The DSiWare exported from a 3DS is located at "sdmc:/Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare". Filenames are same format as DSi: "<TitleID-Low>.bin". The below sizes include the 0x20-byte block metadata.
DSiWare exported from 3DS use keyslots initialized by movable.sed. Each section is encrypted with AES-CBC.
Block Metadata
| Offset
|
Size
|
Description
|
| 0x0
|
0x10
|
AES MAC
|
| 0x10
|
0x10
|
IV, generated by the RNG.
|
Each section begins with the actual encrypted data, followed by this block metadata.
File Structure v1
| Offset
|
Size
|
Description
|
| 0x0
|
0x4020
|
Banner section
|
| 0x4020
|
0xC0
|
Header section
|
| 0x40E0
|
0x420
|
Footer section
|
| 0x4500
|
|
Data for the 4 content sections are stored here.
|
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
Magic number 0x54444633, "3FDT".
|
| 0x4
|
0x4
|
Normally zero?
|
| 0x8
|
0x30
|
Unknown
|
| 0x38
|
0x8
|
TWL TitleID for the exported title.
|
| 0x40
|
0x60
|
?
|
| Offset
|
Size
|
Description
|
| 0x0
|
0xFC
|
?
|
| 0xFC
|
0x180
|
ECDSA "APXXXXXXXXXXXXXXXX" cert signed by the CTCert, where X is random lowercase ASCII hex data.
|
| 0x27C
|
0x180
|
ECDSA CTCert
|
| 0x3FC
|
0x4
|
?
|
File Structure v2
| Offset
|
Size
|
Description
|
| 0x0
|
0x4020
|
Banner section
|
| 0x4020
|
0xC0
|
Header section
|
| 0x40E0
|
?
|
Footer section
|
|
|
|
Data for the 4 content sections are stored here.
|
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
Magic number possibly?
|
| 0x4
|
0x4
|
?
|
| 0x8
|
0x38
|
Unknown
|
| 0x38
|
0x8
|
TWL TitleID for the exported title.
|
| 0x40
|
0x60
|
?
|
| Offset
|
Size
|
Description
|
| 0x0
|
0xD0
|
?
|
| 0xD0
|
0xE0
|
Normally all-zero?
|
| 0x1B0
|
0x20
|
SHA256 hash?
|
| 0x1D0
|
0x20
|
Normally all-zero?
|
| 0x1F0
|
0x3C
|
ECDSA signature over the previous data, signed by the AP cert?
|
| 0x22C
|
0x180
|
ECDSA "APXXXXXXXXXXXXXXXX" cert signed by the CTCert, where X is random lowercase ASCII hex data.
|
| 0x3AC
|
0x54
|
ECDSA certificate, the last 0x14-bytes here are all-zero.
|