Changes

2,603 bytes added ,  18 February
m
Fix dead link
Line 1: Line 1: −
'''Mii Maker''' lets you create Miis, like Wii Mii Channel. Here you can transfer Miis locally from other 3DSes, or from Wii Mii Channel. 3DS Miis can't be transfered to Wii Mii Channel, only from Wii.
+
'''Mii Maker''' lets you create [[Mii]]s, and is the successor of the Wii's Mii Channel.
 +
 
 +
It can transfer Miis over [[NWM_Services|local wireless]] from other systems running Mii Maker (3DS/Wii U), or receive, but not send, from Mii Channel.
    
== Wii Mii Channel transfer protocol ==
 
== Wii Mii Channel transfer protocol ==
Line 7: Line 9:  
== Mii QR Code format ==
 
== Mii QR Code format ==
   −
3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to [http://www.denso-wave.com/qrcode Denso-Wave Inc] web site for QR Code format specifications). It contain 112 byte of binary data. 3DS seems to have fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code. The data itself is encrypted, presumably AES-CTR since some xorpads can be determined from known plaintext here. The CTR might be based on data stored here?
+
3DS Mii QR is a standard 57x57 pixel Level 10 High ECC QR code with 'Mii' logo in center (refer to [http://www.denso-wave.com/qrcode Denso-Wave Inc] web site for QR Code format specifications). It contains 0x70-bytes of binary data. 3DS seems to have a fully implemented QR-code decoder, as it can interpret such Mii binary data being encoded even in the smallest possible for that data size Level 6 Low ECC QR code.
 +
 
 +
The data itself is encrypted with AES-CCM, xorpads can be determined from known plaintext here. The Mii Maker application uses the [[NS]] APT Wrap/Unwrap commands to encrypt/decrypt this Mii data. For the NS [[APT:Unwrap|Unwrap]] command, the Mii Maker application uses nonceoffset=12, noncesize=10, and inputbuffer-size=0x60. Note that the actual nonce size is 8 bytes due to Wrap/Unwrap implementation, and the nonce data should be moved 12 bytes afterwards after decryption. The rest of the data at 0x8-0x5F is encrypted, and should be split into two parts after decryption, with the nonce data in the middle. (See [[APT:Wrap|Wrap]] and [[APT:Unwrap|Unwrap]] for more information)
    
{| class="wikitable"
 
{| class="wikitable"
Line 17: Line 21:  
| 0x0
 
| 0x0
 
| 0x4
 
| 0x4
| Mii ID (big-endian 32-bit unsigned integer)
+
| Mii ID (big-endian 32-bit unsigned integer)<br/>The most significant 3 bits determine whether the Mii is Special, Foreign, or Normal [https://web.archive.org/web/20071011001718/http://www.davidhawley.co.uk/special-miis-gold-pants-and-creating.aspx]<br/>time_offset = (mii_id & 0x0FFFFFFF) * 2;<br/>time_offset is the time the Mii was created, represented as the number of seconds since 01/01/2010 00:00:00
 
  −
The most significant 3 bits determine whether the Mii is Special, Foreign, or Normal [http://www.davidhawley.co.uk/special-miis-gold-pants-and-creating.aspx]
  −
 
  −
time_offset = (mii_id & 0x0FFFFFFF) * 2;
  −
 
  −
time_offset is the time the Mii was created, represented as the number of seconds since 01/01/2010 00:00:00
   
|-
 
|-
 
| 0x4
 
| 0x4
Line 30: Line 28:  
|-
 
|-
 
| 0x8
 
| 0x8
| 0x1
+
| 0x4
| unknown
+
| [[Mii#Mii_ID|Mii ID]], the encrypted data begins here.
 +
|-
 +
| 0xC
 +
| 0x8
 +
| System ID (this ID is produced by the output from [https://www.3dbrew.org/wiki/Cfg:GenHashConsoleUnique GenHashConsoleUnique(0x0)])
 
|-
 
|-
| 0x9
+
| 0x14
| 0x1
+
| 0x2
| Allow Copying
+
| Low 2 octets of MAC address
 
|-
 
|-
| 0xA
+
| 0x16
| 0xE
+
| 0x2
| unknown
+
| padding (0000)
 
|-
 
|-
 
| 0x18
 
| 0x18
Line 47: Line 49:  
| 0x1A
 
| 0x1A
 
| 0x14
 
| 0x14
| UTF-16 Mii Name
+
| UTF-16 Mii Name (10 chars max)
 
|-
 
|-
 
| 0x2E
 
| 0x2E
 
| 0x2
 
| 0x2
| unknown
+
| width & height
 
|-
 
|-
 
| 0x30
 
| 0x30
 
| 0x1
 
| 0x1
| Mii Sharing Value
+
| bit 0: disable sharing<br/>bit 1-4: face shape<br/>bit 5-7: skin color
 
|-
 
|-
 
| 0x31
 
| 0x31
| 0xB
+
| 0x1
 +
| bit 0-3: wrinkles<br/>bit 4-7: makeup
 +
|-
 +
| 0x32
 +
| 0x1
 +
| hair style
 +
|-
 +
| 0x33
 +
| 0x1
 +
| bit 0-2: hair color<br/>bit 3: flip hair
 +
|-
 +
| 0x34
 +
| 0x4
 
| unknown
 
| unknown
 +
|-
 +
| 0x38
 +
| 0x1
 +
| bit 0-4: eyebrow style<br/>bit 5-7: eyebrow color
 +
|-
 +
| 0x39
 +
| 0x1
 +
| bit 0-3: eyebrow scale<br/>bit 4-6: eyebrow yscale
 +
|-
 +
| 0x3A
 +
| 0x2
 +
| note that the bytes are swapped over (little-endian layout)<br/>bit 0-3: eyebrow rotation<br/>bit 5-8: eyebrow x spacing<br/>bit 9-13: eyebrow y position
 
|-
 
|-
 
| 0x3C
 
| 0x3C
Line 79: Line 105:  
| 0x48
 
| 0x48
 
| 0x14
 
| 0x14
| UTF-16 Author Name
+
| UTF-16 Author Name (10 chars max)
 
|-
 
|-
 
| 0x5C
 
| 0x5C
Line 87: Line 113:  
| 0x5E
 
| 0x5E
 
| 0x2
 
| 0x2
| unknown (seems like the start of the checksum)
+
| CRC16 over the previous 0x5E
 
|-
 
|-
 
| 0x60
 
| 0x60
 
| 0x10
 
| 0x10
| AES-CCM MAC?
+
| AES-CCM MAC
 +
|}
 +
 
 +
* QR codes made from the same 3DS for the same Mii are use the same AES-CCM nonce (you can recreate the xorpad by xoring with known values from this table).
 +
 
 +
== Mii Database ==
 +
 
 +
Created, received, or even met-in-multiplayer Miis are saved in [[Mii|CFL_DB.dat]].
 +
 
 +
== Savedata ==
 +
=== editSaveData.bin ===
 +
{| class="wikitable"
 +
|-
 +
! Offset
 +
! Length
 +
!
 +
|-
 +
| 0x0
 +
| 0x4
 +
| "TIDE" header (EDIT byteswapped)
 +
|-
 +
| 0x4
 +
| 0x4
 +
| zero
 +
|-
 +
| 0xC
 +
| 0x4 (?)
 +
| 01000000 (constant?)
 +
|-
 +
| 0x100
 +
| 0x4
 +
| Number of scanned Special Mii QRs
 +
|-
 +
| 0x104
 +
| -
 +
| Some data identifying each scanned Special Mii QRs, for the purpose of not making them scannable again. 8 or 12 byte each?
 +
|-
 +
| 0x2904
 +
| 0x4
 +
| Checksum?
 
|}
 
|}
   −
* Codes made from the same 3DS for the same Mii are encrypted with the same xorpad (you can recreate it by xoring with known values from this table).
+
 
 +
== ExtData ==
 +
The ExtData [[Extdata#Filesystem|File System]] for Mii Maker is as follows:
 +
 
 +
root
 +
├── icon
 +
├── boss
 +
└── user
 +
    └── ExBanner
 +
        └── COMMON.bin
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
!  File
 +
!  Details
 +
!  Size
 +
!  FW Introduced
 +
!  Plaintext
 +
|-
 +
|  icon
 +
|  Duplicate from Application ExeFS. Always image 00000002.
 +
|  0x36c0 Bytes
 +
|  [[1.0.0-0]]
 +
|  [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/MiiMakerExtdata/icon Download]
 +
|-
 +
|  COMMON.bin
 +
|  [[Extended Banner]] for Home Menu. Always image 00000003.
 +
|  0x20224 Bytes
 +
|  [[1.0.0-0]]
 +
|  [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/MiiMakerExtdata/COMMON.bin Download]
 +
|}
1

edit