Difference between revisions of "System Transfer"

From 3dbrew
Jump to navigation Jump to search
m
 
(16 intermediate revisions by 3 users not shown)
Line 1: Line 1:
−
'''System Transfer''' is functionality that will be added with the [[2.0.0-2]] June 6/7 2011 system update, which allows you to transfer DSiWare, recorded audio from the Nintendo DSi Sound title, "internal memory" pictures, some wifi data(?), from DSi to 3DS. On DSi this is done with a System Transfer app that would be downloaded from DSi Shop, while on 3DS System Transfer is accessible in the [[System Settings]]. System Transfer can also be used to transfer 3DSWare to other 3DS systems.
+
'''System Transfer''' is functionality that was added with the [[2.0.0-2]] June 6/7 2011 system update, which allows you to transfer DSiWare, recorded audio from the Nintendo DSi Sound title, "internal memory" pictures, WFC configuration, from DSi to 3DS. On DSi this is done with the "Nintendo 3DS Transfer Tool" that is downloaded from DSi Shop, while on 3DS System Transfer is accessible in the [[System Settings]]. System Transfer can also be used to transfer 3DSWare to other 3DS systems.
  
−
== DSi System Transfer ==
+
= DSi System Transfer =
  
−
With the DSiWare DSi->3DS transfer, savegames are not transferred. This likely blocks DSiWareHax usage on 3DS entirely.
+
With the DSiWare DSi->3DS transfer, savegames are not transferred.
−
Actual protocol info etc is unknown currently since the update isn't released yet, but presumably when transferring DSiWare only the ticket would be transferred and the 3DS would download the latest title from NUS.
+
When transferring DSiWare, the DSi system transfer title will send a SOAP request to the DSi Shop server, this transfers the DSiWare license/ticket to the 3DS shop account. The DSi title will then delete the ticket from NAND. The 3DS will then download the ticket, tmd, and content immediately from shop/CDN.
  
−
== See also ==
+
The 3DS broadcasts beacons with Nintendo tag vendor 0009bf. This includes the 3DS user-name, and possibly some consoleID? The DSi authenticates/associates with some binary SSID. The rest uses cleartext ntr/twl multi-cast communications, a lot of keep-alive frames are sent.
 +
 
 +
The DSi will then send its country code, username, and serial number to the 3DS, 3DS will send its country-code/username/serial# to DSi as well.
 +
The DSi sends a list of owned titles to the 3DS. The 3DS then seems to query the shop server via SOAP to check which titles may be transferred, it then replies to the DSi with a list of titles(of the titles which were sent to it) that can be transferred. When the user selects which title to transfer, DSi sends the banner of that title to the 3DS and many frames later the titleID.
 +
 
 +
When the DSi transfer tool and 3DS transfer tool startup, the DSi sends HTTPS SOAP requests to ecs.t.nintendowifi.net, ias.t.nintendowifi.net, and cas.t.nintendowifi.net. The 3DS sends HTTPS (mostly SOAP, unknown why the first one is used) requests to nus.c.nintendowifi.net, ecs.c.nintendowifi.net, and cas.c.nintendowifi.net. When entering the transfer DSiWare list menu, DSi requests from ecs* and cas*, 3DS does likewise. The 3DS system transfer will not allow you(likely server-side or so) to transfer etc at all unless you have the latest system update.
 +
 
 +
When DSi sends the title list, after the first 6 bytes of the 802.11 data payload, is the below header. Following the header is the list of titles.
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Length
 +
! Notes
 +
|-
 +
| 0x0
 +
| 0x4
 +
| Always zero?
 +
|-
 +
| 0x0
 +
| 0x4
 +
| ?
 +
|-
 +
| 0x8
 +
| 0x4
 +
| Total titles?
 +
|-
 +
| 0xc
 +
| 0x1
 +
| Filler
 +
|-
 +
| 0xd
 +
| 0x48
 +
| All 0xFF bytes.
 +
|}
 +
 
 +
3DS title list header:
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Length
 +
! Notes
 +
|-
 +
| 0x0
 +
| 0x4
 +
| ?
 +
|-
 +
| 0x4
 +
| 0x4
 +
| Usually zero?
 +
|-
 +
| 0x8
 +
| 0x4
 +
| ?
 +
|-
 +
| 0xc
 +
| 0x4
 +
| Total titles?
 +
|-
 +
| 0x10
 +
| 0x4
 +
| ?
 +
|-
 +
| 0x14
 +
| 0x4
 +
| ?
 +
|-
 +
| 0x18
 +
| 0xf
 +
| 3DS serial number
 +
|-
 +
| 0x27
 +
| 0x11
 +
| Bytes alternates between 0xbd and 0xf7: first byte is 0xbd, second is 0xf7, third is 0xbd etc.
 +
|-
 +
| 0x28
 +
| 0x8
 +
| Unknown, ASCII 3DS ticket consoleID used with DSi Shop SOAPs for the DeviceId?(Unconfirmed)
 +
|-
 +
| 0x30
 +
| 0x18
 +
| Always zero?
 +
|}
 +
 
 +
=== Title record from DSi and 3DS ===
 +
 
 +
Total record size is 0x128 bytes.
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Length
 +
! Notes
 +
|-
 +
| 0x0
 +
| 0x8
 +
| TitleID
 +
|-
 +
| 0x8
 +
| 0x8
 +
| Little-endian ticketID
 +
|-
 +
| 0x10
 +
| 0x4
 +
| Usually zero?
 +
|-
 +
| 0x14
 +
| 0x4
 +
| Usually one?
 +
|-
 +
| 0x18
 +
| 0x4
 +
| Some ID?
 +
|-
 +
| 0x1c
 +
| 0x4
 +
| Usually zero?
 +
|-
 +
| 0x20
 +
| ?
 +
| Sometimes the title name is stored here?
 +
|}
 +
 
 +
= 3DS System Transfer =
 +
 
 +
 
 +
3DS System Transfer is now available since 3.0.0-5.
 +
It seems to unlock out of region eShop on the source 3DS (tested on old, not tested on new).
 +
See also [http://www.nintendo.com/consumer/systems/3ds/en_na/gi_index.jsp?menu=transfer&submenu=ctr-gi-apps-transfer-what-data 3DS System transfer ]
 +
 
 +
==System Save Data Transfer==
 +
During a system transfer, the source system transfers raw ([[DISA_and_DIFF|DISA]]) [[System_SaveData|System Save Data]] images (AES-128-CTR encrypted) to the destination system.
 +
 
 +
It appears that both the save data for the [[NIM_Services|nim]] sysmodule and the [[Config_Savegame|Configuration Savegame]] are skipped during this process.
 +
 
 +
The source system first begins by using [[FS:StartDeviceMoveAsSource]] to generate a [[Filesystem_services#DeviceMoveContext|Device Move Context]].
 +
 
 +
It then uses [[FS:EnumerateSystemSaveData]] to obtain a list of system save data IDs.
 +
 
 +
The source system then creates the encrypted, raw system save data dumps using [[Filesystem_services#0x12345681_Archive_Path_Data_Format|archive ID 0x12345681]].
 +
 
 +
The following encryption is used for these dumps:
 +
 
 +
- AES [[AES_Registers#Keyslots|Keyslot 0x20]] is used for the key.
 +
 
 +
- For the CTR, first, the random 16 bytes from the [[Filesystem_services#DeviceMoveContext|Device Move Context]] are hashed with SHA256.
 +
 
 +
- The SHA256 hash is updated using the UTF-16 path for the save data file (relative to <code>nand:/data/<ID0></code>), beginning with a </code>/</code> (and including a two-byte NULL termination). Therefore the path would be UTF-16 <code>/sysdata/<lowercase, 8 character hex system save id>/00000000</code> and two additional NULL bytes.
 +
 
 +
- The CTR is generated as follows: <code>ctr[i] = hash[i] ^ hash[i + 16]</code> for i from 0 to 16.
 +
 
 +
The entire [[DISA_and_DIFF|DISA]] save image for each system save is encrypted.
 +
 
 +
On the destination system, [[FS:StartDeviceMoveAsDestination]] is called using the [[Filesystem_services#DeviceMoveContext|Device Move Context]] from the source console.
 +
 
 +
Similarly, [[Filesystem_services#0x12345681_Archive_Path_Data_Format|archive ID 0x12345681]] is used to import the raw save images, though on the destination system, in write mode.
 +
 
 +
The encrypted save images are written directly to the destination system using the FS interface (and decrypted on the fly).
 +
 
 +
 
 +
= See also =
 
Nintendo of Japan System Transfer [http://www.nintendo.co.jp/3ds/support/transfer/index.html page].
 
Nintendo of Japan System Transfer [http://www.nintendo.co.jp/3ds/support/transfer/index.html page].

Latest revision as of 13:31, 22 December 2024

System Transfer is functionality that was added with the 2.0.0-2 June 6/7 2011 system update, which allows you to transfer DSiWare, recorded audio from the Nintendo DSi Sound title, "internal memory" pictures, WFC configuration, from DSi to 3DS. On DSi this is done with the "Nintendo 3DS Transfer Tool" that is downloaded from DSi Shop, while on 3DS System Transfer is accessible in the System Settings. System Transfer can also be used to transfer 3DSWare to other 3DS systems.

DSi System Transfer[edit]

With the DSiWare DSi->3DS transfer, savegames are not transferred. When transferring DSiWare, the DSi system transfer title will send a SOAP request to the DSi Shop server, this transfers the DSiWare license/ticket to the 3DS shop account. The DSi title will then delete the ticket from NAND. The 3DS will then download the ticket, tmd, and content immediately from shop/CDN.

The 3DS broadcasts beacons with Nintendo tag vendor 0009bf. This includes the 3DS user-name, and possibly some consoleID? The DSi authenticates/associates with some binary SSID. The rest uses cleartext ntr/twl multi-cast communications, a lot of keep-alive frames are sent.

The DSi will then send its country code, username, and serial number to the 3DS, 3DS will send its country-code/username/serial# to DSi as well. The DSi sends a list of owned titles to the 3DS. The 3DS then seems to query the shop server via SOAP to check which titles may be transferred, it then replies to the DSi with a list of titles(of the titles which were sent to it) that can be transferred. When the user selects which title to transfer, DSi sends the banner of that title to the 3DS and many frames later the titleID.

When the DSi transfer tool and 3DS transfer tool startup, the DSi sends HTTPS SOAP requests to ecs.t.nintendowifi.net, ias.t.nintendowifi.net, and cas.t.nintendowifi.net. The 3DS sends HTTPS (mostly SOAP, unknown why the first one is used) requests to nus.c.nintendowifi.net, ecs.c.nintendowifi.net, and cas.c.nintendowifi.net. When entering the transfer DSiWare list menu, DSi requests from ecs* and cas*, 3DS does likewise. The 3DS system transfer will not allow you(likely server-side or so) to transfer etc at all unless you have the latest system update.

When DSi sends the title list, after the first 6 bytes of the 802.11 data payload, is the below header. Following the header is the list of titles.

Offset Length Notes
0x0 0x4 Always zero?
0x0 0x4 ?
0x8 0x4 Total titles?
0xc 0x1 Filler
0xd 0x48 All 0xFF bytes.

3DS title list header:

Offset Length Notes
0x0 0x4 ?
0x4 0x4 Usually zero?
0x8 0x4 ?
0xc 0x4 Total titles?
0x10 0x4 ?
0x14 0x4 ?
0x18 0xf 3DS serial number
0x27 0x11 Bytes alternates between 0xbd and 0xf7: first byte is 0xbd, second is 0xf7, third is 0xbd etc.
0x28 0x8 Unknown, ASCII 3DS ticket consoleID used with DSi Shop SOAPs for the DeviceId?(Unconfirmed)
0x30 0x18 Always zero?

Title record from DSi and 3DS[edit]

Total record size is 0x128 bytes.

Offset Length Notes
0x0 0x8 TitleID
0x8 0x8 Little-endian ticketID
0x10 0x4 Usually zero?
0x14 0x4 Usually one?
0x18 0x4 Some ID?
0x1c 0x4 Usually zero?
0x20 ? Sometimes the title name is stored here?

3DS System Transfer[edit]

3DS System Transfer is now available since 3.0.0-5. It seems to unlock out of region eShop on the source 3DS (tested on old, not tested on new). See also 3DS System transfer

System Save Data Transfer[edit]

During a system transfer, the source system transfers raw (DISA) System Save Data images (AES-128-CTR encrypted) to the destination system.

It appears that both the save data for the nim sysmodule and the Configuration Savegame are skipped during this process.

The source system first begins by using FS:StartDeviceMoveAsSource to generate a Device Move Context.

It then uses FS:EnumerateSystemSaveData to obtain a list of system save data IDs.

The source system then creates the encrypted, raw system save data dumps using archive ID 0x12345681.

The following encryption is used for these dumps:

- AES Keyslot 0x20 is used for the key.

- For the CTR, first, the random 16 bytes from the Device Move Context are hashed with SHA256.

- The SHA256 hash is updated using the UTF-16 path for the save data file (relative to nand:/data/<ID0>), beginning with a / (and including a two-byte NULL termination). Therefore the path would be UTF-16 /sysdata/<lowercase, 8 character hex system save id>/00000000 and two additional NULL bytes.

- The CTR is generated as follows: ctr[i] = hash[i] ^ hash[i + 16] for i from 0 to 16.

The entire DISA save image for each system save is encrypted.

On the destination system, FS:StartDeviceMoveAsDestination is called using the Device Move Context from the source console.

Similarly, archive ID 0x12345681 is used to import the raw save images, though on the destination system, in write mode.

The encrypted save images are written directly to the destination system using the FS interface (and decrypted on the fly).


See also[edit]

Nintendo of Japan System Transfer page.

Retrieved from "https://www.3dbrew.org/w/index.php?title=System_Transfer&oldid=22988"