Difference between revisions of "Flash Filesystem"

From 3dbrew
Jump to navigation Jump to search
Line 59: Line 59:
 
=CTR partition=
 
=CTR partition=
 
The structure of [[nand/title]] appears to be exactly the same as [[SD Filesystem|SD]], except savegames are stored under the [[System SaveData|nand/data/<ID0>/sysdata]] directory instead.
 
The structure of [[nand/title]] appears to be exactly the same as [[SD Filesystem|SD]], except savegames are stored under the [[System SaveData|nand/data/<ID0>/sysdata]] directory instead.
The sub-directory name under [[nand/data]] is the SHA256 hash over the [[nand/private/movable.sed|movable.sed]] keyY, except for this dirname each hex u32 is byte-swapped. This nand/data/<ID0> directory is the NAND equivalent of the "sdmc/Nintendo 3DS/<ID0>/<ID1>" directory, however the data contained here is stored in cleartext. The nand/data/<ID0>/extdata directory contains the shared [[extdata]], and is structured exactly the same way as SD extdata. (ID0 is the first 0x10-bytes from a SHA256 [[nand/private/movable.sed|hash]])
+
The sub-directory name under [[nand/data]] is the SHA256 hash over the [[nand/private/movable.sed|movable.sed]] keyY, except for this dirname each hex u32 is byte-swapped. This nand/data/<ID0> directory is the NAND equivalent of the "sdmc/Nintendo 3DS/<ID0>/<ID1>" directory, however the data contained here is stored in cleartext. Movable.sed is only used for AES MACs for nand/data/<ID0>. The nand/data/<ID0>/extdata directory contains the shared [[extdata]], and is structured exactly the same way as SD extdata. (ID0 is the first 0x10-bytes from a SHA256 [[nand/private/movable.sed|hash]])
  
 
The "nandrw" [[FS:OpenArchive|archive]] is mounted at "nand:/rw/", while the "nandro" archive is mounted at "nand:/ro/".
 
The "nandrw" [[FS:OpenArchive|archive]] is mounted at "nand:/rw/", while the "nandro" archive is mounted at "nand:/ro/".
Line 92: Line 92:
 
  ├── [[Title Data Structure|title]]
 
  ├── [[Title Data Structure|title]]
 
  └── [[nand/tmp|tmp]]
 
  └── [[nand/tmp|tmp]]
 
  
 
=TWL partition=
 
=TWL partition=

Revision as of 19:48, 2 January 2013

The Nintendo 3DS has a 1GB NAND Flash chip.

Format

Reading of the flash chip is possible through pinouts on the motherboard and has been performed successfully but the data is encrypted and can't be understood without first decrypting it.

Encryption

The NAND file system is encrypted using AES-CTR. The TWL regions of NAND use the TWL NAND keyslot, while the CTR regions use the CTR NAND keyslots. The keyslot used for CTR-NAND partitions is determined by the NCSD partition FS type. The TWL/CTR NAND regions are specified by the NCSD header. The first 0x0B100000 bytes of NAND is encrypted with the TWL keyslot, however before 0x00012E00 only the MBR partition table is encrypted with the TWL keyslot. That region contains the TWL partitions listed below.

Partitions

Name Offset Size Description
twln 0x00012E00 0x08FB5200 TWL-NAND FAT16 File System. (DSi)
twlp 0x09011A00 0x020B6600 TWL-NAND PHOTO FAT12 File System. (DSi)
0x0B100000 0x00030000 Usually all-zero in the image.
firm0 0x0B130000 0x00400000 Firmware partition.
firm1 0x0B530000 0x00400000 Firmware partition.(Backup partition, same as above)
0x0B930000 0x2F5D0000 CTR-NAND partition. (3DS)
nand 0x0B95CA00 0x2F3E3600 CTR-NAND FAT16 File System.

3DS TWL NAND FAT partitions has FAT volume name "TWL", for CTR FAT partitions this is "CTR". The offset/size for TWL partitions are stored in the MBR partition table, while the CTR partition table info is stored in the NAND NCSD header. Sector0 in the CTR-NAND partition contains a MBR partition table, and the MBR signature at +0x1fe. The single partition defined by this partition table is the CTR-NAND FAT16 partition.

None of the above physical NAND partitions are normally accessible from the ARM11, except for twlp. CTR/TWL NAND FS can only be accessed when the exheader access control descriptor for those are enabled. Normally the CTR/TWL NAND descriptors are never enabled for retail ARM11 CXI processes. The ARM11 can only access "nand:/rw/" mounted as the nandrw archive, and "nand:/ro/" mounted as the nandro archive below.

CTR partition

The structure of nand/title appears to be exactly the same as SD, except savegames are stored under the nand/data/<ID0>/sysdata directory instead. The sub-directory name under nand/data is the SHA256 hash over the movable.sed keyY, except for this dirname each hex u32 is byte-swapped. This nand/data/<ID0> directory is the NAND equivalent of the "sdmc/Nintendo 3DS/<ID0>/<ID1>" directory, however the data contained here is stored in cleartext. Movable.sed is only used for AES MACs for nand/data/<ID0>. The nand/data/<ID0>/extdata directory contains the shared extdata, and is structured exactly the same way as SD extdata. (ID0 is the first 0x10-bytes from a SHA256 hash)

The "nandrw" archive is mounted at "nand:/rw/", while the "nandro" archive is mounted at "nand:/ro/".

nandro
├── private
├── shared
└── sys
    ├── HWCAL0.dat
    └── HWCAL1.dat
nandrw
├── shared
└── sys
    ├── LocalFriendCodeSeed_B
    ├── native.log
    ├── rand_seed
    ├── SecureInfo_A
    └── updater.log
nand
├── __journal.nn_
├── data
│   └── <ID0>
│       ├── extdata          
│       └── sysdata (NAND savegames are stored at "<SaveID-Low>/<SaveID-High>" under this directory, where the high is the filename)
├── dbs
├── private
│   └── movable.sed
├── ro
├── rw
├── ticket
├── title
└── tmp

TWL partition

The structure of these TWL partitions is mostly the same as DSi, except tickets are stored in the CTR FAT FS. The twlp partition is exactly the same as DSi. The structure of twln/title is exactly the same as CTR NAND/SD, except the .cmd file is a cleartext file.(This is likely a dummy file) The data directory under system titles' /title directory does not exist, this likely only exists for DSiWare. The directory names titleID-High used under twln/title is from DSi.

twln
├── import
├── log
│   ├── inspect.log
│   └── product.log
├── shared1
├── shared2
│   └── 0000
├── sys
│   └── TWLFontTable.dat
├── ticket
├── title
└── tmp
twlp
└── photo