Nintendo Switch Brew - User contributions [en]

NCA

2022-01-18T20:04:29Z

Myster-Tee:

NCA means «Nintendo Content Archive».

The entire raw NCAs are encrypted.

The only known area which is not encrypted in the raw NCA is the logo section, when the NCA includes that section. Everything else documented on this page is for the plaintext version of that data.

= Encryption =
The first 0xC00 bytes are encrypted with AES-XTS with sector size 0x200 with a non-standard "tweak" (endianness is reversed, see [https://gist.github.com/SciresM/fe8a631d13c069bd66e9c656ab5b3f7f here]), this encrypted data is an 0x400 NCA header + an 0x200 header for each section in the section table.

For pre-1.0.0 "NCA2" NCAs, the first 0x400 byte are encrypted the same way as in NCA3. However, each section header is individually encrypted as though it were sector 0, instead of the appropriate sector as in NCA3.

= Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature over the header (data from 0x200 to 0x400) using a fixed key
|-
| 0x100
| 0x100
| RSA-2048 signature over the header (data from 0x200 to 0x400) using a key from [[NPDM]] (or zeroes if not a program)
|-
| 0x200
| 0x4
| Magicnum "NCA3" ("NCA2", "NCA1" or "NCA0" for pre-1.0.0 NCAs)
|-
| 0x204
| 0x1
| DistributionType (0x00 = System NCA, 0x01 = Gamecard NCA)
|-
| 0x205
| 0x1
| ContentType (0x00 = Program, 0x01 = Meta, 0x02 = Control, 0x03 = Manual, 0x04 = Data, 0x05 = PublicData)
|-
| 0x206
| 0x1
| KeyGenerationOld (0x00 = [[1.0.0]], 0x01 = Unused, 0x02 = [[3.0.0]])
|-
| 0x207
| 0x1
| KeyAreaEncryptionKeyIndex (0x00 = Application, 0x01 = Ocean, 0x02 = System)
|-
| 0x208
| 0x8
| ContentSize
|-
| 0x210
| 0x8
| ProgramId
|-
| 0x218
| 0x4
| ContentIndex
|-
| 0x21C
| 0x4
| SdkAddonVersion (used in "FS_ACCESS: { sdk_version: {byte3}.{byte2}.{byte1}, ..." with byte0 set to 0 and compared with a required minimum value: 0x000B0000)
|-
| 0x220
| 0x1
| KeyGeneration (0x03 = [[3.0.1]], 0x04 = [[4.0.0]], 0x05 = [[5.0.0]], 0x06 = [[6.0.0]], 0x07 = [[6.2.0]], 0x08 = [[7.0.0]], 0x09 = [[8.1.0]], 0x0A = [[9.0.0]], 0x0B = [[9.1.0]], 0x0C = [[12.1.0]], 0x0D = [[13.0.0]], 0xFF = Invalid)
|-
| 0x221
| 0x1
| [9.0.0+] Header1SignatureKeyGeneration (0 or 1)
|-
| 0x222
| 0xE
| Reserved
|-
| 0x230
| 0x10
| RightsId
|-
| 0x240
| 0x10 * 4
| Array of [[#FsEntry|FsEntry]]
|-
| 0x280
| 0x20 * 4
| Array of SHA256 hashes (over each [[#FsHeader|FsHeader]])
|-
| 0x300
| 0x10 * 4
| EncryptedKeyArea
|}

When the above '''KeyGenerationOld''' field is 0x2 on >= v3.0, different {crypto/keydata} is used for the sections' data. With system content, this is used with every ncatype except ncatype0. The only other exception is {data-content} for the firm titles: this is required in order for older-system-versions to install it.

'''KeyGeneration''' 0x3 (with '''KeyGenerationOld''' set to 0x2) is used for all [[3.0.1]] sysmodules and the [[System_Version_Title]]. With [[3.0.2]], all updated titles use the crypto from [[3.0.1]] for non-ncatype0, except for firm {data-content}. In some cases various game content uses the above newer crypto as well.

'''KeyGeneration''' is always '''MasterKeyVersion''' + 1, except for generations 0 and 1 which are both version 0.

The keyindex passed to <key-generation-related code> is determined as follows:
* Pre-[[3.0.0]]: The '''KeyAreaEncryptionKeyIndex''' field (0x207) is passed directly.
* [[3.0.0]]+: It's determined using the '''KeyAreaEncryptionKeyIndex''' field (0x207) and the '''KeyGenerationOld''' field (0x206). The latter field must be 0, 1 or 2. In each ncahdr_keyindex block, it executes "if(ncahdr_x206>=3)<panic>", but that won't trigger due to the earlier check. The end result is basically the same as pre-[[3.0.0]], except when ncahdr_x206 == 0x2, final_index is new_base_index+ncahdr_keyindex. Actual implementation loads index from u32_array[ncahdr_crypto_type], where the address of u32_array is different for each ncahdr_keyindex.
* [[3.0.1]]+: The dedicated range check for the '''KeyGenerationOld''' field (0x206) was removed, since the updated code no longer needs it. The output from a function masked with 0xFF is now used instead of ncahdr_x206. The range check for that field was changed from {ncahdr_x206 check with panic described above}, to "if(index>=4)final_index=10;"(skips accessing the array and uses 10 directly). The arrays were updated with an additional entry: final_index=v301_base_index+ncahdr_keyindex.
** The keydata for the above index10 is not(?) known to be initialized.
** The new function called by the code described above does:
** <code>if(ncahdr_x206 < ncahdr_x220){ret = ncahdr_x220; } else { ret = ncahdr_x206; } return ret;</code>

== FsEntry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| StartOffset (in Media Units which are 0x200 bytes)
|-
| 0x4
| 0x4
| EndOffset (in Media Units which are 0x200 bytes)
|-
| 0x8
| 0x4
| Reserved
|-
| 0xC
| 0x4
| Reserved
|}

= FsHeader =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Version (always 2)
|-
| 0x2
| 0x1
| FsType (0 = RomFs, 1 = PartitionFs)
|-
| 0x3
| 0x1
| HashType (0 = Auto, 2 = HierarchicalSha256, 3 = HierarchicalIntegrity)
|-
| 0x4
| 0x1
| EncryptionType (0 = Auto, 1 = None, 2 = AesCtrOld, 3 = AesCtr, 4 = AesCtrEx)
|-
| 0x5
| 0x3
| Padding
|-
| 0x8
| 0xF8
| [[#HashInfo|HashInfo]]
|-
| 0x100
| 0x40
| [[#PatchInfo|PatchInfo]] (only used with game updates RomFs)
|-
| 0x140
| 0x4
| Generation
|-
| 0x144
| 0x4
| SecureValue
|-
| 0x148
| 0x30
| SparseInfo (only used in sections with sparse storage)
|-
| 0x178
| 0x88
| Reserved
|}

The FsHeader for each section is at absoluteoffset+0x400+(sectionid*0x200), where sectionid corresponds to the index used with the entry/hash tables.

== HashInfo ==
This contains information specific to the hash type in use.

=== HierarchicalSha256 ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| SHA256 hash over the hash-table at section-start+0 with the below hash-table size
|-
| 0x20
| 0x4
| Block size in bytes
|-
| 0x24
| 0x4
| Must be 0x2
|-
| 0x28
| 0x8
| Offset of hash-table (normally zero)
|-
| 0x30
| 0x8
| Size of hash-table
|-
| 0x38
| 0x8
| Offset relative to section-start where the PFS0 header is located
|-
| 0x40
| 0x8
| Actual byte-size of the PFS0 filesystem relative to the PFS0 header
|-
| 0x48
| 0xB0
| Reserved
|}

=== HierarchicalIntegrity ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "IVFC"
|-
| 0x4
| 0x4
| Magic Number (0x20000)
|-
| 0xC
| 0x4
| Master hash size?
|-
| 0x10
| 0x4
| Usually 7? Unknown, could be related to total number of levels maybe?
|-
| 0x14
| 0x8
| Level 1 offset
|-
| 0x1C
| 0x8
| Level 1 size
|-
| 0x20
| 0x4
| Level 1 block size (in log2)
|-
| 0x24
| 0x4
| Reserved
|-
| 0x28
| 0x8
| Level 2 offset
|-
| 0x30
| 0x8
| Level 2 size
|-
| 0x38
| 0x4
| Level 2 block size (in log2)
|-
| 0x3C
| 0x4
| Reserved
|-
| 0x40
| 0x8
| Level 3 offset
|-
| 0x48
| 0x8
| Level 3 size
|-
| 0x50
| 0x4
| Level 3 block size (in log2)
|-
| 0x54
| 0x4
| Reserved
|-
| 0x58
| 0x8
| Level 4 offset
|-
| 0x60
| 0x8
| Level 4 size
|-
| 0x68
| 0x4
| Level 4 block size (in log2)
|-
| 0x6C
| 0x4
| Reserved
|-
| 0x70
| 0x8
| Level 5 offset
|-
| 0x78
| 0x8
| Level 5 size
|-
| 0x80
| 0x4
| Level 5 block size (in log2)
|-
| 0x84
| 0x4
| Reserved
|-
| 0x88
| 0x8
| Level 6 offset
|-
| 0x90
| 0x8
| Level 6 size
|-
| 0x98
| 0x4
| Level 6 block size (in log2)
|-
| 0x9C
| 0x4
| Reserved
|-
| 0xA0
| 0x20
| Reserved
|-
| 0xC0
| 0x20
| Hash
|}

== PatchInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset
|-
| 0x8
| 0x8
| Size
|-
| 0x10
| 0x4
| Magicnum "BKTR"
|-
| 0x14
| 0x4
| u32, must be <=1.
|-
| 0x18
| 0x4
| s32, must be >=1.
|-
| 0x1C
| 0x4
|
|-
| 0x20
| 0x20
| Same as the above 0x20-bytes except with different data.
|}

The above byte-offsets are relative to the start of the section-data.

The two sections specified by the two BKTR entries are usually(?) at the very end of the section data(section_endoffset-{size of BKTR sections}).

=== RomFs Patching ===
The [[#PatchInfo|PatchInfo]] section enables combining data from an update NCA with the RomFs from a base NCA to create a single patched RomFS image.

The first BKTR entry describes how to map regions of the two RomFs images to create the patched RomFs. It has the following format:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Buckets
|-
| 0x8
| 0x8
| Total Size of the Virtual RomFS Image
|-
| 0x10
| 0x3FF0
| Base Virtual Offset for each Bucket (u64s, padded with 0s until end)
|-
| 0x4000
| 0x4000*X
| Relocation Buckets
|}

Where relocation buckets are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Entries
|-
| 0x8
| 0x8
| End offset for this Bucket
|-
| 0x10
| 0x3FF0
| Relocation Entries
|}

Where relocation entries are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Address in Patched RomFs
|-
| 0x8
| 0x8
| Address in Source RomFs
|-
| 0x10
| 0x4
| 1=Is from Patch RomFS, 0=Is from Base RomFS
|}

The second BKTR entry describes the subsections within the Patch RomFs. It has the following format:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Buckets
|-
| 0x8
| 0x8
| Total Size of the Physical Patch Image
|-
| 0x10
| 0x3FF0
| Base Physical Offset for each Bucket (u64s, padded with 0s until end)
|-
| 0x4000
| 0x4000*X
| Subsection Buckets
|}

Where subsection buckets are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Entries
|-
| 0x8
| 0x8
| End offset for this Bucket
|-
| 0x10
| 0x3FF0
| Subsection Entries
|}

Where subsection entries are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Address in Patch RomFs
|-
| 0x8
| 0x4
| Padding/Unused?
|-
| 0xC
| 0x4
| Value for subsection AES-CTR
|}

Official code assumes the relocation entries are sorted, and performs a binary search when determining where to read from. Each subsection in the Patch RomFs has its CTR calculated separately from the others based on the value in its entry (the BKTR entries use normal crypto). Thus decrypting a Patch RomFS requires decrypting and parsing the BKTR entries before anything else.

= Logo Section =
This is a PFS0.

See [[NCA_Content_FS|here]] for the mounted-FS logo contents.

= ExeFS Section =
This is a PFS0.

See [[ExeFS|here]] for mounted-FS ExeFS contents.

= Game Updates =
The section-data for ncatype1 RomFS section(section1) uses section-crypto-type 0x4.

Game updates also contain multiple ncatype6 content, which contain "section0_pfs0/fragment". Some of these are just NCAs, unknown for the rest(presumably NCAs with additional crypto?). The first ncatype6 content fragment file has a NDV0 header, with the NCA starting at offset 0x44.

= PFS0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| {Hash-table offset from superblock}
| {Hash-table size from superblock}
| Table of SHA256 hashes.
|-
| {Hash-table <offset+size> from superblock}
|
| Zeros for alignment to {alignment size}.
|-
| {PFS0 offset from superblock}
| {PFS0 size from superblock}
| The actual PFS0.
|}

This is the FS which has magicnum "PFS0" at header+0. This is very similar to [[Gamecard_Format|HFS0]]. A tool for extracting this FS is available [https://gist.github.com/yellows8/1a96c2b846f4ebc4bb45d7f7fa1eb7db here].

The hash table is hashes for every {Block size from superblock} starting at the PFS0 header. The size used for the last hash is {PFS0 filesystem size from superblock} - offset_relativeto_header.

See also the PFS0 superblock above.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "PFS0"
|-
| 0x4
| 0x4
| Number of files
|-
| 0x8
| 0x4
| Size of the string table
|-
| 0xC
| 0x4
| Zero/Reserved
|-
| 0x10
| X
| File Entry Table
|-
| 0x10 + X
| Y
| String Table
|-
| 0x10 + X + Y
| Z
| Raw File Data
|}

Where File Entry Table consists of Number of Files FileEntries:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset of file in Data
|-
| 0x8
| 0x8
| Size of file in Data
|-
| 0x10
| 0x4
| Offset of filename in String Table
|-
| 0x14
| 0x4
| Normally zero?
|}

CNMT

2022-01-11T21:37:08Z

Myster-Tee: /* Packaged Content Info */

This is the metadata file that ends in <code>".cnmt{.nca}"</code> or <code>"meta0.ncd"</code>. This seems to replace the TMD format.

The official name for CNMT is "PackagedContentMeta".

== Header ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| ID
|-
| 0x8
| 0x4
| Version
|-
| 0xC
| 0x1
| [[NCM_services#ContentMetaType|Content Meta Type]]
|-
| 0xD
| 0x1
| Reserved
|-
| 0xE
| 0x2
| Extended Header Size
|-
| 0x10
| 0x2
| Content Count
|-
| 0x12
| 0x2
| Content Meta Count
|-
| 0x14
| 0x1
| Content Meta Attributes (0=None, 1=IncludesExFatDriver, 2=Rebootless)
|-
| 0x15
| 0x3
| Reserved
|-
| 0x18
| 0x4
| Required Download System Version
|-
| 0x1C
| 0x4
| Reserved
|}

== SystemUpdate Extended Header ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Extended Data Size
|}

== Application Extended Header ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Patch ID
|-
| 0x8
| 0x4
| Required System Version
|-
| 0xC
| 0x4
| Required Application Version
|}

== Patch Extended Header ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Application ID
|-
| 0x8
| 0x4
| Required System Version
|-
| 0xC
| 0x4
| Extended Data Size
|-
| 0x10
| 0x8
| Reserved
|}

== AddOnContent Extended Header ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Application ID
|-
| 0x8
| 0x4
| Required Application Version
|-
| 0xC
| 0x4
| Reserved
|}

== Delta Extended Header ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Application ID
|-
| 0x8
| 0x4
| Extended Data Size
|-
| 0xC
| 0x4
| Reserved
|}

== Packaged Content Info ==

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| Hash (SHA256 of the referenced content)
|-
| 0x20
| 0x10
| Content ID
|-
| 0x30
| 0x6
| Size
|-
| 0x36
| 0x1
| Content Type (0=Meta, 1=Program, 2=Data, 3=Control, 4=[[Internet_Browser|HtmlDocument]], 5=[[Internet_Browser|LegalInformation]], 6=[[NCA_Format|DeltaFragment]])
|-
| 0x37
| 0x1
| ID Offset
|}

== Content Meta Info ==

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| ID
|-
| 0x8
| 0x4
| Version
|-
| 0xC
| 0x1
| [[NCM_services#Title_Types|Content Meta Type]]
|-
| 0xD
| 0x1
| Content Meta Attributes (0=None, 1=IncludesExFatDriver, 2=Rebootless)
|-
| 0xE
| 0x2
| Reserved
|}

This is used for SystemUpdate, see here: [[NCM_services#ReadEntryMetaRecords]].

== SystemUpdate Extended Data ==

If the Version field is 1, the format is:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Version
|-
| 0x4
| 0x4
| Variation Count
|-
| 0x8
| 0x20 * Variation Count
| [[CNMT#Firmware_Variation_Info_(Version_1)|Firmware Variation Info (Version 1)]]
|}

If the Version field is 2, the format is:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Version
|-
| 0x4
| 0x4
| Variation Count
|-
| 0x8
| 0x4 * Variation Count
| Firmware Variation ID
|-
|
| 0x20 * Variation Count
| [[CNMT#Firmware_Variation_Info_(Version_2)|Firmware Variation Info (Version 2)]]
|-
|
| 0x10 * Meta Count (From [[CNMT#Firmware_Variation_Info_(Version_2)|Firmware Variation Info (Version 2)]])
| [[CNMT#Content_Meta_Info|Content Meta Info]] (If Refer To Base is False)
|}

=== Firmware Variation Info (Version 1) ===

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Firmware Variation ID
|-
| 0x4
| 0x1C
| Reserved
|}

=== Firmware Variation Info (Version 2) ===

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Refer To Base (0=False, 1=True)
|-
| 0x1
| 0x3
| Reserved
|-
| 0x4
| 0x4
| Meta Count
|-
| 0x8
| 0x18
| Reserved
|}

== Patch Extended Data ==

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| History Count
|-
| 0x4
| 0x4
| Delta History Count
|-
| 0x8
| 0x4
| Delta Count
|-
| 0xC
| 0x4
| Fragment Set Count
|-
| 0x10
| 0x4
| History Content Count
|-
| 0x14
| 0x4
| Delta Content Count
|-
| 0x18
| 0x4
| Reserved
|-
| 0x1C
| 0x38 * History Count
| [[CNMT#History_Header|History Headers]]
|-
|
| 0x28 * Delta History Count
| [[CNMT#Delta_History|Delta Histories]]
|-
|
| 0x28 * Delta Count
| [[CNMT#Delta_Header|Delta Headers]]
|-
|
| 0x34 * Fragment Set Count
| [[CNMT#Fragment_Set|Fragment Sets]]
|-
|
| 0x18 * History Content Count
| [[CNMT#Packaged_Content_Info|History Content Info]] (Packaged Content Info without the Hash entry)
|-
|
| 0x38 * Delta Content Count
| [[CNMT#Packaged_Content_Info|Delta Packaged Content Info]]
|-
|
| 0x4 * Fragment Indicator Count (From [[CNMT#Fragment_Set|Fragment Sets]])
| [[CNMT#Fragment_Indicator|Fragment Indicators]]
|}

=== History Header ===

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| Content Meta Key (Slightly different Content Meta Info)
|-
| 0x10
| 0x20
| Digest
|-
| 0x30
| 0x2
| Content Info Count
|-
| 0x32
| 0x6
| Reserved
|}

=== Delta History ===

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Source Patch ID
|-
| 0x8
| 0x8
| Destination Patch ID
|-
| 0x10
| 0x4
| Source Version
|-
| 0x14
| 0x4
| Destination Version
|-
| 0x18
| 0x8
| Download Size
|-
| 0x20
| 0x8
| Reserved
|}

=== Delta Header ===

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Source Patch ID
|-
| 0x8
| 8
| Destination Patch ID
|-
| 0x10
| 0x4
| Source Version
|-
| 0x14
| 0x4
| Destination Version
|-
| 0x18
| 0x2
| Fragment Set Count
|-
| 0x1A
| 0x6
| Reserved
|-
| 0x20
| 0x2
| Content Info Count
|-
| 0x22
| 0x6
| Reserved
|}

=== Fragment Set ===

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| Source Content ID
|-
| 0x10
| 0x10
| Destination Content ID
|-
| 0x20
| 0x6
| Source Size
|-
| 0x26
| 0x6
| Destination Size
|-
| 0x2C
| 0x2
| Fragment Indicator Count
|-
| 0x2E
| 0x1
| Fragment Target Content Type (0=Meta, 1=Program, 2=Data, 3=Control, 4=[[Internet_Browser|HtmlDocument]], 5=[[Internet_Browser|LegalInformation]], 6=[[NCA_Format|DeltaFragment]])
|-
| 0x2F
| 0x1
| Update Type (0=ApplyAsDelta, 1=Overwrite, 2=Create)
|-
| 0x30
| 0x4
| Reserved
|}

=== Fragment Indicator ===

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Content Info Index
|-
| 0x2
| 0x2
| Fragment Index
|}

== Delta Extended Data ==

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Source Patch ID
|-
| 0x8
| 0x8
| Destination Patch ID
|-
| 0x10
| 0x4
| Source Version
|-
| 0x14
| 0x4
| Destination Version
|-
| 0x18
| 0x2
| Fragment Set Count
|-
| 0x1A
| 0x6
| Reserved
|-
| 0x20
| 0x34 * Fragment Set Count
| [[CNMT#Fragment_Set|Fragment Sets]]
|-
|
| 0x4 * Fragment Indicator Count (From [[CNMT#Fragment_Set|Fragment Sets]])
| [[CNMT#Fragment_Indicator|Fragment Indicators]]
|}

== Digest ==

Always found at the end of the file.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| Digest
|}

NACP

2019-05-20T19:31:55Z

Myster-Tee: /* Title Entry */

This is '''control.nacp'''.

Roughly equivalent to non-gfx areas of 3DS SMDH. All strings for language-entries are UTF-8, unlike SMDH which uses UTF-16.

Total size is 0x4000-bytes.

= Structure =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3000 (0x300*0x10)
| [[#Title Entry|Title entries]]
|-
| 0x3000
| 0x25
| Isbn
|-
| 0x3025
| 0x1
| StartupUserAccount
|-
| 0x3026
| 0x1
| UserAccountSwitchLock
|-
| 0x3027
| 0x1
| AddOnContentRegistrationType
|-
| 0x3028
| 0x4
| ApplicationAttribute
|-
| 0x302C
| 0x4
| SupportedLanguages
|-
| 0x3030
| 0x4
| ParentalControl
|-
| 0x3034
| 0x1
| Screenshot
|-
| 0x3035
| 0x1
| [[#VideoCaptureMode]]
|-
| 0x3036
| 0x1
| DataLossConfirmation
|-
| 0x3037
| 0x1
| PlayLogPolicy
|-
| 0x3038
| 0x8
| PresenceGroupId
|-
| 0x3040
| 0x20
| RatingAge
|-
| 0x3060
| 0x10
| DisplayVersion
|-
| 0x3070
| 0x8
| AddOnContentBaseId
|-
| 0x3078
| 0x8
| SaveDataOwnerId
|-
| 0x3080
| 0x8
| UserAccountSaveDataSize
|-
| 0x3088
| 0x8
| UserAccountSaveDataJournalSize
|-
| 0x3090
| 0x8
| DeviceSaveDataSize
|-
| 0x3098
| 0x8
| DeviceSaveDataJournalSize
|-
| 0x30A0
| 0x8
| BcatDeliveryCacheStorageSize
|-
| 0x30A8
| 0x8
| ApplicationErrorCodeCategory
|-
| 0x30B0
| 0x40 (0x8*0x8)
| LocalCommunicationIds
|-
| 0x30F0
| 0x1
| LogoType
|-
| 0x30F1
| 0x1
| LogoHandling
|-
| 0x30F2
| 0x1
| RuntimeAddOnContentInstall
|-
| 0x30F3
| 0x3
| Reserved
|-
| 0x30F6
| 0x1
| CrashReport
|-
| 0x30F7
| 0x1
| Hdcp
|-
| 0x30F8
| 0x8
| SeedForPseudoDeviceId
|-
| 0x3100
| 0x41
| [[BCAT_Content_Container|BcatPassphrase]] (all-zero when unused)
|-
| 0x3141
| 0x1
| Reserved
|-
| 0x3142
| 0x6
| Reserved
|-
| 0x3148
| 0x8
| UserAccountSaveDataMaxSize
|-
| 0x3150
| 0x8
| UserAccountSaveDataMaxJournalSize
|-
| 0x3158
| 0x8
| DeviceSaveDataMaxSize
|-
| 0x3160
| 0x8
| DeviceSaveDataMaxJournalSize
|-
| 0x3168
| 0x8
| TemporaryStorageSize
|-
| 0x3170
| 0x8
| CacheStorageSize
|-
| 0x3178
| 0x8
| CacheStorageJournalSize
|-
| 0x3180
| 0x8
| CacheStorageMaxSizeAndMaxJournalSize
|-
| 0x3188
| 0x8
| CacheStorageMaxIndex
|-
| 0x3190
| 0x80 (0x10*0x8)
| PlayLogQueryableApplicationId
|-
| 0x3210
| 0x1
| PlayLogQueryCapability
|-
| 0x3211
| 0x1
| RepairFlag
|-
| 0x3212
| 0x1
| ProgramIndex
|-
| 0x3213
| 0x1
| RequiredNetworkServiceLicenseOnLaunchFlag
|-
| 0x3214
| 0xDEC
| Reserved
|}

== Title Entry ==
Total size is 0x300-bytes.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x200
| Application name strings
|-
| 0x200
| 0x100
| Application publisher strings
|}

Entry index for each [[Settings_services#LanguageCode|language]]:

{| class="wikitable" border="1"
|-
! Entry-index || Icon [[NCA_Content_FS#FS-type3|language]] filename
|-
| 0 || "AmericanEnglish"
|-
| 1 || "BritishEnglish"
|-
| 2 || "Japanese"
|-
| 3 || "French"
|-
| 4 || "German"
|-
| 5 || "LatinAmericanSpanish"
|-
| 6 || "Spanish"
|-
| 7 || "Italian"
|-
| 8 || "Dutch"
|-
| 9 || "CanadianFrench"
|-
| 10 || "Portuguese"
|-
| 11 || "Russian"
|-
| 12 || "Korean"
|-
| 13 || "TraditionalChinese"
|-
| 14 || "SimplifiedChinese"
|}

Official apps tend to have the title entries' strings set only to English. Some apps don't have certain title entries set at all. In addition, official apps usually (?) don't have the following title entries set: Korean, Taiwanese, and Chinese.

== VideoCaptureMode ==
This is the enum used to determine how gameplay recording can occur, if at all.

{| class="wikitable" border="1"
|-
! Value || Meaning
|-
| 0 || Disabled
|-
| 1 || Enabled
|-
| 2 || Automatic
|-
|}

When this value is 0, gameplay cannot be recorded. When this value is 1, the game must manually sacrifice some of its heap as transfer memory for AM's IApplicationProxy->InitializeGamePlayRecording(). When this value is 2, AM will call NS->BoostSystemMemoryResourceSize(), and allocate the required memory for recording automatically without the usermode process having to do anything.

NCA

2019-05-19T08:12:36Z

Myster-Tee: /* Header */

The entire raw NCAs are encrypted.

The only known area which is not encrypted in the raw NCA is the logo section, when the NCA includes that section. Everything else documented on this page is for the plaintext version of that data.

=Encryption=
The first 0xC00 bytes are encrypted with AES-XTS with sector size 0x200 with a non-standard "tweak" (endianness is reversed, see [https://gist.github.com/SciresM/fe8a631d13c069bd66e9c656ab5b3f7f here]), this encrypted data is an 0x400 NCA header + an 0x200 header for each section in the section table.

For pre-1.0.0 "NCA2" NCAs, the first 0x400 byte are encrypted the same way as in NCA3. However, each section header is individually encrypted as though it were sector 0, instead of the appropriate sector as in NCA3.

=Header=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature over the 0x200-bytes starting at offset 0x200 using fixed key.
|-
| 0x100
| 0x100
| RSA-2048 signature over the 0x200-bytes starting at offset 0x200 using key from [[NPDM]], or zeroes if not a program.
|-
| 0x200
| 0x4
| Magicnum (Normally "NCA3", "NCA2" for some pre-1.0.0 NCAs)
|-
| 0x204
| 0x1
| 0 for system NCAs. 1 for a NCA from gamecard.
|-
| 0x205
| 0x1
| Content Type (0=Program, 1=Meta, 2=Control, 3=Manual, 4=Data, 5=PublicData)
|-
| 0x206
| 0x1
| Crypto Type. Only used stating with [[3.0.0]]. Normally 0. 2 = Crypto supported starting with [[3.0.0]].
|-
| 0x207
| 0x1
| Key index, must be 0-2.
|-
| 0x208
| 0x8
| Size of the entire NCA.
|-
| 0x210
| 0x8
| titleID
|-
| 0x218
| 0x4
| contentIndex
|-
| 0x21C
| 0x4
| sdk_version. byte0 is normally 0? Compared with a required minimum-value(0x000B0000). Matches this string from codebin: "FS_ACCESS: { sdk_version: {byte3}.{byte2}.{byte1}, ...".
|-
| 0x220
| 0x1
| Crypto-Type2. Selects which crypto-sysver to use. 0x3 = [[3.0.1]], 0x4 = [[4.0.0]], 0x5 = [[5.0.0]].
|-
| 0x230
| 0x10
| Rights ID ([[Ticket]])
|-
| 0x240
| 0x10*0x4(0x40)
| Table for each section, see below.
|-
| 0x280
| 0x20*0x4(0x80)
| Table of SHA256 hashes, over each 0x200-byte Section Header Block.
|-
| 0x300
| 0x10*0x4(0x40)
| Key area
|}

The header is 0x400-bytes, at NCA+0.

When the above "Crypto Type" field is 0x2 on >=v3.0, different {crypto/keydata} is used for the sections' data. With system content, this is used with every ncatype except ncatype0. The only other exception is {data-content} for the firm titles: this is required in order for older-system-versions to install it.

Crypto-Type2 0x3(with the above crypto-type value) is used for all [[3.0.1]] sysmodules and the [[System_Version_Title]].

With [[3.0.2]], all updated titles use the crypto from [[3.0.1]] for non-ncatype0, except for firm {data-content}.

Note: in some cases various game content uses the above newer crypto as well.

The keyindex passed to <key-generation-related code> is determined as follows:
* Pre-[[3.0.0]]: The ncahdr keyindex field(0x207) is passed directly.
* [[3.0.0]]+: It's determined using ncahdr keyindex(0x207) and "Crypto Type"(0x206). The latter field must be 0-2. In each ncahdr_keyindex block, it executes "if(ncahdr_x206>=3)<panic>", but that won't trigger due to the earlier check. The end result is basically the same as pre-[[3.0.0]], except when ncahdr_x206 == 0x2, final_index is new_base_index+ncahdr_keyindex. Actual implementation loads index from u32_array[ncahdr_crypto_type], where the address of u32_array is different for each ncahdr_keyindex.
* [[3.0.1]]+: The dedicated range check for ncahdr_x206("Crypto Type") was removed, since the updated code no longer needs it. The output from a function masked with 0xFF is now used instead of ncahdr_x206(ncahdr_crypto_type). The range check for that field was changed from {ncahdr_x206 check with panic described above}, to "if(index>=4)final_index=10;"(skips accessing the array and uses 10 directly). The arrays were updated with an additional entry: final_index=v301_base_index+ncahdr_keyindex.
** The keydata for the above index10 is not(?) known to be initialized.
** The new function called by the code described above does:
** <code>if(ncahdr_x206 < ncahdr_x220){ret = ncahdr_x220; } else { ret = ncahdr_x206; } return ret;</code>

==Section Table Entry==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Media offset
|-
| 0x4
| 0x4
| Media end-offset
|-
| 0x8
| 0x4
| Unknown
|-
| 0xC
| 0x4
| Unknown
|}

Entry size is 0x10-bytes.

Media offset is absoluteoffset/{mediasize}, where mediasize is hard-coded to 0x200.

=Section Header Block=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Version. Always 0x2
|-
| 0x2
| 0x1
| Filesystem Type. 0x0 = RomFS. 0x1 = PFS0
|-
| 0x3
| 0x1
| Hash Type. 0x2 = PFS0. 0x3 = RomFS
|-
| 0x4
| 0x1
| Crypto type. 0 and >4 are invalid. 1 = none(plaintext from raw NCA). 2 = other crypto. 3 = regular crypto. 4 = unknown.
|-
| 0x5
| 0x1
| Padding?
|-
| 0x8
| 0xF8
| FS-specific superblock.
|-
| 0x100
| ?
| Optional BKTR header. Can be used with any section, but only known to be used with game-updates RomFS.
|}

The Section Header Block for each section is at absoluteoffset+0x400+(sectionid*0x200), where sectionid corresponds to the index used with the entry/hash tables.

The total size is 0x200-bytes.

==PFS0 superblock==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| SHA256 hash over the hash-table at section-start+0 with the below hash-table size.
|-
| 0x20
| 0x4
| Block size in bytes.
|-
| 0x24
| 0x4
| Must be 0x2.
|-
| 0x28
| 0x8
| Offset of hash-table. Normally zero?
|-
| 0x30
| 0x8
| Size of hash-table.
|-
| 0x38
| 0x8
| Offset relative to section-start where the PFS0 header is located.
|-
| 0x40
| 0x8
| Actual byte-size of the PFS0 filesystem relative to the PFS0 header.
|-
| 0x48
| 0xB0
| Normally zeros.
|}

==RomFS superblock==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x8
| 0xE0
| IVFC header. Basically the same as [[Savegames]] IVFC except with 2 more levels and +0x0C is non-zero, see below.
|}

This documents the structure of Section Header Block +0 for RomFS.

=== IVFC ===
{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x00
| 4
| Magic ("IVFC")
|-
| 0x04
| 4
| Magic Number (0x20000)
|-
| 0x08
| 4
| Master hash size?
|-
| 0x0C
| 4
| Usually 7? Unknown, could be related to total number of levels maybe?
|-
| 0x10
| 8
| Level 1 offset
|-
| 0x18
| 8
| Level 1 size
|-
| 0x20
| 4
| Level 1 block size, in log2
|-
| 0x24
| 4
| Reserved
|-
| 0x28
| 8
| Level 2 offset
|-
| 0x30
| 8
| Level 2 size
|-
| 0x38
| 4
| Level 2 block size, in log2.
|-
| 0x3C
| 4
| Reserved
|-
| 0x40
| 8
| Level 3 offset
|-
| 0x48
| 8
| Level 3 size
|-
| 0x50
| 4
| Level 3 block size, in log2.
|-
| 0x54
| 4
| Reserved
|-
| 0x58
| 8
| Level 4 offset
|-
| 0x60
| 8
| Level 4 size
|-
| 0x68
| 4
| Level 4 block size, in log2.
|-
| 0x6C
| 4
| Reserved
|-
| 0x70
| 8
| Level 5 offset
|-
| 0x78
| 8
| Level 5 size
|-
| 0x80
| 4
| Level 5 block size, in log2.
|-
| 0x84
| 4
| Reserved
|-
| 0x88
| 8
| Level 6 offset
|-
| 0x90
| 8
| Level 6 size
|-
| 0x98
| 4
| Level 6 block size, in log2.
|-
| 0x9C
| 4
| Reserved
|-
| 0xA0
| 32
| Unknown, reserved?
|-
| 0xC0
| 32
| Hash
|}

== BKTR ==

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x0
| 0x8
| Offset
|-
|-
| 0x8
| 0x8
| Size
|-
| 0x10
| 0x4
| "BKTR"
|-
| 0x14
| 0x4
| u32, must be <=1.
|-
| 0x18
| 0x4
| s32, must be >=1.
|-
| 0x1C
| 0x4
| ?
|-
| 0x20
| 0x20
| Same as the above 0x20-bytes except with different data.
|-
| 0x40
| 0x4?
| ?
|-
| 0x44
| 0x4?
| ?
|}

Using this header is enabled when offset 0x8 in this header is non-zero.

The above byte-offsets are relative to the start of the section-data.

The two sections specified by the two BKTR entries are usually(?) at the very end of the section data(section_endoffset-{size of BKTR sections}).

===RomFS Patching===

The BKTR section enables combining data from an update NCA with the RomFS from a base NCA to create a single patched RomFS image.

The first BKTR entry describes how to map regions of the two RomFS images to create the patched RomFS. It has the following format:

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x0 || 0x4 || Padding/Unused?
|-
| 0x4 || 0x4 || Number of Buckets
|-
| 0x8 || 0x8 || Total Size of the Virtual RomFS Image
|-
| 0x10 || 0x3FF0 || Base Virtual Offset for each Bucket (u64s, padded with 0s until end)
|-
| 0x4000 || 0x4000*X || Relocation Buckets
|}

Where relocation buckets are as follows:

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x0 || 0x4 || Padding/Unused?
|-
| 0x4 || 0x4 || Number of Entries
|-
| 0x8 || 0x8 || End offset for this Bucket
|-
| 0x10 || 0x3FF0 || Relocation Entries
|}

Where relocation entries are as follows:

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x0 || 0x8 || Address in Patched RomFS
|-
| 0x8 || 0x8 || Address in Source RomFS
|-
| 0x10 || 0x4 || 1=Is from Patch RomFS, 0=Is from Base RomFS
|}

The second BKTR entry describes the subsections within the Patch RomFS. It has the following format:

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x0 || 0x4 || Padding/Unused?
|-
| 0x4 || 0x4 || Number of Buckets
|-
| 0x8 || 0x8 || Total Size of the Physical Patch Image
|-
| 0x10 || 0x3FF0 || Base Physical Offset for each Bucket (u64s, padded with 0s until end)
|-
| 0x4000 || 0x4000*X || Subsection Buckets
|}

Where subsection buckets are as follows:

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x0 || 0x4 || Padding/Unused?
|-
| 0x4 || 0x4 || Number of Entries
|-
| 0x8 || 0x8 || End offset for this Bucket
|-
| 0x10 || 0x3FF0 || Subsection Entries
|}

Where subsection entries are as follows:

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x0 || 0x8 || Address in Patch RomFS
|-
| 0x8 || 0x4 || Padding/Unused?
|-
| 0xC || 0x4 || Value for subsection AES-CTR
|}

Official code assumes the relocation entries are sorted, and performs a binary search when determining where to read from. Each subsection in the Patch RomFS has its CTR calculated separately from the others based on the value in its entry (the BKTR entries use normal crypto). Thus decrypting a Patch RomFS requires decrypting and parsing the BKTR entries before anything else.

=Logo section=
This is a PFS0. See [[NCA_Content_FS|here]] for the mounted-FS logo contents.

=ExeFS section =
This is a PFS0.

See [[ExeFS|here]] for mounted-FS ExeFS contents.

=Game-updates=
The section-data for ncatype1 RomFS section(section1) uses section-crypto-type 0x4.

Game-updates also contain multiple ncatype6 content, which contain "section0_pfs0/fragment". Some of these are just NCAs, unknown for the rest(presumably NCAs with additional crypto?). The first ncatype6 content fragment file has a NDV0 header, with the NCA starting at offset 0x44.

=PFS0=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| {Hash-table offset from superblock}
| {Hash-table size from superblock}
| Table of SHA256 hashes.
|-
| {Hash-table <offset+size> from superblock}
|
| Zeros for alignment to {alignment size}.
|-
| {PFS0 offset from superblock}
| {PFS0 size from superblock}
| The actual PFS0.
|}

This is the FS which has magicnum "PFS0" at header+0. This is very similar to [[Gamecard_Format|HFS0]]. A tool for extracting this FS is available [https://gist.github.com/yellows8/1a96c2b846f4ebc4bb45d7f7fa1eb7db here].

The hash table is hashes for every {Block size from superblock} starting at the PFS0 header. The size used for the last hash is {PFS0 filesystem size from superblock} - offset_relativeto_header.

See also the PFS0 superblock above.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| "PFS0" Magic
|-
| 0x4
| 0x4
| Number of files
|-
| 0x8
| 0x4
| Size of the string table
|-
| 0xC
| 0x4
| Zero/Reserved
|-
| 0x10
| X
| File Entry Table
|-
| 0x10 + X
| Y
| String Table
|-
| 0x10 + X + Y
| Z
| Raw File Data
|}

Where File Entry Table consists of Number of Files FileEntries:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset of file in Data
|-
| 0x8
| 0x8
| Size of file in Data
|-
| 0x10
| 0x4
| Offset of filename in String Table
|-
| 0x14
| 0x4
| Normally zero?
|}