6,264
edits
Changes
Jump to navigation
Jump to search
Line 44:
Line 44: + + + + + + + + + + Line 144:
Line 154: + + + + + + + + + + + + + + + + + + + +
→NAND structure
| 0x00
| 0x00
| TWL NAND region
| TWL NAND region
|-
| style="background: red" | No
| style="background: green" | Yes
|
| 0x00012C00
| 0x200
|
|
|
| Console-unique encrypted New3DS key-storage, see below.
|-
|-
| style="background: green" | Yes
| style="background: green" | Yes
==== 0x4000 ====
==== 0x4000 ====
On some 3DS systems(such as 3DS XL), there's a plaintext FAT16 boot record located at NAND offset 0x4000. This block does not exist for launch-day 3DS systems. This is the only plaintext block for this "partition".
On some 3DS systems(such as 3DS XL), there's a plaintext FAT16 boot record located at NAND offset 0x4000. This block does not exist for launch-day 3DS systems. This is the only plaintext block for this "partition".
==== 0x12C00 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| Normal-key for keyslot 0x11, used for generating the rest of the New3DS keyslots' keyX by decrypting various data with AES-ECB.
|-
| 0x10
| 0x1F0
| Not yet used as of New3DS FIRM [[9.5.0-22|9.5.0-X]].
|}
This 0x200-byte sector contains New3DS key(s), this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).
The first 0x10-byte block is encrypted with AES-ECB, therefore the rest of the blocks are presumably encrypted with AES-ECB too.
=CTR partition=
=CTR partition=