The RSA public keys (the one for 3DS and the other one for DSi) for the below signature can be obtained from 3DS TWL_FIRM Process9 (this is required for getting the binaries' keyY). It is also found in the DSi's ARM9 boot ROM, but this is never copied to some place outside the boot ROM. (The bootroms copy _some_ keys to WRAM/ITCM, but not this one.)
+
The RSA public keys (the one for 3DS and the other one for DSi) for the below signature _for NAND boots_ can be obtained from 3DS TWL_FIRM Process9 (this is required for getting the binaries' keyY). It is also found in the DSi's ARM9 boot ROM, but this is never copied to some place outside the boot ROM. (The bootroms copy _some_ keys to WRAM/ITCM, but not this one.) Public keys for NVRAM and game cartridge boots are only available from the DSi ARM9 boot ROM, and all differ from the NAND RSA public key.
Structure of the 0x74-byte "hash-data" stored in the RSA message:
Structure of the 0x74-byte "hash-data" stored in the RSA message: