With certain 3DS nandimages, the following NCCH can be recovered from NAND(in some cases these are somewhat corrupted). In some cases, only 000400000F980000 is left, in other cases the NCCH headers for all of these are overwritten. All of these use the retail NCCH secure-crypto mode, the NCCH accessdesc uses the retail pubk too.

Note that Nandrw/sys/updater.log, Twln/sys/log/inspect.log, and Twln/sys/log/product.log gets written during Factory Setup. CTRAging appears to do the product.log writing.

CTRAging appears to be an app which is used for hardware testing at the factory. This app also displays images(including Chinese/Asian-language text) which appear to be for system assembly/testing. CTRAging includes images for each 3DS model(which ones are included depends on the CTRAging version): original Old3DS, Old3DS XL, 2DS, regular New3DS, and New3DS XL. Some of the New3DS JPEG images have an EXIF last-modified timestamp of 2013, July-September.

Originally these titles(except for CTRAging) and the exheader dependency lists had TID-high 00040001, later that was changed to the normal TID-highs.

TID-high TID-low Description
00040000 0F980000 CTRAging ("Test Program")
00040001 00000002 NATIVE_FIRM
00040001 00000102 TWL_FIRM
00040001 00000202 AGB_FIRM
00040001 00001902 dmnt (Debugger sysmodule, see here)
00040001 00001B02 gpio sysmodule
00040001 00001D02 hid sysmodule
00040001 00001E02 i2c sysmodule
00040001 00001F02 mcu sysmodule
00040001 00002102 pdn sysmodule
00040001 00002302
00040001 00002702 csnd sysmodule
00040001 00002802 dlp sysmodule
00040001 00002A02 mp sysmodule
00040001 00002B02 ndm sysmodule
00040001 00002C02 nim sysmodule
00040001 00002D02
00040001 00003102 ps module
00040001 00003202 friends sysmodule
00040001 00003302 ir sysmodule
00040001 00003402 boss sysmodule
00040001 00008002 NS
00040001 00008102 TestMenu
00040001 00008A02 DevErrDi
00040030 00008102 TestMenu