DSiWare Exports

The DSiWare exported from a 3DS is located at "sdmc:/Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare". Filenames are same format as DSi: "<TitleID-Low>.bin". The below sizes include the 0x20-byte block metadata.

DSiWare exported from 3DS use keyslots initialized by movable.sed. Each section is encrypted with AES-CBC.

Block Metadata

Offset	Size	Description
0x0	0x10	AES MAC
0x10	0x10	IV, generated by the RNG.

Each section begins with the actual encrypted data, followed by this block metadata.

File Structure v1

Offset	Size	Description
0x0	0x4020	Banner section
0x4020	0xC0	Header section
0x40E0	0x420	Footer section
0x4500		Data for the 4 content sections are stored here.

Header

Offset	Size	Description
0x0	0x4	Magic number 0x54444633, "3FDT".
0x4	0x4	Normally zero?
0x8	0x30	Unknown
0x38	0x8	TWL TitleID for the exported title.
0x40	0x60	?

Footer

Offset	Size	Description
0x0	0xFC	?
0xFC	0x180	ECDSA "APXXXXXXXXXXXXXXXX" cert signed by the CTCert, where X is random lowercase ASCII hex data.
0x27C	0x180	ECDSA CTCert
0x3FC	0x4	?

File Structure v2

Offset	Size	Description
0x0	0x4020	Banner section
0x4020	0xC0	Header section
0x40E0	?	Footer section
		Data for the 4 content sections are stored here.

Header

Offset	Size	Description
0x0	0x4	Magic number possibly?
0x4	0x4	?
0x8	0x38	Unknown
0x38	0x8	TWL TitleID for the exported title.
0x40	0x60	?

Footer

Offset	Size	Description
0x0	0xD0	?
0xD0	0xE0	Normally all-zero?
0x1B0	0x20	SHA256 hash?
0x1D0	0x20	Normally all-zero?
0x1F0	0x3C	ECDSA signature over the previous data, signed by the AP cert?
0x22C	0x180	ECDSA "APXXXXXXXXXXXXXXXX" cert signed by the CTCert, where X is random lowercase ASCII hex data.
0x3AC	0x54	ECDSA certificate, the last 0x14-bytes here are all-zero.