Flash Filesystem - Revision history

Kynex7510 at 08:32, 27 July 2025

2025-07-27T06:32:34Z

← Older revision		Revision as of 10:32, 27 July 2025
Line 55:		Line 55:
	===Encryption===		===Encryption===

	The NAND file system is encrypted using [[AES\|AES-CTR]]. The TWL regions of NAND use the TWL NAND [[AES\|keyslot]], while the CTR regions use the CTR NAND [[AES\|keyslots]]. The keyslot used for each partition is determined by the NCSD partition FS type and encryption type. The TWL/CTR NAND regions are specified by the NCSD header. The first 0x0B100000 bytes of NAND is encrypted with the TWL keyslot, however before 0x00012E00 only the MBR partition table is encrypted with the TWL keyslot. That region contains the TWL partitions listed below.		The NAND file system is encrypted using [[AES\|AES-CTR]]. The TWL regions of NAND use the TWL NAND [[AES\|keyslot]], while the nonce is the sha1 hash of the NAND CID, byte reversed. The CTR regions use the CTR NAND [[AES\|keyslots]], while the nonce is the sha256 hash of the NAND CID. The keyslot used for each partition is determined by the NCSD partition FS type and encryption type. The TWL/CTR NAND regions are specified by the NCSD header. The first 0x0B100000 bytes of NAND is encrypted with the TWL keyslot, however before 0x00012E00 only the MBR partition table is encrypted with the TWL keyslot. That region contains the TWL partitions listed below.

	The New3DS CTRNAND partition uses a [[AES\|keyslot]] separate from the Old3DS one.		The New3DS CTRNAND partition uses a [[AES\|keyslot]] separate from the Old3DS one.

Plailect: added all known NAND flash sizes

2017-02-07T01:06:09Z

added all known NAND flash sizes

← Older revision		Revision as of 04:06, 7 February 2017
Line 1:		Line 1:
	The Nintendo 3DS has ~~a 1GB~~ NAND ~~Flash chip~~. Due to the NCSD header, the actual used size of the Old3DS NAND is 0x3AF00000-bytes(943MiB). On New3DS, the actual NAND size and the total size used by the partitions, is 0x4D800000-bytes(1240MiB).		The Nintendo 3DS has several differently sized NAND flash chips. Due to the NCSD header, the actual used size of the Old3DS NAND is 0x3AF00000-bytes(943MiB). On New3DS, the actual NAND size and the total size used by the partitions, is 0x4D800000-bytes(1240MiB).

			===Physical Size===
			{\| class="wikitable" border="1"
			! Device
			! Manufacturer
			! Size
			\|-
			\| 2DS
			\| Toshiba
			\| 0x3AF00000
			\|-
			\| 2DS
			\| Toshiba
			\| 0x76000000
			\|-
			\| 2DS
			\| Samsung
			\| 0x3BA00000
			\|-
			\| 2DS
			\| Samsung
			\| 0x4D800000
			\|-
			\| Old3DS
			\| Toshiba
			\| 0x3AF00000
			\|-
			\| Old3DS
			\| Samsung
			\| 0x3BA00000
			\|-
			\| New3DS
			\| Toshiba
			\| 0x76000000
			\|-
			\| New3DS
			\| Samsung
			\| 0x4D800000
			\|-
			\| New3DS
			\| Samsung
			\| 0x74800000
			\|}

	===Format===		===Format===

Lynn: /* NAND structure */ nicer colors in table

2016-12-11T22:58:36Z

NAND structure: nicer colors in table

← Older revision		Revision as of 01:58, 12 December 2016
Line 32:		Line 32:
	! Description		! Description
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\|		\|
	\| 0x0		\| 0x0
Line 43:		Line 43:
	\| [[NCSD]] header, this contains the offsets/sizes of the below CTR-NAND partitions. This block also contains the TWL-NAND MBR partition table.		\| [[NCSD]] header, this contains the offsets/sizes of the below CTR-NAND partitions. This block also contains the TWL-NAND MBR partition table.
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\|		\|
	\| 0x00000000		\| 0x00000000
Line 54:		Line 54:
	\| TWL NAND region		\| TWL NAND region
	\|-		\|-
	\| style="background: ~~red~~" \| No		\| style="background: #ffccbb" \| No
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\|		\|
	\| 0x00012C00		\| 0x00012C00
Line 65:		Line 65:
	\| Console-unique encrypted New3DS key-storage, see below.		\| Console-unique encrypted New3DS key-storage, see below.
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| twln		\| twln
	\| 0x00012E00		\| 0x00012E00
Line 76:		Line 76:
	\| TWL-NAND FAT16 File System. (DSi)		\| TWL-NAND FAT16 File System. (DSi)
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| twlp		\| twlp
	\| 0x09011A00		\| 0x09011A00
Line 87:		Line 87:
	\| TWL-NAND PHOTO FAT12 File System. (DSi)		\| TWL-NAND PHOTO FAT12 File System. (DSi)
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\|		\|
	\| 0x0B100000		\| 0x0B100000
Line 98:		Line 98:
	\| By default this partition is empty(only contains 0x00/0xFF bytes since it was never written to), when AGB_FIRM was never launched. This contains the AGB_FIRM GBA savegame.		\| By default this partition is empty(only contains 0x00/0xFF bytes since it was never written to), when AGB_FIRM was never launched. This contains the AGB_FIRM GBA savegame.
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| firm0		\| firm0
	\| 0x0B130000		\| 0x0B130000
Line 109:		Line 109:
	\| [[FIRM\|Firmware]] partition.		\| [[FIRM\|Firmware]] partition.
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| firm1		\| firm1
	\| 0x0B530000		\| 0x0B530000
Line 120:		Line 120:
	\| [[FIRM\|Firmware]] partition.(Backup partition, same as above)		\| [[FIRM\|Firmware]] partition.(Backup partition, same as above)
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~red~~" \| No		\| style="background: #ffccbb" \| No
	\|		\|
	\| 0x0B930000		\| 0x0B930000
Line 131:		Line 131:
	\| CTR-NAND partition. (3DS)		\| CTR-NAND partition. (3DS)
	\|-		\|-
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| style="background: ~~red~~" \| No		\| style="background: #ffccbb" \| No
	\| nand		\| nand
	\| 0x0B95CA00		\| 0x0B95CA00
Line 142:		Line 142:
	\| CTR-NAND FAT16 File System.		\| CTR-NAND FAT16 File System.
	\|-		\|-
	\| style="background: ~~red~~" \| No		\| style="background: #ffccbb" \| No
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\|		\|
	\| 0x0B930000		\| 0x0B930000
Line 153:		Line 153:
	\| CTR-NAND partition. (New3DS)		\| CTR-NAND partition. (New3DS)
	\|-		\|-
	\| style="background: ~~red~~" \| No		\| style="background: #ffccbb" \| No
	\| style="background: ~~green~~" \| Yes		\| style="background: #ccffbb" \| Yes
	\| nand		\| nand
	\| 0x0B95AE00		\| 0x0B95AE00

AuroraWright at 18:15, 24 November 2016

2016-11-24T17:15:51Z

← Older revision		Revision as of 20:15, 24 November 2016
Line 196:		Line 196:
	This 0x200-byte sector contains New3DS keys, this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM\|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).		This 0x200-byte sector contains New3DS keys, this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM\|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).

	This entire sector is encrypted with AES-ECB, the entire plaintext sector is identical for all retail New3DS systems(~~unknown for devunits~~).		This entire sector is encrypted with AES-ECB, the entire plaintext sector is identical for all retail and dev New3DS systems (differing between the two).

	=CTR partition=		=CTR partition=

Neobrain: Reorder and rephase for clarity

2016-09-19T17:21:56Z

Reorder and rephase for clarity

@@ Line 201: / Line 201: @@
 The structure of [[nand/title]] appears to be exactly the same as [[SD Filesystem|SD]], except savegames are stored under the [[System SaveData|nand/data/<ID0>/sysdata]] directory instead.
 The sub-directory name under [[nand/data]] is the SHA256 hash over the [[nand/private/movable.sed|movable.sed]] keyY. This nand/data/<ID0> directory is the NAND equivalent of the "sdmc/Nintendo 3DS/<ID0>/<ID1>" directory, however the data contained here is stored in cleartext. The movable.sed keyY is only used for AES MACs for nand/data/<ID0>. The nand/data/<ID0>/extdata directory contains the shared [[extdata]], and is structured exactly the same way as SD extdata.
   nand
@@ Line 236: / Line 218: @@
   ├── [[Title Data Structure|title]]
   └── [[nand/tmp|tmp]] (This is usually empty, even when installation for a system update still needs [[AMNet:FinishInstallToMedia|finalized]])
 =TWL partition=

Yellows8: /* 0x12C00 */

2016-05-10T11:41:13Z

0x12C00

← Older revision		Revision as of 15:41, 10 May 2016
Line 194:		Line 194:
	\|}		\|}

	This 0x200-byte sector contains New3DS ~~key(s)~~, this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM\|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).		This 0x200-byte sector contains New3DS keys, this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM\|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).

	~~The first two 0x10-byte blocks are~~ encrypted with AES-ECB, ~~therefore the rest of~~ the ~~blocks are presumably encrypted with AES-ECB too~~.		This entire sector is encrypted with AES-ECB, the entire plaintext sector is identical for all retail New3DS systems(unknown for devunits).

	=CTR partition=		=CTR partition=

Profi200: /* NAND structure */

2016-03-20T12:05:39Z

NAND structure

← Older revision		Revision as of 15:05, 20 March 2016
Line 165:		Line 165:
	\|}		\|}

	3DS TWL NAND FAT partitions has FAT volume name "TWL", for CTR FAT partitions this is "CTR". The offset/size for TWL partitions are stored in the MBR partition table, while the CTR partition table info is stored in the NAND NCSD header. Sector0 in the CTR-NAND partition contains a MBR partition table for the ~~TWL-NAND partitions~~, and the MBR signature at +0x1fe.		3DS TWL NAND FAT partitions has FAT volume name "TWL", for CTR FAT partitions this is "CTR". The offset/size for TWL partitions are stored in the MBR partition table, while the CTR partition table info is stored in the NAND NCSD header. Sector0 in the CTR-NAND partition contains a MBR partition table for the nand FAT16 filesystem, and the MBR signature at +0x1fe.

	NAND sectors which were never written to before only contain plaintext 0x00 or 0xFF bytes.		NAND sectors which were never written to before only contain plaintext 0x00 or 0xFF bytes.

Neobrain at 21:19, 21 November 2015

2015-11-21T20:19:17Z

← Older revision		Revision as of 23:19, 21 November 2015
Line 6:		Line 6:
	===Region Changing===		===Region Changing===
	See [https://gist.github.com/yellows8/f15be7a51c38cea14f2c here].		See [https://gist.github.com/yellows8/f15be7a51c38cea14f2c here].

			===Redirection to SD card===
			See [[NAND_Redirection]].

	===Encryption===		===Encryption===

Neobrain: /* NAND structure */

2015-11-04T00:29:37Z

NAND structure

← Older revision		Revision as of 03:29, 4 November 2015
Line 38:		Line 38:
	\|		\|
	\|		\|
	\| NCSD header, this contains the offsets/sizes of the below CTR-NAND partitions. This block also contains the TWL-NAND MBR partition table.		\| [[NCSD]] header, this contains the offsets/sizes of the below CTR-NAND partitions. This block also contains the TWL-NAND MBR partition table.
	\|-		\|-
	\| style="background: green" \| Yes		\| style="background: green" \| Yes

Yellows8: /* 0x12C00 */

2015-03-24T21:45:05Z

0x12C00

← Older revision		Revision as of 00:45, 25 March 2015
Line 180:		Line 180:
	\| 0x0		\| 0x0
	\| 0x10		\| 0x10
	\| Normal-key for keyslot 0x11, used for generating the rest of the New3DS keyslots' keyX by decrypting various data with AES-ECB.		\| Normal-key for keyslot 0x11, used for generating the rest of the New3DS keyslots' keyX by decrypting various data with AES-ECB. With [[9.6.0-24\|9.6.0-X]] this is only used for generating the keyX for keyslots 0x15 and 0x18.
	\|-		\|-
	\| 0x10		\| 0x10
	\| ~~0x1F0~~		\| 0x10
	\| Not yet used as of New3DS FIRM [[9.5.0-22\|9.5.0-X]].		\| [[9.6.0-24\|9.6.0-X]]: Additional normal-key for keyslot 0x11, used for generating the keyX for keyslots 0x16 and 0x19..0x1F.
			\|-
			\| 0x20
			\| 0x1E0
			\| Not yet used as of New3DS FIRM [[9.6.0-24\|9.6.0-X]].
	\|}		\|}

	This 0x200-byte sector contains New3DS key(s), this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM\|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).		This 0x200-byte sector contains New3DS key(s), this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM\|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).

	The first 0x10-byte ~~block is~~ encrypted with AES-ECB, therefore the rest of the blocks are presumably encrypted with AES-ECB too.		The first two 0x10-byte blocks are encrypted with AES-ECB, therefore the rest of the blocks are presumably encrypted with AES-ECB too.

	=CTR partition=		=CTR partition=