Difference between revisions of "Titles"

From 3dbrew
Jump to navigation Jump to search
m
(→‎Data Structure: update DLC NCCH separation information)
 
(37 intermediate revisions by 8 users not shown)
Line 1: Line 1:
−
[[Title list|Titles]] installed to the 3DS are installed to either the NAND(System and Application) or SD Card(Application only), and their respective directory locations are:
+
The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located  [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ here].
  
−
'''[[Flash Filesystem|NAND]]:'''
+
For a list of 3DS titles see the [[Title list]].                         
−
* nand/title - Title Data
+
                   
−
* nand/data/<ID0>/sysdata - Save Data
+
= Title IDs =
 +
 
 +
The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.
 +
 
 +
Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.
 +
 
 +
 
 +
'''TitleID Structure''': 0xCCCCABCDLLLLLLRR
 +
 
 +
* CCCC defines the console '''Platform''' (5=WiiU, 4=3DS, 3=DSi, 1=[http://wiibrew.org/wiki/Title_database Wii])
 +
* ABCD defines the '''Content Category''' of the title, Demo, DLPChild, etc.
 +
* LLLLLL For CTR titles, this is the title's '''Unique ID'''. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.
 +
* RR This is the Title ID '''Variation''', and has various uses.
 +
 +
 
 +
'''Content Categories''':
 +
 
 +
This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.
 +
 
 +
Specific Bitmask Flags:
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Category
 +
!  Bitmask
 +
|-
 +
|  Normal
 +
|  0x0
 +
|-
 +
|  DlpChild
 +
|  0x1
 +
|-
 +
|  Demo
 +
|  0x2
 +
|-
 +
|  Contents
 +
|  0x3
 +
|-
 +
|  AddOnContents
 +
|  0x4
 +
|-
 +
|  Patch
 +
|  0x6
 +
|-
 +
|  CannotExecution
 +
|  0x8
 +
|-
 +
|  System
 +
|  0x10
 +
|-
 +
|  RequireBatchUpdate
 +
|  0x20
 +
|-
 +
|  NotRequireUserApproval
 +
|  0x40
 +
|-
 +
|  NotRequireRightForMount
 +
|  0x80
 +
|-
 +
|  CanSkipConvertJumpId
 +
|  0x100
 +
|-
 +
|  TWL
 +
|  0x8000
 +
|}
 +
 
 +
* TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.
 +
 
 +
* System titles (TWL and CTR) are eligible to be updated during a System Update.
 +
 
 +
* Bit Mask 0x4000 appears to be reserved, as it renders the ''TWL'' and ''System'' bit masks useless.
 +
 
 +
'''Unique ID Restrictions''':
 +
 
 +
For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes.
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
!  TITLE TYPE
 +
!  UNIQUE ID RANGE
 +
|-
 +
|  System
 +
|  0x0 - 0x2FF
 +
|-
 +
|  Application
 +
|  0x300 - 0xF7FFF
 +
|-
 +
|  Evaluation
 +
|  0xF8000 - 0xFEFFF (?)
 +
|-
 +
|  Prototype*
 +
|  0xFF000 - 0xFF3FF
 +
|-
 +
|  Developer
 +
|  0xFF400 - 0xFF7FF (?)
 +
|}
 +
<nowiki>*</nowiki>On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.
 +
 
 +
ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on [[New_3DS]](that is, programID-low 0x20000000 / uniqueID 0x200000).
 +
 
 +
'''TitleID Variation''':
 +
 
 +
This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:
 +
 
 +
* CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:
 +
{| class="wikitable" border="1"
 +
|-
 +
!  RR
 +
!  MEANING
 +
|-
 +
|  02
 +
|  System Title (Core version 0x2)
 +
|-
 +
|  03
 +
|  SAFE_MODE System Title (Core version 0x3)
 +
|}
 +
Normally on retail SAFE_MODE ARM11 [[NCCH#CXI|CXI]] titles can't be launched, since the [[Configuration_Memory|system]] core version doesn't match the CXI exheader core version.
 +
 
 +
* Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.
 +
 
 +
* [[3DS Development Unit Software|Dev Menu]] installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.
 +
 
 +
* Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:
 +
 
 +
= Versions =
 +
 
 +
v## = 0xHHHH = 0bBBBBBBBB...
 +
 
 +
* The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary
 +
* 6 bits : Major, this matches the NCCH remaster-version.
 +
* 6 bits : Minor
 +
* 4 bits : Micro ('Build' in some contexts)
 +
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.
 +
 
 +
= Data Structure =
  
−
'''[[SD Filesystem|SD Card]]:'''
+
Titles are installed to either the NAND (System and Application) or to the SD Card (Application only), and their respective directory locations are:
−
* sdmc/Nintendo 3DS/<ID0>/<ID1>/title - Title Data/Save Data
+
 
 +
{| class="wikitable" border="1" style="margin: auto;"
 +
|-
 +
|
 +
! scope="col"| [[Flash Filesystem|NAND]]
 +
! scope="col"| [[SD Filesystem|SD]]
 +
|-
 +
! scope="row"| Title Data
 +
| nand/title
 +
| rowspan="2" | sdmc/Nintendo 3DS/<ID0>/<ID1>/title
 +
|-
 +
! scope="row"| Save Data
 +
| nand/data/<ID0>/sysdata
 +
|-
 +
|}
  
−
ID0 is the first 0x10-bytes from a SHA256 [[nand/private/movable.sed|hash]].
+
ID0 is the first 0x10-bytes from a SHA256 [[nand/private/movable.sed|hash]] and ID1 is generated from the SD card CID.
  
−
Note: While all title data found on the SD Card is encrypted with the console-unique [[nand/private/movable.sed|keyslots]], it is not known whether title data on the NAND has additional encryption.
+
Title data stored on the SD Card is encrypted with the console-unique [[nand/private/movable.sed|keyslots]], whereas NAND title data is stored as cleartext.
  
 
The base CTR for files stored under /title is likely based on the /title path, similar to extdata. This base CTR is unique per titleID and filename. The base CTR never changes after creation of each file.
 
The base CTR for files stored under /title is likely based on the /title path, similar to extdata. This base CTR is unique per titleID and filename. The base CTR never changes after creation of each file.
  
−
And the title data is contained in this directory structure:
+
When a newer version of a title is installed, the new .app content, .tmd, and .cmd(and .ctx for NAND titles) are written to the /title directory, however the old files here are not yet deleted. Once installation of the title is [[AMNet:InstallTitlesFinish|finalized]], the info from [[Title_Database|import.db]] is moved to [[Title_Database|title.db]] so that the system uses the newer files instead, then the old /title files are deleted.
 +
 
 +
The title data is contained in this directory structure (note that [[Title list#0004008C - Add-on Content (DLC)|DLC]] titles are stored in a different way):
  
−
'''NAND Directory Structure''':
+
{| class="wikitable" border="1" style="margin: auto;"
−
Title Data:
+
!
−
+
! scope="col"| NAND
 +
! scope="col"| SD (non-DLC)
 +
! scope="col"| SD (DLC)
 +
|-
 +
! scope="row"| Title Data:
 +
|
 
  <Title ID High>
 
  <Title ID High>
 
  └── <Title ID Low>
 
  └── <Title ID Low>
Line 24: Line 178:
 
     └── content
 
     └── content
 
         ├── <ContentID>.app
 
         ├── <ContentID>.app
−
         ├── XXXXXXXX.tmd
+
         ├── <ContentID>.tmd
 
         └── cmd
 
         └── cmd
−
             └── XXXXXXXX.cmd
+
             └── <ContentID>.cmd
−
+
| rowspan="2" |
−
Save Data:
 
−
 
−
<SaveID0>
 
−
└── <SaveID1>
 
−
    └── 00000001.sav
 
−
 
 
−
'''SD Card Directory Structure''':
 
−
Title Data/Save Data:
 
−
 
 
  <Title ID High>
 
  <Title ID High>
 
  └── <Title ID Low>
 
  └── <Title ID Low>
Line 42: Line 187:
 
     ├── content
 
     ├── content
 
     │  ├── <ContentID>.app
 
     │  ├── <ContentID>.app
−
     │  ├── XXXXXXXX.tmd
+
     │  ├── <ContentID>.tmd
 
     │  └── cmd
 
     │  └── cmd
−
     │      └── XXXXXXXX.cmd
+
     │      └── <ContentID>.cmd
 
     └── data
 
     └── data
 
         └── 00000001.sav
 
         └── 00000001.sav
−
 
+
| rowspan="2" |
−
The structure differs for [[Title list#0004008C - Add-on Content (DLC)|DLC]] Titles:
 
−
 
 
 
  0004008C
 
  0004008C
 
  └── <Title ID Low>
 
  └── <Title ID Low>
 
     ├── 00000000.ctx
 
     ├── 00000000.ctx
 
     └── content
 
     └── content
−
         ├── XXXXXXXX.tmd
+
         ├── <ContentID>.tmd
−
         ├── XXXXXXXX
+
         ├── <IndexSeparator>
 
         │  └── <ContentID>.app
 
         │  └── <ContentID>.app
 
         └── cmd
 
         └── cmd
−
             └── XXXXXXXX.cmd
+
             └── <ContentID>.cmd
−
   
+
 
−
For a list of 3DS titles see the [[Title list]].                          
+
|-
−
                   
+
! scope="row"|  Save Data:
−
"'''XXXXXXXX.tmd'''" - (file name starts with 00000000.tmd and increases with an increment of "1" for each title version the 3DS is introduced to) This is the Title Metadata associated with the title, it is encrypted with a console-unique [[AES|keyslot]]. The decrypted TMD is available on Nintendo's CDN server at "http://nus.cdn.c.shop.nintendowifi.net/ccs/download/TitleIDhere/tmd". Though CDN version of the title TMD has a certificate chain attached at the end of the TMD, so removing it will give you the 1:1 decrypted TMD. After installation the "00000000.tmd" is redundant, because important title data is extracted and imported into the [[Title Database|title.db]] and ".cmd" files.
+
|
 +
<SaveID0>
 +
└── <SaveID1>
 +
    └── 00000001.sav
 +
|}
 +
 
 +
"'''<ContentID>.tmd'''" - (The Content ID is a u32, initially: '''00000000''' when the title is first installed. Changing by an increment of +'''0x1''' for each title update the 3DS installs) This is the [[Title metadata]] associated with the title. The decrypted TMD is available on Nintendo's CDN server at "http://nus.cdn.c.shop.nintendowifi.net/ccs/download/TitleIDhere/tmd.OptionallyTitleVersionHere". Though CDN version of the title TMD has a certificate chain attached at the end of the TMD, so removing it will give you the 1:1 decrypted TMD. After installation the "<ContentID>.tmd" is redundant, because important title data is extracted and imported into the [[Title Database|title.db]] and ".cmd" files, but is however kept as a reference.
  
  
−
"'''<ContentID>.app'''" - (The names for these files are taken from the title's [[TMD]]) These files are [[NCCH]] files, where the entire file is encrypted with a console-unique [[AES|keyslot]](this is on top of the encryption of the NCCH contents). There can be more than one NCCH in this directory, as seen with .[[CCI]] files, the game executable ([[CXI]]) can be accompanied with additional non-executable NCCH files ([[NCCH#CFA|CFA]]) such as the electronic manual and DLP Child containers. Determining the function of the encrypted NCCH, is done by finding the Content Index of the "XXXXXXXX.app" file in the title's TMD(see above for retrieving decrypted TMD), interpreting the Content Index is as follows*:
+
"'''<ContentID>.app'''" - (The Content ID is a u32, taken from the title's [[TMD]]) These files are [[NCCH]] files. There can be more than one NCCH in this directory, as seen with .[[CCI]] files, the game executable ([[CXI]]) can be accompanied with additional non-executable NCCH files ([[NCCH#CFA|CFA]]) such as the electronic manual and DLP Child containers. Determining the function of the NCCH, is done by finding the Content Index of the "XXXXXXXX.app" file in the title's TMD(see above for retrieving decrypted TMD), interpreting the Content Index is as follows (does not apply to DLC content):
  
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
Line 81: Line 230:
 
|  DLP Child Container (.[[NCCH#CFA|CFA]])
 
|  DLP Child Container (.[[NCCH#CFA|CFA]])
 
|}
 
|}
−
*The above table does not apply to DLC content.
 
  
−
Unlike the TMD, a decrypted version of the NCCH files cannot be retrieved from Nintendo's CDN, the NCCH files do exist on Nintendo's CDN but are encrypted. Of course editing/deleting ".app" files will have an effect. Deleting/renaming the manual ".app' will cause the manual not to load when clicked on. And deleting/renaming the executable ".app" will cause the application to not load, and the 3D Banner does not show(The banner is loaded each time from the game's executable NCCH when the home menu loads, it is not cached like the icon and name).
+
Unlike the TMD, a decrypted version of the NCCH files cannot be retrieved from Nintendo's CDN, the NCCH files do exist on Nintendo's CDN but are [[AES|encrypted]]. Decrypting CDN versions of content, requires the title's [[CommonETicket|ticket]], and the common key specified by an index in the  [[CommonETicket|ticket]]. Of course editing/deleting ".app" files will have an effect. Deleting/renaming the manual ".app' will cause the manual not to load when clicked on. And deleting/renaming the executable ".app" will cause the application to not load, and the 3D Banner does not show(The banner is loaded each time from the game's executable NCCH when the home menu loads, it is not cached like the icon and name).
 +
 
  
 +
"'''<ContentID>.cmd'''" - (The Content ID is a u32, initially: '''00000001''' when the title is first installed. Changing by an increment of +'''0x1''' for each time the 3DS adds/removes '.app' files) This file contains data taken from the title's [[TMD]]. See the below table for the format of the cleartext .cmd file. The [[Title Database|Title.db]] contains the Content ID for the '.cmd' file, but does not contain a hash of the '.cmd' file. This acts as part of the DRM for installed titles, along with the [[Title Database|title.db]].
  
−
"'''XXXXXXXX.cmd'''" - (file name starts with 00000001.cmd and increases with an increment of "1" for each title version the 3DS is introduced to) This file contains data taken from the title's [[TMD]] during install. See the below table for the format of the cleartext .cmd file. [[Title Database|Title.db]] likely contains a hash over this .cmd file, title.db also likely contains the ID for the .cmd filename. In addition it is also encrypted with a console-unique [[AES|keyslot]]. This acts as part of the DRM for installed titles, along with the [[Title Database|title.db]].
+
The below AES-CMACs(including the last 0x10-bytes of the header) are only used for SD titles, for NAND [[Title_list|download-play]] titles, and non-system DSiWare titles. For other titles, these MACs are set to all-zero.
  
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
Line 95: Line 245:
 
|-
 
|-
 
| 0x0
 
| 0x0
−
| 0x20
+
| 0x4
−
| Header, for TWL .cmd the first 3 words are value 1, the rest of the header is all-zero.
+
| .cmd ContentID, for the .cmd filename. This is the beginning of the header.
 
|-
 
|-
−
| 0x20
+
| 0x4
−
| 0x18
+
| 0x4
−
| Entries for each content begin here with size 0x18 for each entry, entry size is 0x8 for TWL.
+
| Number of AES-CMACs and Content IDs in the first list (X). The method to determine this is explained below.
−
|}
 
−
 
 
−
Entries format:
 
−
{| class="wikitable" border="1"
 
 
|-
 
|-
−
!  Start
+
| 0x8
−
!  Size
 
−
!  Description
 
−
|-
 
−
| 0x0
 
 
| 0x4
 
| 0x4
−
| Unknown, zero for TWL
+
| Number of Content IDs in the second list (Y)
 
|-
 
|-
 +
| 0xC
 
| 0x4
 
| 0x4
−
| 0x8
+
| Unknown, usually (always?) 1.
−
| Unknown, zero for TWL
 
 
|-
 
|-
−
| 0x8
 
 
| 0x10
 
| 0x10
−
| AES-CBC MAC over data in the NCCH content?
+
| 0x10
 +
| AES-CMAC over first 0x10
 +
|-
 +
| 0x20
 +
| 0x4 * X
 +
| List of installed Content IDs in order of Content Index, with missing contents replaced with 0xFFFFFFFF
 +
|-
 +
| 0x20 + 0x4 * X
 +
| 0x4 * Y
 +
| List of installed Content IDs in order of ID name
 +
|-
 +
| 0x20 + 0x4 * (X + Y)
 +
| 0x10 * X
 +
| AES-CMACs for each content in the first list, generated using the process below
 
|}
 
|}
  
−
'''"00000001.sav"''' - This is the title's encrypted savegame. Renaming these savegames causes home-menu to hang while launching titles, modifying these saves results in the same corruption errors as other savegames.
+
The number of AES-CMACs depends on the highest Content Index installed. For example, a title with 5 contents, but only 1 and 3 are installed, will still result in 3 AES-CMACs, with the 2nd one being unused.
 +
 
 +
For SD contents, each AES-CMAC is generated by combining the NCCH header without the signature (0x100-0x1FF), the Content Index and Content ID at the end, both as u32. Then calculate the SHA256 of the data and generate the AES-CMAC using the [[AES Registers#Keyslots|SD/NAND AES-CMAC key]].
 +
 
 +
For TWLNAND contents, the same process is used(even for SRL contents) with the keyslot for NAND dbs.
 +
 
 +
 
 +
'''"00000001.sav"''' - This is the title's [[Savegames|savegame]]. Renaming these savegames causes home-menu to hang while launching titles, modifying these saves results in the same corruption errors as other savegames.
 +
 
 +
 
 +
'''"00000000.ctx"''' - This file is temporarily stored on SD card while a title is being downloaded from the eShop, it is deleted after the download is completed. This contains an AP0000000000000000 cert used to sign the data following the cert, this cert is signed by the [[CTCert]].
 +
The unknown signed data is likely an ECDSA public key. There's .ctx files stored under the /title directory for NAND CTR/TWL titles, however those use the [[CTXT]] format which is completely different from this SD .ctx format. These .ctx files for NAND/SD titles only exist for titles where installation was not yet finalized(like when a system update install was not yet finalized).
 +
 
 +
=== DLC Titles ===
 +
 
 +
DLC titles have a different directory structure to most installed titles. This is because all DLC content for a given title is installed under the same Title ID, but DLC add-ons are usually separate purchases, hence the structure altered so any combination of DLC content can be installed. DLC titles can receive 'updates', this is usually in the form of more DLC content and/or DLC bug fixes. Individual DLC content can only be managed from with-in the application using the DLC.
 +
 
 +
'''"<IndexSeparator>"''' - DLC [[NCCH]] contents are split across different directories, depending on the Content Index. Starting with 00000000, there is a directory for every 256 contents. All the directories are created upon install, which means some may be empty if the contents within its index range are not installed.
 +
 
 +
 
 +
"'''<ContentID>.tmd'''" - This is not modified by the 3DS, and contains the details for all DLC content(installed or not).
 +
 
  
 +
"'''<ContentID>.cmd'''" - This contains entries for all '''installed''' DLC [[NCCH]] content, and is updated (<ContentID> will change) every time DLC content is installed/removed.
  
−
'''"00000000.ctx"''' - This file encrypted with a console-unique [[AES|keyslot]] is temporarily stored on SD card while a title is being downloaded from the eShop, it is deleted after the download is completed. This is presumably moved to NAND once installation is finished. This contains an AP0000000000000000 cert used to sign the data following the cert, this cert is signed by the [[CTCert]].
+
=Installing other-model system-titles=
−
The unknown signed data is likely an ECDSA public key.
+
When finalizing title-install of already downloaded Old3DS system-titles to a New3DS NAND image with New3DS NATIVE_FIRM, the end result is that the New3DS version (TID-low bitmask 0x20000000) of those titles gets deleted.
  
−
'''"XXXXXXXX"''' - This extra directory only found in DLC titles, contains the DLC NCCH content.
+
It's unknown where this behaviour is implemented (might be NIM, AM, or AMXPXI).

Latest revision as of 01:45, 26 June 2019

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located here.

For a list of 3DS titles see the Title list.

Title IDs[edit]

The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.

Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.


TitleID Structure: 0xCCCCABCDLLLLLLRR

  • CCCC defines the console Platform (5=WiiU, 4=3DS, 3=DSi, 1=Wii)
  • ABCD defines the Content Category of the title, Demo, DLPChild, etc.
  • LLLLLL For CTR titles, this is the title's Unique ID. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.
  • RR This is the Title ID Variation, and has various uses.


Content Categories:

This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.

Specific Bitmask Flags:

Category Bitmask
Normal 0x0
DlpChild 0x1
Demo 0x2
Contents 0x3
AddOnContents 0x4
Patch 0x6
CannotExecution 0x8
System 0x10
RequireBatchUpdate 0x20
NotRequireUserApproval 0x40
NotRequireRightForMount 0x80
CanSkipConvertJumpId 0x100
TWL 0x8000
  • TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.
  • System titles (TWL and CTR) are eligible to be updated during a System Update.
  • Bit Mask 0x4000 appears to be reserved, as it renders the TWL and System bit masks useless.

Unique ID Restrictions:

For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes.

TITLE TYPE UNIQUE ID RANGE
System 0x0 - 0x2FF
Application 0x300 - 0xF7FFF
Evaluation 0xF8000 - 0xFEFFF (?)
Prototype* 0xFF000 - 0xFF3FF
Developer 0xFF400 - 0xFF7FF (?)

*On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.

ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on New_3DS(that is, programID-low 0x20000000 / uniqueID 0x200000).

TitleID Variation:

This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:

  • CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:
RR MEANING
02 System Title (Core version 0x2)
03 SAFE_MODE System Title (Core version 0x3)

Normally on retail SAFE_MODE ARM11 CXI titles can't be launched, since the system core version doesn't match the CXI exheader core version.

  • Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.
  • Dev Menu installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.
  • Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:

Versions[edit]

v## = 0xHHHH = 0bBBBBBBBB...

  • The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary
  • 6 bits : Major, this matches the NCCH remaster-version.
  • 6 bits : Minor
  • 4 bits : Micro ('Build' in some contexts)
  • i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.

Data Structure[edit]

Titles are installed to either the NAND (System and Application) or to the SD Card (Application only), and their respective directory locations are:

NAND SD
Title Data nand/title sdmc/Nintendo 3DS/<ID0>/<ID1>/title
Save Data nand/data/<ID0>/sysdata

ID0 is the first 0x10-bytes from a SHA256 hash and ID1 is generated from the SD card CID.

Title data stored on the SD Card is encrypted with the console-unique keyslots, whereas NAND title data is stored as cleartext.

The base CTR for files stored under /title is likely based on the /title path, similar to extdata. This base CTR is unique per titleID and filename. The base CTR never changes after creation of each file.

When a newer version of a title is installed, the new .app content, .tmd, and .cmd(and .ctx for NAND titles) are written to the /title directory, however the old files here are not yet deleted. Once installation of the title is finalized, the info from import.db is moved to title.db so that the system uses the newer files instead, then the old /title files are deleted.

The title data is contained in this directory structure (note that DLC titles are stored in a different way):

NAND SD (non-DLC) SD (DLC)
Title Data: 
<Title ID High>
└── <Title ID Low>
    ├── 00000000.ctx
    └── content
        ├── <ContentID>.app
        ├── <ContentID>.tmd
        └── cmd
            └── <ContentID>.cmd

<Title ID High>
└── <Title ID Low>
    ├── 00000000.ctx
    ├── content
    │   ├── <ContentID>.app
    │   ├── <ContentID>.tmd
    │   └── cmd
    │       └── <ContentID>.cmd
    └── data
        └── 00000001.sav

0004008C
└── <Title ID Low>
    ├── 00000000.ctx
    └── content
        ├── <ContentID>.tmd
        ├── <IndexSeparator>
        │   └── <ContentID>.app
        └── cmd
            └── <ContentID>.cmd
Save Data: 
<SaveID0>
└── <SaveID1>
    └── 00000001.sav

"<ContentID>.tmd" - (The Content ID is a u32, initially: 00000000 when the title is first installed. Changing by an increment of +0x1 for each title update the 3DS installs) This is the Title metadata associated with the title. The decrypted TMD is available on Nintendo's CDN server at "http://nus.cdn.c.shop.nintendowifi.net/ccs/download/TitleIDhere/tmd.OptionallyTitleVersionHere". Though CDN version of the title TMD has a certificate chain attached at the end of the TMD, so removing it will give you the 1:1 decrypted TMD. After installation the "<ContentID>.tmd" is redundant, because important title data is extracted and imported into the title.db and ".cmd" files, but is however kept as a reference.


"<ContentID>.app" - (The Content ID is a u32, taken from the title's TMD) These files are NCCH files. There can be more than one NCCH in this directory, as seen with .CCI files, the game executable (CXI) can be accompanied with additional non-executable NCCH files (CFA) such as the electronic manual and DLP Child containers. Determining the function of the NCCH, is done by finding the Content Index of the "XXXXXXXX.app" file in the title's TMD(see above for retrieving decrypted TMD), interpreting the Content Index is as follows (does not apply to DLC content):

Index Content Type
0000 Main Executable (.CXI)(In the case of System Data Archives, this is a CFA file)
0001 Home Menu Manual (.CFA)
0002 DLP Child Container (.CFA)

Unlike the TMD, a decrypted version of the NCCH files cannot be retrieved from Nintendo's CDN, the NCCH files do exist on Nintendo's CDN but are encrypted. Decrypting CDN versions of content, requires the title's ticket, and the common key specified by an index in the ticket. Of course editing/deleting ".app" files will have an effect. Deleting/renaming the manual ".app' will cause the manual not to load when clicked on. And deleting/renaming the executable ".app" will cause the application to not load, and the 3D Banner does not show(The banner is loaded each time from the game's executable NCCH when the home menu loads, it is not cached like the icon and name).


"<ContentID>.cmd" - (The Content ID is a u32, initially: 00000001 when the title is first installed. Changing by an increment of +0x1 for each time the 3DS adds/removes '.app' files) This file contains data taken from the title's TMD. See the below table for the format of the cleartext .cmd file. The Title.db contains the Content ID for the '.cmd' file, but does not contain a hash of the '.cmd' file. This acts as part of the DRM for installed titles, along with the title.db.

The below AES-CMACs(including the last 0x10-bytes of the header) are only used for SD titles, for NAND download-play titles, and non-system DSiWare titles. For other titles, these MACs are set to all-zero.

Offset Size Description
0x0 0x4 .cmd ContentID, for the .cmd filename. This is the beginning of the header.
0x4 0x4 Number of AES-CMACs and Content IDs in the first list (X). The method to determine this is explained below.
0x8 0x4 Number of Content IDs in the second list (Y)
0xC 0x4 Unknown, usually (always?) 1.
0x10 0x10 AES-CMAC over first 0x10
0x20 0x4 * X List of installed Content IDs in order of Content Index, with missing contents replaced with 0xFFFFFFFF
0x20 + 0x4 * X 0x4 * Y List of installed Content IDs in order of ID name
0x20 + 0x4 * (X + Y) 0x10 * X AES-CMACs for each content in the first list, generated using the process below

The number of AES-CMACs depends on the highest Content Index installed. For example, a title with 5 contents, but only 1 and 3 are installed, will still result in 3 AES-CMACs, with the 2nd one being unused.

For SD contents, each AES-CMAC is generated by combining the NCCH header without the signature (0x100-0x1FF), the Content Index and Content ID at the end, both as u32. Then calculate the SHA256 of the data and generate the AES-CMAC using the SD/NAND AES-CMAC key.

For TWLNAND contents, the same process is used(even for SRL contents) with the keyslot for NAND dbs.


"00000001.sav" - This is the title's savegame. Renaming these savegames causes home-menu to hang while launching titles, modifying these saves results in the same corruption errors as other savegames.


"00000000.ctx" - This file is temporarily stored on SD card while a title is being downloaded from the eShop, it is deleted after the download is completed. This contains an AP0000000000000000 cert used to sign the data following the cert, this cert is signed by the CTCert. The unknown signed data is likely an ECDSA public key. There's .ctx files stored under the /title directory for NAND CTR/TWL titles, however those use the CTXT format which is completely different from this SD .ctx format. These .ctx files for NAND/SD titles only exist for titles where installation was not yet finalized(like when a system update install was not yet finalized).

DLC Titles[edit]

DLC titles have a different directory structure to most installed titles. This is because all DLC content for a given title is installed under the same Title ID, but DLC add-ons are usually separate purchases, hence the structure altered so any combination of DLC content can be installed. DLC titles can receive 'updates', this is usually in the form of more DLC content and/or DLC bug fixes. Individual DLC content can only be managed from with-in the application using the DLC.

"<IndexSeparator>" - DLC NCCH contents are split across different directories, depending on the Content Index. Starting with 00000000, there is a directory for every 256 contents. All the directories are created upon install, which means some may be empty if the contents within its index range are not installed.


"<ContentID>.tmd" - This is not modified by the 3DS, and contains the details for all DLC content(installed or not).


"<ContentID>.cmd" - This contains entries for all installed DLC NCCH content, and is updated (<ContentID> will change) every time DLC content is installed/removed.

Installing other-model system-titles[edit]

When finalizing title-install of already downloaded Old3DS system-titles to a New3DS NAND image with New3DS NATIVE_FIRM, the end result is that the New3DS version (TID-low bitmask 0x20000000) of those titles gets deleted.

It's unknown where this behaviour is implemented (might be NIM, AM, or AMXPXI).

Retrieved from "https://www.3dbrew.org/w/index.php?title=Titles&oldid=21006"