Mii Maker lets you create Miis, and is the successor of the Wii's Mii Channel.
It can transfer Miis over local wireless from other systems running Mii Maker (3DS/Wii U), or receive, but not send, from Mii Channel.
Wii Mii Channel transfer protocol
The Wii beacons are similar to the usual multi-cart NDS beacons, except: beacon_type is zero, and payload size is 0x14. The payload data is just the Wii UTF-16 nickname, with some extra unused zero data. The usual multi-cast NDS protocol is used for sending the 3DS nick to the Wii. After many keep-alive frames, it eventually sends a bunch of frames, each containing the whole Mii. There's a 6-byte header, followed by Mii data. At the end of these frames like most NDS frames is the 0200 byte marker.
Mii QR Code format
3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to Denso-Wave Inc web site for QR Code format specifications). It contains 0x70-bytes of binary data. 3DS seems to have a fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code.
The data itself is encrypted with AES-CCM, xorpads can be determined from known plaintext here. The Mii Maker application uses the NS APT Wrap/Unwrap commands to encrypt/decrypt this Mii data. For the NS Unwrap command, the Mii Maker application uses nonceoffset=12, noncesize=10, and inputbuffer-size=0x60. Note that the actual nonce size is 8 bytes due to Wrap/Unwrap implementation, and the nonce data should be moved 12 bytes afterwards after decryption. The rest of the data at 0x8-0x5F is encrypted, and should be split into two parts after decryption, with the nonce data in the middle. (See Wrap and Unwrap for more information)
| Offset | Length | |
|---|---|---|
| 0x0 | 0x4 | Mii ID (big-endian 32-bit unsigned integer) The most significant 3 bits determine whether the Mii is Special, Foreign, or Normal [1] time_offset = (mii_id & 0x0FFFFFFF) * 2; time_offset is the time the Mii was created, represented as the number of seconds since 01/01/2010 00:00:00 |
| 0x4 | 0x4 | High 4 octets of MAC address [2] |
| 0x8 | 0x4 | Mii ID, the encrypted data begins here. |
| 0xC | 0x8 | System ID (this ID is produced by the output from GenHashConsoleUnique(0x0)) |
| 0x14 | 0x2 | Low 2 octets of MAC address |
| 0x16 | 0x2 | padding (0000) |
| 0x18 | 0x2 | Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt, ?? |
| 0x1A | 0x14 | UTF-16 Mii Name (10 chars max) |
| 0x2E | 0x2 | width & height |
| 0x30 | 0x1 | bit 0: disable sharing bit 1-4: face shape bit 5-7: skin color |
| 0x31 | 0x1 | bit 0-3: wrinkles bit 4-7: makeup |
| 0x32 | 0x1 | hair style |
| 0x33 | 0x1 | bit 0-2: hair color bit 3: flip hair |
| 0x34 | 0x4 | unknown |
| 0x38 | 0x1 | bit 0-4: eyebrow style bit 5-7: eyebrow color |
| 0x39 | 0x1 | bit 0-3: eyebrow scale bit 4-6: eyebrow yscale |
| 0x3A | 0x2 | note that the bytes are swapped over (little-endian layout) bit 0-3: eyebrow rotation bit 5-8: eyebrow x spacing bit 9-13: eyebrow y position |
| 0x3C | 0x1 | Allow Copying |
| 0x3D | 0x3 | unknown |
| 0x40 | 0x1 | Mii Sharing Value |
| 0x41 | 0x7 | unknown |
| 0x48 | 0x14 | UTF-16 Author Name (10 chars max) |
| 0x5C | 0x2 | unknown |
| 0x5E | 0x2 | CRC16 over the previous 0x5E |
| 0x60 | 0x10 | AES-CCM MAC |
- QR codes made from the same 3DS for the same Mii are use the same AES-CCM nonce (you can recreate the xorpad by xoring with known values from this table).
Mii Database
Created, received, or even met-in-multiplayer Miis are saved in CFL_DB.dat.
Savedata
editSaveData.bin
| Offset | Length | |
|---|---|---|
| 0x0 | 0x4 | "TIDE" header (EDIT byteswapped) |
| 0x4 | 0x4 | zero |
| 0xC | 0x4 (?) | 01000000 (constant?) |
| 0x100 | 0x4 | Number of scanned Special Mii QRs |
| 0x104 | - | Some data identifying each scanned Special Mii QRs, for the purpose of not making them scannable again. 8 or 12 byte each? |
| 0x2904 | 0x4 | Checksum? |
ExtData
The ExtData File System for Mii Maker is as follows:
root
├── icon
├── boss
└── user
└── ExBanner
└── COMMON.bin
| File | Details | Size | FW Introduced | Plaintext |
|---|---|---|---|---|
| icon | Duplicate from Application ExeFS. Always image 00000002. | 0x36c0 Bytes | 1.0.0-0 | Download |
| COMMON.bin | Extended Banner for Home Menu. Always image 00000003. | 0x20224 Bytes | 1.0.0-0 | Download |