Difference between revisions of "Mii Maker"

From 3dbrew
Jump to navigation Jump to search
(27 intermediate revisions by 10 users not shown)
Line 1: Line 1:
−
'''Mii Maker''' lets you create Miis, like Wii Mii Channel. Here you can transfer Miis locally from other 3DSes, or from Wii Mii Channel. 3DS Miis can't be transfered to Wii Mii Channel, only from Wii.
+
'''Mii Maker''' lets you create [[Mii]]s, and is the successor of the Wii's Mii Channel.
 +
 
 +
It can transfer Miis over [[NWM_Services|local wireless]] from other systems running Mii Maker (3DS/Wii U), or receive, but not send, from Mii Channel.
  
 
== Wii Mii Channel transfer protocol ==
 
== Wii Mii Channel transfer protocol ==
  
−
The Wii beacons are similar to the usual multi-cart NDS beacons, except: beacon_type is zero, and payload size is 0x14. The payload data is just the Wii UCS-2 nickname, with some extra unused zero data. The usual multi-cast NDS protocol is used for sending the 3DS nick to the Wii. After many keep-alive frames, it eventually sends a bunch of frames, each containing the whole Mii. There's a 6-byte header, followed by [http://wiibrew.org/wiki/Wiimote/Mii_Data Mii data]. At the end of these frames like most NDS frames is the 0200 byte marker.
+
The Wii beacons are similar to the usual multi-cart NDS beacons, except: beacon_type is zero, and payload size is 0x14. The payload data is just the Wii UTF-16 nickname, with some extra unused zero data. The usual multi-cast NDS protocol is used for sending the 3DS nick to the Wii. After many keep-alive frames, it eventually sends a bunch of frames, each containing the whole Mii. There's a 6-byte header, followed by [http://wiibrew.org/wiki/Wiimote/Mii_Data Mii data]. At the end of these frames like most NDS frames is the 0200 byte marker.
  
 
== Mii QR Code format ==
 
== Mii QR Code format ==
  
−
3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to [http://www.denso-wave.com/qrcode Denso-Wave Inc] web site for QR Code format specifications). It contain 112 byte of binary data. 3DS seems to have fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code. The data itself is ciphered, algorithm is unknown yet.
+
3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to [http://www.denso-wave.com/qrcode Denso-Wave Inc] web site for QR Code format specifications). It contains 0x70-bytes of binary data. 3DS seems to have a fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code.
 +
 
 +
The data itself is encrypted with AES-CCM, xorpads can be determined from known plaintext here. The Mii Maker application uses the [[NS]] APT Wrap/Unwrap commands to encrypt/decrypt this Mii data. For the NS [[APT:Unwrap|Unwrap]] command, the Mii Maker application uses nonceoffset=12, noncesize=10, and inputbuffer-size=0x60. Note that the actual nonce size is 8 bytes due to Wrap/Unwrap implementation, and the nonce data should be moved 12 bytes afterwards after decryption. The rest of the data at 0x8-0x5F is encrypted, and should be split into two parts after decryption, with the nonce data in the middle. (See [[APT:Wrap|Wrap]] and [[APT:Unwrap|Unwrap]] for more information)
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 17: Line 21:
 
| 0x0
 
| 0x0
 
| 0x4
 
| 0x4
−
| unknown (MiiID ? usually starts with 0x912)
+
| Mii ID (big-endian 32-bit unsigned integer)<br/>The most significant 3 bits determine whether the Mii is Special, Foreign, or Normal [http://www.davidhawley.co.uk/special-miis-gold-pants-and-creating.aspx]<br/>time_offset = (mii_id & 0x0FFFFFFF) * 2;<br/>time_offset is the time the Mii was created, represented as the number of seconds since 01/01/2010 00:00:00
 
|-
 
|-
 
| 0x4
 
| 0x4
 
| 0x4
 
| 0x4
−
| High 4 octets of MAC address in clear text [http://www.adminsub.net/mac-address-finder/nintendo]
+
| High 4 octets of MAC address [http://www.adminsub.net/mac-address-finder/nintendo]
 
|-
 
|-
 
| 0x8
 
| 0x8
−
| 0x10
+
| 0x4
 +
| [[Mii#Mii_ID|Mii ID]], the encrypted data begins here.
 +
|-
 +
| 0xC
 +
| 0x8
 +
| System ID (this ID is produced by the output from [https://www.3dbrew.org/wiki/Cfg:GenHashConsoleUnique GenHashConsoleUnique(0x0)])
 +
|-
 +
| 0x14
 +
| 0x2
 +
| Low 2 octets of MAC address
 +
|-
 +
| 0x16
 +
| 0x2
 +
| padding (0000)
 +
|-
 +
| 0x18
 +
| 0x2
 +
| Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt, ??
 +
|-
 +
| 0x1A
 +
| 0x14
 +
| UTF-16 Mii Name (10 chars max)
 +
|-
 +
| 0x2E
 +
| 0x2
 +
| width & height
 +
|-
 +
| 0x30
 +
| 0x1
 +
| bit 0: disable sharing<br/>bit 1-4: face shape<br/>bit 5-7: skin color
 +
|-
 +
| 0x31
 +
| 0x1
 +
| bit 0-3: wrinkles<br/>bit 4-7: makeup
 +
|-
 +
| 0x32
 +
| 0x1
 +
| hair style
 +
|-
 +
| 0x33
 +
| 0x1
 +
| bit 0-2: hair color<br/>bit 3: flip hair
 +
|-
 +
| 0x34
 +
| 0x4
 
| unknown
 
| unknown
 
|-
 
|-
−
| 0x18
+
| 0x38
 +
| 0x1
 +
| bit 0-4: eyebrow style<br/>bit 5-7: eyebrow color
 +
|-
 +
| 0x39
 +
| 0x1
 +
| bit 0-3: eyebrow scale<br/>bit 4-6: eyebrow yscale
 +
|-
 +
| 0x3A
 +
| 0x2
 +
| note that the bytes are swapped over (little-endian layout)<br/>bit 0-3: eyebrow rotation<br/>bit 5-8: eyebrow x spacing<br/>bit 9-13: eyebrow y position
 +
|-
 +
| 0x3C
 
| 0x1
 
| 0x1
−
| Bit-mapped Sex, Birthday, ??
+
| Allow Copying
 +
|-
 +
| 0x3D
 +
| 0x3
 +
| unknown
 
|-
 
|-
−
| 0x19
+
| 0x40
−
| 0x14
+
| 0x1
−
| UTF-16 Mii Name
+
| Mii Sharing Value
 
|-
 
|-
−
| 0x2D
+
| 0x41
−
| 0x2A
+
| 0x7
 
| unknown
 
| unknown
 
|-
 
|-
−
| 0x47
+
| 0x48
 
| 0x14
 
| 0x14
−
| UTF-16 Author Name
+
| UTF-16 Author Name (10 chars max)
 
|-
 
|-
−
| 0x5B
+
| 0x5C
−
| 0x15
+
| 0x2
 
| unknown
 
| unknown
 +
|-
 +
| 0x5E
 +
| 0x2
 +
| CRC16 over the previous 0x5E
 +
|-
 +
| 0x60
 +
| 0x10
 +
| AES-CCM MAC
 +
|}
 +
 +
* QR codes made from the same 3DS for the same Mii are use the same AES-CCM nonce (you can recreate the xorpad by xoring with known values from this table).
 +
 +
== Mii Database ==
 +
 +
Created, received, or even met-in-multiplayer Miis are saved in [[Mii|CFL_DB.dat]].
 +
 +
== Savedata ==
 +
=== editSaveData.bin ===
 +
{| class="wikitable"
 +
|-
 +
! Offset
 +
! Length
 +
!
 +
|-
 +
| 0x0
 +
| 0x4
 +
| "TIDE" header (EDIT byteswapped)
 +
|-
 +
| 0x4
 +
| 0x4
 +
| zero
 +
|-
 +
| 0xC
 +
| 0x4 (?)
 +
| 01000000 (constant?)
 +
|-
 +
| 0x100
 +
| 0x4
 +
| Number of scanned Special Mii QRs
 +
|-
 +
| 0x104
 +
| -
 +
| Some data identifying each scanned Special Mii QRs, for the purpose of not making them scannable again. 8 or 12 byte each?
 +
|-
 +
| 0x2904
 +
| 0x4
 +
| Checksum?
 +
|}
 +
 +
 +
== ExtData ==
 +
The ExtData [[Extdata#Filesystem|File System]] for Mii Maker is as follows:
 +
 +
root
 +
├── icon
 +
├── boss
 +
└── user
 +
    └── ExBanner
 +
        └── COMMON.bin
 +
 +
{| class="wikitable" border="1"
 +
|-
 +
!  File
 +
!  Details
 +
!  Size
 +
!  FW Introduced
 +
!  Plaintext
 +
|-
 +
|  icon
 +
|  Duplicate from Application ExeFS. Always image 00000002.
 +
|  0x36c0 Bytes
 +
|  [[1.0.0-0]]
 +
|  [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/MiiMakerExtdata/icon Download]
 +
|-
 +
|  COMMON.bin
 +
|  [[Extended Banner]] for Home Menu. Always image 00000003.
 +
|  0x20224 Bytes
 +
|  [[1.0.0-0]]
 +
|  [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/MiiMakerExtdata/COMMON.bin Download]
 
|}
 
|}

Revision as of 05:24, 28 February 2018

Mii Maker lets you create Miis, and is the successor of the Wii's Mii Channel.

It can transfer Miis over local wireless from other systems running Mii Maker (3DS/Wii U), or receive, but not send, from Mii Channel.

Wii Mii Channel transfer protocol

The Wii beacons are similar to the usual multi-cart NDS beacons, except: beacon_type is zero, and payload size is 0x14. The payload data is just the Wii UTF-16 nickname, with some extra unused zero data. The usual multi-cast NDS protocol is used for sending the 3DS nick to the Wii. After many keep-alive frames, it eventually sends a bunch of frames, each containing the whole Mii. There's a 6-byte header, followed by Mii data. At the end of these frames like most NDS frames is the 0200 byte marker.

Mii QR Code format

3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to Denso-Wave Inc web site for QR Code format specifications). It contains 0x70-bytes of binary data. 3DS seems to have a fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code.

The data itself is encrypted with AES-CCM, xorpads can be determined from known plaintext here. The Mii Maker application uses the NS APT Wrap/Unwrap commands to encrypt/decrypt this Mii data. For the NS Unwrap command, the Mii Maker application uses nonceoffset=12, noncesize=10, and inputbuffer-size=0x60. Note that the actual nonce size is 8 bytes due to Wrap/Unwrap implementation, and the nonce data should be moved 12 bytes afterwards after decryption. The rest of the data at 0x8-0x5F is encrypted, and should be split into two parts after decryption, with the nonce data in the middle. (See Wrap and Unwrap for more information)

Offset Length
0x0 0x4 Mii ID (big-endian 32-bit unsigned integer)
The most significant 3 bits determine whether the Mii is Special, Foreign, or Normal [1]
time_offset = (mii_id & 0x0FFFFFFF) * 2;
time_offset is the time the Mii was created, represented as the number of seconds since 01/01/2010 00:00:00
0x4 0x4 High 4 octets of MAC address [2]
0x8 0x4 Mii ID, the encrypted data begins here.
0xC 0x8 System ID (this ID is produced by the output from GenHashConsoleUnique(0x0))
0x14 0x2 Low 2 octets of MAC address
0x16 0x2 padding (0000)
0x18 0x2 Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt, ??
0x1A 0x14 UTF-16 Mii Name (10 chars max)
0x2E 0x2 width & height
0x30 0x1 bit 0: disable sharing
bit 1-4: face shape
bit 5-7: skin color
0x31 0x1 bit 0-3: wrinkles
bit 4-7: makeup
0x32 0x1 hair style
0x33 0x1 bit 0-2: hair color
bit 3: flip hair
0x34 0x4 unknown
0x38 0x1 bit 0-4: eyebrow style
bit 5-7: eyebrow color
0x39 0x1 bit 0-3: eyebrow scale
bit 4-6: eyebrow yscale
0x3A 0x2 note that the bytes are swapped over (little-endian layout)
bit 0-3: eyebrow rotation
bit 5-8: eyebrow x spacing
bit 9-13: eyebrow y position
0x3C 0x1 Allow Copying
0x3D 0x3 unknown
0x40 0x1 Mii Sharing Value
0x41 0x7 unknown
0x48 0x14 UTF-16 Author Name (10 chars max)
0x5C 0x2 unknown
0x5E 0x2 CRC16 over the previous 0x5E
0x60 0x10 AES-CCM MAC
  • QR codes made from the same 3DS for the same Mii are use the same AES-CCM nonce (you can recreate the xorpad by xoring with known values from this table).

Mii Database

Created, received, or even met-in-multiplayer Miis are saved in CFL_DB.dat.

Savedata

editSaveData.bin

Offset Length
0x0 0x4 "TIDE" header (EDIT byteswapped)
0x4 0x4 zero
0xC 0x4 (?) 01000000 (constant?)
0x100 0x4 Number of scanned Special Mii QRs
0x104 - Some data identifying each scanned Special Mii QRs, for the purpose of not making them scannable again. 8 or 12 byte each?
0x2904 0x4 Checksum?


ExtData

The ExtData File System for Mii Maker is as follows: 

root
├── icon
├── boss
└── user
    └── ExBanner
        └── COMMON.bin
File Details Size FW Introduced Plaintext
icon Duplicate from Application ExeFS. Always image 00000002. 0x36c0 Bytes 1.0.0-0 Download
COMMON.bin Extended Banner for Home Menu. Always image 00000003. 0x20224 Bytes 1.0.0-0 Download
Retrieved from "https://www.3dbrew.org/w/index.php?title=Mii_Maker&oldid=20620"