3dbrew

Flash Filesystem: Difference between revisions

← Older edit
Neobrain (talk | contribs)
549 edits
Kynex7510 (talk | contribs)
99 edits
mNo edit summary
 
(7 intermediate revisions by 6 users not shown)
Line 1: Line 1:
The Nintendo 3DS has a 1GB NAND Flash chip. Due to the NCSD header, the actual used size of the Old3DS NAND is 0x3AF00000-bytes(943MiB). On New3DS, the actual NAND size and the total size used by the partitions, is 0x4D800000-bytes(1240MiB).
The Nintendo 3DS has several differently sized NAND flash chips. Due to the NCSD header, the actual used size of the Old3DS NAND is 0x3AF00000-bytes(943MiB). On New3DS, the actual NAND size and the total size used by the partitions, is 0x4D800000-bytes(1240MiB).
 
===Physical Size===
{| class="wikitable" border="1"
! Device
! Manufacturer
! Size
|-
| 2DS
| Toshiba
| 0x3AF00000
|-
| 2DS
| Toshiba
| 0x76000000
|-
| 2DS
| Samsung
| 0x3BA00000
|-
| 2DS
| Samsung
| 0x4D800000
|-
| Old3DS
| Toshiba
| 0x3AF00000
|-
| Old3DS
| Samsung
| 0x3BA00000
|-
| New3DS
| Toshiba
| 0x76000000
|-
| New3DS
| Samsung
| 0x4D800000
|-
| New3DS
| Samsung
| 0x74800000
|}


===Format===
===Format===
Line 6: Line 49:
===Region Changing===
===Region Changing===
See [https://gist.github.com/yellows8/f15be7a51c38cea14f2c here].
See [https://gist.github.com/yellows8/f15be7a51c38cea14f2c here].
===Redirection to SD card===
See [[NAND_Redirection]].


===Encryption===
===Encryption===


The NAND file system is encrypted using [[AES|AES-CTR]]. The TWL regions of NAND use the TWL NAND [[AES|keyslot]], while the CTR regions use the CTR NAND [[AES|keyslots]]. The keyslot used for each partition is determined by the NCSD partition FS type and encryption type. The TWL/CTR NAND regions are specified by the NCSD header. The first 0x0B100000 bytes of NAND is encrypted with the TWL keyslot, however before 0x00012E00 only the MBR partition table is encrypted with the TWL keyslot. That region contains the TWL partitions listed below.
The NAND file system is encrypted using [[AES|AES-CTR]]. The TWL regions of NAND use the TWL NAND [[AES|keyslot]], while the nonce is the sha1 hash of the NAND CID, byte reversed. The CTR regions use the CTR NAND [[AES|keyslots]], while the nonce is the sha256 hash of the NAND CID. The keyslot used for each partition is determined by the NCSD partition FS type and encryption type. The TWL/CTR NAND regions are specified by the NCSD header. The first 0x0B100000 bytes of NAND is encrypted with the TWL keyslot, however before 0x00012E00 only the MBR partition table is encrypted with the TWL keyslot. That region contains the TWL partitions listed below.


The New3DS CTRNAND partition uses a [[AES|keyslot]] separate from the Old3DS one.
The New3DS CTRNAND partition uses a [[AES|keyslot]] separate from the Old3DS one.
Line 29: Line 75:
!  Description
!  Description
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|   
|   
|  0x0
|  0x0
Line 40: Line 86:
|  [[NCSD]] header, this contains the offsets/sizes of the below CTR-NAND partitions. This block also contains the TWL-NAND MBR partition table.
|  [[NCSD]] header, this contains the offsets/sizes of the below CTR-NAND partitions. This block also contains the TWL-NAND MBR partition table.
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|   
|   
|  0x00000000
|  0x00000000
Line 51: Line 97:
|  TWL NAND region
|  TWL NAND region
|-
|-
|  style="background: red" | No
|  style="background: #ffccbb" | No
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  
|  
| 0x00012C00
| 0x00012C00
Line 62: Line 108:
| Console-unique encrypted New3DS key-storage, see below.
| Console-unique encrypted New3DS key-storage, see below.
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  twln
|  twln
|  0x00012E00
|  0x00012E00
Line 73: Line 119:
|  TWL-NAND FAT16 File System. (DSi)
|  TWL-NAND FAT16 File System. (DSi)
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  twlp
|  twlp
|  0x09011A00
|  0x09011A00
Line 84: Line 130:
|  TWL-NAND PHOTO FAT12 File System. (DSi)
|  TWL-NAND PHOTO FAT12 File System. (DSi)
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|   
|   
|  0x0B100000
|  0x0B100000
Line 95: Line 141:
|  By default this partition is empty(only contains 0x00/0xFF bytes since it was never written to), when AGB_FIRM was never launched. This contains the AGB_FIRM GBA savegame.
|  By default this partition is empty(only contains 0x00/0xFF bytes since it was never written to), when AGB_FIRM was never launched. This contains the AGB_FIRM GBA savegame.
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  firm0
|  firm0
|  0x0B130000
|  0x0B130000
Line 106: Line 152:
|  [[FIRM|Firmware]] partition.
|  [[FIRM|Firmware]] partition.
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  firm1
|  firm1
|  0x0B530000
|  0x0B530000
Line 117: Line 163:
|  [[FIRM|Firmware]] partition.(Backup partition, same as above)
|  [[FIRM|Firmware]] partition.(Backup partition, same as above)
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: red" | No
|  style="background: #ffccbb" | No
|   
|   
|  0x0B930000
|  0x0B930000
Line 128: Line 174:
|  CTR-NAND partition. (3DS)
|  CTR-NAND partition. (3DS)
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: red" | No
|  style="background: #ffccbb" | No
|  nand
|  nand
|  0x0B95CA00
|  0x0B95CA00
Line 139: Line 185:
|  CTR-NAND FAT16 File System.
|  CTR-NAND FAT16 File System.
|-
|-
|  style="background: red" | No
|  style="background: #ffccbb" | No
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|   
|   
|  0x0B930000
|  0x0B930000
Line 150: Line 196:
|  CTR-NAND partition. (New3DS)
|  CTR-NAND partition. (New3DS)
|-
|-
|  style="background: red" | No
|  style="background: #ffccbb" | No
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  nand
|  nand
|  0x0B95AE00
|  0x0B95AE00
Line 162: Line 208:
|}
|}


3DS TWL NAND FAT partitions has FAT volume name "TWL", for CTR FAT partitions this is "CTR". The offset/size for TWL partitions are stored in the MBR partition table, while the CTR partition table info is stored in the NAND NCSD header. Sector0 in the CTR-NAND partition contains a MBR partition table for the TWL-NAND partitions, and the MBR signature at +0x1fe.
3DS TWL NAND FAT partitions has FAT volume name "TWL", for CTR FAT partitions this is "CTR". The offset/size for TWL partitions are stored in the MBR partition table, while the CTR partition table info is stored in the NAND NCSD header. Sector0 in the CTR-NAND partition contains a MBR partition table for the nand FAT16 filesystem, and the MBR signature at +0x1fe.


NAND sectors which were never written to before only contain plaintext 0x00 or 0xFF bytes.
NAND sectors which were never written to before only contain plaintext 0x00 or 0xFF bytes.
Line 191: Line 237:
|}
|}


This 0x200-byte sector contains New3DS key(s), this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).
This 0x200-byte sector contains New3DS keys, this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).


The first two 0x10-byte blocks are encrypted with AES-ECB, therefore the rest of the blocks are presumably encrypted with AES-ECB too.
This entire sector is encrypted with AES-ECB, the entire plaintext sector is identical for all retail and dev New3DS systems (differing between the two).


=CTR partition=
=CTR partition=
The structure of [[nand/title]] appears to be exactly the same as [[SD Filesystem|SD]], except savegames are stored under the [[System SaveData|nand/data/<ID0>/sysdata]] directory instead.
The structure of [[nand/title]] appears to be exactly the same as [[SD Filesystem|SD]], except savegames are stored under the [[System SaveData|nand/data/<ID0>/sysdata]] directory instead.
The sub-directory name under [[nand/data]] is the SHA256 hash over the [[nand/private/movable.sed|movable.sed]] keyY. This nand/data/<ID0> directory is the NAND equivalent of the "sdmc/Nintendo 3DS/<ID0>/<ID1>" directory, however the data contained here is stored in cleartext. The movable.sed keyY is only used for AES MACs for nand/data/<ID0>. The nand/data/<ID0>/extdata directory contains the shared [[extdata]], and is structured exactly the same way as SD extdata.
The sub-directory name under [[nand/data]] is the SHA256 hash over the [[nand/private/movable.sed|movable.sed]] keyY. This nand/data/<ID0> directory is the NAND equivalent of the "sdmc/Nintendo 3DS/<ID0>/<ID1>" directory, however the data contained here is stored in cleartext. The movable.sed keyY is only used for AES MACs for nand/data/<ID0>. The nand/data/<ID0>/extdata directory contains the shared [[extdata]], and is structured exactly the same way as SD extdata.
The "nandrw" [[FS:OpenArchive|archive]] is mounted at "nand:/rw/", while the "nandro" archive is mounted at "nand:/ro/".
nandro
├── [[nandro/private|private]]
├── [[nandro/shared|shared]]
└── [[nandro/sys|sys]]
    ├── [[nandro/sys/HWCAL0.dat|HWCAL0.dat]]
    └── [[nandro/sys/HWCAL1.dat|HWCAL1.dat]]
nandrw
├── [[nandrw/shared|shared]]
└── [[nandrw/sys|sys]]
    ├── [[nandrw/sys/lgy.log|lgy.log]] (This is written to by [[FIRM|TWL_FIRM]] when errors occur, this is equivalent to native.log)
    ├── [[nandrw/sys/LocalFriendCodeSeed_B|LocalFriendCodeSeed_B]]
    ├── [[nandrw/sys/native.log|native.log]] (This is written to by [[ErrDisp]])
    ├── [[nandrw/sys/rand_seed|rand_seed]]
    ├── [[nandrw/sys/SecureInfo_A|SecureInfo_A]]
    └── [[nandrw/sys/updater.log|updater.log]]


  nand
  nand
Line 233: Line 261:
  ├── [[Title Data Structure|title]]
  ├── [[Title Data Structure|title]]
  └── [[nand/tmp|tmp]] (This is usually empty, even when installation for a system update still needs [[AMNet:FinishInstallToMedia|finalized]])
  └── [[nand/tmp|tmp]] (This is usually empty, even when installation for a system update still needs [[AMNet:FinishInstallToMedia|finalized]])
The "ro" and "rw" directories are accessible through the "nandrw" and "nandro" [[FS:OpenArchive|archives]], respectively. Their contents are as follows:
ro
├── [[nandro/private|private]]
├── [[nandro/shared|shared]]
└── [[nandro/sys|sys]]
    ├── [[nandro/sys/HWCAL0.dat|HWCAL0.dat]]
    └── [[nandro/sys/HWCAL1.dat|HWCAL1.dat]]
rw
├── [[nandrw/shared|shared]]
└── [[nandrw/sys|sys]]
    ├── [[nandrw/sys/lgy.log|lgy.log]] (This is written to by [[FIRM|TWL_FIRM]] when errors occur, this is equivalent to native.log)
    ├── [[nandrw/sys/LocalFriendCodeSeed_B|LocalFriendCodeSeed_B]]
    ├── [[nandrw/sys/native.log|native.log]] (This is written to by [[ErrDisp]])
    ├── [[nandrw/sys/rand_seed|rand_seed]]
    ├── [[nandrw/sys/SecureInfo_A|SecureInfo_A]]
    └── [[nandrw/sys/updater.log|updater.log]]


=TWL partition=
=TWL partition=
Retrieved from "https://www.3dbrew.org/wiki/Flash_Filesystem"