9.0.0-20

The 9.0.0-20 system update was released on October 6, 2014.

Change-log

Official change-log:

• Users can now use themes to customize the design and sounds of the HOME Menu
• Five themes are pre-installed and additional themes can be purchased from the Theme Shop
• Themes can be changed by using settings located within the HOME Menu settings
• A feature has been added that allows users to capture screenshots of their HOME Menu
• The Nintendo eShop Title Information page has been updated to provide easier access to any available videos, demos, user reviews, and other information
• Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience

System Titles

3DS

The following system-modules were updated: AM, camera, cfg, codec, gsp, hid, ac, cecd, CSND, dlp, http, ndm, NIM, NWM, SOC, SSL, PS, friends, IR, BOSS, news(notifications), RO, NS, and act.

The following applications were updated: System Settings, Download Play, Nintendo 3DS Camera, eShop, System Transfer, and NNID settings.

The following "applets" were updated: ErrDisp, Home Menu, camera, Instruction Manual, Game Notes, Friend List, Notifications, error, Software Keyboard, appletEd, PNOTE_AP, SNOTE_AP, extrapad, mint, Miiverse, and Miiverse memolib.

An applet with TID-low 00008B02 was added, "solv3". The description from the ExeFS icon is "Post to Miiverse".

The following titles were also updated: 0004009B00012302, EULA CFA, NGWord bad word list CFA, Nintendo Zone hotspot list CFA, NVer, CVer, 0004001B00018002, 0004001B00018102, and 0004001B00018202.

NS_CFA was updated, the following new file was added to the RomFS: "qtm_black_list".

NATIVE_FIRM was also updated.

New3DS

New3DS versions of most sysmodules were added with this upgrade.

This upgrade included 3 new sysmodules:

• NFC -- talking to NFC hardware (over I2C).
• MVD
• QTM -- camera headtracking? (over I2C).

FIRM

For New3DS firmwares (NATIVE_FIRM, TWL_FIRM, ..), the ARM9 binary has an additional layer of crypto. At the end of each ARM9 binary, there's a plaintext loader.

If (u8*)0x10000000 bit 1 is clear (which means that this happens only on hard reboots), it does the following things:

• Hashes data from the region 0x10012000-0x10012090 using SHA2.
• Initializes AES keyslot 0x11 keyX, keyY to the lower and higher portion of that hash, respectively.
• Decrypts arm9_bin_buf+0 using keyslot 0x11, and initialises keyX for keyslot 0x15 with it.
• Initialises KeyX for keyslots 0x18-0x20 with the output of encrypting a certain binary sequence using keyslot 0x11. These are presumably New3DS-specific keys.

It sets KeyY for keyslot 0x15 to arm9_bin_buf+16, the IV to arm9_bin_buf+32. It then proceeds to decrypt the binary. When done, it decrypts arm9_bit_buf+64 using a fixed key and makes sure it's all zeroes. It it is, it jumps to the decrypted addr. Otherwise it will just loop forever.

Thus, the ARM9 binary has the following header:

OFFSET	SIZE	DESCRIPTION
0x000	16	Encrypted KeyX (same for all FIRM's)
0x010	16	KeyY
0x020	16	IV
0x030	16	?
0x040	16	Control block

See Also

System update reports:

• [1]
• [2]
• [3]
• [4]