Overview
CIA stands for CTR Importable Archive. This format allows the installation titles to the 3DS. CIA files can compile NCCH files for installation to either the SDMC or CTR NAND. CIA files can also compile .SRL files (format for DS(i) executable images) for installation to the TWL NAND of the 3DS.
An example .CIA can be downloaded here Credit: Jl12. It includes a .cia file, the result of installation, some screenshots. Also I've decrypted/extracted everything, for those people who can't be bothered using ctrtool ;)
Download Play utilises the CIA format when transferring titles.(This is also the only known retail implementation of the CIA format)
Development Units, are capable of manually installing CIA files via the Dev Menu
Format
The CIA format has a similar structure to the WAD format.
The file is represented in little-endian.
The data is aligned in 64 byte blocks (if a content ends at the middle of the block, the next content will begin from a new block).
The CIA format is capable of containing more then one NCCH in the APP data, the TMD specifies the size of each NCCH contained in the APP data. Generally it will only contain additional NCCH files (.CFA format, such as the Manual and DLP Child) related to the main executable NCCH (.CXI format). The CIA format could be interpreted as an installable variant of the CCI format.
CIA Header
This is a 32 bytes long header (8 x uint32).
| START | SIZE | DESCRIPTION |
|---|---|---|
| 0x00 | 0x04 | Archive Header Size (=0x2020 bytes) (Starts with 0x80 @ offset 0x0020) |
| 0x04 | 0x02 | Type |
| 0x06 | 0x02 | Version |
| 0x08 | 0x04 | Certificate chain size |
| 0x0C | 0x04 | Ticket size |
| 0x10 | 0x04 | TMD file size |
| 0x14 | 0x04 | ExeFS/Exheader Excerpt size (0 if no excerpt is present) |
| 0x18 | 0x04 | APP file size |
| 0x1C | 0x04 | 0x80000000 |
The order of the sections in the CIA file:
- certificate chain
- Ticket
- TMD file data
- APP file data
- ExeFS/ExHeader Excerpt
The APP data (CXI/SRL) is encrypted, using 128-bit AES-CBC. The encryption uses the decrypted titlekey of the ticket, and the titleid padded with zeros as the IV. To get the decrypted titlekey, the titlekey stored in the ticket must be decrypted using 128-bit AES-CBC with the 3DS common key, and the same IV as mentioned previously.
ExeFS/ExHeader Excerpt
The structure of this excerpt is as follows:
| START | SIZE | DESCRIPTION |
|---|---|---|
| 0x00 | 0x180 | Title ID dependency list - From the application's ExHeader |
| 0x180 | 0x280 | Reserved/Unused |
| 0x400 | 0x36C0 | Icon Data(.ICN) - From the application's ExeFS |
Obviously this section is not present in TWL CIA files.