The DSiWare exported from a 3DS is located at "sdmc:/Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare". Filenames are same format as DSi: "<TitleID-Low>.bin". The below sizes include the 0x20-byte block metadata.
DSiWare exported from 3DS use keyslots initialized by movable.sed.
Block Metadata
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x10 | AES MAC |
| 0x10 | 0x10 | CTR for AES-CTR / IV for AES-CBC, generated by the RNG. |
Each section begins with the actual encrypted data, followed by this block metadata.
File Structure
| Offset | Size | Description | Algorithm Type |
|---|---|---|---|
| 0x0 | 0x4020 | Banner section | AES-CBC |
| 0x4020 | 0xC0 | Header section | AES-CBC |
| 0x40E0 | 0x420 | Footer section | AES-CBC |
| 0x4500 | Data for the 4 content sections are stored here. | AES-CTR |
Header
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x38 | Unknown |
| 0x38 | 0x8 | TWL TitleID for the exported title. |
| 0x40 | 0x60 | ? |
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0xD0 | Hashes? |
| 0xD0 | 0xE0 | Normally all-zero? |
| 0x1B0 | 0x20 | SHA256 hash? |
| 0x1D0 | 0x20 | Normally all-zero? |
| 0x1F0 | 0x3C | ECDSA signature over the previous data, signed by the AP cert? |
| 0x22C | 0x180 | ECDSA "APXXXXXXXXXXXXXXXX" cert signed by the CTCert, where X is random ASCII hex data. |
| 0x3AC | 0x54 | ECDSA certificate, the last 0x14-bytes here are all-zero. |