12-11T09:58:07Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
:: I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online or provide it for you to use on that host. I actually do not have any exploitable or dev unit to rip the actual date. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. Diff patch from the previous version will be enough --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11049Talk:Nintendo Zone2014-12-11T09:50:36Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)<br />
:I thought of doing some sort of hotspot.conf parser which would be located somewhere under [http://yls8.mtheall.com], with certain data stripped out, but I haven't bothered yet(upload hotspot.conf files myself -> server lets the site visitors see the extracted data). --[[User:Yellows8|Yellows8]] 22:44, 10 December 2014 (CET)<br />
I already have the parser in Perl with the exact BASE64 alphabet sequence and able to host the decoder online. But I actually do not have any exploitable or dev unit to rip the actual date. As long as I manintan one of the homepass script implementation I always need the up to date hotspot list with the flags. --[[User:Duke srg|Duke srg]] 10:50, 11 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=11021Talk:Nintendo Zone2014-12-09T20:28:44Z<p>Duke srg: /* hotspot.conf for fw9.3 */</p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)<br />
Any chance hotspot.conf info will be updated with fw 9.3 changes? --[[User:Duke srg|Duke srg]] 21:28, 9 December 2014 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=10260Talk:Nintendo Zone2014-10-14T06:22:14Z<p>Duke srg: /* hotspot.conf for fw9 */ new section</p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)<br />
<br />
== hotspot.conf for fw9 ==<br />
<br />
Is it possible to get hotspot.conf from fw9? Really need this one to maintain the homepass scripts --[[User:Duke srg|Duke srg]] 08:22, 14 October 2014 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:9.0.0-20&diff=10107Talk:9.0.0-202014-10-07T20:18:13Z<p>Duke srg: hoyspot.conf information update request</p>
<hr />
<div>Will Hotspot.conf information be updated? There are really strange changes, attwifi do not have a Nintendo Zone available anymore, but still can be used for internet access. Or it was switched to beacon-only mode?</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Flash_Filesystem&diff=8914Talk:Flash Filesystem2014-04-11T12:01:52Z<p>Duke srg: </p>
<hr />
<div>* Can't help with nand reading but lib references give some indication of the filesystem.<br />
<br />
'''Note! some of these NAND paths below may be outdated'''. Confirmed NAND directories/directory structures are on the [[Flash Filesystem]] page.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
|nand:/extdata<br />
|-<br />
|nand:/ro/<br />
|-<br />
|nand:/ro/sys/HWCAL0.dat<br />
|-<br />
|nand:/ro/sys/HWCAL1.dat<br />
|-<br />
|nand:/rw/<br />
|-<br />
|nand:/rw/sys/<br />
|-<br />
|nand:/rw/sys/config<br />
|-<br />
|nand:/rw/sys/updater.log<br />
|-<br />
|nand:/rw/sys/PlayHistory.dat<br />
|-<br />
|nand:/rw/sys/PedometerHistory.dat<br />
|-<br />
|nand:/rw/sys/LocalFriendCodeSeed<br />
|-<br />
|nand:/rw/sys/SecureInfo<br />
|-<br />
|nand:/title<br />
|-<br />
|nand:/title/%08x/%08x<br />
|-<br />
|nand:/title/%08x/%08x/%08x.app<br />
|-<br />
|nand:/title/%08x/%08x/title.tmd<br />
|-<br />
|nand:/ticket<br />
|-<br />
|nand:/ticket/%08x/%08x.tik<br />
|-<br />
|nand:/tmp<br />
|}<br />
<br />
@yellows8, since the \titles directory is similar between nand and sdmc, do you think it should have a separate page from the [[SD Filesystem]] page?--[[User:3dsguy|3dsguy]] 02:36, 23 August 2012 (CEST)<br />
:Go ahead.(SD/NAND /title is exactly the same, except for the additional encryption for SD perhaps) NAND has .db files too, but I'm not sure where those are located. --[[User:Yellows8|Yellows8]] 02:59, 23 August 2012 (CEST)<br />
<br />
== Possible firmware downgrade vulnerability ==<br />
<br />
Please correct where I'm wrong. Assume we have NAND-dumps from two 3DS units A and B for both firmware versions X and Y. I.e. 4 data sets AX, AY, BX, BY. Assume that all clear data is identical for the same firmware version or unique per console and stay untouched with firmware version change (i.e. AX, BX is a brand-new console with a factory reset dumps and AY, BY have just updated firmwares). Then AX xor AY = BX xor BY and BX = BY xor AX xor AY.<br />
:There's no way to convert a NAND image from one 3DS for use on another 3DS, without generating the NAND xorpad(s) for both systems(requires ARM9 code exec on both). Another reason why ARM9 exec is needed here is because there's certain files stored in CTRNAND containing console-unique AESMACs. Since that keyslot is initialized by bootrom those AESMACs can only be calculated on the same 3DS which you're calculating these CTRNAND AESMACs for. --[[User:Yellows8|Yellows8]] 18:02, 10 April 2014 (CEST)<br />
::I'm not about converting a NAND image from system to another directly. Can we alculate for a various firmware byte-to-byte XOR-difference, which result the same xorpads for each system to annihilate. And for the same CTRNAND files untouched with a firmware update this difference will be zero. So applying this difference for another console CTRNAND will update a firmware without the need of the actual console-unique xorpad--[[User:Duke srg|Duke srg]] 21:48, 10 April 2014 (CEST)<br />
:::The CTRNAND files /w console-unique AESMACs I'm referring to get updated when sys-updates get installed, if those don't get updated properly(invalid AESMACs for example) you would have a system which would fail to boot when it tries to launch titles from CTRNAND-FS. There's no way to properly update those files without proper NAND xorpads/etc. --[[User:Yellows8|Yellows8]] 22:11, 10 April 2014 (CEST)<br />
::::Ok, just to clarify, during system update AESMAC init file IS updated with the new console-unique data. So after transferring firmware changes from one system to another without complete decypher, during next boot at least AESMAC file on CTR NAND partition contents will have wrong data and REG_AESMAC being initialized with that will fail the following boot process. Smart enough.--[[User:Duke srg|Duke srg]] 05:59, 11 April 2014 (CEST)<br />
:::::Yeah, at least one of those console-unique AESMACs would be rendered invalid with method you're describing. --[[User:Yellows8|Yellows8]] 06:21, 11 April 2014 (CEST)<br />
::::::Aren't you talking about a movable.sed file or there are others not mentioned explicitly?--[[User:Duke srg|Duke srg]] 14:01, 11 April 2014 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Flash_Filesystem&diff=8909Talk:Flash Filesystem2014-04-11T04:00:59Z<p>Duke srg: typo</p>
<hr />
<div>* Can't help with nand reading but lib references give some indication of the filesystem.<br />
<br />
'''Note! some of these NAND paths below may be outdated'''. Confirmed NAND directories/directory structures are on the [[Flash Filesystem]] page.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
|nand:/extdata<br />
|-<br />
|nand:/ro/<br />
|-<br />
|nand:/ro/sys/HWCAL0.dat<br />
|-<br />
|nand:/ro/sys/HWCAL1.dat<br />
|-<br />
|nand:/rw/<br />
|-<br />
|nand:/rw/sys/<br />
|-<br />
|nand:/rw/sys/config<br />
|-<br />
|nand:/rw/sys/updater.log<br />
|-<br />
|nand:/rw/sys/PlayHistory.dat<br />
|-<br />
|nand:/rw/sys/PedometerHistory.dat<br />
|-<br />
|nand:/rw/sys/LocalFriendCodeSeed<br />
|-<br />
|nand:/rw/sys/SecureInfo<br />
|-<br />
|nand:/title<br />
|-<br />
|nand:/title/%08x/%08x<br />
|-<br />
|nand:/title/%08x/%08x/%08x.app<br />
|-<br />
|nand:/title/%08x/%08x/title.tmd<br />
|-<br />
|nand:/ticket<br />
|-<br />
|nand:/ticket/%08x/%08x.tik<br />
|-<br />
|nand:/tmp<br />
|}<br />
<br />
@yellows8, since the \titles directory is similar between nand and sdmc, do you think it should have a separate page from the [[SD Filesystem]] page?--[[User:3dsguy|3dsguy]] 02:36, 23 August 2012 (CEST)<br />
:Go ahead.(SD/NAND /title is exactly the same, except for the additional encryption for SD perhaps) NAND has .db files too, but I'm not sure where those are located. --[[User:Yellows8|Yellows8]] 02:59, 23 August 2012 (CEST)<br />
<br />
== Possible firmware downgrade vulnerability ==<br />
<br />
Please correct where I'm wrong. Assume we have NAND-dumps from two 3DS units A and B for both firmware versions X and Y. I.e. 4 data sets AX, AY, BX, BY. Assume that all clear data is identical for the same firmware version or unique per console and stay untouched with firmware version change (i.e. AX, BX is a brand-new console with a factory reset dumps and AY, BY have just updated firmwares). Then AX xor AY = BX xor BY and BX = BY xor AX xor AY.<br />
:There's no way to convert a NAND image from one 3DS for use on another 3DS, without generating the NAND xorpad(s) for both systems(requires ARM9 code exec on both). Another reason why ARM9 exec is needed here is because there's certain files stored in CTRNAND containing console-unique AESMACs. Since that keyslot is initialized by bootrom those AESMACs can only be calculated on the same 3DS which you're calculating these CTRNAND AESMACs for. --[[User:Yellows8|Yellows8]] 18:02, 10 April 2014 (CEST)<br />
::I'm not about converting a NAND image from system to another directly. Can we alculate for a various firmware byte-to-byte XOR-difference, which result the same xorpads for each system to annihilate. And for the same CTRNAND files untouched with a firmware update this difference will be zero. So applying this difference for another console CTRNAND will update a firmware without the need of the actual console-unique xorpad--[[User:Duke srg|Duke srg]] 21:48, 10 April 2014 (CEST)<br />
:::The CTRNAND files /w console-unique AESMACs I'm referring to get updated when sys-updates get installed, if those don't get updated properly(invalid AESMACs for example) you would have a system which would fail to boot when it tries to launch titles from CTRNAND-FS. There's no way to properly update those files without proper NAND xorpads/etc. --[[User:Yellows8|Yellows8]] 22:11, 10 April 2014 (CEST)<br />
::::Ok, just to clarify, during system update AESMAC init file IS updated with the new console-unique data. So after transferring firmware changes from one system to another without complete decypher, during next boot at least AESMAC file on CTR NAND partition contents will have wrong data and REG_AESMAC being initialized with that will fail the following boot process. Smart enough.--[[User:Duke srg|Duke srg]] 05:59, 11 April 2014 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Flash_Filesystem&diff=8908Talk:Flash Filesystem2014-04-11T03:59:42Z<p>Duke srg: </p>
<hr />
<div>* Can't help with nand reading but lib references give some indication of the filesystem.<br />
<br />
'''Note! some of these NAND paths below may be outdated'''. Confirmed NAND directories/directory structures are on the [[Flash Filesystem]] page.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
|nand:/extdata<br />
|-<br />
|nand:/ro/<br />
|-<br />
|nand:/ro/sys/HWCAL0.dat<br />
|-<br />
|nand:/ro/sys/HWCAL1.dat<br />
|-<br />
|nand:/rw/<br />
|-<br />
|nand:/rw/sys/<br />
|-<br />
|nand:/rw/sys/config<br />
|-<br />
|nand:/rw/sys/updater.log<br />
|-<br />
|nand:/rw/sys/PlayHistory.dat<br />
|-<br />
|nand:/rw/sys/PedometerHistory.dat<br />
|-<br />
|nand:/rw/sys/LocalFriendCodeSeed<br />
|-<br />
|nand:/rw/sys/SecureInfo<br />
|-<br />
|nand:/title<br />
|-<br />
|nand:/title/%08x/%08x<br />
|-<br />
|nand:/title/%08x/%08x/%08x.app<br />
|-<br />
|nand:/title/%08x/%08x/title.tmd<br />
|-<br />
|nand:/ticket<br />
|-<br />
|nand:/ticket/%08x/%08x.tik<br />
|-<br />
|nand:/tmp<br />
|}<br />
<br />
@yellows8, since the \titles directory is similar between nand and sdmc, do you think it should have a separate page from the [[SD Filesystem]] page?--[[User:3dsguy|3dsguy]] 02:36, 23 August 2012 (CEST)<br />
:Go ahead.(SD/NAND /title is exactly the same, except for the additional encryption for SD perhaps) NAND has .db files too, but I'm not sure where those are located. --[[User:Yellows8|Yellows8]] 02:59, 23 August 2012 (CEST)<br />
<br />
== Possible firmware downgrade vulnerability ==<br />
<br />
Please correct where I'm wrong. Assume we have NAND-dumps from two 3DS units A and B for both firmware versions X and Y. I.e. 4 data sets AX, AY, BX, BY. Assume that all clear data is identical for the same firmware version or unique per console and stay untouched with firmware version change (i.e. AX, BX is a brand-new console with a factory reset dumps and AY, BY have just updated firmwares). Then AX xor AY = BX xor BY and BX = BY xor AX xor AY.<br />
:There's no way to convert a NAND image from one 3DS for use on another 3DS, without generating the NAND xorpad(s) for both systems(requires ARM9 code exec on both). Another reason why ARM9 exec is needed here is because there's certain files stored in CTRNAND containing console-unique AESMACs. Since that keyslot is initialized by bootrom those AESMACs can only be calculated on the same 3DS which you're calculating these CTRNAND AESMACs for. --[[User:Yellows8|Yellows8]] 18:02, 10 April 2014 (CEST)<br />
::I'm not about converting a NAND image from system to another directly. Can we alculate for a various firmware byte-to-byte XOR-difference, which result the same xorpads for each system to annihilate. And for the same CTRNAND files untouched with a firmware update this difference will be zero. So applying this difference for another console CTRNAND will update a firmware without the need of the actual console-unique xorpad--[[User:Duke srg|Duke srg]] 21:48, 10 April 2014 (CEST)<br />
:::The CTRNAND files /w console-unique AESMACs I'm referring to get updated when sys-updates get installed, if those don't get updated properly(invalid AESMACs for example) you would have a system which would fail to boot when it tries to launch titles from CTRNAND-FS. There's no way to properly update those files without proper NAND xorpads/etc. --[[User:Yellows8|Yellows8]] 22:11, 10 April 2014 (CEST)<br />
::::Ok, just to clarify, during system update AESMAC init file IS updated with the new console-unique data. So after transferring firmware canges from one system to another without complete decypher, during next boot at least AESMAC file on CTR NAND partition contents will have wrong data and REG_AESMAC being initialized with that will fail the following boot process. Smart enough.--[[User:Duke srg|Duke srg]] 05:59, 11 April 2014 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Flash_Filesystem&diff=8907Talk:Flash Filesystem2014-04-11T03:57:24Z<p>Duke srg: /* Possible firmware downgrade vulnerability */</p>
<hr />
<div>* Can't help with nand reading but lib references give some indication of the filesystem.<br />
<br />
'''Note! some of these NAND paths below may be outdated'''. Confirmed NAND directories/directory structures are on the [[Flash Filesystem]] page.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
|nand:/extdata<br />
|-<br />
|nand:/ro/<br />
|-<br />
|nand:/ro/sys/HWCAL0.dat<br />
|-<br />
|nand:/ro/sys/HWCAL1.dat<br />
|-<br />
|nand:/rw/<br />
|-<br />
|nand:/rw/sys/<br />
|-<br />
|nand:/rw/sys/config<br />
|-<br />
|nand:/rw/sys/updater.log<br />
|-<br />
|nand:/rw/sys/PlayHistory.dat<br />
|-<br />
|nand:/rw/sys/PedometerHistory.dat<br />
|-<br />
|nand:/rw/sys/LocalFriendCodeSeed<br />
|-<br />
|nand:/rw/sys/SecureInfo<br />
|-<br />
|nand:/title<br />
|-<br />
|nand:/title/%08x/%08x<br />
|-<br />
|nand:/title/%08x/%08x/%08x.app<br />
|-<br />
|nand:/title/%08x/%08x/title.tmd<br />
|-<br />
|nand:/ticket<br />
|-<br />
|nand:/ticket/%08x/%08x.tik<br />
|-<br />
|nand:/tmp<br />
|}<br />
<br />
@yellows8, since the \titles directory is similar between nand and sdmc, do you think it should have a separate page from the [[SD Filesystem]] page?--[[User:3dsguy|3dsguy]] 02:36, 23 August 2012 (CEST)<br />
:Go ahead.(SD/NAND /title is exactly the same, except for the additional encryption for SD perhaps) NAND has .db files too, but I'm not sure where those are located. --[[User:Yellows8|Yellows8]] 02:59, 23 August 2012 (CEST)<br />
<br />
== Possible firmware downgrade vulnerability ==<br />
<br />
Please correct where I'm wrong. Assume we have NAND-dumps from two 3DS units A and B for both firmware versions X and Y. I.e. 4 data sets AX, AY, BX, BY. Assume that all clear data is identical for the same firmware version or unique per console and stay untouched with firmware version change (i.e. AX, BX is a brand-new console with a factory reset dumps and AY, BY have just updated firmwares). Then AX xor AY = BX xor BY and BX = BY xor AX xor AY.<br />
:There's no way to convert a NAND image from one 3DS for use on another 3DS, without generating the NAND xorpad(s) for both systems(requires ARM9 code exec on both). Another reason why ARM9 exec is needed here is because there's certain files stored in CTRNAND containing console-unique AESMACs. Since that keyslot is initialized by bootrom those AESMACs can only be calculated on the same 3DS which you're calculating these CTRNAND AESMACs for. --[[User:Yellows8|Yellows8]] 18:02, 10 April 2014 (CEST)<br />
::I'm not about converting a NAND image from system to another directly. Can we alculate for a various firmware byte-to-byte XOR-difference, which result the same xorpads for each system to annihilate. And for the same CTRNAND files untouched with a firmware update this difference will be zero. So applying this difference for another console CTRNAND will update a firmware without the need of the actual console-unique xorpad--[[User:Duke srg|Duke srg]] 21:48, 10 April 2014 (CEST)<br />
:::The CTRNAND files /w console-unique AESMACs I'm referring to get updated when sys-updates get installed, if those don't get updated properly(invalid AESMACs for example) you would have a system which would fail to boot when it tries to launch titles from CTRNAND-FS. There's no way to properly update those files without proper NAND xorpads/etc. --[[User:Yellows8|Yellows8]] 22:11, 10 April 2014 (CEST)<br />
::::Ok, just to clarify, during system update AESMAC init file IS updated with the new console-unique data. So after transferring firmware canges from one system to another without complete decypher, during next boot at least AESMAC file on CTR NAND partition contents will have wrong data and REG_AESMAC being initialized with that will fail the following boot process. Smart enough.</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Flash_Filesystem&diff=8904Talk:Flash Filesystem2014-04-10T19:48:01Z<p>Duke srg: </p>
<hr />
<div>* Can't help with nand reading but lib references give some indication of the filesystem.<br />
<br />
'''Note! some of these NAND paths below may be outdated'''. Confirmed NAND directories/directory structures are on the [[Flash Filesystem]] page.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
|nand:/extdata<br />
|-<br />
|nand:/ro/<br />
|-<br />
|nand:/ro/sys/HWCAL0.dat<br />
|-<br />
|nand:/ro/sys/HWCAL1.dat<br />
|-<br />
|nand:/rw/<br />
|-<br />
|nand:/rw/sys/<br />
|-<br />
|nand:/rw/sys/config<br />
|-<br />
|nand:/rw/sys/updater.log<br />
|-<br />
|nand:/rw/sys/PlayHistory.dat<br />
|-<br />
|nand:/rw/sys/PedometerHistory.dat<br />
|-<br />
|nand:/rw/sys/LocalFriendCodeSeed<br />
|-<br />
|nand:/rw/sys/SecureInfo<br />
|-<br />
|nand:/title<br />
|-<br />
|nand:/title/%08x/%08x<br />
|-<br />
|nand:/title/%08x/%08x/%08x.app<br />
|-<br />
|nand:/title/%08x/%08x/title.tmd<br />
|-<br />
|nand:/ticket<br />
|-<br />
|nand:/ticket/%08x/%08x.tik<br />
|-<br />
|nand:/tmp<br />
|}<br />
<br />
@yellows8, since the \titles directory is similar between nand and sdmc, do you think it should have a separate page from the [[SD Filesystem]] page?--[[User:3dsguy|3dsguy]] 02:36, 23 August 2012 (CEST)<br />
:Go ahead.(SD/NAND /title is exactly the same, except for the additional encryption for SD perhaps) NAND has .db files too, but I'm not sure where those are located. --[[User:Yellows8|Yellows8]] 02:59, 23 August 2012 (CEST)<br />
<br />
== Possible firmware downgrade vulnerability ==<br />
<br />
Please correct where I'm wrong. Assume we have NAND-dumps from two 3DS units A and B for both firmware versions X and Y. I.e. 4 data sets AX, AY, BX, BY. Assume that all clear data is identical for the same firmware version or unique per console and stay untouched with firmware version change (i.e. AX, BX is a brand-new console with a factory reset dumps and AY, BY have just updated firmwares). Then AX xor AY = BX xor BY and BX = BY xor AX xor AY.<br />
:There's no way to convert a NAND image from one 3DS for use on another 3DS, without generating the NAND xorpad(s) for both systems(requires ARM9 code exec on both). Another reason why ARM9 exec is needed here is because there's certain files stored in CTRNAND containing console-unique AESMACs. Since that keyslot is initialized by bootrom those AESMACs can only be calculated on the same 3DS which you're calculating these CTRNAND AESMACs for. --[[User:Yellows8|Yellows8]] 18:02, 10 April 2014 (CEST)<br />
::I'm not about converting a NAND image from system to another directly. Can we alculate for a various firmware byte-to-byte XOR-difference, which result the same xorpads for each system to annihilate. And for the same CTRNAND files untouched with a firmware update this difference will be zero. So applying this difference for another console CTRNAND will update a firmware without the need of the actual console-unique xorpad--[[User:Duke srg|Duke srg]] 21:48, 10 April 2014 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Flash_Filesystem&diff=8902Talk:Flash Filesystem2014-04-10T09:33:17Z<p>Duke srg: /* Possible firmware downgrade vulnerability */ new section</p>
<hr />
<div>* Can't help with nand reading but lib references give some indication of the filesystem.<br />
<br />
'''Note! some of these NAND paths below may be outdated'''. Confirmed NAND directories/directory structures are on the [[Flash Filesystem]] page.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
|nand:/extdata<br />
|-<br />
|nand:/ro/<br />
|-<br />
|nand:/ro/sys/HWCAL0.dat<br />
|-<br />
|nand:/ro/sys/HWCAL1.dat<br />
|-<br />
|nand:/rw/<br />
|-<br />
|nand:/rw/sys/<br />
|-<br />
|nand:/rw/sys/config<br />
|-<br />
|nand:/rw/sys/updater.log<br />
|-<br />
|nand:/rw/sys/PlayHistory.dat<br />
|-<br />
|nand:/rw/sys/PedometerHistory.dat<br />
|-<br />
|nand:/rw/sys/LocalFriendCodeSeed<br />
|-<br />
|nand:/rw/sys/SecureInfo<br />
|-<br />
|nand:/title<br />
|-<br />
|nand:/title/%08x/%08x<br />
|-<br />
|nand:/title/%08x/%08x/%08x.app<br />
|-<br />
|nand:/title/%08x/%08x/title.tmd<br />
|-<br />
|nand:/ticket<br />
|-<br />
|nand:/ticket/%08x/%08x.tik<br />
|-<br />
|nand:/tmp<br />
|}<br />
<br />
@yellows8, since the \titles directory is similar between nand and sdmc, do you think it should have a separate page from the [[SD Filesystem]] page?--[[User:3dsguy|3dsguy]] 02:36, 23 August 2012 (CEST)<br />
:Go ahead.(SD/NAND /title is exactly the same, except for the additional encryption for SD perhaps) NAND has .db files too, but I'm not sure where those are located. --[[User:Yellows8|Yellows8]] 02:59, 23 August 2012 (CEST)<br />
<br />
== Possible firmware downgrade vulnerability ==<br />
<br />
Please correct where I'm wrong. Assume we have NAND-dumps from two 3DS units A and B for both firmware versions X and Y. I.e. 4 data sets AX, AY, BX, BY. Assume that all clear data is identical for the same firmware version or unique per console and stay untouched with firmware version change (i.e. AX, BX is a brand-new console with a factory reset dumps and AY, BY have just updated firmwares). Then AX xor AY = BX xor BY and BX = BY xor AX xor AY.</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Nintendo_Video&diff=8901Nintendo Video2014-04-10T08:47:49Z<p>Duke srg: added EOL dates</p>
<hr />
<div>'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DSes to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos even when the Nintendo Video app itself is not running. Service was discontinued March 31 2014.<br />
<br />
'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DSes to download and watch various videos offered by Eurosport. This service was discontinued December 31 2012.<br />
<br />
== Internet connection ==<br />
<br />
To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country and a language code. Here's a table containing country codes and subdomains known so far and corresponding file names:<br />
<br />
{| class="wikitable"<br />
|-<br />
! Country<br />
! Region subdomain<br />
! File name<br />
|-<br />
| EUR (Nintendo Video)<br />
| pubeu-p<br />
| ESP_MD<br />
|-<br />
| EUR (Eurosport)<br />
| pubes-p<br />
| EWP_MD<br />
|-<br />
| USA<br />
| pubus-p<br />
| ESE_MD<br />
|-<br />
| Japan<br />
| pubjp-p<br />
| ESJ_MD<br />
|}<br />
<br />
See http://www.wiibrew.org/wiki/Country_Codes for the country codes.<br />
<br />
Language codes known so far:<br />
{| class="wikitable"<br />
|-<br />
! Language<br />
! Code<br />
! Region<br />
|-<br />
| Japanese<br />
| 0<br />
| Japan<br />
|-<br />
| English<br />
| 1<br />
| EUR/USA<br />
|-<br />
| French<br />
| 2<br />
| EUR/USA<br />
|-<br />
| German<br />
| 3<br />
| EUR<br />
|-<br />
| Italian<br />
| 4<br />
| EUR<br />
|-<br />
| Spanish<br />
| 5<br />
| EUR/USA<br />
|-<br />
| Netherlands<br />
| 8<br />
| EUR<br />
|-<br />
| Portuguese<br />
| 9<br />
| EUR/USA<br />
|-<br />
| Russian<br />
| 10<br />
| EUR<br />
|}<br />
<br />
In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).<br />
<br />
Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "Connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by ''COUNTRYCODE'' and ''COUNTRYSUBDOMAIN'' and 404 means that everything's OK.<br />
<br />
If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):<br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''1 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''2 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''3 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''4 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
''FILENAMEi'' seems to return 403 if user's region doesn't match, 404 if ''i''th video doesn't exist and the video itself otherwise. As of 18th of July 2011, only 1st and 2nd videos are available from UK IP addresses.<br />
<br />
For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.<br />
<br />
These videos can easily be downloaded from any computer with IP address that matches country specified by ''COUNTRYCODE'', ''COUNTRYSUBDOMAIN'' and ''LANGUAGECODE'' using wget without any special settings. Videos are region-locked.<br />
<br />
== SD storage ==<br />
Downloaded videos are stored in the SD card [[Extdata]], from the decrypted [[SpotPass]] content payload. Country info is presumably stored in this metadata, region-lock is handled by the BOSS module via the programID in the [[SpotPass#Payload Content Header|payload header]]. At the end of the video file is a JPEG, which contains the video thumbnail, and various metadata in the EXIF including the URL associated with the video. The text shown on the web browser button is also stored in the EXIF.<br />
<br />
All of these fields are big-endian?<br />
Structure of this SD data:<br />
{| class="wikitable"<br />
|-<br />
! Offset<br />
! Length<br />
! Notes<br />
|-<br />
| 0x0<br />
| 4<br />
| Unknown, value is 0x18<br />
|-<br />
| 0x4<br />
| 0x14<br />
| ?<br />
|-<br />
| 0x18<br />
| 8<br />
| TitleID of Nintendo Video<br />
|-<br />
| 0x20<br />
| 0x8<br />
| ?<br />
|-<br />
| 0x28<br />
| 0x4<br />
| Total filesize?<br />
|-<br />
| 0x2c<br />
| 0x2c<br />
| Unknown, some countries' videos has two extra words added here?<br />
|-<br />
| 0x58<br />
| 0x20<br />
| ASCII Video ID? M<shortvidtitle>someid<br />
|-<br />
| 0x68<br />
| 0x20<br />
| ?<br />
|-<br />
| 0x88<br />
| 0x78<br />
| UTF-16 video title<br />
|-<br />
| 0x100<br />
| 0xc<br />
| ?<br />
|-<br />
| 0x10c<br />
| 0x190<br />
| UTF-16 video description<br />
|-<br />
| 0x29c<br />
| 0x20<br />
| Another ASCII video ID? I<shortvidtitle>someid<br />
|-<br />
| 0x2bc<br />
| Video size<br />
| Mobiclip .moflex video data (first word here is little-endian magic number 0xabaa324c)<br />
|}<br />
<br />
== File format ==<br />
<br />
The SpotPass content downloaded for NVideo uses the [[SpotPass]] content container format, see the SpotPass page for info on the container format. See the above SD storage section for info on the cleartext payload.<br />
<br />
Region info is stored in the decrypted SpotPass crypto layer, see above SD section.<br />
<br />
== Server spoofing == <br />
<br />
In case you want to try messing with Nintendo Video, here's a description of what I did:<br />
<br />
# Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net [http://pastie.org/2230422 (bind config)].<br />
## Don't forget to replace MY_IP in config with your IP address, but '''don't''' replace the IP of conntest.nintendowifi.net service<br />
# Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.<br />
# Configured my 3DS to use my DNS server as both primary and secondary DNS server.<br />
# ???<br />
# PROFIT!<br />
<br />
== External links ==<br />
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Nintendo_Video&diff=8900Nintendo Video2014-04-10T08:45:40Z<p>Duke srg: </p>
<hr />
<div>'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DSes to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos even when the Nintendo Video app itself is not running. This service was discontinued March 31 2014.<br />
<br />
'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DSes to download and watch various videos offered by Eurosport. <br />
<br />
== Internet connection ==<br />
<br />
To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country and a language code. Here's a table containing country codes and subdomains known so far and corresponding file names:<br />
<br />
{| class="wikitable"<br />
|-<br />
! Country<br />
! Region subdomain<br />
! File name<br />
|-<br />
| EUR (Nintendo Video)<br />
| pubeu-p<br />
| ESP_MD<br />
|-<br />
| EUR (Eurosport)<br />
| pubes-p<br />
| EWP_MD<br />
|-<br />
| USA<br />
| pubus-p<br />
| ESE_MD<br />
|-<br />
| Japan<br />
| pubjp-p<br />
| ESJ_MD<br />
|}<br />
<br />
See http://www.wiibrew.org/wiki/Country_Codes for the country codes.<br />
<br />
Language codes known so far:<br />
{| class="wikitable"<br />
|-<br />
! Language<br />
! Code<br />
! Region<br />
|-<br />
| Japanese<br />
| 0<br />
| Japan<br />
|-<br />
| English<br />
| 1<br />
| EUR/USA<br />
|-<br />
| French<br />
| 2<br />
| EUR/USA<br />
|-<br />
| German<br />
| 3<br />
| EUR<br />
|-<br />
| Italian<br />
| 4<br />
| EUR<br />
|-<br />
| Spanish<br />
| 5<br />
| EUR/USA<br />
|-<br />
| Netherlands<br />
| 8<br />
| EUR<br />
|-<br />
| Portuguese<br />
| 9<br />
| EUR/USA<br />
|-<br />
| Russian<br />
| 10<br />
| EUR<br />
|}<br />
<br />
In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).<br />
<br />
Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "Connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by ''COUNTRYCODE'' and ''COUNTRYSUBDOMAIN'' and 404 means that everything's OK.<br />
<br />
If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):<br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''1 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''2 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''3 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''4 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
''FILENAMEi'' seems to return 403 if user's region doesn't match, 404 if ''i''th video doesn't exist and the video itself otherwise. As of 18th of July 2011, only 1st and 2nd videos are available from UK IP addresses.<br />
<br />
For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.<br />
<br />
These videos can easily be downloaded from any computer with IP address that matches country specified by ''COUNTRYCODE'', ''COUNTRYSUBDOMAIN'' and ''LANGUAGECODE'' using wget without any special settings. Videos are region-locked.<br />
<br />
== SD storage ==<br />
Downloaded videos are stored in the SD card [[Extdata]], from the decrypted [[SpotPass]] content payload. Country info is presumably stored in this metadata, region-lock is handled by the BOSS module via the programID in the [[SpotPass#Payload Content Header|payload header]]. At the end of the video file is a JPEG, which contains the video thumbnail, and various metadata in the EXIF including the URL associated with the video. The text shown on the web browser button is also stored in the EXIF.<br />
<br />
All of these fields are big-endian?<br />
Structure of this SD data:<br />
{| class="wikitable"<br />
|-<br />
! Offset<br />
! Length<br />
! Notes<br />
|-<br />
| 0x0<br />
| 4<br />
| Unknown, value is 0x18<br />
|-<br />
| 0x4<br />
| 0x14<br />
| ?<br />
|-<br />
| 0x18<br />
| 8<br />
| TitleID of Nintendo Video<br />
|-<br />
| 0x20<br />
| 0x8<br />
| ?<br />
|-<br />
| 0x28<br />
| 0x4<br />
| Total filesize?<br />
|-<br />
| 0x2c<br />
| 0x2c<br />
| Unknown, some countries' videos has two extra words added here?<br />
|-<br />
| 0x58<br />
| 0x20<br />
| ASCII Video ID? M<shortvidtitle>someid<br />
|-<br />
| 0x68<br />
| 0x20<br />
| ?<br />
|-<br />
| 0x88<br />
| 0x78<br />
| UTF-16 video title<br />
|-<br />
| 0x100<br />
| 0xc<br />
| ?<br />
|-<br />
| 0x10c<br />
| 0x190<br />
| UTF-16 video description<br />
|-<br />
| 0x29c<br />
| 0x20<br />
| Another ASCII video ID? I<shortvidtitle>someid<br />
|-<br />
| 0x2bc<br />
| Video size<br />
| Mobiclip .moflex video data (first word here is little-endian magic number 0xabaa324c)<br />
|}<br />
<br />
== File format ==<br />
<br />
The SpotPass content downloaded for NVideo uses the [[SpotPass]] content container format, see the SpotPass page for info on the container format. See the above SD storage section for info on the cleartext payload.<br />
<br />
Region info is stored in the decrypted SpotPass crypto layer, see above SD section.<br />
<br />
== Server spoofing == <br />
<br />
In case you want to try messing with Nintendo Video, here's a description of what I did:<br />
<br />
# Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net [http://pastie.org/2230422 (bind config)].<br />
## Don't forget to replace MY_IP in config with your IP address, but '''don't''' replace the IP of conntest.nintendowifi.net service<br />
# Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.<br />
# Configured my 3DS to use my DNS server as both primary and secondary DNS server.<br />
# ???<br />
# PROFIT!<br />
<br />
== External links ==<br />
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=3159Talk:Nintendo Zone2012-05-14T20:14:46Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)<br />
On the other hand, some hotspots from a list is not usable without a beacon at least. --[[User:Duke srg|Duke srg]] 22:14, 14 May 2012 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=3156Talk:Nintendo Zone2012-05-14T05:54:39Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
<br />
<br />
<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=3155Talk:Nintendo Zone2012-05-14T05:53:54Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
----<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Nintendo_Zone&diff=3154Talk:Nintendo Zone2012-05-14T05:53:36Z<p>Duke srg: </p>
<hr />
<div>--[[User:Yellows8|Yellows8]] 03:58, 9 June 2011 (CEST) If there's an USA Best Buy NZone nearby you and you can either capture it via laptop or have a DS /w flashcard, /msg yellows8 on IRC EFnet #3dsdev. Note that it's extremely unlikely NZone is exploitable since with DSi all comms were HTTPS,(let alone 3DS uses a NetFront version without the old html parsing bugs) this is just for accessing the server at home from both 3DS and laptop.<br />
::[[User:Yellows8|Yellows8]] 19:36, 10 June 2011 (CEST) Some NZone captures were obtained, no more captures are needed.<br />
<br />
Some kind of Nintendo Information Terminals use Windows Server 2008?,Vista or 7.<br />
<br />
I saw a terminal returned Internet Explorer's error code.--Matyapiro31 04:19, 6 February 2012 (CET)<br />
:Huh? The USA NZone server uses Apache. "Server: Apache/2.2.16 (Unix)" --[[User:Yellows8|Yellows8]] 04:26, 6 February 2012 (CET)<br />
<br />
I explain about "ニンテンドーおさがしガイド" in Japan.<br />
:You mentioned "NZone server" in your edit summary, those terminals are *not* servers. --[[User:Yellows8|Yellows8]] 20:06, 6 February 2012 (CET)<br />
<br />
[[File:Head photo1.jpg]]<br />
<br />
-- The Cloud WiFi --<br />
<br />
Can be "WiFi Zone - The Cloud" also (based on https://www.thecloud.net/free-wifi/support/faqs/) --[[User:Elisherer|Elisherer]] 16:34, 25 April 2012 (CEST)<br />
<br />
--[[User:LuigiBlood|LuigiBlood]] 20:27, 25 April 2012 (CEST) A friend of mine (Prof. 9) recently tested "_The Cloud" as SSID, and it works, and has access to the Europe Nintendo Zone. MAC filtering can be enabled.<br />
"_The Cloud" SSID is still usable by european consoles without a beacon, but was deleted from the list --[[User:Duke srg|Duke srg]] 07:53, 14 May 2012 (CEST)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Games&diff=2733Games2012-03-27T17:26:19Z<p>Duke srg: /* Game list */</p>
<hr />
<div>This page lists off many 3DS games and info about them, as well info about the product code and serial format. If the list is missing a game, and you have info about it, feel free to add it to the list.<br />
<br />
Some of these games also have a savegame dumped, which can be downloaded under the Savegame column of the table. Info about the savegames' filesystem can be found on the [[Savegames]] page.<br />
<br />
== Game list ==<br />
Note the [DEMO] in the title name denotes that the game is a demo. Also, when adding games, please keep them in alphabetical order, keeping demos at the start of the list.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! width="35%" | Title<br />
! width="12%" | [[Serials|Serial]]<br />
! width="12% | Product Code<br />
! width="5%" | EUR<br />
! width="5%" | USA<br />
! width="5%" | JPN<br />
! width="5%" | ROM Size<br />
! width="5%" | FLASH Size<br />
! width="5%" | FLASH ID<br />
! width="5%" | FLASH Chip #<br />
! width="6%" | Savegame<br />
|-<br />
| [DEMO] Mario Kart 7 (E3)<br />
| ?<br />
| CTR-P-AMKU<br />
| No<br />
| No<br />
| No<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
|-<br />
| [DEMO] Nintendogs+Cats (Kiosk)<br />
| LNZ-CTR-ADAP<br />
| CTR-P-ADAP<br />
| Yes<br />
| ?<br />
| ?<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| [DEMO] Super Mario 3D Land<br />
| LNZ-CTR-AREP<br />
| ?<br />
| Yes<br />
| No<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
|-<br />
| [DEMO] Super Mario 3D Land (E3)<br />
| ?<br />
| CTR-P-CTAP<br />
| No<br />
| No<br />
| No<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
|-<br />
| [DEMO] The Legend of Zelda: Ocarina of Time 3D<br />
| LNZ-CTR-AQEP<br />
| ?<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
| ?<br />
|-<br />
| Asphalt 3D<br />
| LNA-CTR-ASFE<br />
| CTR-P-ASFE<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| ?<br />
| ?<br />
| ?<br />
|-<br />
| Cubic Ninja<br />
| LNA-CTR-AQNE<br />
| CTR-P-AQNE<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| ?<br />
| ?<br />
| ?<br />
|-<br />
| Dead or Alive - Dimensions<br />
| LNA-CTR-ADDP<br />
| CTR-P-ADDP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| Lego Star Wars III: The Clone Wars<br />
| LNA-CTR-ALGP<br />
| CTR-P-ALGP<br />
| Yes<br />
| Yes<br />
| No<br />
| 4GBit<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| Mario Kart 7<br />
| LNA-CTR-AMKE<br />
| CTR-P-AMKE<br />
| Yes<br />
| Yes<br />
| Yes<br />
| 8GBit<br />
| 512kByte<br />
| ?<br />
| ?<br />
| ?<br />
|-<br />
| Nintendogs+Cats: French Bulldog & New Friends<br />
| LNA-CTR-ADBP<br />
| CTR-P-ADBP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 512kByte<br />
| 0xC22213<br />
| 25L4001<br />
| ?<br />
|-<br />
| One Piece: Unlimited Cruise SP<br />
| LNA-CTR-ALFJ<br />
| CTR-P-ALFJ<br />
| No<br />
| No<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| Pilotwings Resort<br />
| LNA-CTR-AWAP<br />
| CTR-P-AWAP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| Puzzle Bobble Universe<br />
| LNA-CTR-ABBP<br />
| CTR-P-ABBP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| [[Raving Rabbids: Travel in Time 3D]]<br />
| LNA-CTR-ARBJ<br />
| CTR-P-ARBJ<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| [http://dl.dropbox.com/u/7830918/3DS%20Upload/decrypted.bin de]/[http://dl.dropbox.com/u/7830918/3DS%20Upload/encrypted.bin en]<br />
|-<br />
| Ridge Racer 3D<br />
| LNA-CTR-ARRP<br />
| CTR-P-ARRP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| 8GBit<br />
| 512kByte<br />
| 0xC22213<br />
| 25L4001<br />
| ?<br />
|-<br />
| Samurai Warriors - Chronicles<br />
| LNA-CTR-A66P<br />
| CTR-P-A66P<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 512kByte<br />
| 0xC22213<br />
| 25L4001<br />
| ?<br />
|-<br />
| Splinter Cell 3D<br />
| LNA-CTR-ASCP<br />
| CTR-P-ASCP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| 16Gbit<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| Steel Diver<br />
| LNA-CTR-ASDP<br />
| CTR-P-ASDP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 512kByte<br />
| 0xC22213<br />
| 25L4001<br />
| [http://dl.dropbox.com/u/32759832/3DS_saves/Steel_Diver/decrypted.sav de]/[http://dl.dropbox.com/u/32759832/3DS_saves/Steel_Diver/encrypted.sav en]<br />
|-<br />
| Super Mario 3D Land<br />
| LNA-CTR-AREP<br />
| CTR-P-AREP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| Super Monkey Ball 3D NTSC<br />
| LNA-CTR-ASME<br />
| CTR-P-ASME<br />
| Yes<br />
| Yes<br />
| Yes<br />
| 2GBit<br />
| 128kByte<br />
| ?<br />
| ?<br />
| ?<br />
|-<br />
| Super Monkey Ball 3D PAL<br />
| LNA-CTR-ASMP<br />
| CTR-P-ASMP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| 2GBit<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| Super Street Fighter IV - 3D Edition<br />
| LNA-CTR-ASSP<br />
| CTR-P-ASSP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
| [[The Legend of Zelda: Ocarina of Time 3D]]<br />
| LNA-CTR-AQEP<br />
| CTR-P-AQEP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| ?<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| [http://dl.dropbox.com/u/32759832/3DS_saves/Zelda_OoT/decrypted.sav de]/[http://dl.dropbox.com/u/32759832/3DS_saves/Zelda_OoT/encrypted.sav en]<br />
|-<br />
| The Sims 3<br />
| LNA-CTR-AS3P<br />
| CTR-P-AS3P<br />
| Yes<br />
| Yes<br />
| Yes<br />
| 4GBit<br />
| 512kByte<br />
| 0xC22213<br />
| 25L4001<br />
| ?<br />
|-<br />
| Tom Clancy's Ghost Recon: Shadow Wars<br />
| LNA-CTR-AGRP<br />
| CTR-P-ARGP<br />
| Yes<br />
| Yes<br />
| Yes<br />
| 2GBit<br />
| 128kByte<br />
| 0xC22211<br />
| 25L1001<br />
| ?<br />
|-<br />
|}<br />
<br />
Elisherer's Savefile collection: [http://sherer.co.il/saves http://sherer.co.il/saves]</div>Duke srghttps://www.3dbrew.org/w/index.php?title=EShop&diff=2443EShop2012-02-29T05:46:28Z<p>Duke srg: sorted</p>
<hr />
<div>The Nintendo 3DS eShop was added in the June 2011 Update for JP/EUR/USA.<br />
<br />
From here you can download Virtual Console games, 3D Classics, DSiware software, view screenshots and 3D trailers for upcoming 3DS titles.<br />
<br />
When connecting to the servers, eShop requests from these domains over HTTPS: nus.c.shop.nintendowifi.net, ecs.c.shop.nintendowifi.net, cp3s-auth.c.shop.nintendowifi.net, cas.c.shop.nintendowifi.net, and a248.e.akamai.net.<br />
<br />
== EShop QR Codes ==<br />
Eshop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eshop title with just two clicks. The QR Codes itself is a simple text/url QR, started with "ESHOP://" string followed by a eshop title link id and then some special data, delimited by a dot symbol, which can be ommited. <br />
<br />
{| class="wikitable"<br />
|-<br />
! QR Code source<br />
! Region<br />
! Title<br />
! Serial<br />
! Title Id<br />
|-<br />
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01<br />
|-<br />
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01<br />
|-<br />
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief & the Emperor's Treasure Demo || ARTJ || 00040002<br />
|-<br />
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002<br />
|-<br />
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||<br />
|-<br />
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700<br />
|-<br />
| ESHOP://50010000008647.J00101Z00096 || JPN || MGS Snake Eater 3D Demo || AMGJ || 00040002<br />
|-<br />
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ || <br />
|-<br />
| ESHOP://50010000008782.PEAALL000000 || EUR || MGS Snake Eater 3D Demo || AMGE || 0004000200082401<br />
|-<br />
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku and Future Stars: Project Mirai Demo || AM9J || 00040002<br />
|-<br />
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J || <br />
|-<br />
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000<br />
|-<br />
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000<br />
|-<br />
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||<br />
|-<br />
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||<br />
|}<br />
<br />
* There is a link in the Japanese eshop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get its qrcode. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo qr code)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:EShop&diff=2413Talk:EShop2012-02-27T12:27:26Z<p>Duke srg: </p>
<hr />
<div>Duke srg, where did you find the European eShop QR codes? --[[User:MegaByte|MegaByte]] 02:04, 27 February 2012 (CET)<br />
At nintendo direct section and at game mini sites --[[User:Duke srg|Duke srg]] 04:26, 27 February 2012 (CET)<br />
<br />
Elisherer, how did you get the serials for unreleased titles? --[[User:Duke srg|Duke srg]] 09:11, 27 February 2012 (CET)<br />
:The links in the japanese eshop pages reveal its serials...--[[User:Elisherer|Elisherer]] 12:52, 27 February 2012 (CET)<br />
::Yes, but it is a release version serial, while title id is different. --[[User:Duke srg|Duke srg]] 13:27, 27 February 2012 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:EShop&diff=2409Talk:EShop2012-02-27T08:12:21Z<p>Duke srg: </p>
<hr />
<div>Duke srg, where did you find the European eShop QR codes? --[[User:MegaByte|MegaByte]] 02:04, 27 February 2012 (CET)<br />
At nintendo direct section and at game mini sites --[[User:Duke srg|Duke srg]] 04:26, 27 February 2012 (CET)<br />
<br />
Elisherer, how did you get the serials for unreleased titles? --[[User:Duke srg|Duke srg]] 09:11, 27 February 2012 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:EShop&diff=2408Talk:EShop2012-02-27T08:12:12Z<p>Duke srg: </p>
<hr />
<div>Duke srg, where did you find the European eShop QR codes? --[[User:MegaByte|MegaByte]] 02:04, 27 February 2012 (CET)<br />
At nintendo direct section and at game mini sites --[[User:Duke srg|Duke srg]] 04:26, 27 February 2012 (CET)<br />
----<br />
Elisherer, how did you get the serials for unreleased titles? --[[User:Duke srg|Duke srg]] 09:11, 27 February 2012 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:EShop&diff=2407Talk:EShop2012-02-27T08:11:57Z<p>Duke srg: </p>
<hr />
<div>Duke srg, where did you find the European eShop QR codes? --[[User:MegaByte|MegaByte]] 02:04, 27 February 2012 (CET)<br />
At nintendo direct section and at game mini sites --[[User:Duke srg|Duke srg]] 04:26, 27 February 2012 (CET)<br />
Elisherer, how did you get the serials for unreleased titles? --[[User:Duke srg|Duke srg]] 09:11, 27 February 2012 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=EShop&diff=2405EShop2012-02-27T05:50:32Z<p>Duke srg: </p>
<hr />
<div>The Nintendo 3DS eShop was added in the June 2011 Update for JP/EUR/USA.<br />
<br />
From here you can download Virtual Console games, 3D Classics, DSiware software, view screenshots and 3D trailers for upcoming 3DS titles.<br />
<br />
When connecting to the servers, eShop requests from these domains over HTTPS: nus.c.shop.nintendowifi.net, ecs.c.shop.nintendowifi.net, cp3s-auth.c.shop.nintendowifi.net, cas.c.shop.nintendowifi.net, and a248.e.akamai.net.<br />
<br />
== EShop QR Codes ==<br />
Eshop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eshop title with just two clicks. The QR Codes itself is a simple text/url QR, started with "ESHOP://" string followed by a eshop title link id and then some special data, delimited by a dot symbol, which can be ommited. <br />
<br />
{| class="wikitable"<br />
|-<br />
! QR Code source<br />
! Region<br />
! Title<br />
|-<br />
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats<br />
|-<br />
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations<br />
|-<br />
| ESHOP://50010000008782.PEAALL000000 || EUR || MGS Snake Eater 3D<br />
|-<br />
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations<br />
|-<br />
| ESHOP://50010000008123.J00101Z00095 || JPN || (unknown, japan title)<br />
|-<br />
| ESHOP://50010000008647.J00101Z00096 || JPN || MGS Snake Eater 3D<br />
|-<br />
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy<br />
|-<br />
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western<br />
|-<br />
| ESHOP://50010000009261 || USA || Dillon's Rolling Western<br />
|}</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:EShop&diff=2400Talk:EShop2012-02-27T03:26:13Z<p>Duke srg: </p>
<hr />
<div>Duke srg, where did you find the European eShop QR codes? --[[User:MegaByte|MegaByte]] 02:04, 27 February 2012 (CET)<br />
At nintendo direct section and at game mini sites --[[User:Duke srg|Duke srg]] 04:26, 27 February 2012 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=EShop&diff=2388EShop2012-02-25T07:41:37Z<p>Duke srg: Added eshop qr codes</p>
<hr />
<div>The Nintendo 3DS eShop was added in the June 2011 Update for JP/EUR/USA.<br />
<br />
From here you can download Virtual Console games, 3D Classics, DSiware software, view screenshots and 3D trailers for upcoming 3DS titles.<br />
<br />
When connecting to the servers, eShop requests from these domains over HTTPS: nus.c.shop.nintendowifi.net, ecs.c.shop.nintendowifi.net, cp3s-auth.c.shop.nintendowifi.net, cas.c.shop.nintendowifi.net, and a248.e.akamai.net.<br />
<br />
== EShop QR Codes ==<br />
Eshop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eshop title with just two clicks. The QR Codes itself is a simple text/url QR, started with "ESHOP://" string followed by a eshop title link id and then some special data, delimited by a dot symbol, which can be ommited. <br />
<br />
{| class="wikitable"<br />
|-<br />
! QR Code source<br />
! Region<br />
! Title<br />
|-<br />
| ESHOP://50010000000201.PEAALL000000<br />
| EUR<br />
| Nintendogs & Cats<br />
|-<br />
| ESHOP://50010000008009.PEAALL000000<br />
| EUR<br />
| Resident Evil Revelations<br />
|-<br />
| ESHOP://50010000008123.J00101Z00095<br />
| JPN<br />
| (unknown, japan title)<br />
|-<br />
| ESHOP://50010000008447.J00101Z00094<br />
| JPN<br />
| Resident Evil Revelations<br />
|-<br />
| ESHOP://50010000008647.J00101Z00096<br />
| JPN<br />
| MGS Snake Eater 3D<br />
|-<br />
| ESHOP://50010000008648.J00101Z00097<br />
| JPN<br />
| Theatrythm Final Fantasy<br />
|-<br />
| ESHOP://50010000008782.PEAALL000000<br />
| EUR<br />
| MGS Snake Eater 3D<br />
|-<br />
| ESHOP://50010000009161.J00101Z00118<br />
| JPN<br />
| Rolling Western<br />
|}</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Title_list&diff=2381Title list2012-02-23T17:15:00Z<p>Duke srg: + European demos</p>
<hr />
<div>The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The same [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ update server] is being used as was with the DSi, however a new common key has been introduced.<br />
<br />
The organization of Title IDs has not been documented fully yet. It's unknown how regions are determined in titleids if at all though there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi).<br />
<br />
<br />
== 00000000 - Ext/Extra Data ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
| 000004aa<br />
| USA<br />
| Nintendo Video Extra Data<br />
(Notes: This is where the video files are stored, and I assume the thumbnails, the descriptions, and some check sum files. There are always 9 files within the subdirectory "00000000" of this folder, even without any videos downloaded. The files are "00000001" - "00000009", and "00000003" - "00000008" have the same filesize of 50.7 MB. It is possible to restore the older videos by overwriting all the files within this directory. Provided of course you have made a backup of the files before hand, by copying all the files within this directory to your computer. As far I'm aware its not possible to mix and match the files in order to get certain videos in one grouping, ie. having all 3 Zelda orchestral recordings in one group of 4 Nintendo videos.)<br />
| v0<br />
|}<br />
<br />
== 00040010 - System Applications ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
! Status<br />
|-<br />
| 00020000<br />
| JPN<br />
| [[System Settings]]<br />
| v0, v1027, v2062<br />
| Active<br />
|-<br />
| 00021000<br />
| USA<br />
| [[System Settings]]<br />
| v0, v1027, v2062<br />
| Active<br />
|-<br />
| 00022000<br />
| EUR<br />
| [[System Settings]]<br />
| v0, v1027, v2062<br />
| Active<br />
|-<br />
| 00020100<br />
| JPN<br />
| [[Download Play]]<br />
| v0, v1026<br />
| Active<br />
|-<br />
| 00021100<br />
| USA<br />
| [[Download Play]]<br />
| v0, v1026<br />
| Active<br />
|-<br />
| 00022100<br />
| EUR<br />
| [[Download Play]]<br />
| v0, v1026<br />
| Active<br />
|-<br />
| 00020200<br />
| JPN<br />
| [[Activity Log]]<br />
| v0, v1026, v2054<br />
| Active<br />
|-<br />
| 00021200<br />
| USA<br />
| [[Activity Log]]<br />
| v0, v1026, v2054<br />
| Active<br />
|-<br />
| 00022200<br />
| EUR<br />
| [[Activity Log]]<br />
| v0, v1026, v2054<br />
| Active<br />
|-<br />
| 00020300<br />
| JPN<br />
| [[Health and Safety Information]]<br />
| v0<br />
| Active<br />
|-<br />
| 00021300<br />
| USA<br />
| [[Health and Safety Information]]<br />
| v0<br />
| Active<br />
|-<br />
| 00022300<br />
| EUR<br />
| [[Health and Safety Information]]<br />
| v0<br />
| Active<br />
|-<br />
| 00020400<br />
| JPN<br />
| [[Nintendo 3DS Camera]]<br />
| v0, v16, v1039<br />
| Active<br />
|-<br />
| 00021400<br />
| USA<br />
| [[Nintendo 3DS Camera]]<br />
| v0, v16, v1039<br />
| Active<br />
|-<br />
| 00022400<br />
| EUR<br />
| [[Nintendo 3DS Camera]]<br />
| v0, v16, v1039<br />
| Active<br />
|-<br />
| 00020500<br />
| JPN<br />
| [[Nintendo 3DS Sound]]<br />
| v0, v1027, v2049<br />
| Active<br />
|-<br />
| 00021500<br />
| USA<br />
| [[Nintendo 3DS Sound]]<br />
| v0, v1027, v2049<br />
| Active<br />
|-<br />
| 00022500<br />
| EUR<br />
| [[Nintendo 3DS Sound]]<br />
| v0, v1027, v2049<br />
| Active<br />
|-<br />
| 00020700<br />
| JPN<br />
| [[Mii Maker]]<br />
| v0, v1026<br />
| Active<br />
|-<br />
| 00021700<br />
| USA<br />
| [[Mii Maker]]<br />
| v0, v1026<br />
| Active<br />
|-<br />
| 00022700<br />
| EUR<br />
| [[Mii Maker]]<br />
| v0, v1026<br />
| Active<br />
|-<br />
| 00020800<br />
| JPN<br />
| [[StreetPass Mii Plaza]]<br />
| v0, v1027, v2048, v3087, v4096<br />
| Active<br />
|-<br />
| 00021800<br />
| USA<br />
| [[StreetPass Mii Plaza]]<br />
| v0, v1027, v2048, v3087, v4096<br />
| Active<br />
|-<br />
| 00022800<br />
| EUR<br />
| [[StreetPass Mii Plaza]]<br />
| v0, v1027, v2048, v3087, v4096<br />
| Active<br />
|-<br />
| 00020900<br />
| JPN<br />
| [[eShop]]<br />
| v4, v1026, 2058<br />
| Active<br />
|-<br />
| 00021900<br />
| USA<br />
| [[eShop]]<br />
| v4, v1026, v2058<br />
| Active<br />
|-<br />
| 00022900<br />
| EUR<br />
| [[eShop]]<br />
| v4, v1026, v2058<br />
| Active<br />
|-<br />
| 00020A00<br />
| JPN<br />
| Web browser<br />
| v4, v1035<br />
| Active<br />
|-<br />
| 00021A00<br />
| USA<br />
| Web browser<br />
| v4, v1035<br />
| Active<br />
|-<br />
| 00022A00<br />
| EUR<br />
| Web browser<br />
| v4, v1035<br />
| Active<br />
|-<br />
| 00020B00<br />
| JPN<br />
| [[Nintendo Zone]]<br />
| v0, v1034<br />
| Active<br />
|-<br />
| 00021B00<br />
| USA<br />
| [[Nintendo Zone]]<br />
| v0, v1034<br />
| Active<br />
|-<br />
| 00022B00<br />
| EUR<br />
| [[Nintendo Zone]]<br />
| v0, v1034<br />
| Active<br />
|-<br />
| 00020D00<br />
| JPN<br />
| ?<br />
| v0, v1028<br />
| Active<br />
|-<br />
| 00021D00<br />
| USA<br />
| ?<br />
| v0, v1028<br />
| Active<br />
|-<br />
| 00022D00<br />
| EUR<br />
| ?<br />
| v0, v1028<br />
| Active<br />
|-<br />
| 00020E00<br />
| JPN<br />
| ?<br />
| v0, v1027<br />
| Active<br />
|-<br />
| 00021E00<br />
| USA<br />
| ?<br />
| v0, v1027<br />
| Active<br />
|-<br />
| 00022E00<br />
| EUR<br />
| ?<br />
| v0, v1027<br />
| Active<br />
|-<br />
| 00020F00<br />
| JPN<br />
| ?<br />
| v0, v1024<br />
| Active<br />
|-<br />
| 00021F00<br />
| USA<br />
| ?<br />
| v0, v1024<br />
| Active<br />
|-<br />
| 00022F00<br />
| EUR<br />
| ?<br />
| v0, v1024<br />
| Active<br />
|-<br />
| 00023000<br />
| JPN<br />
| Promotional video<br />
| v0, v2048<br />
| Stubbed<br />
|-<br />
| 00024000<br />
| USA<br />
| Promotional video<br />
| v0, v2048<br />
| Stubbed<br />
|-<br />
| 00025000<br />
| EUR<br />
| Promotional video<br />
| v0, v2048<br />
| Stubbed<br />
|}<br />
<br />
== 0004001B ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Description<br />
! Versions<br />
|-<br />
| 00010002<br />
| ?<br />
| v0<br />
|-<br />
| 00010702<br />
| ?<br />
| v0<br />
|}<br />
<br />
== 00040020 - Game Trials ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
!00048101<br />
!JPN<br />
!Monster Hunter tri G<br />
!v1<br />
|-<br />
|}<br />
<br />
== 00040030 ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
| 00008202<br />
| JPN<br />
| ?<br />
| v0, v1029, v4111<br />
|-<br />
| 00008402<br />
| JPN<br />
| ?<br />
| v0, v1036<br />
|-<br />
| 00008602<br />
| JPN<br />
| ?<br />
| v0, v1026, v2048<br />
|-<br />
| 00008802<br />
| JPN<br />
| ?<br />
| v6, v1024<br />
|-<br />
| 00008A02<br />
| All<br />
| ?<br />
| v0, v1025, v3072<br />
|-<br />
| 00008D02<br />
| JPN<br />
| ?<br />
| v0, v1026, v3082<br />
|-<br />
| 00008E02<br />
| JPN<br />
| ?<br />
| v0, v1029, v2054<br />
|-<br />
| 00008F02<br />
| USA<br />
| ?<br />
| v0, v1027, v2049, v4111<br />
|-<br />
| 00009202<br />
| USA<br />
| ?<br />
| v0, v1026, v1036<br />
|-<br />
| 00009302<br />
| USA<br />
| ?<br />
| v0, v1026, v2048<br />
|-<br />
| 00009402<br />
| USA<br />
| ?<br />
| v6, v1024<br />
|-<br />
| 00009602<br />
| USA<br />
| ?<br />
| v0, v1026, v3082<br />
|-<br />
| 00009702<br />
| USA<br />
| ?<br />
| v0, v1029, v2054<br />
|-<br />
| 00009802<br />
| EUR<br />
| ?<br />
| v0, v1029, v4111<br />
|-<br />
| 00009902<br />
| EUR<br />
| ?<br />
| v0, v1036<br />
|-<br />
| 00009B02<br />
| EUR<br />
| ?<br />
| v0, v1036, v2048<br />
|-<br />
| 00009D02<br />
| EUR<br />
| ?<br />
| v6, v1024<br />
|-<br />
| 00009F02<br />
| EUR<br />
| ?<br />
| v6, v1024, v3082<br />
|-<br />
| 0000A002<br />
| EUR<br />
| ?<br />
| v6, v1024, v2054<br />
|-<br />
| 0000C002<br />
| JPN<br />
| ?<br />
| v0, v1026, v2053<br />
|-<br />
| 0000C102<br />
| JPN<br />
| ?<br />
| v0, v1026<br />
|-<br />
| 0000C302<br />
| JPN<br />
| ?<br />
| v0, v1024<br />
|-<br />
| 0000C502<br />
| All<br />
| ?<br />
| v0, v1026, v2053<br />
|-<br />
| 0000C602<br />
| JPN<br />
| ?<br />
| v5<br />
|-<br />
| 0000C802<br />
| USA<br />
| ?<br />
| v0, v1026, v2053<br />
|-<br />
| 0000C902<br />
| USA<br />
| ?<br />
| v0, v1026<br />
|-<br />
| 0000CB02<br />
| USA<br />
| ?<br />
| v0, v1024<br />
|-<br />
| 0000CC02<br />
| USA<br />
| ?<br />
| v3<br />
|-<br />
| 0000CD02<br />
| All<br />
| ?<br />
| v1<br />
|-<br />
| 0000CE02<br />
| USA<br />
| ?<br />
| v5<br />
|-<br />
| 0000D002<br />
| EUR<br />
| ?<br />
| v0, v1026, v2053<br />
|-<br />
| 0000D102<br />
| EUR<br />
| ?<br />
| v0, v1026<br />
|-<br />
| 0000D302<br />
| EUR<br />
| ?<br />
| v0, v1024<br />
|-<br />
| 0000D602<br />
| EUR<br />
| ?<br />
| v5<br />
|}<br />
<br />
== 0004009B ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
| 00010202<br />
| All<br />
| ?<br />
| v0, v2050<br />
|-<br />
| 00010302<br />
| All<br />
| ?<br />
| v0, v2052<br />
|-<br />
| 00010402<br />
| All<br />
| ?<br />
| v0, v1024, v2050<br />
|-<br />
| 00010502<br />
| All<br />
| ?<br />
| v0, v1024, v2048<br />
|-<br />
| 00010602<br />
| All<br />
| ?<br />
| v2<br />
|-<br />
| 00011902<br />
| JPN<br />
| ?<br />
| v0<br />
|-<br />
| 00011402<br />
| USA<br />
| ?<br />
| v0<br />
|-<br />
| 00011202<br />
| EUR<br />
| ?<br />
| v0<br />
|-<br />
| 00012102<br />
| EUR<br />
| ?<br />
| v0, v1026, v2051<br />
|-<br />
| 00012202<br />
| JPN<br />
| ?<br />
| v1026<br />
|-<br />
| 00012302<br />
| USA<br />
| ?<br />
| v1026, v2053<br />
|-<br />
| 00012102<br />
| EUR<br />
| ?<br />
| v1026, v2051<br />
|-<br />
| 00013102<br />
| EUR<br />
| ?<br />
| v1024, v2049<br />
|-<br />
| 00013302<br />
| USA<br />
| ?<br />
| v1024, v2051<br />
|-<br />
| 00016302<br />
| USA<br />
| ?<br />
| v80<br />
|-<br />
| 00017302<br />
| USA<br />
| ?<br />
| v3088<br />
|}<br />
<br />
== 000400DB ==<br />
<br />
These ids can be found @ offset 0x320 in every CCI... (the region of the title is the region of the CCI). <br />
<br />
(Maybe this is the loader title, like IOS on the Wii, and could be the value we need to change to get RegionFree...).<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
| 00010302<br />
| EUR<br />
| ?<br />
| v0, v1024, v2052<br />
|-<br />
| 00010502<br />
| EUR<br />
| ?<br />
| v0, v1024, v2048<br />
|-<br />
| 00016102<br />
| EUR<br />
| ?<br />
| v32, v48, v64, v80, v96<br />
|-<br />
| 00016202<br />
| JPN<br />
| ?<br />
| v32, v48, v64, v80, v96<br />
|-<br />
| 00016302<br />
| USA<br />
| ?<br />
| v32, v48, v64, v80, v96<br />
|-<br />
| 00017102<br />
| EUR<br />
| ?<br />
| v2049, v2069, v3088<br />
|-<br />
| 00017302<br />
| USA<br />
| ?<br />
| v2049, v2069<br />
|}<br />
<br />
== 00040130 - ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Title Name<br />
! Description<br />
! Versions<br />
|-<br />
| 00001502<br />
| 02_15<br />
|<br />
| v0, v1026, v2053<br />
|-<br />
| 00001503<br />
| 03_15<br />
| <br />
| v0<br />
|-<br />
| 00001602<br />
| 02_16<br />
| Camera - System applet<br />
| v0, v1026, v2048<br />
|-<br />
| 00001702<br />
| 02_17<br />
| Config - System applet<br />
| v0, v1024, v2049<br />
|-<br />
| 00001703<br />
| 03_17<br />
|<br />
| v0<br />
|-<br />
| 00001802<br />
| 02_18<br />
| Codec - system applet<br />
| v0, v1025, v3072<br />
|-<br />
| 00001803<br />
| 03_18<br />
| <br />
| v0<br />
|-<br />
| 00001A02<br />
| 02_1A <br />
| DSP - system applet.<br />
| v0, v1024<br />
|-<br />
| 00001A03<br />
| 03_1A <br />
| <br />
| v0<br />
|-<br />
| 00001B02<br />
| 02_1B<br />
| <br />
| v0<br />
|-<br />
| 00001B03<br />
| 03_1B<br />
| <br />
| v0<br />
|-<br />
| 00001C02<br />
| 02_1C<br />
| <br />
| v0, v1040, v2049, v3075<br />
|-<br />
| 00001C03<br />
| 03_1C<br />
| <br />
| v0<br />
|-<br />
| 00001D02<br />
| 02_1D <br />
| <br />
| v0, v1025, v3072<br />
|-<br />
| 00001D03<br />
| 03_1D <br />
| <br />
| v0<br />
|-<br />
| 00001E02<br />
| 02_1E <br />
| i2c - system applet.<br />
| v0, v1024<br />
|- <br />
| 00001E03<br />
| 03_1E <br />
|<br />
| v0<br />
|-<br />
| 00001F02<br />
| 02_1F <br />
| <br />
| v0, v1026, v3072<br />
|-<br />
| 00001F03<br />
| 03_1F <br />
| <br />
| v0<br />
|-<br />
| 00002002<br />
| 02_20 <br />
| Microphone - system applet<br />
| v0<br />
|-<br />
| 00002102<br />
| 02_21 <br />
| <br />
| v0<br />
|-<br />
| 00002103<br />
| 03_21 <br />
| <br />
| v0<br />
|-<br />
| 00002202<br />
| 02_22 <br />
| <br />
| v0, v1026, v3075<br />
|-<br />
| 00002203<br />
| 03_22 <br />
|<br />
| v0<br />
|-<br />
| 00002302<br />
| 02_23 <br />
| spi - system applet.<br />
| v0, v1025<br />
|-<br />
| 00002303<br />
| 03_23 <br />
| <br />
| v0<br />
|-<br />
| 00002402<br />
| 02_24 <br />
| Network - System Applet<br />
| v0, v1024, v2052, v4101<br />
|-<br />
| 00002403<br />
| 03_24 <br />
| <br />
| v0<br />
|-<br />
| 00002602<br />
| 02_26<br />
| Messaging (NintendoZone) - System Applet<br />
| v0, v1026, v3073<br />
|-<br />
| 00002702<br />
| 02_27 <br />
|<br />
| v0, v1025<br />
|-<br />
| 00002703<br />
| 03_27 <br />
| <br />
| v0<br />
|-<br />
| 00002802<br />
| 02_28 <br />
| DownloadPlay - System applet<br />
| v0, v1026, v3078<br />
|-<br />
| 00002902<br />
| 02_29 <br />
| http - system applet<br />
| v0, v1026, v4099<br />
|-<br />
| 00002903<br />
| 03_29 <br />
| <br />
| v0<br />
|-<br />
| 00002A02<br />
| 02_2A <br />
| <br />
| v0<br />
|-<br />
| 00002A03<br />
| 03_2A <br />
| <br />
| v0<br />
|-<br />
| 00002B02<br />
| 02_2B <br />
| <br />
| v0, v1025, v2049<br />
|-<br />
| 00002C02<br />
| 02_2C <br />
| <br />
| v0, v1028, v2055<br />
|-<br />
| 00002C03<br />
| 03_2C <br />
| <br />
| v0<br />
|-<br />
| 00002D02<br />
| 02_2D <br />
| <br />
| v0, v1024, v2052, v4101<br />
|-<br />
| 00002D03<br />
| 03_2D <br />
| <br />
| v0<br />
|-<br />
| 00002E02<br />
| 02_2E <br />
| Sockets - System applet<br />
| v0, v1024, v2053, v3075<br />
<br />
|-<br />
| 00002E03<br />
| 03_2E <br />
|<br />
| v0<br />
|-<br />
| 00002F02<br />
| 02_2F <br />
| SSL - System applet.<br />
| v0, v1024, v3072<br />
|-<br />
| 00002F03<br />
| 03_2F <br />
| <br />
| v0<br />
|-<br />
| 00003102<br />
| 02_31 <br />
|<br />
| v0, v1025<br />
|-<br />
| 00003103<br />
| 03_31 <br />
| <br />
| v0<br />
|-<br />
| 00003202<br />
| 02_32 <br />
| FriendsList - System applet<br />
| v0, v1028, v3072<br />
|-<br />
| 00003203<br />
| 03_32 <br />
| <br />
| v0<br />
|-<br />
| 00003302<br />
| 02_33 <br />
| <br />
| v0, v1026, v3072<br />
|-<br />
| 00003303<br />
| 03_33 <br />
| <br />
| v0<br />
|- <br />
| 00003402<br />
| 02_34 <br />
| BOSS (SpotPass) System Applet<br />
| v0, v1024, v2053, v4101<br />
|-<br />
| 00003502<br />
| 02_35 <br />
|<br />
| v0, v1028, v3072<br />
|-<br />
| 00003702<br />
| 02_37 <br />
| <br />
| v0<br />
|-<br />
| 00008002<br />
| 02_80 <br />
|<br />
| v0, v1028, v3077<br />
|-<br />
| 00008003<br />
| 03_80 <br />
| <br />
| v0<br />
|}<br />
<br />
== 00040138 ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Description<br />
! Versions<br />
|-<br />
| 00000002<br />
| [[Home Menu]]<br />
| v432, v1472, v2516, v3553, v5647<br />
|-<br />
| 00000003<br />
| ?<br />
| v432, v5632<br />
|-<br />
| 00000102<br />
| ?<br />
| v432, v1489, 2565<br />
|-<br />
| 00000202<br />
| ?<br />
| v519<br />
|}<br />
<br />
== 00048005 ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Description<br />
! Versions<br />
|-<br />
| 42383841(B88A)<br />
| [[DS Internet]]<br />
| v0, v1025, v2048<br />
|-<br />
| 484E4441(HNDA)<br />
| [[Download Play]]<br />
| v1024<br />
|}<br />
<br />
== 0004800F ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Description<br />
! Versions<br />
|-<br />
| 484E4841(HNHA)<br />
| [[Nintendo DS Cart Whitelist]]<br />
| v0, v1026, v3072<br />
|-<br />
| 484E4C41(HNLA)<br />
| Matches the DSi titleid low for [[Version Data]] but this title was never updated.(As of [[2.1.0-4]])<br />
| v0<br />
|}<br />
<br />
== 00040000 - eShop Titles ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
| 00032600<br />
| EUR/USA<br />
| Pokédex 3D<br />
| v0<br />
|-<br />
| 00034700<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00040800<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 00040900<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 00040A00<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 00040B00<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 00040E00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00041000<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00041100<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00041300<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00041500<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00041700<br />
| USA<br />
| Kirby's Dream Land<br />
| v0<br />
|-<br />
| 00041800<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00041900<br />
| EUR<br />
| Kirby's Dream Land<br />
| v0<br />
|-<br />
| 00041D00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00041E00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00041F00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00042400<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00042600<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00042700<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00042800<br />
| EUR<br />
| Zelda: Link's Awakening DX<br />
| v0<br />
|-<br />
| 00042900<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 00042A00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00042C00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00042E00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00043000<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00045C00<br />
| JPN<br />
| 3D Classics Excitebike<br />
| v0<br />
|-<br />
| 00046C00<br />
| EUR<br />
| 3D Classics Excitebike<br />
| v0<br />
|-<br />
| 00048900<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00049900<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00049D00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0004A900<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0004AA00<br />
| USA<br />
| [[Nintendo Video]]<br />
| v0<br />
|-<br />
| 0004AB00<br />
| EUR<br />
| [[Nintendo Video]]<br />
| v0<br />
|-<br />
| 0004B400<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0004D500<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0004E700<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 0004EF00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0004F300<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0004FA00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0004FD00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00051700<br />
| USA<br />
| [[Swapnote]]<br />
| v0<br />
|-<br />
| 00051800<br />
| EUR<br />
| [[Swapnote|Letter Box]]<br />
| v0<br />
|-<br />
| 00052600<br />
| ?<br />
| ?<br />
| v32<br />
|-<br />
| 00052700<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 00052800<br />
| ?<br />
| ?<br />
| v0, v1024<br />
|-<br />
| 00052900<br />
| ?<br />
| ?<br />
| v32<br />
|-<br />
| 00052A00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00052D00<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 00054300<br />
| USA<br />
| 3D Classics Excitebike<br />
| v0<br />
|-<br />
| 00054E00<br />
| EUR<br />
| 3D Classics Excitebike<br />
| v0, v1024<br />
|-<br />
| 00055800<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 00057700<br />
| USA<br />
| Netflix<br />
| v0<br />
|-<br />
| 00059200<br />
| ?<br />
| ?<br />
| v16<br />
|-<br />
| 0005AD00<br />
| JPN<br />
| Kid Icarus Uprising E3 Video<br />
| v0<br />
|-<br />
| 0005AE00<br />
| USA<br />
| Kid Icarus Uprising E3 Video<br />
| v0<br />
|-<br />
| 0005AF00<br />
| JPN<br />
| Paper Mario E3 Video<br />
| v0<br />
|-<br />
| 0005B000<br />
| USA<br />
| Paper Mario E3 Video<br />
| v0<br />
|-<br />
| 0005B100<br />
| JPN<br />
| Mario Kart E3 Video<br />
| v0<br />
|-<br />
| 0005B200<br />
| USA<br />
| Mario Kart E3 Video<br />
| v0<br />
|-<br />
| 0005B300<br />
| JPN<br />
| Animal Crossing E3 Video<br />
| v0<br />
|-<br />
| 0005B400<br />
| USA<br />
| Animal Crossing E3 Video<br />
| v0<br />
|-<br />
| 0005B500<br />
| JPN<br />
| Luigi's Mansion 2 E3 Video<br />
| v0<br />
|-<br />
| 0005B600<br />
| USA<br />
| Luigi's Mansion 2 E3 Video<br />
| v0<br />
|-<br />
| 0005B700<br />
| JPN<br />
| Zelda Ocarina of Time E3 Video<br />
| v0<br />
|-<br />
| 0005B800<br />
| USA<br />
| Zelda Ocarina of Time E3 Video<br />
| v0<br />
|-<br />
| 0005B900<br />
| JPN<br />
| Super Mario E3 Video<br />
| v0<br />
|-<br />
| 0005BA00<br />
| USA<br />
| Super Mario E3 Video<br />
| v0<br />
|-<br />
| 0005BB00<br />
| JPN<br />
| MGS Snake Eater 3D E3 Video<br />
| v0<br />
|-<br />
| 0005BC00<br />
| USA<br />
| MGS Snake Eater 3D E3 Video<br />
| v32<br />
|-<br />
| 0005BD00<br />
| JPN<br />
| Biohazard Revelations E3 Video<br />
| v16<br />
|-<br />
| 0005BE00<br />
| USA<br />
| Resident Evil Revelations E3 Video<br />
| v32<br />
|-<br />
| 0005BF00<br />
| JPN<br />
| Starfox 64 3D E3 Video<br />
| v0<br />
|-<br />
| 0005C000<br />
| USA<br />
| Starfox 64 3D E3 Video<br />
| v0<br />
|-<br />
| 0005EA00<br />
| EUR<br />
| Green Lantern 3D Trailer Video<br />
| v0<br />
|-<br />
| 0005F000<br />
| USA<br />
| Green Lantern 3D Trailer Video<br />
| v0<br />
|-<br />
| 0005F800<br />
| ?<br />
| ? <br />
| v0<br />
|-<br />
| 0005F900<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0005FC00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 0005FD00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00060000<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00060F00<br />
| EUR<br />
| Pyramids<br />
|<br />
|-<br />
| 00062400<br />
| EUR<br />
| Kid Icarus Uprising E3 Video<br />
| v0<br />
|-<br />
| 00062700<br />
| EUR<br />
| Paper Mario E3 Video<br />
| v0<br />
|-<br />
| 00062A00<br />
| EUR<br />
| Mario Kart E3 Video<br />
| v0<br />
|-<br />
| 00062B00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00062C00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00062D00<br />
| EUR<br />
| Animal Crossing E3 Video<br />
| v0<br />
|-<br />
| 00063000<br />
| EUR<br />
|Luigi's Mansion 2 E3 Video<br />
| v0<br />
|-<br />
| 00063300<br />
| EUR<br />
| Zelda Ocarina of Time E3 Video<br />
| v0<br />
|-<br />
| 00063400<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00063500<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00063600<br />
| EUR<br />
| Super Mario E3 Video<br />
| v0<br />
|-<br />
| 00063700<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00063800<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00063900<br />
| EUR<br />
| MGS Snake Eater 3D E3 Video<br />
| v0<br />
|-<br />
| 00063C00<br />
| EUR<br />
| Resident Evil Revelations E3 Video<br />
| v0<br />
|-<br />
| 00063D00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00063E00<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00063F00<br />
| EUR<br />
| Starfox 64 3D E3 Video<br />
| v0<br />
|-<br />
| 00064000<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00064100<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| 00066300<br />
| USA<br />
| Mighty Switch Force<br />
| v0<br />
|-<br />
| 0006E500<br />
| USA<br />
| Super Mario Bros.<br />
| v0<br />
|-<br />
| 0006E600<br />
| EUR<br />
| Super Mario Bros.<br />
| v0<br />
|-<br />
| 0006EE00<br />
| USA<br />
| Metroid<br />
| v0<br />
|-<br />
| 0006EF00<br />
| EUR<br />
| Metroid<br />
| v0<br />
|-<br />
| 0006F100<br />
| USA<br />
| The Legend of Zelda<br />
| v0<br />
|-<br />
| 0006F200<br />
| EUR<br />
| The Legend of Zelda<br />
| v0<br />
|-<br />
| 0006F700<br />
| USA<br />
| Wrecking Crew<br />
| v0<br />
|-<br />
| 0006F800<br />
| EUR<br />
| Wrecking Crew<br />
| v0<br />
|-<br />
| 0006FA00<br />
| USA<br />
| NES Open Tournament Golf<br />
| v0<br />
|-<br />
| 0006FB00<br />
| EUR<br />
| NES Open Tournament Golf<br />
| v0<br />
|-<br />
| 00070000<br />
| USA<br />
| Donkey Kong Jr.<br />
| v0<br />
|-<br />
| 00070100<br />
| EUR<br />
| Donkey Kong Jr.<br />
| v0<br />
|-<br />
| 00070300<br />
| USA<br />
| Balloon Fight<br />
| v0<br />
|-<br />
| 00070400<br />
| EUR<br />
| Balloon Fight<br />
| v0<br />
|-<br />
| 00070600<br />
| USA<br />
| Ice Climber<br />
| v0<br />
|-<br />
| 00070700<br />
| EUR<br />
| Ice Climber<br />
| v0<br />
|-<br />
| 00070900<br />
| USA<br />
| Zelda II The Adventure of Link<br />
| v0<br />
|-<br />
| 00070A00<br />
| EUR<br />
| Zelda II The Adventure of Link<br />
| v0<br />
|-<br />
| 00071200<br />
| USA<br />
| Yoshi<br />
| v0<br />
|-<br />
| 00071300<br />
| EUR<br />
| Yoshi<br />
| v0<br />
|-<br />
| 00072400<br />
| EUR<br />
| Ambassador Certificate<br />
| v0<br />
|-<br />
| 00072500<br />
| USA<br />
| Ambassador Certificate<br />
| v0<br />
|-<br />
| 00074900<br />
| USA<br />
| F-Zero: Maximum Velocity<br />
| v0<br />
|-<br />
| 00074C00<br />
| USA<br />
| Mario Kart Super Circuit<br />
| v0<br />
|-<br />
| 00074F00<br />
| USA<br />
| Wario Land 4<br />
| v0<br />
|-<br />
| 00075300<br />
| USA<br />
| Yoshi's Island: Super Mario Advance 3<br />
| v0<br />
|-<br />
| 00075600<br />
| USA<br />
| Metroid Fusion<br />
| v0<br />
|-<br />
| 00075900<br />
| USA<br />
| WarioWare Inc: Mega Microgame$ <br />
| v0<br />
|-<br />
| 00075D00<br />
| EUR<br />
| Kirby & The Amazing Mirror<br />
| v0<br />
|-<br />
| 00075C00<br />
| USA<br />
| Kirby & The Amazing Mirror<br />
| v0<br />
|-<br />
| 00076700<br />
| USA<br />
| Mario vs Donkey Kong<br />
| v0<br />
|-<br />
| 00076A00<br />
| USA<br />
| Fire Emblem: The Sacred Stones<br />
| v0<br />
|-<br />
| 00076D00<br />
| USA<br />
| The Legend of Zelda: The Minish Cap<br />
| v0<br />
|-<br />
| 00079700<br />
| USA<br />
| Preview Video: ?<br />
| v0<br />
|-<br />
| 00079800<br />
| USA<br />
| Preview Video: ?<br />
| v0<br />
|-<br />
| 00079900<br />
| USA<br />
| Preview Video: ?<br />
| v0<br />
|-<br />
| 00079A00<br />
| USA<br />
| Preview Video: ?<br />
| v0<br />
|-<br />
| 00079B00<br />
| USA<br />
| Preview Video: ?<br />
| v0<br />
|-<br />
| 00079C00<br />
| USA<br />
| Preview Video: Animal Crossing<br />
| v0<br />
|-<br />
| 00079D00<br />
| USA<br />
| Preview Video: ?<br />
| v0<br />
|-<br />
| 0007AB00<br />
| EUR<br />
| Eurosport (looks/acts like Nintendo Video)<br />
| v0<br />
|}<br />
<br />
== 00040000 - Retail Titles ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
| 00030700<br />
| EUR<br />
| Mario Kart 7<br />
| v0<br />
|-<br />
| 00031D00<br />
| EUR<br />
| PilotWings Resort<br />
| v0<br />
|-<br />
| 00033600<br />
| EUR<br />
| The Legend of Zelda - Ocarina of Time 3D<br />
| v0<br />
|-<br />
| 00033800<br />
| EUR<br />
| Puzzle Bobble Universe<br />
| v0<br />
|-<br />
| 00033900<br />
| EUR<br />
| Rayman 3D<br />
| v0<br />
|-<br />
| 00033A00<br />
| EUR<br />
| Tom Clancy's Splinter Cell 3D<br />
| v0<br />
|-<br />
| 00033B00<br />
| EUR<br />
| Ridge Racer 3D<br />
| v0<br />
|-<br />
| 00033C00<br />
| EUR<br />
| Super Street Fighter IV - 3D Edition<br />
| v0<br />
|-<br />
| 00037500<br />
| EUR<br />
| Tom Clancy's Ghost Recon - Shadow Wars<br />
| v0<br />
|-<br />
| 00038900<br />
| EUR<br />
| Super Monkey Ball 3D<br />
| v0<br />
|-<br />
| 00038A00<br />
| EUR<br />
| Dead or Alive - Dimensions<br />
| v0<br />
|-<br />
| 00038C00<br />
| EUR<br />
| LEGO Star Wars III - The Clone Wars<br />
| v0<br />
|-<br />
| 00038B00<br />
| EUR<br />
| Resident Evil - The Mercenaries 3D<br />
| v0<br />
|-<br />
| 00049100<br />
| EUR<br />
| StarFox 64 3D<br />
| v0<br />
|-<br />
| 00053F00<br />
| EUR<br />
| Super Mario 3D Land<br />
| v0<br />
|-<br />
| 00056200<br />
| EUR<br />
| Doctor Lautrec and The Forgotten Knights<br />
| v0<br />
|}<br />
<br />
== 00040002 - eShop Demos ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
| 00030c01<br />
| EUR<br />
| Nintendogs & Cats<br />
| v0<br />
|-<br />
| 00040401<br />
| EUR<br />
| Crush 3D<br />
| v0<br />
|-<br />
| 00054801<br />
| USA<br />
| Mario & Sonic at the London 2012 Olympic games<br />
| v0<br />
|-<br />
| 0005ed01<br />
| EUR<br />
| Cooking Mama 4<br />
| v0<br />
|-<br />
| 0005ee01<br />
| EUR<br />
| Resident Evil Revelations Demo<br />
| v0<br />
|-<br />
| 00060201<br />
| USA<br />
| Resident Evil Revelations Demo<br />
| v0<br />
|-<br />
| 00081e01<br />
| USA<br />
| Metal Gear Solid Snake Eater 3D Demo<br />
| v0<br />
|-<br />
| 00082401<br />
| EUR<br />
| Metal Gear Solid Snake Eater 3D Demo<br />
| v0<br />
|}</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Mii_Maker&diff=2288Talk:Mii Maker2012-02-08T06:50:39Z<p>Duke srg: </p>
<hr />
<div>First 4 bytes IS a Mii ID, you can check gold-bottomed MIIs.<br />
:I see Gold-bottomed Miis have a header of 0x11 instead of 0x91 but what's a MiiID? Where did you hear of that concept? (btw use the signature button) --[[User:Elisherer|Elisherer]] 21:39, 7 February 2012 (CET)<br />
::Nevermind...I read about it [http://code.google.com/p/jmiieditor/source/browse/trunk/src/jMiiEditor/mii/Mii.java here] and it seems true...so the mac address is the 3DS Id...kindof..--[[User:Elisherer|Elisherer]] 21:49, 7 February 2012 (CET)<br />
<br />
I get the suspicion that the block from 0x18 to 0x5C is in the same format as [http://wiibrew.org/wiki/Wiimote/Mii_Data Wiimote Mii data], however it seems to be little-endian in the case of the 3DS. This may or may not help figuring out the encryption. Also, the 0x14 bytes at 0x5C may be a SHA1 hash of the Mii data, and the 0x10 bytes at 0x10 may be used as an IV for AES-CTR encryption or something... --[[User:Luigi2us|Luigi2us]] 23:17, 7 February 2012 (CET)<br />
:I'm not dismissing anything but from some of my decrypted miis it seems similiar but not the same, plus, it would mean that the Mii id and the mac would appear again inside the encrypted data, (and another point: the distance, in bytes, between the name and the creator's name is not the same), I agree about the AES-CTR and the IV --[[User:Elisherer|Elisherer]] 23:32, 7 February 2012 (CET)<br />
::Oh right, I counted wrong. Also the last 0x14 bytes can't be a SHA1, the first 2 bytes don't change between two Miis with the same ID... I don't know of 0x12-byte hash algorithms, and afaik Nintendo doesn't use MD5, so all I can think of is a AES-CBC MAC... --[[User:Luigi2us|Luigi2us]] 23:42, 7 February 2012 (CET)<br />
We should try to make Miis on PC with MyAvatarEditor (http://www.softpedia.com/progDownload/My-Avatar-Editor-Download-180170.html), export it to WiiMote with MiiTransfer (http://mirror.transact.net.au/pub/sourceforge/w/project/wd/wdml/WDML%20-%20MiiTransfer/) and transfer to 3DS via Mii channel and then we can analyse the differences and assure that only MiiID and MAC section is used as a key. Unfortunately I do not have a Wii for that, but all other steps worked fine with Dolphin. --[[User:Duke srg|Duke srg]] 07:50, 8 February 2012 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Mii_Maker&diff=2287Talk:Mii Maker2012-02-08T06:50:04Z<p>Duke srg: added some useful links</p>
<hr />
<div>First 4 bytes IS a Mii ID, you can check gold-bottomed MIIs.<br />
:I see Gold-bottomed Miis have a header of 0x11 instead of 0x91 but what's a MiiID? Where did you hear of that concept? (btw use the signature button) --[[User:Elisherer|Elisherer]] 21:39, 7 February 2012 (CET)<br />
::Nevermind...I read about it [http://code.google.com/p/jmiieditor/source/browse/trunk/src/jMiiEditor/mii/Mii.java here] and it seems true...so the mac address is the 3DS Id...kindof..--[[User:Elisherer|Elisherer]] 21:49, 7 February 2012 (CET)<br />
<br />
I get the suspicion that the block from 0x18 to 0x5C is in the same format as [http://wiibrew.org/wiki/Wiimote/Mii_Data Wiimote Mii data], however it seems to be little-endian in the case of the 3DS. This may or may not help figuring out the encryption. Also, the 0x14 bytes at 0x5C may be a SHA1 hash of the Mii data, and the 0x10 bytes at 0x10 may be used as an IV for AES-CTR encryption or something... --[[User:Luigi2us|Luigi2us]] 23:17, 7 February 2012 (CET)<br />
:I'm not dismissing anything but from some of my decrypted miis it seems similiar but not the same, plus, it would mean that the Mii id and the mac would appear again inside the encrypted data, (and another point: the distance, in bytes, between the name and the creator's name is not the same), I agree about the AES-CTR and the IV --[[User:Elisherer|Elisherer]] 23:32, 7 February 2012 (CET)<br />
::Oh right, I counted wrong. Also the last 0x14 bytes can't be a SHA1, the first 2 bytes don't change between two Miis with the same ID... I don't know of 0x12-byte hash algorithms, and afaik Nintendo doesn't use MD5, so all I can think of is a AES-CBC MAC... --[[User:Luigi2us|Luigi2us]] 23:42, 7 February 2012 (CET)<br />
We should try to make Miis on PC with MyAvatarEditor (http://www.softpedia.com/progDownload/My-Avatar-Editor-Download-180170.html), export it to WiiMote with MiiTransfer (http://mirror.transact.net.au/pub/sourceforge/w/project/wd/wdml/WDML%20-%20MiiTransfer/) and transfer to 3DS via Mii channel and then we can analyse the differences and assure that only MiiID and MAC section is user as a key. Unfortunately I do not have a Wii for that, but all other steps worked fine with Dolphin. --[[User:Duke srg|Duke srg]] 07:50, 8 February 2012 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Mii_Maker&diff=2286Talk:Mii Maker2012-02-08T06:18:13Z<p>Duke srg: </p>
<hr />
<div>First 4 bytes IS a Mii ID, you can check gold-bottomed MIIs.<br />
:I see Gold-bottomed Miis have a header of 0x11 instead of 0x91 but what's a MiiID? Where did you hear of that concept? (btw use the signature button) --[[User:Elisherer|Elisherer]] 21:39, 7 February 2012 (CET)<br />
::Nevermind...I read about it [http://code.google.com/p/jmiieditor/source/browse/trunk/src/jMiiEditor/mii/Mii.java here] and it seems true...so the mac address is the 3DS Id...kindof..--[[User:Elisherer|Elisherer]] 21:49, 7 February 2012 (CET)<br />
<br />
I get the suspicion that the block from 0x18 to 0x5C is in the same format as [http://wiibrew.org/wiki/Wiimote/Mii_Data Wiimote Mii data], however it seems to be little-endian in the case of the 3DS. This may or may not help figuring out the encryption. Also, the 0x14 bytes at 0x5C may be a SHA1 hash of the Mii data, and the 0x10 bytes at 0x10 may be used as an IV for AES-CTR encryption or something... --[[User:Luigi2us|Luigi2us]] 23:17, 7 February 2012 (CET)<br />
:I'm not dismissing anything but from some of my decrypted miis it seems similiar but not the same, plus, it would mean that the Mii id and the mac would appear again inside the encrypted data, (and another point: the distance, in bytes, between the name and the creator's name is not the same), I agree about the AES-CTR and the IV --[[User:Elisherer|Elisherer]] 23:32, 7 February 2012 (CET)<br />
::Oh right, I counted wrong. Also the last 0x14 bytes can't be a SHA1, the first 2 bytes don't change between two Miis with the same ID... I don't know of 0x12-byte hash algorithms, and afaik Nintendo doesn't use MD5, so all I can think of is a AES-CBC MAC... --[[User:Luigi2us|Luigi2us]] 23:42, 7 February 2012 (CET)<br />
We should try to make Miis on PC, export it to WiiMote and transfer to 3DS via Mii channel (?) and analyse the differences. --[[User:Duke srg|Duke srg]] 07:18, 8 February 2012 (CET)</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Mii_Maker&diff=2277Mii Maker2012-02-07T16:21:53Z<p>Duke srg: MiiID field fiexed</p>
<hr />
<div>'''Mii Maker''' lets you create Miis, like Wii Mii Channel. Here you can transfer Miis locally from other 3DSes, or from Wii Mii Channel. 3DS Miis can't be transfered to Wii Mii Channel, only from Wii.<br />
<br />
== Wii Mii Channel transfer protocol ==<br />
<br />
The Wii beacons are similar to the usual multi-cart NDS beacons, except: beacon_type is zero, and payload size is 0x14. The payload data is just the Wii UCS-2 nickname, with some extra unused zero data. The usual multi-cast NDS protocol is used for sending the 3DS nick to the Wii. After many keep-alive frames, it eventually sends a bunch of frames, each containing the whole Mii. There's a 6-byte header, followed by [http://wiibrew.org/wiki/Wiimote/Mii_Data Mii data]. At the end of these frames like most NDS frames is the 0200 byte marker.<br />
<br />
== Mii QR Code format ==<br />
<br />
3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to [http://www.denso-wave.com/qrcode Denso-Wave Inc] web site for QR Code format specifications). It contain 112 byte of binary data. 3DS seems to have fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code. The data itself is ciphered, algorithm is unknown yet.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Offset<br />
! Length<br />
! <br />
|-<br />
| 0x0<br />
| 0x4<br />
| MiiID<br />
|-<br />
| 0x4<br />
| 0x4<br />
| High 4 octets of MAC address [http://www.adminsub.net/mac-address-finder/nintendo]<br />
|-<br />
| 0x8<br />
| 0x10<br />
| unknown<br />
|-<br />
| 0x18<br />
| 0x2<br />
| Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt, ??<br />
|-<br />
| 0x1A<br />
| 0x14<br />
| UTF-16 Mii Name<br />
|-<br />
| 0x2E<br />
| 0x1A<br />
| unknown<br />
|-<br />
| 0x48<br />
| 0x14<br />
| UTF-16 Author Name<br />
|-<br />
| 0x5C<br />
| 0x2<br />
| unknown<br />
|-<br />
| 0x5E<br />
| 0x2<br />
| unknown (seems like the start of the checksum)<br />
|-<br />
| 0x60<br />
| 0x10<br />
| Checksum (Hash)<br />
|}<br />
<br />
* Codes made from the same 3DS are encrypted with the same xorpad (you can recreate it by xoring with known values from this table). (Correction: It seems that codes that made on the same day are encrypted the same way, not all codes).</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Talk:Mii_Maker&diff=2276Talk:Mii Maker2012-02-07T16:21:18Z<p>Duke srg: Created page with "First 4 bytes IS a Mii ID, you can check gold-bottomed MIIs."</p>
<hr />
<div>First 4 bytes IS a Mii ID, you can check gold-bottomed MIIs.</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Eurosport&diff=1808Eurosport2011-12-15T18:06:39Z<p>Duke srg: Created page with "Eurosport is a service similar to Nintendo Video. Please refer to Nintendo Video page for more information."</p>
<hr />
<div>Eurosport is a service similar to [[Nintendo Video]]. Please refer to [[Nintendo Video]] page for more information.</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Nintendo_Software&diff=1807Nintendo Software2011-12-15T18:05:25Z<p>Duke srg: Eurosport link added</p>
<hr />
<div>*[[Home Menu]]<br />
*[[3D Video]]<br />
*[[Activity Log]]<br />
*[[AR Games]]<br />
*[[Download Play]]<br />
*[[eShop]]<br />
*[[Face Raiders]]<br />
*[[Friend List]]<br />
*[[Game Notes]]<br />
*[[Health & Safety Information]]<br />
*[[Internet Browser]]<br />
*[[Mii Maker]]<br />
*[[Nintendo 3DS Camera]]<br />
*[[Nintendo 3DS Sound]]<br />
*[[Nintendo Zone]]<br />
*[[Notifications]]<br />
*[[SpotPass]]<br />
*[[StreetPass]]<br />
*[[StreetPass Mii Plaza]]<br />
*[[System Settings]]<br />
*[[System Transfer]]<br />
*[[Nintendo Video]]<br />
*[[Eurosport]]</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Nintendo_Software&diff=1806Nintendo Software2011-12-15T18:04:37Z<p>Duke srg: </p>
<hr />
<div>*[[Home Menu]]<br />
*[[3D Video]]<br />
*[[Activity Log]]<br />
*[[AR Games]]<br />
*[[Download Play]]<br />
*[[eShop]]<br />
*[[Face Raiders]]<br />
*[[Friend List]]<br />
*[[Game Notes]]<br />
*[[Health & Safety Information]]<br />
*[[Internet Browser]]<br />
*[[Mii Maker]]<br />
*[[Nintendo 3DS Camera]]<br />
*[[Nintendo 3DS Sound]]<br />
*[[Nintendo Zone]]<br />
*[[Notifications]]<br />
*[[SpotPass]]<br />
*[[StreetPass]]<br />
*[[StreetPass Mii Plaza]]<br />
*[[System Settings]]<br />
*[[System Transfer]]<br />
*[[Nintendo Video]]</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Nintendo_Software&diff=1805Nintendo Software2011-12-15T18:04:20Z<p>Duke srg: </p>
<hr />
<div>*[[Home Menu]]<br />
*[[3D Video]]<br />
*[[Activity Log]]<br />
*[[AR Games]]<br />
*[[Download Play]]<br />
*[[eShop]]<br />
*[[Face Raiders]]<br />
*[[Friend List]]<br />
*[[Game Notes]]<br />
*[[Health & Safety Information]]<br />
*[[Internet Browser]]<br />
*[[Mii Maker]]<br />
*[[Nintendo 3DS Camera]]<br />
*[[Nintendo 3DS Sound]]<br />
*[[Nintendo Zone]]<br />
*[[Notifications]]<br />
*[[SpotPass]]<br />
*[[StreetPass]]<br />
*[[StreetPass Mii Plaza]]<br />
*[[System Settings]]<br />
*[[System Transfer]]<br />
*[[Nintendo Video (and Eurosport)]]</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Nintendo_Video&diff=1804Nintendo Video2011-12-15T18:03:04Z<p>Duke srg: Eurosport information added</p>
<hr />
<div>'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DSes to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos even when the Nintendo Video app itself is not running.<br />
<br />
'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DSes to download and watch various videos offered by Eurosport. <br />
<br />
== Internet connection ==<br />
<br />
To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country and a language code. Here's a table containing country codes and subdomains known so far and corresponding file names:<br />
<br />
{| class="wikitable"<br />
|-<br />
! Country<br />
! Region subdomain<br />
! File name<br />
|-<br />
| EUR (Nintendo Video)<br />
| pubeu-p<br />
| ESP_MD<br />
|-<br />
| EUR (Eurosport)<br />
| pubes-p<br />
| EWP_MD<br />
|-<br />
| USA<br />
| pubus-p<br />
| ESE_MD<br />
|-<br />
| Japan<br />
| pubjp-p<br />
| ESJ_MD<br />
|}<br />
<br />
See http://www.wiibrew.org/wiki/Country_Codes for the country codes.<br />
<br />
Language codes known so far:<br />
{| class="wikitable"<br />
|-<br />
! Language<br />
! Code<br />
! Region<br />
|-<br />
| Japanese<br />
| 0<br />
| Japan<br />
|-<br />
| English<br />
| 1<br />
| EUR/USA<br />
|-<br />
| French<br />
| 2<br />
| EUR/USA<br />
|-<br />
| German<br />
| 3<br />
| EUR<br />
|-<br />
| Italian<br />
| 4<br />
| EUR<br />
|-<br />
| Spanish<br />
| 5<br />
| EUR/USA<br />
|-<br />
| Netherlands<br />
| 8<br />
| EUR<br />
|-<br />
| Portuguese<br />
| 9<br />
| EUR/USA<br />
|-<br />
| Russian<br />
| 10<br />
| EUR<br />
|}<br />
<br />
In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).<br />
<br />
Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "Connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by ''COUNTRYCODE'' and ''COUNTRYSUBDOMAIN'' and 404 means that everything's OK.<br />
<br />
If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):<br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''1 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''2 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''3 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
<br />
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''4 HTTP/1.1<br />
<br />
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt><br />
<br />
''FILENAMEi'' seems to return 403 if user's region doesn't match, 404 if ''i''th video doesn't exist and the video itself otherwise. As of 18th of July 2011, only 1st and 2nd videos are available from UK IP addresses.<br />
<br />
For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.<br />
<br />
These videos can easily be downloaded from any computer with IP address that matches country specified by ''COUNTRYCODE'', ''COUNTRYSUBDOMAIN'' and ''LANGUAGECODE'' using wget without any special settings. Videos are region-locked.<br />
<br />
== SD storage ==<br />
After downloading videos, Nintendo Video stores them on the SD card. Videos with the decrypted SpotPass payload are stored in [[Extdata]]. [https://gist.github.com/bef27e4a60cdb472c359 Metadata] is stored in cleartext in the decrypted extdata - the actual video might be encrypted(unknown), there's no magic number/fourcc in the decrypted extdata for the video. Region/country info is presumably stored in this metadata.<br />
<br />
Structure of the above metadata:(size is 0x1000-bytes)<br />
{| class="wikitable"<br />
|-<br />
! Offset<br />
! Length<br />
! Notes<br />
|-<br />
| 0x0<br />
| 4<br />
| Unknown, value is 0x18<br />
|-<br />
| 0x4<br />
| 0x14<br />
| ?<br />
|-<br />
| 0x18<br />
| 8<br />
| Big-endian titleID of Nintendo Video<br />
|-<br />
| 0x20<br />
| 0x38<br />
| Unknown, some countries' videos has two extra words added here?<br />
|-<br />
| 0x58<br />
| 0x20<br />
| ASCII Video ID? M<shortvidtitle>someid<br />
|-<br />
| 0x68<br />
| 0x20<br />
| ?<br />
|-<br />
| 0x88<br />
| 0x78<br />
| UCS-2 video title<br />
|-<br />
| 0x100<br />
| 0xc<br />
| ?<br />
|-<br />
| 0x10c<br />
| 0x190<br />
| UCS-2 video description<br />
|-<br />
| 0x29c<br />
| 0x20<br />
| Another ASCII video ID? I<shortvidtitle>someid<br />
|-<br />
| 0x2bc<br />
| 0xd44<br />
| ?<br />
|}<br />
<br />
== File format ==<br />
<br />
File format used for storing videos is not yet known either. Both videos that were available at 18th of July 2011 contained string "boss" in the first four bytes, which leads me to believe this is a [http://en.wikipedia.org/wiki/Magic_number_(programming)#Magic_numbers_in_files "magic number"] used to identify this type of file. This header and the crypto used for the payload following it is presumably the [[SpotPass]] content encapsulation format.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Offset<br />
! Length<br />
! <br />
|-<br />
| 0x0<br />
| 0x4<br />
| "boss"<br />
|-<br />
| 0x4<br />
| 0x4<br />
| Always 00 01 00 01<br />
|-<br />
| 0x8<br />
| 0x4<br />
| Big-endian filesize<br />
|-<br />
| 0xC<br />
| 0x4<br />
| Always 00 00 00 00<br />
|-<br />
| 0x10<br />
| 0x4<br />
| Release date (UNIX timestamp)<br />
|-<br />
| 0x14<br />
| 0x8<br />
| Always 00 01 00 00 00 02 00 02<br />
|}<br />
<br />
It appears that this file format is big-endian, unlike [[CXI]].<br />
<br />
Data following the header is encrypted, the CTR used is likely based on metadata in the header.(like the timestamp) Since [http://wiibrew.org/wiki/WiiConnect24/WC24_Content WC24] content was signed, it's likely SpotPass content is signed as well. The video codec used is unknown. Region info is stored the decrypted SpotPass crypto layer, see above SD section.<br />
<br />
== Server spoofing == <br />
<br />
In case you want to try messing with Nintendo Video, here's a description of what I did:<br />
<br />
# Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net [http://pastie.org/2230422 (bind config)].<br />
## Don't forget to replace MY_IP in config with your IP address, but '''don't''' replace the IP of conntest.nintendowifi.net service<br />
# Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.<br />
# Configured my 3DS to use my DNS server as both primary and secondary DNS server.<br />
# ???<br />
# PROFIT!<br />
<br />
== External links ==<br />
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]</div>Duke srghttps://www.3dbrew.org/w/index.php?title=Mii_Maker&diff=1373Mii Maker2011-10-09T21:46:00Z<p>Duke srg: QR code format description added</p>
<hr />
<div>'''Mii Maker''' lets you create Miis, like Wii Mii Channel. Here you can transfer Miis locally from other 3DSes, or from Wii Mii Channel. 3DS Miis can't be transfered to Wii Mii Channel, only from Wii.<br />
<br />
== Wii Mii Channel transfer protocol ==<br />
<br />
The Wii beacons are similar to the usual multi-cart NDS beacons, except: beacon_type is zero, and payload size is 0x14. The payload data is just the Wii UCS-2 nickname, with some extra unused zero data. The usual multi-cast NDS protocol is used for sending the 3DS nick to the Wii. After many keep-alive frames, it eventually sends a bunch of frames, each containing the whole Mii. There's a 6-byte header, followed by [http://wiibrew.org/wiki/Wiimote/Mii_Data Mii data]. At the end of these frames like most NDS frames is the 0200 byte marker.<br />
<br />
== Mii QR Code format ==<br />
<br />
3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to [http://www.denso-wave.com/qrcode Denso-Wave Inc] web site for QR Code format specifications). It contain 112 byte of binary data. 3DS seems to have fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code. The data itself is ciphered, algorithm is unknown yet.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Offset<br />
! Length<br />
! <br />
|-<br />
| 0x0<br />
| 0x4<br />
| unknown (MiiID ?)<br />
|-<br />
| 0x4<br />
| 0x4<br />
| High 4 octets of MAC address in clear text<br />
|-<br />
| 0x8<br />
| 0x10<br />
| unknown<br />
|-<br />
| 0x18<br />
| 0x1<br />
| Bit-mapped Sex, Birthday, ??<br />
|-<br />
| 0x19<br />
| 0x14<br />
| UTF-16 Mii Name<br />
|-<br />
| 0x2D<br />
| 0x2A<br />
| unknown<br />
|-<br />
| 0x47<br />
| 0x14<br />
| UTF-16 Author Name<br />
|-<br />
| 0x5B<br />
| 0x15<br />
| unknown<br />
|}</div>Duke srg