Memory layout: Difference between revisions

Line 471:

| 0x4100

| 0x800

| ~~Unknown~~, ~~not console~~-~~unique~~.

| These are RSA-2048 keys: 4 slots, each slot is 0x200-bytes. Slot+0 is the modulo, slot+0x100 is the private-exponent. This can be confirmed by RSA-decrypting a message into a signature, then RSA-encrypting the signature back into a message, and comparing the original message with the output from the last operation.

[[FIRM]] doesn't seem to ever use these. None of these are related to RSA-keyslot0 used for v6.0/v7.0 key generation. These modulus are separate from all other modulus used elsewhere.

|-

| 0x01FFC900

Line 517:

Line 519:

* 0x01FFD398 is the keyX used for 'Tad' crypto, usually in keyslot 0x02 "Nintendo DS", ..

* 0x01FFD3A8 is set as the middle two words of keyslot 0x03's keyX, before being overwritten "NINTENDO"

* 0x01FFD3BC is the ~~first 3 words of~~ keyslot 0x01~~'s keyY~~, see below

* 0x01FFD3BC is the keyY for keyslot 0x01, see below

* 0x01FFD3C8 is the fixed keyY used for eMMC partition crypto on retail DSi, see below (keyslot 0x03)

* 0x01FFD3E0 is the 0x1048-byte Blowfish data for DSi cart crypto

* 0x01FFE428 is the 0x1048-byte Blowfish data for DS cart crypto

On the 3DS, keyslots ~~0x02~~ and 0x03 have the last word set as 0xE1A00005 instead of the ~~original DSi~~ retail ~~keyYs~~.

On the 3DS, keyslots 0x01 and 0x03 have the last word set as 0xE1A00005 instead of the next word in ITCM. This is consistent with retail DSis.

|-

| 0x01FFF470

@@ Line 471: / Line 471: @@
 | 0x4100
 | 0x800
-| Unknown, not console-unique.
+| These are RSA-2048 keys: 4 slots, each slot is 0x200-bytes. Slot+0 is the modulo, slot+0x100 is the private-exponent. This can be confirmed by RSA-decrypting a message into a signature, then RSA-encrypting the signature back into a message, and comparing the original message with the output from the last operation.
+[[FIRM]] doesn't seem to ever use these. None of these are related to RSA-keyslot0 used for v6.0/v7.0 key generation. These modulus are separate from all other modulus used elsewhere.
 |-
 | 0x01FFC900
@@ Line 517: / Line 519: @@
 * 0x01FFD398 is the keyX used for 'Tad' crypto, usually in keyslot 0x02 "Nintendo DS", ..
 * 0x01FFD3A8 is set as the middle two words of keyslot 0x03's keyX, before being overwritten "NINTENDO"
-* 0x01FFD3BC is the first 3 words of keyslot 0x01's keyY, see below
+* 0x01FFD3BC is the keyY for keyslot 0x01, see below
 * 0x01FFD3C8 is the fixed keyY used for eMMC partition crypto on retail DSi, see below (keyslot 0x03)
 * 0x01FFD3E0 is the 0x1048-byte Blowfish data for DSi cart crypto
 * 0x01FFE428 is the 0x1048-byte Blowfish data for DS cart crypto
-On the 3DS, keyslots 0x02 and 0x03 have the last word set as 0xE1A00005 instead of the original DSi retail keyYs.
+On the 3DS, keyslots 0x01 and 0x03 have the last word set as 0xE1A00005 instead of the next word in ITCM. This is consistent with retail DSis.
 |-
 | 0x01FFF470