242
edits
Changes
Jump to navigation
Jump to search
Line 1:
Line 1: − + − + − + − + − + Line 20:
Line 20: − + − + Line 29:
Line 29: − + − + − '''NOTE: For a full understanding of the steps involved in decryption, consult the [https://github.com/Relys/Project_CTR ctrtool] and [https://github.com/archshift/Decrypt9 Decrypt9] source code instead.'''.+ − Starting with [[9.6.0-24|9.6.0-X]] Process9, there is a different method of generating the NCCH keyY which is enabled by setting the bitmask 0x20 in ncchflag[7]: The keyY will be set to a SHA256 hash generated with the 0x20 bytes of data constituted by the old-method-keyY and a unique content lock seed (each of which are 0x10 bytes wide), where seeds for downloaded titles that use the new crypto are stored in [[Filesystem_services#SEEDDB|SEEDDB]] (nand:/data/<console-unique>/sysdata/0001000f/00000000). The decryption is transparent to ARM11 userland: When FSUSER OpenFile is used with a NCCH archive which uses this crypto, the FS-module will add the seed-data from SEEDDB to the end of the file lowpath used for [[FSPXI:OpenFile]], using which Process9 then gets the hash for calculating the NCCH keyY. It has been observed that this new keyY generation is only used for [[RomFS]] and for [[ExeFS]] sections other than "icon" and "banner" (the same sections which would be used for the additional NCCH keyslots, however this keyY generation can be used without any additional NCCH keyslot). Not applying the encryption to "icon" and "banner" was presumably done to support pre-loading of games from the eShop (i.e. being able to download and install titles without being able to start them until official release).+ − If a certain NCCH flag is set, a fixed AES key is used. There are two fixed keys, one for titles which have the system category bit set (SystemFixedKey), and one for the rest ("zeros" key). These are debug keys, as they aren't nomally supported on retail systems.+ − As of [[7.0.0-13|7.0.0-X]] the system supports a new encryption method for secure-crypto (when ncchflag[3] != 0). Where a second key is generated using the same keyY but with another [[AES|keyslot]]. The second key is used to crypt the [[RomFS]] and [[ExeFS]] files which don't have filenames "icon" or "banner" (i.e. ".code" and ".firm"). While everything else is crypted with the original key. Note the CTR used is the same for both keys. This makes titles "recognizable" but not "launchable" on systems which don't support this method or the keyslot used.+ + + − See below for the keyslots used for the additional NCCH keyslots. On Old3DS, as of [[9.6.0-24|9.6.0-X]], Process9 will *only* use keyslot 0x25 when ncchflag[3] is non-zero.+ Line 48:
Line 50: − + + + + + + + − + Line 59:
Line 67: − + Line 65:
Line 73: − + + + + + + + + + + + + + + + + + Line 87:
Line 111: − + − + − + Line 141:
Line 165: − + Line 207:
Line 231: + + Line 314:
Line 340: − − === Extended Header === − See [[NCCH/Extended Header|this]]. − − See also: [https://github.com/3dshax/ctr/blob/master/ctrtool/exheader.h] − + − − [[3DSExplorer]] - (GUI)(Windows Only) Parsing NCCH files
→Encryption: Just document the encryption stuff here instead of external link
[[Category:File formats]]
[[Category:File formats]]
The following text tries to document the structure of the NCCH container format.
The following text tries to document the structure of the NCCH (Nintendo Content Container Header) container format. This format is used to store the content of any installed [[Titles|title]].
== Overview ==
== Overview ==
There are two known NCCH container specialisations used on the 3DS, "executable" and "non-executable", officially known as CXI and CFA respectively.
There are two known NCCH container specializations used on the 3DS, "executable" and "non-executable", officially known as CXI and CFA, respectively.
== CXI ==
=== CXI ===
The CXI (CTR Executable Image) specialisation of the NCCH container contains executable code, which runs on a single ARM11 core.
The CXI (CTR Executable Image) specialization of the NCCH container contains executable code, which runs on a single ARM11 core.
The CXI format is structured in the following order:
The CXI format is structured in the following order:
* first a NCCH header,
* first a NCCH header,
* followed by an [[#Extended_Header|extended header]],
* followed by an [[NCCH/Extended Header|extended header]],
* followed by an access descriptor,
* followed by an access descriptor,
* followed by an '''optional''' plain binary region,
* followed by an '''optional''' plain binary region,
The plain binary region is an area specifically stored in plaintext, mostly containing SDK library strings for identification.
The plain binary region is an area specifically stored in plaintext, mostly containing SDK library strings for identification.
== CFA ==
=== CFA ===
The CFA (CTR File Archive) specialisation of the NCCH container, is not executable, but are used in conjunction with CXI files. For instance the DLP Child Container and the Electronic Manual. (There is a system update NCCH which follows this format, but is used by the 3DS rather than the Application NCCH, and only works when embedded in the [[CCI]] format because the nVer is kept in the header of retail [[CCI]] files instead of the application NCCH). There are CFA files which exist alone in a title, but these are just [[Title list|System Data Archive]] titles and are found only in the [[Flash Filesystem#CTR partition|NAND]].
The CFA (CTR File Archive) specialization of the NCCH container is not executable, but is used in conjunction with CXI files, e.g. the DLP Child Container and the Electronic Manual. (There is a system update NCCH which follows this format, but is used by the 3DS rather than the Application NCCH, and only works when embedded in the [[CCI]] format because the nVer is kept in the header of retail [[CCI]] files instead of the application NCCH). There are CFA files which exist alone in a title, but these are just [[Title list|System Data Archive]] titles and are found only in the [[Flash Filesystem#CTR partition|NAND]].
CFA files are structured in the following order:
CFA files are structured in the following order:
* followed by an '''optional''' read-only filesystem ([[RomFS]])
* followed by an '''optional''' read-only filesystem ([[RomFS]])
== NCCH Specs ==
== Container File Format ==
=== Encryption ===
=== Encryption ===
The extended header, the [[ExeFS]], and the [[RomFS]] are encrypted using [https://github.com/3dshax/ctr/blob/master/ctrtool/ncch.c 128-bit AES CTR] unless the NoCrypto mask is set in ncchflag[7]. There are different sets of encryption parameters in use, as over the time new system updates introduced more sophisticated means of encryption. Generally, the decryption key is generated using the [[AES|AES Engine]] key generator by selecting a particular key slot (see below), the keyX of which is usually set by the bootrom and keyY of which was originally set to the first 0x10 bytes of the NCCH signature.
The [[NCCH/Extended Header|extended header]], the [[ExeFS]], and the [[RomFS]] are encrypted using [https://github.com/3dshax/ctr/blob/master/ctrtool/ncch.c 128-bit AES CTR] unless the NoCrypto flag is set in ncchflag[7]. There are different sets of encryption parameters in use, as over the time new system updates introduced more sophisticated means of encryption.
All encrypted regions are grouped into two categories, each of which uses one kind of encryption scheme:
* The "menu info" group, including the [[NCCH/Extended Header|extended header]], the [[ExeFS]] header, and the files "icon" and "banner" in [[ExeFS]], which are needed to display the game on the menu regardless whether system version supports the game, or whether the pre-downloaded eshop game is officially released.
* The "content" group, including the rest files (".code" and ".firm") in [[ExeFS]], and the entire [[RomFS]], which is needed for actually running the game, and which can be only decrypted on the supported system (and when the seed is officially released for eshop games).
The decryption key is generated using the [[AES|AES Engine]]. The keyX and keyY for each group are set as follows:
* The "menu info" group uses the primary key, always generated by keyX in the slot 0x2C (set by bootrom) and keyY from the first 0x10 bytes of the NCCH signature.
* The "content" group uses the secondary key. The slot selection for keyX depends on ncchflag[3], as listed in the table below.
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! FW Introduced
! FW Introduced
! Old3DS
! Old3DS
! AES Keyslot
! [[AES#Keyslot|AES Keyslots]]
! Notes
! Notes
|-
| 0x00
| The initial version
| style="background: #ccffbb" | Yes
| 0x2C
| This keyslot is initialized by bootrom. This is the same key as the primary key.
|-
|-
| 0x01
| 0x01
| [[7.0.0-13|7.0.0-X]]
| [[7.0.0-13|7.0.0-X]]
| style="background: green" | Yes
| style="background: #ccffbb" | Yes
| 0x25
| 0x25
| This keyslot is [[Savegames|initialized]] by the 6.0 gamecard savegame keyY init function during boot, using a different portion of the [[Savegames|final]] hash (this keyslot is separate from the one used for the 6.0 save crypto).
| This keyslot is [[Savegames|initialized]] by the 6.0 gamecard savegame keyY init function during boot, using a different portion of the [[Savegames|final]] hash (this keyslot is separate from the one used for the 6.0 save crypto).
| 0x0A
| 0x0A
| [[9.3.0-21|9.3.0-X]]
| [[9.3.0-21|9.3.0-X]]
| style="background: red" | No
| style="background: #ffccbb" | No
| 0x18
| 0x18
| This keyslot is initialized by [[FIRM#New_3DS_FIRM|arm9loader]] on New3DS starting with [[8.1.0-0_New3DS]], but only [[9.3.0-21|9.3.0-X]] and later know how to use it with ncchflag[3].
| This keyslot is initialized by [[FIRM#New_3DS_FIRM|arm9loader]] on New3DS starting with [[8.1.0-0_New3DS]], but only [[9.3.0-21|9.3.0-X]] and later know how to use it with ncchflag[3].
| 0x0B
| 0x0B
| [[9.6.0-24|9.6.0-X]]
| [[9.6.0-24|9.6.0-X]]
| style="background: red" | No
| style="background: #ffccbb" | No
| 0x1B
| 0x1B
| [[9.6.0-24|9.6.0-X]]'s [[FIRM#New_3DS_FIRM|arm9loader]] changed the contents of keyslots 0x19-0x1F; 9.6.0-X was the first time they were officially used, so this is not a breaking change (there is no content that would use the old versions of those keys).
| [[9.6.0-24|9.6.0-X]]'s [[FIRM#New_3DS_FIRM|arm9loader]] changed the contents of keyslots 0x19-0x1F; 9.6.0-X was the first time they were officially used, so this is not a breaking change (there is no content that would use the old versions of those keys).
|}
|}
Besides all rules above, if ncchflag[7] bitmask 0x1 is set, and a fixed AES key instead is used for both groups. There are two fixed keys, one for titles which have the system category bit set (SystemFixedKey), and one for the rest ("zeros" key). These are debug keys, as they aren't nomally supported on retail systems.
The initial CTR for decryption each region is generated from the partition ID, as described below:
* if the version field (NCCH header + 0x112) is 0 or 2, the 16-byte CTR is [partition_id[7], partition_id[6], ..., partition_id[0], M, 0, ..., 0], where
** The 8-byte partition ID starts from the beginning in the reverse order. If the partition ID is viewed as a little-endian u64, and the CTR is viewed as big-endian u128, then this is to put the partition ID to the most significant bits of the CTR
** CTR[8] is set to a magic number M. For [[NCCH/Extended Header|extended header]], M = 1. For [[ExeFS]], M = 2. For [[RomFS]], M = 3.
** The rest 7 bytes (the least significant bits of big-endian CTR) are set to zero
* if the version field is 1, the 16-byte CTR is [partition_id[0], partition_id[1], ...,partition_id[7], 0, 0, 0, 0, T[0], T[1], T[2], T[3]], where
** The 8-byte partition ID starts from the beginning in the same order.
** Then four zeros follow.
** Then a number T in big-endian follows. This number is the offset of each encrypted region to the NCCH beginning. So for [[NCCH/Extended Header|extended header]], T = 0x200. For [[ExeFS]]/[[RomFS]]. T = 0x200 * ExeFS/RomFS offset in media units
Note that due to the key generation schemes described above, ExeFS can contain regions using different keys. Regardless of this, both regions shared the same initial CTR at the beginning of ExeFS. If one region doesn't start at the beginning of ExeFS, its actual CTR at its own beginning = ExeFS CTR + (region offset / AESBlockSize=16)
=== Format ===
=== Format ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! OFFSET
! Offset
! SIZE
! Size
! DESCRIPTION
! Description
|-
|-
| 0x000
| 0x000
| 0x180
| 0x180
| 4
| 4
| Extended header size
| Extended header size, in bytes
|-
|-
| 0x184
| 0x184
| RomFS superblock SHA-256 hash - (SHA-256 hash, starting at 0x0 of the RomFS over the number of media units specified in the RomFS hash region size)
| RomFS superblock SHA-256 hash - (SHA-256 hash, starting at 0x0 of the RomFS over the number of media units specified in the RomFS hash region size)
|}
|}
Given offsets are based on the start of the file.
=== NCCH Flags ===
=== NCCH Flags ===
009E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
009E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
009F0 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 02 . .............
009F0 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 02 . .............
== Tools ==
== Tools ==
[https://github.com/3dshax/ctr/tree/master/ctrtool ctrtool] - (CMD)(Windows/Linux) Parsing and decrypting(debug only) NCCH files
[https://github.com/profi200/Project_CTR/tree/master/ctrtool ctrtool] - (CMD)(Windows/Linux) Parsing and decrypting (debug only) NCCH files