Mii

Revision as of 20:28, 6 May 2020 by HEYimHeroic (talk | contribs) (→‎Mii format: updated "private name?" to what it really is - a profanity flag.)

Originally created for the Nintendo Wii (and backported to a selection of DS/i games), the Mii format was expanded with a larger selection of facial features and a new "copying" permission for the 3DS family, and later implemented as-is on Wii U.

See Mii Maker for the application chiefly designed to create, edit, delete, and trade Miis or convert them from and to a QR code.

The default endianness in this page is little-endian, unless explicitly specified.

Mii Database

Format of the Mii main database CFL_DB.dat, found in shared extdata archive f0000000b.

Offset Length
0x0 0x4 Header "CFOG" (Mii Maker section)
0x4 0x4 Header 0x00000100
0x8 0x23F0 (100 * 0x5C) Array of owned (saved in Mii Maker) Miis. Order in file is unrelated to canonical order in-app.
0x23F8 0x4 Header "CFHE"
0x23FC 0x2 Linked list tail index. 0xFFFF if the list is empty
0x23FE 0x2 Linked list head index. 0xFFFF if the list is empty
0x2400 0xA410 (3000 * 0xE) Linked list of objects? See chapter
0xC810 0xE Padding?
0xC81E 0x2 Checksum of all of the above (the first 0xC81E byte). See section below.
0xC820 0x4 Header "CFRA" (Invitations section)
0xC824 0x4 Mii count in this section. Maximum 100
0xC828 0x64 (100 * 0x1) Order index of Mii in this section?
0xC88C 0x1C20 (100 * 0x48) Array of Miis contributed from games, used for Mii Plaza "invitations" feature.
The format isn't that of a full Mii. The "author" field is missing
0xE4AC 0x12 01 00 [..] 00
0xE4BE 0x2 Checksum over the data above starting from 0xC820
0xE4C0 0x3D860 (3000 * 0x54) Another array of Miis. Seems related to the CFHE section.
The Mii format in this section is modified. The "author" field is missing, A 4-byte timestamp (seconds since 2000) together with 8-byte zeros(?) is appended at the end.

When encrypted in QR codes, 4 additional bytes are added. Two null bytes and a CRC-16. It's the exact same CRC-16 as for the Wii blocks on the 0x5e first bytes. It seems that the CRC is ignored, the Mii Maker expecting the result of APT:Unwrap to detect integrity loss.

CFHE object

A 0xE-byte long linked list node. The format is 4-byte Mii ID (See Mii format) + 6-byte MAC + 2-byte previous node index (prev) + 2-byte next node index (next).

An invalid node has value: ID = 0, MAC = 0, prev = 0x7FFF, next = 0x7FFF.

The highest bit of these fields has some special meaning and isn't part of the index value.

Checksum

The algorithm used to verify the integrity of the database is based on CRC16-CCITT, though it's an incorrect implementation. It is the same algorithm used to verify Mii Data on the Wii.

To obtain the correct value for the checksum, apply the algorithm to the first 0xC81E bytes of the database. This can be done using FixCRC; alternativly a pseudocode implementation of the checksum algorithm is given below:

def crc16_CCITTWii(u8[]: data) -> u16:
    """Calculate a checksum of data using the CRC16-CCITT implementation of the Wii

    This implementation uses 0x0000 as the starting value, which is different
    from what CRC16-CCITT specifies.
    """

    # note: a correct implementation of CRC16-CCITT
    #       would initialize this to 0xffff
    u32 crc := 0x0

    for byte in data:
        # Iterate over every of the 8 bits in byte.
        # Begin with the most significant bit. (7, 6, ... , 1, 0)
        for bit in 7..0:
            # & - binary `and'; <</>> - bitshift left/right; ^ - binary `xor'
            crc := (
                     (crc << 1) | ((byte >> bit) & 0x1)
                     ^ (0x1021 if crc & 0x8000 else 0)
                   )

    for _ in 0..15:
        crc := (crc << 1) ^ (0x1021 if crc & 0x8000 else 0)

    # only return the lowest 16 bit of crc
    return (u16) (crc & 0xffff)

checksum := crc16_CCITTWii(miidb[0:0xc81e]) # checksum over the first 0xc81e bytes

Mii format

Offset Length
0x0 0x1 Always 3?
0x1 0x1 bit 0: allow copying
bit 1: profanity flag (whether in Mii name or creator name does not matter)
bit 2-3: region lock (0=no lock, 1=JPN, 2=USA, 3=EUR)
bit4-5:character set(0=JPN+USA+EUR, 1=CHN, 2=KOR, 3=TWN)
0x2 0x1 Mii position shown on the selection screen
bit 0-3: page index
bit 4-7: slot index
0x3 0x1 bit 0-3: ?
bit 4-6: version? (1=Wii, 2=DSi, 3=3DS)
0x4 0x8 System ID (identifies owner, for purpose of enforcing editing restrictions and blue pants).
Is not tied to the MAC address anymore.
0xC 0x4 Mii ID (big-endian 32bit unsigned integer):
Bit 0..27: (bit[0..27] * 2) = date of creation (seconds since 01/01/2010 00:00:00)
Bit 28: Always set?
Bit 29: set for temporary Mii
Bit 30: Set for DSi mii?
Bit 31: not set iff Mii is special
0x10 0x6 Creator's full MAC
0x16 0x2 Padding (0000)
0x18 0x2 bit 0: sex (0 if male, 1 if female)
bit 1-4: birthday month
bit 5-9: birthday day
bit 10-13: favorite color
bit 14: favorite mii (0 if false, 1 if true)
0x1A 0x14 UTF-16 Mii Name (10 chars max, 0000 terminated)
0x2E 0x2 width & height
0x30 0x1 bit 0: disable sharing
bit 1-4: face shape
bit 5-7: skin color
0x31 0x1 bit 0-3: wrinkles
bit 4-7: makeup
0x32 0x1 hair style
0x33 0x1 bit 0-2: hair color
bit 3: flip hair
0x34 0x4 bit 0-5: eye style
bit 6-8: eye color
bit 9-12: eye scale
bit 13-15: eye yscale
bit 16-20: eye rotation
bit 21-24: eye x spacing
bit 25-29: eye y position
0x38 0x4 bit 0-4: eyebrow style
bit 5-7: eyebrow color
bit 8-11: eyebrow scale
bit 12-14: eyebrow yscale
bit 16-19: eyebrow rotation
bit 21-24: eyebrow x spacing
bit 25-29: eyebrow y position
0x3C 0x2 bit 0-4: nose style
bit 5-8: nose scale
bit 9-13: nose y position
0x3E 0x2 bit 0-5: mouse style
biy 6-8: mouse color
bit 9-12: mouse scale
bit 13-15: mouse yscale
0x40 0x2 bit 0-4: mouse y position
bit 5-7: mustach style
0x42 0x2 bit 0-2: beard style
bit 3-5: beard color
bit 6-9: mustache scale
bit 10-14:mustache y position
0x44 0x2 bit 0-3: glasses style
bit 4-6: glasses color
bit 7-10: glasses scale
bit 11-15: glasses y position
0x46 0x2 bit 0: enable mole
bit 1-4: mole scale
bit 5-9: mole x position
bit 10-14: mole y position
0x48 0x14 UTF-16 Author Name (10 chars max, 0000 terminated)

Mii categories (pants colors)

Special (gold) Miis

Specialness will override any other color and make the Mii non-editable.

Copying is rumored to have to be disabled.

Zeroed system-id and timestamp?

Imported (blue) Miis

Any (non-gold) Mii with a different System ID will appear as a foreign one.

There is also a range of Mii IDs that are always foreign and uneditable, regardless of the System ID:


Regular (black/red) Miis

Always editable, since they can only appear as such on the console that created them.


Personal (red) Mii

A red Mii that happens to be the first in the file!

Mii values

Each of the following values were found with NTR Debugger: If you want to access the value, grab the given "NTR address" and add 0x08815000.

Data NTR address Variation (hex) Notes
Face style 0x894 00-0B Not ordered as in editor, read below
Face color 0x898 00-05 From top to bottom
Wrinkles 0x89C 00-0B Same order as displayed in editor
Makeup 0x8A0 00-0B Same order as displayed in editor
Hair style 0x8A4 00-84 Not ordered as in editor, read below
Hair color 0x8A8 00-07 From top to bottom
Hair flipped 0x8AC 1 if true From top to bottom
Eye style 0x8B0 00-3C Not ordered as in editor, read below
Eyes color 0x8B4 00-05 From top to bottom
Eyes size 0x8B8 07-00 Left button increases value.
Eyes thickness 0x8BC 06-00 Left button increases value.
Eyes rotation 0x8C0 00-07
Eyes spacing 0x8C4 00-0C
Eyes height 0x8C8 00-12
Eyebrows style 0x8CC 00-18 Not ordered as in editor, read below
Eyebrows color 0x8D0 00-07 From top to bottom
Eyebrows size 0x8D4 08-00 Left button increases value.
Eyebrows thickness 0x8D8 06-00 Left button increases value.
Eyebrows rotation 0x8DC 00-0B
Eyebrows spacing 0x8E0 00-0C
Eyebrows height 0x8E4 03-12 Yup, minimum is 0x03
Nose style 0x8E8 00-11 Not ordered as in editor, read below
Nose size 0x8EC 08-00 Left button increases value.
Nose height 0x8F0 00-12
Mouth style 0x8F4 00-23 Not ordered as in editor, read below
Mouth color 0x8F8 00-04 From top to bottom.
Mouth size 0x8FC 08-00 Left button increases value.
Mouth thickness 0x900 06-00 Left button increases value.
Mouth height 0x904 00-12
Mustache style 0x908 00-05 Order like in editor.
Beard style 0x90C 00-05 Order like in editor.
Mustache/Beard color 0x910 00-07 From top to button.
Mustache size 0x914 08-00 Left button increases value.
Mustache height 0x918 00-10
Glasses style 0x91C 00-08 Order like in editor.
Glasses color 0x920 00-05 From top to bottom
Glasses size 0x924 07-00 Left button increases value.
Glasses height 0x928 00-14
Mole enable 0x92C 1 if enabled, 0 else.
Mole size 0x930 08-00 Left button increases value.
Mole horiz pos 0x934 00-10
Mole vert pos 0x938 00-1E
Mii height 0x93C 00-7F
Mii weight 0x940 00-7F
Mii name 0x944-0x959 UTF-16 Terminated with 0x0000. Not updated immediatly?
Creator's name 0x95A-96F UTF-16 Terminated with 0x0000. Not updated immediatly?
Mii gender 0x970 0: Male, 1: Female
Birthdate month 0x974 01-0C
Birthdate day 0x978 01-1F
Mii shirt color 0x97C 00-0B Ordered like in editor.
Favorite 0x980 0: false, 1: true
Allow copy 0x981 0: false, 1: true
Unused byte? 0x982
Allow sharing 0x983 0: true, 1: false
??? 0x984-0x98F All zero?
??? 0x990-0x997 4?

0x08815998: Same 4 bytes as encrypted Mii: first 4 bits for Mii type, 4 next for number of seconds since 01/01/2010 00:00:00 UTC+3 (should be verified by other country and region 3DS) divided by 2. 0x0881599C: 6 bytes of MAC address of the 3DS that created the Mii. 0x088159A2: 6 unknow uses bytes 0x088159A8: Same 8 bytes as decrypted Mii at 0x04 through 0x0B. Seems NAND specific, kept the same on Miis created on same NAND but different 3DS via System Transfer. Might be a coincidence but the two first bytes are in ID0 folder name in the Nintendo 3DS folder.

Mapped Editor <-> Hex values

Most of the values are ordered (left button decreases, right increases, color choices are top to bottom...) but for most "main" part of the UI, where you choose the style of the part being edited, hex values has no correlation with displayed order. Here is a JSON that can go from a Part, a Page and Position to the right hex value. This is 0 indexed (eg: datas["face"][0][11]).

{
face: [
    0x00,0x01,0x08,
    0x02,0x03,0x09,
    0x04,0x05,0x0a,
    0x06,0x07,0x0b
],
hairs: [
    [0x21,0x2f,0x28,
    0x25,0x20,0x6b,
    0x30,0x33,0x37,
    0x46,0x2c,0x42],
    [0x34,0x32,0x26,
    0x31,0x2b,0x1f,
    0x38,0x44,0x3e,
    0x73,0x4c,0x77],
    [0x40,0x51,0x74,
    0x79,0x16,0x3a,
    0x3c,0x57,0x7d,
    0x75,0x49,0x4b],
    [0x2a,0x59,0x39,
    0x36,0x50,0x22,
    0x17,0x56,0x58,
    0x76,0x27,0x24],
    [0x2d,0x43,0x3b,
    0x41,0x29,0x1e,
    0x0c,0x10,0x0a,
    0x52,0x80,0x81],
    [0x0e,0x5f,0x69,
    0x64,0x06,0x14,
    0x5d,0x66,0x1b,
    0x04,0x11,0x6e]
    [0x7b,0x08,0x6a,
    0x48,0x03,0x15,
    0x00,0x62,0x3f,
    0x5a,0x0b,0x78],
    [0x05,0x4a,0x6c,
    0x5e,0x7c,0x19,
    0x63,0x45,0x23,
    0x0d,0x7a,0x71],
    [0x35,0x18,0x55,
    0x53,0x47,0x83,
    0x60,0x65,0x1d,
    0x07,0x0f,0x70],
    [0x4f,0x01,0x6d,
    0x7f,0x5b,0x1a,
    0x3d,0x67,0x02,
    0x4d,0x12,0x5c],
    [0x54,0x09,0x13,
    0x82,0x61,0x68,
    0x2e,0x4e,0x1c,
    0x72,0x7e,0x6f]
],
eyebrows: [
    [0x06,0x00,0x0c,
    0x01,0x09,0x13,
    0x07,0x15,0x08,
    0x11,0x05,0x04],
    [0x0b,0x0a,0x02,
    0x03,0x0e,0x14,
    0x0f,0x0d,0x16,
    0x12,0x10,0x17]
],
eyes: [
    [0x02,0x04,0x00,
    0x08,0x27,0x11,
    0x01,0x1a,0x10,
    0x0f,0x1b,0x14],
    [0x21,0x0b,0x13,
    0x20,0x09,0x0c,
    0x17,0x22,0x15,
    0x19,0x28,0x23],
    [0x05,0x29,0x0d,
    0x24,0x25,0x06,
    0x18,0x1e,0x1f,
    0x12,0x1c,0x2e],
    [0x07,0x2c,0x26,
    0x2a,0x2d,0x1d,
    0x03,0x2b,0x16,
    0x0a,0x0e,0x2f],
    [0x30,0x31,0x32,
    0x35,0x3b,0x38,
    0x36,0x3a,0x39,
    0x37,0x33,0x34]
],
nose: [
    [0x01,0x0a,0x02,
    0x03,0x06,0x00,
    0x05,0x04,0x08,
    0x09,0x07,0x0B],
    [0x0d,0x0e,0x0c,
    0x11,0x10,0x0f]
],
mouth: [
    [0x17,0x01,0x13,
    0x15,0x16,0x05,
    0x00,0x08,0x0a,
    0x10,0x06,0x0d],
    [0x07,0x09,0x02,
    0x11,0x03,0x04,
    0x0f,0x0b,0x14,
    0x12,0x0e,0x0c],
    [0x1b,0x1e,0x18,
    0x19,0x1d,0x1c,
    0x1a,0x23,0x1f,
    0x22,0x21,0x20]
]
}