DSi cartridge header: Difference between revisions
No edit summary |
Hallowizer (talk | contribs) m Hallowizer moved page DSi Cartridge Header to DSi cartridge header: Proper casing |
||
| (11 intermediate revisions by 5 users not shown) | |||
| Line 5: | Line 5: | ||
! OFFSET | ! OFFSET | ||
! SIZE | ! SIZE | ||
! DESCRIPTION | ! DESCRIPTION - ORIGINAL NDS ENTRIES | ||
|- | |- | ||
| 0x000 | | 0x000 | ||
| Line 21: | Line 21: | ||
| 0x012 | | 0x012 | ||
| 1 | | 1 | ||
| Unitcode | | Unitcode (00h=NDS, 02h=NDS+DSi, 03h=DSi) (bit1=DSi) | ||
|- | |- | ||
| 0x013 | | 0x013 | ||
| Line 32: | Line 33: | ||
|- | |- | ||
| 0x015 | | 0x015 | ||
| | | 7 | ||
| Reserved | | Reserved | ||
|- | |||
| 0x01C | |||
| 2 | |||
| Game Revision (used by DSi titles) | |||
|- | |- | ||
| 0x01E | | 0x01E | ||
| Line 101: | Line 106: | ||
| 0x058 | | 0x058 | ||
| 4 | | 4 | ||
| | | ARM7 overlay offset | ||
|- | |- | ||
| 0x05C | | 0x05C | ||
| 4 | | 4 | ||
| | | ARM7 overlay length | ||
|- | |- | ||
| 0x060 | | 0x060 | ||
| Line 117: | Line 122: | ||
| 0x068 | | 0x068 | ||
| 4 | | 4 | ||
| Icon Banner offset | | Icon Banner offset (same as NDS, but with new extra entries) | ||
|- | |- | ||
| 0x06C | | 0x06C | ||
| Line 141: | Line 147: | ||
| 0x080 | | 0x080 | ||
| 4 | | 4 | ||
| NTR region ROM size | | NTR region ROM size (excluding DSi area) | ||
|- | |- | ||
| 0x084 | | 0x084 | ||
| Line 149: | Line 155: | ||
| 0x088 | | 0x088 | ||
| 56 | | 56 | ||
| Reserved | | Reserved (0x88, 0x8C, 0x90 = Unknown, used by DSi) | ||
|- | |- | ||
| 0x0C0 | | 0x0C0 | ||
| Line 166: | Line 172: | ||
| 32 | | 32 | ||
| Debugger reserved | | Debugger reserved | ||
|- | |||
! OFFSET | |||
! SIZE | |||
! DESCRIPTION - EXTENDED DSi ENTRIES | |||
|- | |- | ||
| 0x180 | | 0x180 | ||
| | | 20 | ||
| | | Global MBK1..MBK5 Settings | ||
|- | |||
| 0x194 | |||
| 12 | |||
| Local MBK6..MBK8 Settings for ARM9 | |||
|- | |||
| 0x1A0 | |||
| 12 | |||
| Local MBK6..MBK8 Settings for ARM7 | |||
|- | |||
| 0x1AC | |||
| 4 | |||
| Global MBK9 Setting | |||
|- | |||
| 0x1B0 | |||
| 4 | |||
| Region Flags | |||
|- | |- | ||
| 0x1B4 | | 0x1B4 | ||
| Line 181: | Line 207: | ||
| 0x1BC | | 0x1BC | ||
| 4 | | 4 | ||
| Reserved | | Reserved/flags? When bit2 of byte 0x1bf is set, usage of banner.sav from the title data dir is enabled.(additional banner data) | ||
|- | |- | ||
| 0x1C0 | | 0x1C0 | ||
| Line 205: | Line 231: | ||
| 0x1D4 | | 0x1D4 | ||
| 4 | | 4 | ||
| | | Pointer to [[base address where various structures and parameters are passed to the title]] - what is that??? | ||
|- | |- | ||
| 0x1D8 | | 0x1D8 | ||
| Line 256: | Line 282: | ||
|- | |- | ||
| 0x208 | | 0x208 | ||
| | | 4 | ||
| | | Icon Banner Size (usually 0x23C0) | ||
|- | |||
| 0x20C | |||
| 4 | |||
| Unknown (used by DSi) | |||
|- | |||
| 0x210 | |||
| 4 | |||
| NTR+TWL region ROM size (total size including DSi area) | |||
|- | |||
| 0x214 | |||
| 12 | |||
| Unknown (used by DSi) | |||
|- | |- | ||
| 0x220 | | 0x220 | ||
| Line 280: | Line 318: | ||
|- | |- | ||
| 0x238 | | 0x238 | ||
| | | 4 | ||
| Reserved | | DSiWare: "public.sav" size | ||
|- | |||
| 0x23C | |||
| 4 | |||
| DSiWare: "private.sav" size | |||
|- | |||
| 0x240 | |||
| 176 | |||
| Reserved (zero) | |||
|- | |||
| 0x2F0 | |||
| 16 | |||
| Unknown (used by DSi) | |||
|- | |- | ||
| 0x300 | | 0x300 | ||
| Line 313: | Line 363: | ||
| 0x3A0 | | 0x3A0 | ||
| 20 | | 20 | ||
| | | ARM9 (without secure area) SHA1 HMAC hash | ||
|- | |- | ||
| 0x3B4 | | 0x3B4 | ||
| Line 325: | Line 375: | ||
| 0xF80 | | 0xF80 | ||
| 0x80 | | 0x80 | ||
| RSA signature | | RSA signature (the first 0xE00 bytes of the header are signed with an 1024-bit RSA signature). | ||
|} | |} | ||
= Modcrypt = | = Modcrypt = | ||
| Line 340: | Line 388: | ||
keytype = SECURE; | keytype = SECURE; | ||
The insecure key is simply the first 16 bytes of the header. The secure key is constructed from a scrambled key pair, where one part is based on an 8-byte shared secret between all DSi's and an 8-byte expanded gamecode, and the other part is based on the first 16 bytes of the ARM9i SHA1 HMAC hash (0x350). The key | The insecure key is simply the first 16 bytes of the header. The secure key is constructed from a scrambled key pair, where one part is based on an 8-byte shared secret between all DSi's and an 8-byte expanded gamecode, and the other part is based on the first 16 bytes of the ARM9i SHA1 HMAC hash (0x350). The key pair is scrambled in an unknown way to form the final secure key. | ||
It is likely that the insecure key is only used for a debug version of an application, since most card based and NAND based applications are using the secure key. | |||
| Line 347: | Line 397: | ||
The sector hashtable reaches over the NTR and TWL regions, respectively. | The sector hashtable reaches over the NTR and TWL regions, respectively. | ||
= See Also = | |||
* [[Card hardware]] - cartridge bus protocol | |||
* [[Bootloader]] - boot procedure | |||