6,263
edits
Changes
Jump to navigation
Jump to search
Line 443:
Line 443: − + − + + + + + + + + + + + + + + + + + + +
→0x10012000
=0x10012000=
=0x10012000=
Keys seem to be stored here? Access to this region is disabled once the ARM9 writes 0x2 to [[CONFIG|REG_SYSPROT9]]. Before writing that bit, the ARM9 copies the low u32 for the TWL keydata to +0x100 (and high u32 keydata to +0x104 with the New 3DS). On development units ([[CONFIG|UNITINFO]]!=0) ARM9 uses the first 8-bytes from 0x10012000 for the TWL keydata.
Keys seem to be stored here? Access to this region is disabled once the ARM9 writes 0x2 to [[CONFIG|REG_SYSPROT9]].
Originally the above TWL keyinit + region disable was done by Kernel9. However, with the [[New_3DS]] FIRM ARM9 binary this is now done in the [[FIRM]] ARM9 binary loader, which also uses the 0x10012000 region for key generation.
Originally the console-unique TWL keyinit + region disable was done by Kernel9. However, with the [[New_3DS]] FIRM ARM9 binary this is now done in the [[FIRM]] ARM9 binary loader, which also uses the 0x10012000 region for key generation.
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| On development units ([[CONFIG|UNITINFO]]!=0) ARM9 uses the first 8-bytes from 0x10012000 for the TWL keydata. This doesn't seem to be used by NATIVE_FIRM on retail, besides New3DS key-generation in the [[FIRM|ARM9-loader]].
|-
| 0x8
| 0xF8
| ?
|-
| 0x100
| 0x8
| Before writing REG_SYSPROT9 bit1, the ARM9 copies the 8-byte TWL-keydata to here.
|}