Flash Filesystem: Difference between revisions

Profi200 (talk | contribs)
Plailect (talk | contribs)
added all known NAND flash sizes
 
(4 intermediate revisions by 4 users not shown)
Line 1: Line 1:
The Nintendo 3DS has a 1GB NAND Flash chip. Due to the NCSD header, the actual used size of the Old3DS NAND is 0x3AF00000-bytes(943MiB). On New3DS, the actual NAND size and the total size used by the partitions, is 0x4D800000-bytes(1240MiB).
The Nintendo 3DS has several differently sized NAND flash chips. Due to the NCSD header, the actual used size of the Old3DS NAND is 0x3AF00000-bytes(943MiB). On New3DS, the actual NAND size and the total size used by the partitions, is 0x4D800000-bytes(1240MiB).
 
===Physical Size===
{| class="wikitable" border="1"
! Device
! Manufacturer
! Size
|-
| 2DS
| Toshiba
| 0x3AF00000
|-
| 2DS
| Toshiba
| 0x76000000
|-
| 2DS
| Samsung
| 0x3BA00000
|-
| 2DS
| Samsung
| 0x4D800000
|-
| Old3DS
| Toshiba
| 0x3AF00000
|-
| Old3DS
| Samsung
| 0x3BA00000
|-
| New3DS
| Toshiba
| 0x76000000
|-
| New3DS
| Samsung
| 0x4D800000
|-
| New3DS
| Samsung
| 0x74800000
|}


===Format===
===Format===
Line 32: Line 75:
!  Description
!  Description
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|   
|   
|  0x0
|  0x0
Line 43: Line 86:
|  [[NCSD]] header, this contains the offsets/sizes of the below CTR-NAND partitions. This block also contains the TWL-NAND MBR partition table.
|  [[NCSD]] header, this contains the offsets/sizes of the below CTR-NAND partitions. This block also contains the TWL-NAND MBR partition table.
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|   
|   
|  0x00000000
|  0x00000000
Line 54: Line 97:
|  TWL NAND region
|  TWL NAND region
|-
|-
|  style="background: red" | No
|  style="background: #ffccbb" | No
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  
|  
| 0x00012C00
| 0x00012C00
Line 65: Line 108:
| Console-unique encrypted New3DS key-storage, see below.
| Console-unique encrypted New3DS key-storage, see below.
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  twln
|  twln
|  0x00012E00
|  0x00012E00
Line 76: Line 119:
|  TWL-NAND FAT16 File System. (DSi)
|  TWL-NAND FAT16 File System. (DSi)
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  twlp
|  twlp
|  0x09011A00
|  0x09011A00
Line 87: Line 130:
|  TWL-NAND PHOTO FAT12 File System. (DSi)
|  TWL-NAND PHOTO FAT12 File System. (DSi)
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|   
|   
|  0x0B100000
|  0x0B100000
Line 98: Line 141:
|  By default this partition is empty(only contains 0x00/0xFF bytes since it was never written to), when AGB_FIRM was never launched. This contains the AGB_FIRM GBA savegame.
|  By default this partition is empty(only contains 0x00/0xFF bytes since it was never written to), when AGB_FIRM was never launched. This contains the AGB_FIRM GBA savegame.
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  firm0
|  firm0
|  0x0B130000
|  0x0B130000
Line 109: Line 152:
|  [[FIRM|Firmware]] partition.
|  [[FIRM|Firmware]] partition.
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  firm1
|  firm1
|  0x0B530000
|  0x0B530000
Line 120: Line 163:
|  [[FIRM|Firmware]] partition.(Backup partition, same as above)
|  [[FIRM|Firmware]] partition.(Backup partition, same as above)
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: red" | No
|  style="background: #ffccbb" | No
|   
|   
|  0x0B930000
|  0x0B930000
Line 131: Line 174:
|  CTR-NAND partition. (3DS)
|  CTR-NAND partition. (3DS)
|-
|-
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  style="background: red" | No
|  style="background: #ffccbb" | No
|  nand
|  nand
|  0x0B95CA00
|  0x0B95CA00
Line 142: Line 185:
|  CTR-NAND FAT16 File System.
|  CTR-NAND FAT16 File System.
|-
|-
|  style="background: red" | No
|  style="background: #ffccbb" | No
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|   
|   
|  0x0B930000
|  0x0B930000
Line 153: Line 196:
|  CTR-NAND partition. (New3DS)
|  CTR-NAND partition. (New3DS)
|-
|-
|  style="background: red" | No
|  style="background: #ffccbb" | No
|  style="background: green" | Yes
|  style="background: #ccffbb" | Yes
|  nand
|  nand
|  0x0B95AE00
|  0x0B95AE00
Line 194: Line 237:
|}
|}


This 0x200-byte sector contains New3DS key(s), this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).
This 0x200-byte sector contains New3DS keys, this entire sector is encrypted with a console-unique keyX+keyY. The keyX+keyY for this is generated by the New3DS [[FIRM|arm9bin-loader]]. Once the arm9bin-loader finishes decrypting this data, the keyX+keyY in the keyslot are then cleared, then the memory used for generating the keydata is disabled(after it finishes using it for TWL key init).


The first two 0x10-byte blocks are encrypted with AES-ECB, therefore the rest of the blocks are presumably encrypted with AES-ECB too.
This entire sector is encrypted with AES-ECB, the entire plaintext sector is identical for all retail and dev New3DS systems (differing between the two).


=CTR partition=
=CTR partition=
The structure of [[nand/title]] appears to be exactly the same as [[SD Filesystem|SD]], except savegames are stored under the [[System SaveData|nand/data/<ID0>/sysdata]] directory instead.
The structure of [[nand/title]] appears to be exactly the same as [[SD Filesystem|SD]], except savegames are stored under the [[System SaveData|nand/data/<ID0>/sysdata]] directory instead.
The sub-directory name under [[nand/data]] is the SHA256 hash over the [[nand/private/movable.sed|movable.sed]] keyY. This nand/data/<ID0> directory is the NAND equivalent of the "sdmc/Nintendo 3DS/<ID0>/<ID1>" directory, however the data contained here is stored in cleartext. The movable.sed keyY is only used for AES MACs for nand/data/<ID0>. The nand/data/<ID0>/extdata directory contains the shared [[extdata]], and is structured exactly the same way as SD extdata.
The sub-directory name under [[nand/data]] is the SHA256 hash over the [[nand/private/movable.sed|movable.sed]] keyY. This nand/data/<ID0> directory is the NAND equivalent of the "sdmc/Nintendo 3DS/<ID0>/<ID1>" directory, however the data contained here is stored in cleartext. The movable.sed keyY is only used for AES MACs for nand/data/<ID0>. The nand/data/<ID0>/extdata directory contains the shared [[extdata]], and is structured exactly the same way as SD extdata.
The "nandrw" [[FS:OpenArchive|archive]] is mounted at "nand:/rw/", while the "nandro" archive is mounted at "nand:/ro/".
nandro
├── [[nandro/private|private]]
├── [[nandro/shared|shared]]
└── [[nandro/sys|sys]]
    ├── [[nandro/sys/HWCAL0.dat|HWCAL0.dat]]
    └── [[nandro/sys/HWCAL1.dat|HWCAL1.dat]]
nandrw
├── [[nandrw/shared|shared]]
└── [[nandrw/sys|sys]]
    ├── [[nandrw/sys/lgy.log|lgy.log]] (This is written to by [[FIRM|TWL_FIRM]] when errors occur, this is equivalent to native.log)
    ├── [[nandrw/sys/LocalFriendCodeSeed_B|LocalFriendCodeSeed_B]]
    ├── [[nandrw/sys/native.log|native.log]] (This is written to by [[ErrDisp]])
    ├── [[nandrw/sys/rand_seed|rand_seed]]
    ├── [[nandrw/sys/SecureInfo_A|SecureInfo_A]]
    └── [[nandrw/sys/updater.log|updater.log]]


  nand
  nand
Line 236: Line 261:
  ├── [[Title Data Structure|title]]
  ├── [[Title Data Structure|title]]
  └── [[nand/tmp|tmp]] (This is usually empty, even when installation for a system update still needs [[AMNet:FinishInstallToMedia|finalized]])
  └── [[nand/tmp|tmp]] (This is usually empty, even when installation for a system update still needs [[AMNet:FinishInstallToMedia|finalized]])
The "ro" and "rw" directories are accessible through the "nandrw" and "nandro" [[FS:OpenArchive|archives]], respectively. Their contents are as follows:
ro
├── [[nandro/private|private]]
├── [[nandro/shared|shared]]
└── [[nandro/sys|sys]]
    ├── [[nandro/sys/HWCAL0.dat|HWCAL0.dat]]
    └── [[nandro/sys/HWCAL1.dat|HWCAL1.dat]]
rw
├── [[nandrw/shared|shared]]
└── [[nandrw/sys|sys]]
    ├── [[nandrw/sys/lgy.log|lgy.log]] (This is written to by [[FIRM|TWL_FIRM]] when errors occur, this is equivalent to native.log)
    ├── [[nandrw/sys/LocalFriendCodeSeed_B|LocalFriendCodeSeed_B]]
    ├── [[nandrw/sys/native.log|native.log]] (This is written to by [[ErrDisp]])
    ├── [[nandrw/sys/rand_seed|rand_seed]]
    ├── [[nandrw/sys/SecureInfo_A|SecureInfo_A]]
    └── [[nandrw/sys/updater.log|updater.log]]


=TWL partition=
=TWL partition=