Mii Maker

Mii Maker lets you create Miis, like Wii Mii Channel. Here you can transfer Miis over local-WLAN from other systems running Mii Maker(3DS/Wii U), or from Wii Mii Channel. 3DS Miis can't be transfered to Wii Mii Channel, only from Wii.

Wii Mii Channel transfer protocol

The Wii beacons are similar to the usual multi-cart NDS beacons, except: beacon_type is zero, and payload size is 0x14. The payload data is just the Wii UTF-16 nickname, with some extra unused zero data. The usual multi-cast NDS protocol is used for sending the 3DS nick to the Wii. After many keep-alive frames, it eventually sends a bunch of frames, each containing the whole Mii. There's a 6-byte header, followed by Mii data. At the end of these frames like most NDS frames is the 0200 byte marker.

Mii QR Code format

3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to Denso-Wave Inc web site for QR Code format specifications). It contains 0x70-bytes of binary data. 3DS seems to have a fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code.

The data itself is encrypted with AES-CCM, xorpads can be determined from known plaintext here. The Mii Maker application uses the NS APT Wrap/Unwrap commands to encrypt/decrypt this Mii data. For the NS Unwrap command, the Mii Maker application uses blocksize=12, noncesize=10, and inputbuffer-size=0x60. The first 8-bytes(cleartext MiiID+MAC address) in the below Mii data is the nonce used with the NS Unwrap/Wrap commands, the rest of the data at 0x8-0x5F is encrypted.

Offset	Length
0x0	0x4	Mii ID (big-endian 32-bit unsigned integer) The most significant 3 bits determine whether the Mii is Special, Foreign, or Normal [1] time_offset = (mii_id & 0x0FFFFFFF) * 2; time_offset is the time the Mii was created, represented as the number of seconds since 01/01/2010 00:00:00
0x4	0x4	High 4 octets of MAC address [2]
0x8	0x1	Unknown, the encrypted data begins here.
0x9	0x1	Allow Copying
0xA	0xE	unknown
0x18	0x2	Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt, ??
0x1A	0x14	UTF-16 Mii Name
0x2E	0x2	unknown
0x30	0x1	from MSB to LSB: 3-bit skin color, 4-bit face shape, 1-bit sharing enable
0x31	0x1	from MSB to LSB: 4-bit makeup, 4-bit wrinkles
0x32	0x6	unknown
0x38	0x1	from MSB to LSB: 3-bit eyebrow color, 5-bit eyebrow style
0x39	0x1	from MSB to LSB: 1-bit unknown, 3-bit eyebrow yscale, 4-bit eyebrow scale
0x3A	0x2	from MSB to LSB (note that MSB is in 0x3B, LSB is in 0x3A, little-endian bytes yay) 2-bit unknown, 5-bit eyebrow elevation, 4-bit eyebrow spacing, 1-bit unknown, 4-bit eyebrow rotation
0x3C	0x1	Allow Copying
0x3D	0x3	unknown
0x40	0x1	Mii Sharing Value
0x41	0x7	unknown
0x48	0x14	UTF-16 Author Name
0x5C	0x2	unknown
0x5E	0x2	unknown
0x60	0x10	AES-CCM MAC

• QR codes made from the same 3DS for the same Mii are use the same AES-CCM nonce (you can recreate the xorpad by xoring with known values from this table).

ExtData

The ExtData File System for Mii Maker is as follows:

root
├── icon
├── boss
└── user
    └── ExBanner
        └── COMMON.bin

File	Details	Size	FW Introduced	Plaintext
icon	Duplicate from Application ExeFS. Always image 00000002.	0x36c0 Bytes	1.0.0-0	Download
COMMON.bin	Extended Banner for Home Menu. Always image 00000003.	0x20224 Bytes	1.0.0-0	Download