CIA

Overview

CIA stands for CTR Importable Archive. This format allows the installation titles to the 3DS. CIA files can compile a CXI for installation to either the SDMC or CTR NAND. CIA files can also compile .SRL files (format for DS(i) executable images) for installation to the TWL NAND of the 3DS.

An example .CIA can be downloaded here Credit: Jl12. It includes a .cia file, the .cia file in its extracted form, a screenshot of the application working and some information given by the 3DS.

Download Play utilises the CIA format when transferring titles.(This is also the only know retail use of the CIA format)

Development Units, are capable of manually installing CIA files via the Dev Menu

Format

The CIA format has a similar structure to the WAD format.

The file is represented in little-endian.

The data is aligned in 64 byte blocks (if a content ends at the middle of the block, the next content will begin from a new block).

CIA Header

This is a 32 bytes long header (8 x uint32).

START	SIZE	DESCRIPTION
0x00	0x04	Archive Header Size (=0x2020 bytes) (Starts with 0x80 @ offset 0x0020)
0x04	0x02	Type
0x06	0x02	Version
0x08	0x04	Certificate chain size
0x0C	0x04	Ticket size
0x10	0x04	TMD file size
0x14	0x04	Icon size (0 if no icon)
0x18	0x04	APP file size
0x1C	0x04	0x80000000

The order of the sections in the CIA file:

• certificate chain
• Ticket
• TMD file data
• APP file data
• Icon

The APP data (CXI/SRL) is encrypted, using 128-bit AES-CBC. The encryption uses the decrypted titlekey of the ticket, and the titleid padded with zeros as the IV. To get the decrypted titlekey, the titlekey stored in the ticket must be decrypted using 128-bit AES-CBC with the 3DS common key, and the same IV as mentioned previously.

Icon

The actual icon data in a CIA is 0x400 bytes smaller than described in header and the true offset is 0x400 bytes past the TMD,