3DS Virtual Console
There are several types of VC titles: NES/GB/GBC VC titles, SNES VC titles, GameGear VC titles and GBA VC titles. Except for GBA VC, the games are ran using emulators.
NES/GB/GBC VC
An emulator application + VC ROM in the NCCH RomFS (among other things in the RomFS). The emulator build includes support for all these three platforms, not specific to just the included ROM platform.
This emulator includes GBA support, however the GBA emulation for this this is somewhat slow. This was presumably implemented before AGB_FIRM was.
Unlike Wii VC, the 3DS VC ROMs for NES use the "TNES" header.
RomFS
- "rom:/rom/" This directory contains the ROM file(s). Filenames used under here don't matter: the filename is determined by the emulator app by doing a directory read.
- "rom:/shaders/" This directory contains GPU shaders used by the emulator app: .shbin, .csdr, and .obj.
- "rom:/VCM/" This directory contains graphics, audio, and text used by the emulator app.
- "rom:/agb.bin" GBA BIOS.
- "rom:/buildtime.txt" Emulator app build timestamp.
- "rom:/config.ini" Emulator configuration .ini, contains sections for all supported 3DS VC platforms.
- "rom:/<rom_name>.patch" rom_name = filename from the rom directory. This .ini contains patches for the ROM.
- "rom:/shader.shbin" GPU shader.
Savedata
The savedata can contain:
- "rsm1.dat": Same format as the below rsm2.dat. Probably used for the "restore-point".
- "rsm2.dat": Current emulator save-state, for storing/loading state at VC-title launch/exit.
- "sav.dat": The actual savedata used by the emulated ROM.
- "SecureValue": The random number used by Anti Savegame Restore. No known version of the emulator implements both savestates and secure value.
Overwriting sav.dat with 0xFF-bytes doesn't have any affect on the actual emulator. Doing that with most of the rsm*.dat data doesn't crash anything.
SNES VC
An emulator application + VC ROM in the NCCH RomFS (among other things in the RomFS). SNES VC titles are New 3DS exclusive.
RomFS
- "rom:/ErrorMessage/" This directory contains text used by the emulator app.
- "rom:/shader/" This directory contains .shbin GPU shaders used by the emulator app.
- "rom:/VCM/" This directory contains text used by the emulator app.
- "rom:/caravel.bcsar" This file contains audio used by the emulator app.
- "rom:/ctrl_change.arc" This file contains graphics used by the emulator app.
- "rom:/data.bin" This file contains the ROM and other data. See below for documentation.
- "rom:/ErrorMessage.arc" This file contains graphics used by the emulator app.
- "rom:/KTR-XXXX.icn" Copy of the SMDH of the game.
- "rom:/shader.shbin" GPU shader.
- "rom:/nnfont_RectDrawerShader.shbin" GPU shader.
- "rom:/VCM.arc" This file contains graphics used by the emulator app.
data.bin structure
The file begins with a header (all values are little-endian):
| START | SIZE | DESCRIPTION |
|---|---|---|
| 0x00 | 0x4 | Always 0x00000100 |
| 0x04 | 0x4 | File size |
| 0x08 | 0x4 | Always 0x00000030 |
| 0x0C | 0x4 | Always 0x00000050 |
| 0x10 | 0x4 | Start of the ROM (always 0x00000060 in official VC) |
| 0x14 | 0x4 | End of the ROM |
| 0x18 | 0x4 | Start of the footer region (presumably an index for the PCM audio samples). Matches end of file/file size if PCM data is missing |
| 0x1C | 0x4 | Always 0 |
| 0x20 | 0x4 | Start of decompressed SDD-1 graphics data region. Matches end of file/file size if no SDD-1 chip is present |
| 0x24 | 0x8 | Product ID (KTR-XXXX), determines filenames in savedata |
| 0x2C | 0x4 | Always 0 |
| 0x30 | 0x1 | Emulation speed in FPS (always 0x3C in official VC) |
| 0x31 | 0x3 | ROM size |
| 0x34 | 0x1 | Always 0 |
| 0x35 | 0x3 | Size of the converted PCM audio samples region (starting after ROM). 0 if PCM data is missing |
| 0x38 | 0x1 | Always 0 |
| 0x39 | 0x2 | Footer region size. 0 if PCM data is missing |
| 0x3B | 0x2 | Always 0 |
| 0x3D | 0x2 | Game preset ID? (varies for each game). Incremental, started with 0x10XX values in old releases, newest ones have 0x11XX (with XX being back to low values). |
| 0x3F | 0x1 | Always 0x2 |
| 0x40 | 0x1 | Sound volume |
| 0x41 | 0x1 | ROM type (0x15 == HiROM/0x14 == LoROM) |
| 0x42 | 0xE | Always 0 |
| 0x50 | 0x4 | Always 0x00000003 |
| 0x54 | 0x4 | Always 0x00000001 |
| 0x58 | 0x8 | Always 0 |
The 0x60 header is followed by the SNES ROM, often altered to replace audio samples with pointers to external PCM audio files converted from the game, presumably to speed up emulation (these pointers can be found by looking for "PCMF" in the ROM, as seen on Wii VC). The ROM is then optionally followed by the PCM audio files, by the SDD-1 decompressed graphics data (presumably the emulator doesn't properly emulate the chip because of hardware constraints) and by a footer which appears to be an index for the PCM audio data. There are no setting fields for specific cart features, and it appears that the emulator has "game presets" stored in its own code, which determine the cart expansion chip and probably more game-specific settings. Each official VC release has a different preset ID in the header.
Savedata
The savedata contains:
- "KTR-XXXX.cfg": Appears to contain the "preset ID" and possibly more game/save information.
- "KTR-XXXX.vea": Current emulator save-state, for storing/loading state at VC-title launch/exit.
- "KTR-XXXX.ves": The actual savedata used by the emulated ROM.
Filenames are determined in the ROM header.
GBA VC
GBA VC is run by AGB_FIRM. RomFS isn't used for GBA VC titles, but can be found empty within GBA VC titles. The NCCH ExeFS contains the same files as a normal application. The ExeFS:/.code contains the GBA VC ROM followed by a 0x360 byte long footer.
All values in the GBA VC footer are little-endian.
| START | SIZE | DESCRIPTION |
|---|---|---|
| 0x004 | 0x4 | GBA ROM Filesize |
| 0x008 | 0x4 | Save type (see below) |
| 0x020 | 0x4 | LCD ghosting (01-FF, lower values equal more ghosting) |
| 0x024 | 0x300 | Video LUT (black to full, rgbrgbrgb...)?, three different types of this data have been observed. |
| 0x338 | 0x4 | GBA ROM Filesize |
| 0x344 | 0x4 | GBA ROM Filesize |
| 0x350 | 0x4 | Magic '.CAA' |
| 0x35A | 0x2 | High two bytes of GBA ROM file size |
Save types:
- 0x0: EEPROM 8k
- 0x1: EEPROM 8k (?)
- 0x2: EEPROM 64k
- 0x3: EEPROM 64k (?)
- 0x4: Flash 512k (Atmel, ID: 0x3D1F) + RTC
- 0x5: Flash 512k (Atmel, ID: 0x3D1F)
- 0x6: Flash 512k (SST, ID: 0xD4BF) + RTC
- 0x7: Flash 512k (SST, ID: 0xD4BF)
- 0x8: Flash 512k (Panasonic, ID: 0x1B32) + RTC
- 0x9: Flash 512k (Panasonic, ID: 0x1B32)
- 0xA: Flash 1Mbit (Macronix, ID: 0x09C2) + RTC
- 0xB: Flash 1Mbit (Macronix, ID: 0x09C2)
- 0xC: Flash 1Mbit (Sanyo, ID: 0x1362) + RTC
- 0xD: Flash 1Mbit (Sanyo, ID: 0x1362)
- 0xE: SRAM/FRAM 256k
Everything above 0xE results in no save chip and nothing being saved to NAND.
NAND Savegame
AGB_FIRM saves its active save memory to NAND on exit, this is then immediately picked up by NATIVE_FIRM on reboot by checking CFG_BOOTENV. From there, this is verified and copied out to SD (also see below). The savegame format is as follows:
| START | SIZE | DESCRIPTION |
|---|---|---|
| 0x0 | 0x4 | Magic ('.SAV') |
| 0x4 | 0xC | Always 0xFF |
| 0x10 | 0x10 | AES-CMAC of the SHA256 hash of 0x30..0x200 + the entire save itself, keyslot 0x24, keyY from process9 .rodata |
| 0x20 | 0x10 | Always 0xFF |
| 0x30 | 0x4 | Always 0x1 |
| 0x34 | 0x4 | Number of times saved (unused?) |
| 0x38 | 0x8 | AGB TitleID |
| 0x40 | 0x10 | SD card CID from the console the save was made on (verified on load) |
| 0x50 | 0x4 | Save start addr (always 0x200) |
| 0x54 | 0x4 | Save size |
| 0x58 | 0x8 | Always 0xFF (?) |
| 0x60 | 0x4 | See here |
| 0x64 | 0x4 | See here |
| 0x68 | 0x198 | Always 0xFF |
NAND Savegame on SD
A NAND savegame copied to the SD by process9 is identical to its counterpart on the NAND partition, save for the CMAC. For SD copies on retail units, the CMAC is recalculated as the AES-CMAC of the (SHA256 hash of ("CTR-SIGN" + Title ID (big endian) + SHA256 hash of ("CTR-SAV0" + SHA256 hash of (0x30..0x200 + the entire save itself)))), using keyslot 0x30 set up with the keyY from movable.sed. For SD copies on devkit units, the CMAC is recalculated using the SHA256 hash of 0x30..0x200 + the entire save itself, using a different key from process9 .rodata.