Changes

Jump to navigation Jump to search
8,461 bytes added ,  08:24, 21 July 2012
no edit summary
''このテンプレートは[[:Category:Stubs|カテゴリ:Stubs]]のタグが付きます。''</noinclude>
=== 暗号化方式 ===This page describes the format, encryption, etc. of savegames stored in 3DS game cartridges/gamecards and SD/NAND. You can find savegames from various 3DS games on the [[Games]] page.
3DSのセーブデータはゲームカートにまさにDSのそれと同じように保存されています。
DSではこのようなセーブデータはそのまま保存されていましたが、3DSにおいては暗号化して保存する仕組みが加わりました。
これはとてもストリームの暗号化に似ています。排他的論理和を取ることによって、セーブデータの復号鍵が
得られます。                                                                                            
このアルゴリズムを解読できるのは、たった512バイトのキーによって暗号化されているためです。言ってみれば、512バイト周期で同じように復号しているわけです。つまり、暗号化されても、その排他的論理和を取る事によってキーを作ることができます。残念ながら、既存の平文をを暗号化するときにこの方法を使うと、誰でもキーを得ることができるのです。=== Gamecard Savegame Encryption ===
ということで、ここからどうやって3DSでセーブデータを復号するのでしょうか?まず、データを512バイトの区切りに分けます。次に、データで最も多いのは0xFFであるはずなので、ある値がそれにあてはまるはずです。そこで最もよく使われている値を探します。これを基準値とします。そして、元のセーブデータとを取ることで完全な復号化されたデータをえることができます。もう一度基準値とその排他的論理和を取れば、データを復号化することができます。On the 3DS savegames are stored much like on the DS, that is on a FLASH chip in the gamecart. On the DS these savegames were stored in plain-text but on the 3DS a layer of encryption was added. This is highly likely a streamcipher, as the contents of several savegames exhibit the odd behavior that xor-ing certain parts of the savegame together will result in the plain-text appearing. The reason this works is because the stream cipher used has a period of 512 bytes. That is to say, it will repeat the same keystream after 512 bytes. The way you encrypt with a stream cipher is you XOR your data with the keystream as it is produced. Unfortunately, if your streamcipher repeats and you are encrypting a known plain-text (in our case, zeros) you are basically giving away your valuable keystream. So how do you use this to decrypt a savegame on a 3DS? First off, you chunk up the savegame into 512 byte chunks. Then, you bin these chunks by their contents, discarding any that contain only FF. Now look for the most common chunk. This is your keystream. Now XOR the keystream with your original savegame and you should have a fully decrypted savegame. XOR with the keystream again to produce an encrypted savegame. All savegames, including non-gamecard savegames, are encrypted with AES-CTR. The base CTR never changes after savegame creation. The CTR used for gamecard savegames eventually repeats, while non-gamecard savegames don't use a repeating CTR. For the old gamecard CTR method, it repeated every 0x200-bytes. With the new method it repeats at least every 0x1000-bytes, but the exact period isn't known for certain. Update: With system version [[2.0.0-4]] the system now uses a different CTR method, which fixed the above flaw. The xorpad seems to repeat in the file but not every 0x200 bytes. So for now it is unknown how to decrypt the newer save files. '''Games to use the new encryption:'''* Super Mario 3D Land* Mario Kart 7* Need for Speed - The Run '''Some information:'''* Old games saves still use the old 0x200-bytes AES-CTR xorpad.* New games saves can be backed-up and restored.* The wearleveling stayed the same.* Xoring two files together can produce some clear text* It's been spotted that the AES-CTR xorpad repeated after 0x1000 bytes (so it might be the maximum length but still it's not proved).
=== Wear leveling ===
The 3DS employs a wearleveling wear leveling scheme on the savegame FLASH chips. This is done trough through the usage of blockmaps and a journal. The blockmap is located at offset 0 of the flash chip, and is immediately followed by the journal. The initial state is dictated by the blockmap, and the journal is then applied to that.
First, there are 8 bytes whose purposes are currently unknown. Then comes the actual blockmap.
The blockmap structure is simple:
<pre>
struct header_entry {
uint8_t phys_sec; // when bit7 is set, block has checksums, otherwise checksums are all zero
uint8_t alloc_cnt;
uint8_t chksums[8];
uint8_t phys_sec;
uint8_t alloc_cnt;
} __attribute__((__packed__));
</pre>
There's one entry per sector, counting from physical sector 1 (sector 0 contains the blockmap/journal).
 
The 2 bytes that follow the blockmap are the CRC16 (with starting value 0xFFFF (like modbus)) of the first 8 bytes and the blockmap.
 
Then comes the journal.
The journal structure is as follows:
<pre>
With magic being a constant 0x080d6ce0.
 
The checksums in the blockmap/journal entries work as follows:
* each byte is the checksum of an encrypted 0x200 bytes large block
* to calculate the checksum, a CRC16 of the block (with starting value 0xFFFF) is calculated, and the two bytes of the CRC16 are XORed together to produce the 8bit checksum
=== Partitions ===
There can be multiple partitions on the chip. For some games one is The partitions are represented by tables of DIFI blobs inside a backup partition, some other games seem to use only one partition, yet other games actually use multiple partitionsDISA structure. Partitions are defined at The order of the DIFI blobs is the start order of the de-wearleveled blobpartitions in the chip. At offset 0x200  '''DISA''' * If the uint32 @ 0x168 into the imagein the DISA(the low 8-bits) is non-zero, then first table is is hashed, otherwise the second DIFI blobs starttable is hashed. These 0x130 large blobs describe * If the partitions. Every table has more then 1 DIFI blob describes a then the uint32 @ 0x168 is the offset from the DATA partition. In order to find the partitions, you will need file base (masked with 0xFFFFFFFE).* At offset 0x0 in the uint32_t at 0x9C into image is a 0x10-byte MAC over the DIFI blob0x100-byte DISA/DIFF, and it might be AES-CCM MAC but it's unknown for certain. The following 0xf0-bytes after the uint32_t at 0xA4MAC normally must be zero, it's unknown whether this can ever be non-zero. The uint32_t at 0x9C describes  {| class="wikitable"|-! Start! Length! Description|-| 0x00| 4| Magic ("DISA")|-| 0x04| 4| Magic Number (0x40000)|-| 0x08| 8| Partition table size|-| 0x10| 8| Offset to primary partition table in DISA|-| 0x18| 8| Offset to secondary partition table in DISA|-| 0x20| 8| Partition table's length|-| 0x28| 8| SAVE Partition entry offset in the partition table|-| 0x30| 8| SAVE Partition entry length of in the hash partition table at |-| 0x38| 8| DATA Partition entry offset in the start of partition table|-| 0x40| 8| DATA Partition entry length in the partitiontable|-| 0x48| 8| SAVE Partition offset|-| 0x50| 8| SAVE Partition length|-| 0x58| 8| DATA Partition offset|-| 0x60| 8| DATA Partition length|-| 0x68| 4| Active table (and the offset to the filebase)|-| 0x6C| 0x20| Hash from active table|-| 0x8C| 4*29| Unknown|} * The hash in the DISA hashes the Active Table (starting from tables's offset to tables's offset + table length) with SHA256. * The partitions offsets points to a 0x1000 long block which isn't understood yet. The actual information starts after that block. The DIFIs table @ 0x200 (into the image) is written twice, (Meaning, if there's 4 DIFI blobs then the uint32_t table is 2 DIFIs long). The second table is for backup. The active table is mentioned at 0xA4 0x13C into the image (1=First table, other=Second Table) '''DIFF''' * This is the length [[extdata]] equivalent of DISA, for extdata which use FS. DIFF is *only* used with extdata, not regular savegames. * When the active-table field low 8-bits is non-zero, the filesystemprimary partition is used. Partitions are catted togetherOtherwise, so the end of one secondary partition is used. {| class="wikitable"|-! Start! Length! Description|-| 0x00| 4| Magic ("DIFF")|-| 0x04| 4| Magic Number (0x30000)|-| 0x08| 8| Primary partition table offset|-| 0x10| 8| Secondary partition table offset|-| 0x18| 8| Partition table length|-| 0x20| 4| Active table (and the offset to the beginning filebase)|-| 0x24| 0x20| Unknown|-| 0x34| 0x20| Hash of the next. active partition table|-| 0x54| 0x1ac| Unknown|} '''DIFI'''
The first These 0x130 large blobs describe the partitions. Every DIFI blob describes a partition starts at 0x2000. The hashtable at Partitions are catted together, so after the start end of one partition is the partitions describe each in-use block in the partition with a SHA256 beginning of the 0x1000 sized blocknext.
* The exact location of Actually DIFI blobs are 0x12C large because the partition can vary in each save/game.* The first two hashes don't seem to be associated with any 0x1000 block.* The last 0x20 bytes of the hash table, doesn't 4 are not used and appear to change along with the rest of the data and repeats 0xFFFFFFFF at the end of all other hash-tables, even when the hashes/data are differentencrypted image.
For most games there's only 1 partition (The hash in the DISA blob hashes 300 bytes of the first DIFI blobSAVE partition) and some (like Asphalt 3D, Steel Diver & Lego Star Wars III) has 2 partitions.
* If 2 Partitions means that the uint32 before files inside the hash in the DISA SAVE partition is 0x01, on the first DIFI blob is hashed, if other partition (we would call it's 0x00 the second DIFI is hashed. The offsets and size for each DIFI can be found beneath the DISA tag (10h, 20h and 18h, 30h relative to the DISA locationDATA partition).
* No more than 2 partitions have been seen yet (and can't be because of the DISA known structure).
{| class=== ファイルシステム==="wikitable"|-! Start! Length! Description|-| 0x00| 4| Magic ("DIFI")|-| 0x04| 4| Magic Number (0x10000)|-| 0x08| 8| Offset to "IVFC" blob in DIFI (usually 0x44)|-| 0x10| 8| Size of "IVFC" blob|-| 0x18| 8| Offset to "DPFS" blob in DIFI (usually 0xBC)|-| 0x20 | 8セーブデータは「SAVE」という特殊なファイルシステムでフラッシュメモリに保存されています。 SAVEはヘッダー部分にファイルシステムの様々なデータの詳細情報があります。FSTを見つける方法として、なぜか必ず含まれる| Size of "{DPFS"を検索する、または.sav,.dat等を探すのが一番早いです。 The most important is the FST or filesystem table. You can find the FST by first finding the file base offset which is the offset blob|-| 0x28| 8| Offset to which all the entries hash in the FST are relative. The file base offset DIFI (usually 0x010C)|-| 0x30| 8| Size of this hash|-| 0x38| 4| Flags (when this byte is non-zero, this is a uint16_t at 0x58 from the filesystem start. The FST DATA partition)|-| 0x3C| 8| File base offset is a uint32_t at 0x6C and is in blocks (which are 0x200 bytes largefor DATA partitions).|}
FSTが見つかれば、そのセーブデータを解析するのは非常に簡単です。'''IVFC'''
{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x00
| 4
| Magic ("IVFC")
|-
| 0x04
| 4
| Magic Number (0x20000)
|-
| 0x08
| 8
| Unknown (0x20?)
|-
| 0x10
| 8
| First Hash Offset
|-
| 0x18
| 8
| First Hash Length
|-
| 0x20
| 8
| First Hash Block Size (1<<value)
|-
| 0x28
| 8
| Second Hash Offset
|-
| 0x30
| 8
| Second Hash Length
|-
| 0x38
| 8
| Second Hash Block Size (1<<value)
|-
| 0x40
| 8
| HashTable Offset
|-
| 0x48
| 8
| HashTable Length
|-
| 0x50
| 8
| HashTable Block Size (1<<value)
|-
| 0x58
| 8
| FileSystem Offset
|-
| 0x60
| 8
| FileSystem Length
|-
| 0x68
| 8
| FileSystem Block Size (1<<value)
|-
| 0x70
| 8
| Unknown (usually 0x78=120)
|-
|}
 
* First & Second hash are not understood yet.
 
'''DPFS'''
 
{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x00
| 4
| Magic ("DPFS")
|-
| 0x04
| 4
| Magic Number (0x10000)
|-
| 0x08
| 8
| Offset To First table
|-
| 0x10
| 8
| First table length
|-
| 0x18
| 8
| First table block size (1<<value)
|-
| 0x20
| 8
| Offset To Second table
|-
| 0x28
| 8
| Second table length
|-
| 0x30
| 8
| Second table block size (1<<value)
|-
| 0x38
| 8
| Offset to Data
|-
| 0x40
| 8
| Data Length
|-
| 0x48
| 8
| Data block size (1<<value)
|-
|}
 
* Every block this table point to is written twice (concatenated). You can see that the offset to the next block is twice the length (except the data which always begin after 0x1000).
 
The first partition's data starts at 0x2000. First comes the hashtable (usually start @ 0x40 into the partition) and then the filesystem.
 
The hashtable entries' size is 2^x where x is the 'Hashed block size' from the IVFC block.
 
'''Hash'''
 
After the DIFI,IVFC & DPFS comes a 0x20 long hash, it is unknown what it's hashing.
 
'''Summary Drawing'''
 
[[File:Sfimg_drawing.png]]
 
==== The SAVE partition ====
 
* The SAVE filesystem works with a backup. There are two SAVE blocks inside the partition concatenated. Which SAVE block is the updated one is unknown yet.. (I'm guessing from experience that (image[0x100B] & 0x20) == 0x20 --> 1st SAVE --[[User:Elisherer|Elisherer]] 01:30, 18 October 2011 (CEST))
 
'''Finding the folders table:'''
* If DATA partition exists: At folder table exact offset from the SAVE struct (from the beginning of the struct).
* Otherwise: The 'folder table offset' * 'folder table media' (=0x200) from the 'filestore offset'. (usually 0 from filebase)
 
'''Finding the files table:'''
* If DATA partition exists: At file table exact offset from the SAVE struct (from the beginning of the struct).
* Otherwise: The 'file table offset' * 'file table media' (=0x200) from the 'filestore offset'.
 
'''Detemining the filestore base:'''
* If DATA partition exists: At file base from the DATA's DIFI struct into the DATA partition.
* Otherwise: At the 'filestore offset' from the beginning of the SAVE struct.
 
Folder's entry structure:
<pre>
struct fs_entry folder_entry { u32 node_cntparent_folder_index; u8 filename[0x10]; u32 folder_index; u32 unk1; u32 last_file_index; u32 unk3; u32 unk4; }<//9文字以内pre> File's entry structure:<pre> struct file_entry { u32 parent_folder_index; u8 filename[0x10];
u32 index;
u32 unk1; // マジック・ワードmagic?
u32 block_offset;
u32 u64 file_size; u32 unk2; u32 unk3; // フラグまたは日付flags? u32 unk4unk3;
}
</pre>
The first entry in both tables is the root count of the table, the parent directory, easily identifiable by index will be the node_cnt being larger than 1amount of table rows. The node_cnt root includes the root directory itself, so there are node_cnt the amount - 1 files (minus one) folders in the root directory(or files). The entries that follow after the root directory are the actual folders/files. Reading them out is as simple as taking the file base offset and adding (block_offset * 0x200) to it.
スーパーモンキーボール 3Dの例Reading the files out is as simple as taking the file base offset and adding (block_offset * 0x200) to it. Here's a follow-up example from the Legend of Zelda: Ocarina of Time 3D:
<pre>
0003800//FST entry = SAVE base + File base + (FST offset * 0x200) + (FST entry # * 0x30)//0x2600 = 0x2000 + 0x400 + (0x1 * 0x200) + (0x0 * 0x30) 00002600: 04000000 21000000 03000000 09000000 00000000 00000000 ....!............000381000002610: 00000000 00000000 00000000 00000000 ................000382000002620: 00000000 00000000 00000000 00000000 ................000383000002630: 01000000 736d6233 64732e64 73797374 656D2E64 61740000 ....smb3dssystem.dat..000384000002640: 00000000 00000000 d57b1100 05000000 D57B1100 02000000 .........Õ{......000385000002650: e4060000 22000000 00000000 c8cf0008 E8121500 00000000 ".........è.......000386000002660: 01000000 6d677265 706c6179 30302e64 73617665 30302E62 696E0000 ....mgreplay00.d0003870: 61740000 01000000 d57b1100 09000000 at.......{...save00.bin..000388000002670: 1c210000 00000000 cd331000 00000000 .!.......3......0003890: 01000000 6d677265 706c6179 30312e64 69921100 03000000 ....mgreplay01.d00038a0: 61740000 02000000 d57b1100 1a000000 at.......{i’......00038b000002680: 1c210000 00000000 DC140000 00000000 04000000 00000000 Ü.!..............
</pre>
{| class="wikitable"|-! Start! Length! Description|-| 0x00| 4| Magic ("SAVE")|-| 0x04| 4| Magic Number (0x40000)|-| 0x08| 8| Offset to data in this SAVE header(normally 0x20)|-| 0x10| 8| Partition Size [medias]|-| 0x18| 4| Partition Media Size|-| 0x1C| 8| Unknown|-| 0x24| 4| Unknown|-| 0x28| 8| FolderMap Offset|-| 0x30| 4| FolderMap Size|-| 0x34| 4| FolderMap Media Size|-| 0x38| 8| FileMap Offset|-| 0x40| 4| FileMap Size|-| 0x44| 4| FileMap Media Size|-| 0x48| 8| BlockMap Offset|-| 0x50| 4| BlockMap Size|-| 0x54| 4| BlockMap Media Size|-| 0x58| 8| File store offset (from SAVE)|-| 0x60| 4| File store length [medias]|-| 0x64| 4| File store media size|-| 0x68| 4/8| Folders Table offset (8 bytes in DATA)|-| 0x6C| 4| Folders Table Length (medias) (Only in no DATA)|-| 0x70| 4| Folders Table unknown|-| 0x74| 4| Folders Table Media size|-| 0x78| 4/8| Files Table offset (8 bytes in DATA)|-| 0x7C| 4| Files Table Length (medias) (Only in no DATA)|-| 0x80| 4| Files Table unknown|-| 0x84| 4| Files Table Media size|-|} * The FolderMap and FileMap still unknown. They are tables of uint32.* The BlockMap is a map of the blocks in the filestore. An entry in the BlockMap is 2 uint32: {uint32 start_block; uint32 end_block; }. This is still being researched. (You can use [[3DSExplorer]] to see those maps. '''Summary Drawing''' [[File:Sfsave_drawing.png]] == 初期化方法= Initialization === When a save FLASH contains all xFFFF blocks it's assumed uninitialized by the game cartridges and it initializes default data in place, without prompting the user. The 0xFFFFFFFF blocks are uninitialized data. When creating a non-gamecard savegame and other images/files, it's initially all 0xFFFFFFFF until it's formatted where some of the blocks are overwritten with encrypted data. I got a new game SplinterCell3D-Pal and I downloaded the save and it was 128KB of 0xFF, except the first 0x10 bytes which were the letter 'Z' (uppercase) --[[User:Elisherer|Elisherer]] 22:41, 15 October 2011 (CEST) === Fun Facts ===
EEPROMの内容をすべて0xFFFFで初期化することで、出荷するときの状態に戻すことができます。If you have facts that you found out by looking at the binary files please share them here:
* From one save to another the game backups the last files that were in the partition and the entire image header in "random" locations.. --[[User:Elisherer|Elisherer]] 22:41, 15 October 2011 (CEST)
[[Category:Stubs]]
[[Savegames|English]]
405

edits

Navigation menu