Changes

Jump to navigation Jump to search
3,027 bytes added ,  7 April
no edit summary
Line 10: Line 10:  
*Required for initialization of [[eShop]], (for first time eShop users). Not required for using eShop after first use.
 
*Required for initialization of [[eShop]], (for first time eShop users). Not required for using eShop after first use.
   −
Every time the system connects to the wifi AP, the BOSS(SpotPass) module itself will download the cleartext xml policylist: "https://nppl.c.app.nintendowifi.net/p01/policylist/3/<countrycode>". This policylist contains a list of SpotPass tasks for certain titles. This policylist can control whether the specified tasks are processed at all. The user-agent used for all SpotPass HTTP(S) requests(including this policylist) is: "PBOS-5.0/<printed hex u64 LocalFriendCodeSeed>-<unknown hex u64>/<text [[CVer|system]] [[NVer|version]]>/<unknown decimal value>/0".
+
In some cases the BOSS module will add the following URL parameter to HTTPS requests, when connected to a [[Nintendo Zone]] AP: "ap=<NZoneApNum>" or when using a specific [[Cfg:GetSystemModel|system model]]: "tm=<SystemModelNumber>". The Old 3DS and Old 3DS XL don't set this value.
 +
 
 +
== policylist ==
 +
Every time the system connects to the wifi AP, the BOSS ("Background online storage service" = SpotPass) module itself will download the cleartext xml policylist: "https://nppl.c.app.nintendowifi.net/p01/policylist/3/<countrycode>". This policylist contains a list of SpotPass tasks for certain titles. This policylist can control whether the specified tasks are processed at all.
 +
 
 +
As of the policylist updated 2017-11-08, this stops the <tt>OlvNotf</tt> (Miiverse notification sync) task for <tt>000400300000bc00</tt>, <tt>000400300000bd00</tt>, <tt>000400300000be00</tt> for all regions and <tt>basho0</tt> for the [[Home Menu]]. Japan also has the <tt>9ER_NTD</tt> task blocked for いつの間にテレビ (<tt>0004000000034700</tt>).
 +
 
 +
== User Agent ==
 +
 
 +
The default user-agent used for SpotPass HTTPS requests (including the policylist) has the following format:
 +
 
 +
<tt><user agent codename>-<user agent version>/<printed hex u64 [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]]>-<printed hex u64 [[FRDU:GetMyFriendKey|Friend]] [[FRDU:PrincipalIdToFriendCode|Code]]>/<text [[CVer|system]] [[NVer|version]]>/<unknown decimal value>/<[[Cfg:GetSystemModel|system model number]]></tt>
 +
 
 +
The codename can be set to either <tt>PBOS</tt> (Production BOSS?) or <tt>DBOS</tt> (Development BOSS?) depending if the console is a [[Configuration_Memory#UNITINFO|retail]] unit. As of system version 11.17, the user agent version is hardcoded to 8.0 and the decimal value is set to 62452 (0xF3F4).
 +
 
 +
No user-agent is used for plaintext HTTP requests with SpotPass.
    
== Titles Spotpass usage ==
 
== Titles Spotpass usage ==
Line 30: Line 45:  
== Automatic System Update Download ==
 
== Automatic System Update Download ==
 
See [[Automatic System Update Download]].
 
See [[Automatic System Update Download]].
 +
 +
== BOSS Sysmodule Savegame==
 +
See [[BOSS Savegame]]
    
== Content Container ==
 
== Content Container ==
   −
SpotPass content can use this container to encrypt the payload and sign it, however SpotPass also supports downloading raw content without this container. The cleartext content is stored in [[extdata]]. The format of these headers is big-endian.
+
SpotPass content must use this container to encrypt the payload and sign it, for content downloads. The cleartext content is stored in [[extdata]]. The format of these headers is big-endian.
    
=== BOSS Header ===
 
=== BOSS Header ===
Line 56: Line 74:  
| 0xC
 
| 0xC
 
| 0x8
 
| 0x8
| u64 release date (UNIX timestamp)
+
| u64 serial number (?)
 
|-
 
|-
 
| 0x14
 
| 0x14
Line 76: Line 94:  
| 0x1C
 
| 0x1C
 
| 0xC
 
| 0xC
| First 12 bytes of the CTR
+
| First 12 bytes of the Initialization Vector (IV)
 
|}
 
|}
   −
Data following the BOSS header is encrypted with AES-CTR. The first 12 bytes of the CTR are from offset 0x1C of the header, while the last word of the CTR in big-endian is 0x1. The CTR from the header is random per file, and an unique random CTR is used each time the content is updated. The cleartext data begins with the content header.
+
Data following the BOSS header is encrypted with AES-CTR. The AES key that is used is stored in [[AES_Registers#Keyslots|keyslot 0x38]]. The first 12 bytes of the IV are from offset 0x1C of the header, while the last 32-bit integer of the IV in big-endian is 0x1. The IV from the header is random per file, and an unique random IV is used each time the content is updated. The cleartext data begins with the content header.
 +
 
 +
The 64-bit number at 0xC may be a serial number which is increased every time someone requested to sign and create a boss container for a file. The 3DS sees the downloaded file as new if this number is different from the previous download (Doesn't matter if the number is bigger or smaller).
 +
 
 +
The boss system module v13314 begins at address 0x0010eb98 with the function for parsing the BOSS header.
    
=== Content Header ===
 
=== Content Header ===
Line 94: Line 116:  
| 0x10
 
| 0x10
 
| 0x2
 
| 0x2
| FileID used for the extdata filename
+
| Number of payload contents (Payload Content Header + Payload)
 
|-
 
|-
 
| 0x12
 
| 0x12
Line 105: Line 127:  
|}
 
|}
   −
The first 0x10-bytes are all-zero except the first byte which is 0x80. It's unknown what the first 0x10-bytes are used for.
+
The first 0x10-bytes are all-zero except the first byte which is usually 0x80. It's unknown what the first 0x10-bytes are used for.
   −
The hash at offset 0x12 hashes the 0x12-byte data at offset 0x0 followed by a zero u16. The RSA signature is signed by Nintendo. Following this header is the actual content payload, which is written to a cleartext file under the [[extdata]] /boss directory. The data following the payload header is written to extdata, but it's unknown what data is written to the extdata file before the content payload.
+
The 16-bit value at 0x10 tells how many payload contents follow after this the content header. For example there can be a downloaded file for a game followed by a message for the news system module.
 +
 
 +
The hash at offset 0x12 hashes the 0x12-byte data at offset 0x0 followed by a zero u16. The RSA signature is signed by Nintendo. Following this header is the actual content payload, which is written to a cleartext file under the [[extdata]] /boss directory.
    
=== Payload Content Header ===
 
=== Payload Content Header ===
Line 126: Line 150:  
| 0xC
 
| 0xC
 
| 0x4
 
| 0x4
| Usually 0x10001?
+
| Content datatype, used for filtering with [[BOSSU:GetNsDataIdList]].
 +
Usually 0x10001? (observed 0x20001 in eShop strings)
 
|-
 
|-
 
| 0x10
 
| 0x10
Line 134: Line 159:  
| 0x14
 
| 0x14
 
| 0x4
 
| 0x4
| Extdata FileID
+
| [[BOSS_Services|NsDataId]], used for generating the extdata filepath.
 
|-
 
|-
 
| 0x18
 
| 0x18
 
| 0x4
 
| 0x4
| ?
+
| Probably some version field for the payload
 
|-
 
|-
 
| 0x1C
 
| 0x1C
 
| 0x20
 
| 0x20
| SHA-256 hash, unknown what this hashes
+
| SHA-256 hash
 
|-
 
|-
 
| 0x3C
 
| 0x3C
Line 150: Line 175:     
This signature is signed by Nintendo with the same key-pair as the content header.
 
This signature is signed by Nintendo with the same key-pair as the content header.
 +
 +
The hash at offset 0x1C hashes the 0x1C-byte data at offset 0x0 followed by a zero u16, followed by all of the remaining cleartext data following this header(the actual content data).
 +
 +
The downloaded boss data is written in the following format to extdata.
 +
First an extdata header in the following format
 +
{| class="wikitable"
 +
|-
 +
! Offset
 +
! Length
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x1
 +
| Size of header including this field. Always 0x18
 +
|-
 +
| 0x1
 +
| 0xB
 +
| Usually zero?
 +
|-
 +
| 0xC
 +
| 0x4
 +
| Unknown
 +
|-
 +
| 0x10
 +
| 0x4
 +
| Download date in format: Bit 0-6 = day, Bit 7-10 = month, Bit 11-21 = year
 +
|-
 +
| 0x14
 +
| 0x4
 +
| Usually zero? Padding?
 +
|}
 +
Followed by the Payload Content Header without the hash and signature (first 0x1C bytes) and the actual payload.
 +
 +
==Tools==
 +
* [http://wiiucodes.ddnss.eu/tools/BossDecryptor3DS.zip BossDecryptor3DS] Decrypts an encrypted boss container
 +
* [http://wiiucodes.ddnss.eu/tools/BossEncryptor3DS.zip BossEncryptor3DS] Builds and encrypts a file into a boss container
    
[[Category:Nintendo Software]]
 
[[Category:Nintendo Software]]
77

edits

Navigation menu