The following text tries to document the structure of the CTR Executable Image (CXI) format.

Overview

A CXI file contains the 'application' program code, which runs on a single ARM11 core. It can communicate through SVC calls with the other ARM11 core running the 'system' program code. For reasons of clarity, the ARM11 cores will sometimes be called the 'appcore' and 'syscore' respectively.

The CXI file format contains application ARM11 code, the menu icon, the menu 3D model, and an embedded read-only (ROM) filesystem for external filestorage. In fact, the application ARM11 code, menu icon, and menu 3D model are embedded into its own filesystem, called the ExeFS.

More specifically, the CXI file format is structured in the following order:

  • first an NCCH header,
  • followed by an extended header,
  • followed by a plain binary region,
  • followed by an embedded executable filesystem (ExeFS),
  • and finally followed by a read-only filesystem (RomFS).

The extended header contains additional information regarding access control. The plain binary region is an area specifically stored in plaintext, mostly containing SDK library strings for identification.

The extended header, the ExeFS and the RomFS are encrypted using AES CTR.


NCCH Header

OFFSET SIZE DESCRIPTION
0x000 0x100 RSA-2048 signature of the NCCH header, using SHA-256.
0x100 4 Magic ID, always 'NCCH'
0x104 4 Content size, in media units (1 media unit = 0x200 bytes)
0x108 8 Partition ID
0x110 2 Maker code
0x112 2 Version
0x114 4 Reserved
0x118 8 Program ID
0x120 1 Temp flag
0x121 0x2F Reserved
0x150 0x10 Product code
0x160 0x20 Extended header hash
0x180 4 Extended header size
0x184 4 Reserved
0x188 8 Flags
0x190 4 Plain region offset, in media units
0x194 4 Plain region size, in media units
0x198 8 Reserved
0x1A0 4 ExeFS offset, in media units
0x1A4 4 ExeFS size, in media units
0x1A8 4 ExeFS hash region size, in media units
0x1AC 4 Reserved
0x1B0 4 RomFS offset, in media units
0x1B4 4 RomFS size, in media units
0x1B8 4 RomFS hash region size, in media units
0x1BC 4 Reserved
0x1C0 0x20 ExeFS superblock hash
0x1E0 0x20 RomFS superblock hash