Overview
This is the file format for the 3DS' Firmware, it contains four 'sections' of ARM code (ARM9 and ARM11). The firmware sections are not encrypted in the FIRM format.
A structural example of a FIRM file (created using the specs in ctrtool) can be found here (Note it does not contain any ARM code, it's just a structural example)
The ARM9 section contains the ARM9 kernel and the ARM9 process. The ARM11 section(s) contains the ARM11 kernel, and the ARM11 process(es). For NATIVE_FIRM/SAFE_MODE_FIRM these ARM11 processes are sm, fs, pm, loader, and pxi. Normally the 4th section is not used. The code loaded from FIRM is constantly running on the system until another FIRM is launched.
FIRM Header
| OFFSET | SIZE | DESCRIPTION |
|---|---|---|
| 0x000 | 4 | Magic 'FIRM' |
| 0x004 | 4 | Reserved1 |
| 0x008 | 4 | ARM11 Entrypoint |
| 0x00C | 4 | ARM9 Entrypoint |
| 0x010 | 0x030 | Reserved2 |
| 0x040 | 0x0C0 (0x030*4) | Firmware Section Headers |
| 0x100 | 0x100 | RSA-2048 signature of the FIRM header, using SHA-256. |
Firmware Section Headers
| OFFSET | SIZE | DESCRIPTION |
|---|---|---|
| 0x000 | 4 | Offset |
| 0x004 | 4 | Address |
| 0x008 | 4 | Size |
| 0x00C | 4 | Firmware Type ('0'=ARM9/'1'=ARM11) |
| 0x010 | 0x020 | SHA-256 Hash of Firmware Section |
NATIVE_FIRM and SAFE_MODE_FIRM
NATIVE_FIRM is the FIRM which is installed to the NAND firm partitions, which is loaded by bootrom. SAFE_MODE_FIRM and NATIVE_FIRM for the initial versions are exactly the same, except for the system core version fields. SAFE_MODE is used for running the System Updater.
TWL_FIRM and AGB_FIRM
TWL_FIRM handles DS(i) backwards compatibility, while AGB_FIRM handles running GBA VC titles. The ARM9 FIRM section for TWL_FIRM and AGB_FIRM are exactly the same(for TWL_FIRM and AGB_FIRM versions which were updated with the same system-update).