Changes

=0x10012000=

=0x10012000=

Keys seem to be stored here? Access to this region is disabled once Kernel9 crt0 writes 0x2 to [[CONFIG|REG_SYSPROT9]]. Before writing that bit, Kernel9 copies the low u32 for the TWL keydata to +0x100. On devunits([[CONFIG|UNITINFO]]!=0) Kernel9 uses the first 8-bytes from 0x10012000 for the TWL keydata.

Keys seem to be stored here? Access to this region is disabled once the ARM9 writes 0x2 to [[CONFIG|REG_SYSPROT9]]. Before writing that bit, the ARM9 copies the low u32 for the TWL keydata to +0x100(and high u32 keydata to +0x104 with New3DS). On devunits([[CONFIG|UNITINFO]]!=0) ARM9 uses the first 8-bytes from 0x10012000 for the TWL keydata.

This region is also used by the [[New_3DS]] FIRM loader at the end of the [[FIRM]] ARM9 binary.

Originally the above TWL keyinit + region disable was done by Kernel9. However, with the [[New_3DS]] FIRM ARM9 binary this is now done in the [[FIRM]] ARM9 binary loader, which also uses the 0x10012000 region for key generation.