The DSiWare exported from a 3DS is located at "sdmc:/Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare". Filenames are same format as DSi: "<TitleID-Low>.bin". The below sizes include the 0x20-byte block metadata.
DSiWare exported from 3DS use keyslots initialized by movable.sed.
Block Metadata
| Offset
|
Size
|
Description
|
| 0x0
|
0x10
|
AES MAC
|
| 0x10
|
0x10
|
CTR for AES-CTR / IV for AES-CBC, generated by the RNG.
|
Each section begins with the actual encrypted data, followed by this block metadata.
File Structure
| Offset
|
Size
|
Description
|
Algorithm Type
|
| 0x0
|
0x4020
|
Banner section
|
AES-CBC
|
| 0x4020
|
0xC0
|
Header section
|
AES-CBC
|
| 0x40E0
|
0x420
|
Footer section
|
AES-CBC
|
| 0x4500
|
|
Data for the 4 content sections are stored here.
|
AES-CTR
|
| Offset
|
Size
|
Description
|
| 0x0
|
0x38
|
Unknown
|
| 0x38
|
0x8
|
TWL TitleID for the exported title.
|
| 0x40
|
0x60
|
?
|
| Offset
|
Size
|
Description
|
| 0x0
|
0xD0
|
Hashes?
|
| 0xD0
|
0xE0
|
Normally all-zero?
|
| 0x1B0
|
0x20
|
SHA256 hash?
|
| 0x1D0
|
0x20
|
Normally all-zero?
|
| 0x1F0
|
0x3C
|
ECDSA signature over the previous data, signed by the AP cert?
|
| 0x22C
|
0x180
|
ECDSA "APXXXXXXXXXXXXXXXX" cert signed by the CTCert, where X is random ASCII hex data.
|
| 0x3AC
|
0x54
|
ECDSA certificate, the last 0x14-bytes here are all-zero.
|