<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://switchbrew.org/w/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=DarkMatterCore</id>
	<title>Nintendo Switch Brew - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://switchbrew.org/w/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=DarkMatterCore"/>
	<link rel="alternate" type="text/html" href="https://switchbrew.org/wiki/Special:Contributions/DarkMatterCore"/>
	<updated>2026-04-30T07:53:53Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.43.1</generator>
	<entry>
		<id>https://switchbrew.org/w/index.php?title=XCI&amp;diff=13385</id>
		<title>XCI</title>
		<link rel="alternate" type="text/html" href="https://switchbrew.org/w/index.php?title=XCI&amp;diff=13385"/>
		<updated>2025-06-07T20:26:03Z</updated>

		<summary type="html">&lt;p&gt;DarkMatterCore: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is the format used for storing the contents of a Nintendo Switch Gamecard.&lt;br /&gt;
&lt;br /&gt;
= Structure =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x1000&lt;br /&gt;
| [[#CardKeyArea]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x1000&lt;br /&gt;
| 0x200&lt;br /&gt;
| [[#CardHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x1200&lt;br /&gt;
| 0x200&lt;br /&gt;
| [11.0.0+] [[#NewCardHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x1400&lt;br /&gt;
| 0x400&lt;br /&gt;
| [11.0.0+] [[#NewCardHeaderCertArea]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x1800&lt;br /&gt;
| 0x100&lt;br /&gt;
| [11.0.0+] NewCardHeaderCertAreaModulus&lt;br /&gt;
|-&lt;br /&gt;
| 0x1900&lt;br /&gt;
| 0x6700&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x8000&lt;br /&gt;
| 0x8000&lt;br /&gt;
| [[#CertArea]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x10000&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#NormalArea]]&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#RomArea]]&lt;br /&gt;
|-&lt;br /&gt;
| Invalid&lt;br /&gt;
| Invalid&lt;br /&gt;
| BackupArea&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== CardKeyArea ==&lt;br /&gt;
This region cannot be read directly once written to the Gamecard. Therefore, it is hidden away during read/write operations on the raw Gamecard data.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x200&lt;br /&gt;
| [[#InitialData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x200&lt;br /&gt;
| 0xD00&lt;br /&gt;
| [[#TitleKeyArea]]&lt;br /&gt;
|-&lt;br /&gt;
| 0xF00&lt;br /&gt;
| 0x100&lt;br /&gt;
| Reserved&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== InitialData ===&lt;br /&gt;
This region is used for challenge–response authentication when changing to the Gamecard&#039;s secure mode.&lt;br /&gt;
&lt;br /&gt;
[[Filesystem_services|FS]] calculates a SHA-256 hash over the whole 0x200 bytes and compares it with the hash stored at offset 0x160 in the [[#CardHeader]].&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x8&lt;br /&gt;
| Package ID from [[#CardHeader]] at offset 0x110&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x8&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0x10&lt;br /&gt;
| Challenge–response authentication data&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| 0x10&lt;br /&gt;
| Challenge–response authentication MAC&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| 0xC&lt;br /&gt;
| Challenge–response authentication Nonce&lt;br /&gt;
|-&lt;br /&gt;
| 0x3C&lt;br /&gt;
| 0x1C4&lt;br /&gt;
| Reserved (must be empty)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== TitleKeyArea ===&lt;br /&gt;
This region is stored encrypted and contains the title keys used by the [[#InitialData]].&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x8&lt;br /&gt;
| TitleKey1&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x8&lt;br /&gt;
| TitleKey2&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0xCF0&lt;br /&gt;
| Reserved&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== CardHeader ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x100&lt;br /&gt;
| RSA-2048 PKCS #1 signature over the header (data from 0x100 to 0x200)&lt;br /&gt;
|-&lt;br /&gt;
| 0x100&lt;br /&gt;
| 0x4&lt;br /&gt;
| Magic (&amp;quot;HEAD&amp;quot;)&lt;br /&gt;
|-&lt;br /&gt;
| 0x104&lt;br /&gt;
| 0x4&lt;br /&gt;
| RomAreaStartPageAddress (in Gamecard page units, which are 0x200 bytes)&lt;br /&gt;
|-&lt;br /&gt;
| 0x108&lt;br /&gt;
| 0x4&lt;br /&gt;
| BackupAreaStartPageAddress (always 0xFFFFFFFF)&lt;br /&gt;
|-&lt;br /&gt;
| 0x10C&lt;br /&gt;
| 0x1&lt;br /&gt;
| TitleKeyDecIndex (high nibble) and KekIndex (low nibble)&lt;br /&gt;
|-&lt;br /&gt;
| 0x10D&lt;br /&gt;
| 0x1&lt;br /&gt;
| [[#RomSize]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x10E&lt;br /&gt;
| 0x1&lt;br /&gt;
| [[#Version]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x10F&lt;br /&gt;
| 0x1&lt;br /&gt;
| [[#Flags]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x110&lt;br /&gt;
| 0x8&lt;br /&gt;
| PackageId (used for challenge–response authentication)&lt;br /&gt;
|-&lt;br /&gt;
| 0x118&lt;br /&gt;
| 0x4&lt;br /&gt;
| ValidDataEndAddress (in Gamecard page units, which are 0x200 bytes)&lt;br /&gt;
|-&lt;br /&gt;
| 0x11C&lt;br /&gt;
| 0x4&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x120&lt;br /&gt;
| 0x10&lt;br /&gt;
| Iv (reversed)&lt;br /&gt;
|-&lt;br /&gt;
| 0x130&lt;br /&gt;
| 0x8&lt;br /&gt;
| PartitionFsHeaderAddress&lt;br /&gt;
|-&lt;br /&gt;
| 0x138&lt;br /&gt;
| 0x8&lt;br /&gt;
| PartitionFsHeaderSize&lt;br /&gt;
|-&lt;br /&gt;
| 0x140&lt;br /&gt;
| 0x20&lt;br /&gt;
| PartitionFsHeaderHash (SHA-256 hash of the [[#PartitionFsHeader]])&lt;br /&gt;
|-&lt;br /&gt;
| 0x160&lt;br /&gt;
| 0x20&lt;br /&gt;
| InitialDataHash (SHA-256 hash of the [[#InitialData]])&lt;br /&gt;
|-&lt;br /&gt;
| 0x180&lt;br /&gt;
| 0x4&lt;br /&gt;
| [[#SelSec]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x184&lt;br /&gt;
| 0x4&lt;br /&gt;
| SelT1Key (always 2)&lt;br /&gt;
|-&lt;br /&gt;
| 0x188&lt;br /&gt;
| 0x4&lt;br /&gt;
| SelKey (always 0)&lt;br /&gt;
|-&lt;br /&gt;
| 0x18C&lt;br /&gt;
| 0x4&lt;br /&gt;
| LimArea (in Gamecard page units, which are 0x200 bytes)&lt;br /&gt;
|-&lt;br /&gt;
| 0x190&lt;br /&gt;
| 0x70&lt;br /&gt;
| [[#CardHeaderEncryptedData]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== RomSize ===&lt;br /&gt;
[[Filesystem_services|FS]] retrieves this data as [[Filesystem_services#GameCardSize|GameCardSize]].&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Value&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0xFA&lt;br /&gt;
| 1GB&lt;br /&gt;
|-&lt;br /&gt;
| 0xF8&lt;br /&gt;
| 2GB&lt;br /&gt;
|-&lt;br /&gt;
| 0xF0&lt;br /&gt;
| 4GB&lt;br /&gt;
|-&lt;br /&gt;
| 0xE0&lt;br /&gt;
| 8GB&lt;br /&gt;
|-&lt;br /&gt;
| 0xE1&lt;br /&gt;
| 16GB&lt;br /&gt;
|-&lt;br /&gt;
| 0xE2&lt;br /&gt;
| 32GB&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Version ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Value&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Default&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| [20.0.0+] T2Supported&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Flags ===&lt;br /&gt;
[[Filesystem_services|FS]] retrieves this data as [[Filesystem_services#GameCardAttribute|GameCardAttribute]].&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Bits&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| AutoBoot&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| HistoryErase&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| [4.0.0+] RepairTool&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| [9.0.0+] DifferentRegionCupToTerraDevice&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| [9.0.0+] DifferentRegionCupToGlobalDevice&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| [11.0.0+] CardHeaderSignKey&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== SelSec ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Value&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| T1&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| T2&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CardHeaderEncryptedData ===&lt;br /&gt;
This region is stored encrypted (AES-128-CBC).&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x8&lt;br /&gt;
| [[#FwVersion]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x4&lt;br /&gt;
| [[#AccCtrl1]]&lt;br /&gt;
|-&lt;br /&gt;
| 0xC&lt;br /&gt;
| 0x4&lt;br /&gt;
| Wait1TimeRead (always 0x1388)&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0x4&lt;br /&gt;
| Wait2TimeRead (always 0)&lt;br /&gt;
|-&lt;br /&gt;
| 0x14&lt;br /&gt;
| 0x4&lt;br /&gt;
| Wait1TimeWrite (always 0)&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| 0x4&lt;br /&gt;
| Wait2TimeWrite (always 0)&lt;br /&gt;
|-&lt;br /&gt;
| 0x1C&lt;br /&gt;
| 0x4&lt;br /&gt;
| FwMode (the current SdkAddonVersion)&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| 0x4&lt;br /&gt;
| UppVersion&lt;br /&gt;
|-&lt;br /&gt;
| 0x24&lt;br /&gt;
| 0x1&lt;br /&gt;
| [9.0.0+] [[#CompatibilityType]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x25&lt;br /&gt;
| 0x3&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x28&lt;br /&gt;
| 0x8&lt;br /&gt;
| UppHash (SHA-256 hash of the [[#UpdatePartition]])&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| 0x8&lt;br /&gt;
| UppId (always 0x0100000000000816)&lt;br /&gt;
|-&lt;br /&gt;
| 0x38&lt;br /&gt;
| 0x38&lt;br /&gt;
| Reserved&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== FwVersion ====&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Value&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Development&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Retail&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| [4.0.0+] Retail&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| [11.0.0+] Development&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| [11.0.0+] Retail&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| [12.0.0+] Retail&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== AccCtrl1 ====&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Value&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00A10011&lt;br /&gt;
| 25MHz&lt;br /&gt;
|-&lt;br /&gt;
| 0x00A10010&lt;br /&gt;
| 50MHz&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== CompatibilityType ====&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Value&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Normal&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Terra&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NewCardHeader ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x100&lt;br /&gt;
| RSA-2048 PKCS #1 signature over the header (data from 0x100 to 0x200)&lt;br /&gt;
|-&lt;br /&gt;
| 0x100&lt;br /&gt;
| 0x4&lt;br /&gt;
| Magic (&amp;quot;HEAD&amp;quot;)&lt;br /&gt;
|-&lt;br /&gt;
| 0x104&lt;br /&gt;
| 0x4&lt;br /&gt;
| RomAreaStartPageAddress (in Gamecard page units, which are 0x200 bytes)&lt;br /&gt;
|-&lt;br /&gt;
| 0x108&lt;br /&gt;
| 0x4&lt;br /&gt;
| BackupAreaStartPageAddress (always 0xFFFFFFFF)&lt;br /&gt;
|-&lt;br /&gt;
| 0x10C&lt;br /&gt;
| 0x1&lt;br /&gt;
| TitleKeyDecIndex (high nibble) and KekIndex (low nibble)&lt;br /&gt;
|-&lt;br /&gt;
| 0x10D&lt;br /&gt;
| 0x1&lt;br /&gt;
| [[#RomSize]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x10E&lt;br /&gt;
| 0x1&lt;br /&gt;
| [[#Version]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x10F&lt;br /&gt;
| 0x1&lt;br /&gt;
| [[#Flags]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x110&lt;br /&gt;
| 0x8&lt;br /&gt;
| PackageId (used for challenge–response authentication)&lt;br /&gt;
|-&lt;br /&gt;
| 0x118&lt;br /&gt;
| 0x4&lt;br /&gt;
| ValidDataEndAddress (in Gamecard page units, which are 0x200 bytes)&lt;br /&gt;
|-&lt;br /&gt;
| 0x11C&lt;br /&gt;
| 0x1&lt;br /&gt;
| [20.0.0+] CardHeaderSignKeyIndex ([1.0.0-19.0.1] Reserved)&lt;br /&gt;
|-&lt;br /&gt;
| 0x11D&lt;br /&gt;
| 0x1&lt;br /&gt;
| [18.0.0+] [[#Flags2]] ([1.0.0-17.0.1] Reserved)&lt;br /&gt;
|-&lt;br /&gt;
| 0x11E&lt;br /&gt;
| 0x2&lt;br /&gt;
| [19.0.0+] [[#NumberOfApplicationIds]] ([1.0.0-18.1.0] Reserved)&lt;br /&gt;
|-&lt;br /&gt;
| 0x120&lt;br /&gt;
| 0x10&lt;br /&gt;
| Iv (reversed)&lt;br /&gt;
|-&lt;br /&gt;
| 0x130&lt;br /&gt;
| 0x8&lt;br /&gt;
| PartitionFsHeaderAddress&lt;br /&gt;
|-&lt;br /&gt;
| 0x138&lt;br /&gt;
| 0x8&lt;br /&gt;
| PartitionFsHeaderSize&lt;br /&gt;
|-&lt;br /&gt;
| 0x140&lt;br /&gt;
| 0x20&lt;br /&gt;
| PartitionFsHeaderHash (SHA-256 hash of the [[#PartitionFsHeader]])&lt;br /&gt;
|-&lt;br /&gt;
| 0x160&lt;br /&gt;
| 0x20&lt;br /&gt;
| InitialDataHash (SHA-256 hash of the [[#InitialData]])&lt;br /&gt;
|-&lt;br /&gt;
| 0x180&lt;br /&gt;
| 0x4&lt;br /&gt;
| [[#SelSec]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x184&lt;br /&gt;
| 0x4&lt;br /&gt;
| SelT1Key (always 2)&lt;br /&gt;
|-&lt;br /&gt;
| 0x188&lt;br /&gt;
| 0x4&lt;br /&gt;
| SelKey (always 0)&lt;br /&gt;
|-&lt;br /&gt;
| 0x18C&lt;br /&gt;
| 0x4&lt;br /&gt;
| LimArea (in Gamecard page units, which are 0x200 bytes)&lt;br /&gt;
|-&lt;br /&gt;
| 0x190&lt;br /&gt;
| 0x70&lt;br /&gt;
| [[#NewCardHeaderEncryptedData]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Flags2 ===&lt;br /&gt;
[[Filesystem_services|FS]] retrieves this data as [[Filesystem_services#GameCardAttribute2|GameCardAttribute2]].&lt;br /&gt;
&lt;br /&gt;
=== NumberOfApplicationIds ===&lt;br /&gt;
This is the number of entries in the ApplicationIdList located right before ValidDataEndAddress.&lt;br /&gt;
&lt;br /&gt;
=== NewCardHeaderEncryptedData ===&lt;br /&gt;
This region is stored encrypted (AES-128-CBC).&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x8&lt;br /&gt;
| [[#FwVersion]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x4&lt;br /&gt;
| [[#AccCtrl1]]&lt;br /&gt;
|-&lt;br /&gt;
| 0xC&lt;br /&gt;
| 0x4&lt;br /&gt;
| Wait1TimeRead (always 0x1388)&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0x4&lt;br /&gt;
| Wait2TimeRead (always 0)&lt;br /&gt;
|-&lt;br /&gt;
| 0x14&lt;br /&gt;
| 0x4&lt;br /&gt;
| Wait1TimeWrite (always 0)&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| 0x4&lt;br /&gt;
| Wait2TimeWrite (always 0)&lt;br /&gt;
|-&lt;br /&gt;
| 0x1C&lt;br /&gt;
| 0x4&lt;br /&gt;
| FwMode (the current SdkAddonVersion)&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| 0x4&lt;br /&gt;
| UppVersion&lt;br /&gt;
|-&lt;br /&gt;
| 0x24&lt;br /&gt;
| 0x1&lt;br /&gt;
| [[#CompatibilityType]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x25&lt;br /&gt;
| 0x3&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x28&lt;br /&gt;
| 0x8&lt;br /&gt;
| UppHash (SHA-256 hash of the [[#UpdatePartition]])&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| 0x8&lt;br /&gt;
| UppId (always 0x0100000000000816)&lt;br /&gt;
|-&lt;br /&gt;
| 0x38&lt;br /&gt;
| 0x8&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x40&lt;br /&gt;
| 0x20&lt;br /&gt;
| RelatedCardHeaderHash (SHA-256 hash of [[#CardHeader]])&lt;br /&gt;
|-&lt;br /&gt;
| 0x60&lt;br /&gt;
| 0x10&lt;br /&gt;
| Reserved&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NewCardHeaderCertArea ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x100&lt;br /&gt;
| RSA-2048 PKCS #1 signature over the data from 0x100 to 0x400&lt;br /&gt;
|-&lt;br /&gt;
| 0x100&lt;br /&gt;
| 0x4&lt;br /&gt;
| Magic&lt;br /&gt;
|-&lt;br /&gt;
| 0x104&lt;br /&gt;
| 0x4&lt;br /&gt;
| Version&lt;br /&gt;
|-&lt;br /&gt;
| 0x108&lt;br /&gt;
| 0x8&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x110&lt;br /&gt;
| 0x1&lt;br /&gt;
| CardHeaderSignKeyIndex&lt;br /&gt;
|-&lt;br /&gt;
| 0x111&lt;br /&gt;
| 0x1F&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x130&lt;br /&gt;
| 0x100&lt;br /&gt;
| Modulus&lt;br /&gt;
|-&lt;br /&gt;
| 0x230&lt;br /&gt;
| 0x3&lt;br /&gt;
| PublicExponent&lt;br /&gt;
|-&lt;br /&gt;
| 0x233&lt;br /&gt;
| 0x1CD&lt;br /&gt;
| Reserved&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== CertArea ==&lt;br /&gt;
This is the Gamecard&#039;s unique certificate.&lt;br /&gt;
&lt;br /&gt;
[[Filesystem_services|FS]] retrieves this data with [[Filesystem_services#GetGameCardDeviceCertificate|GetGameCardDeviceCertificate]].&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x100&lt;br /&gt;
| RSA-2048 PKCS #1 signature over the data from 0x100 to 0x200&lt;br /&gt;
|-&lt;br /&gt;
| 0x100&lt;br /&gt;
| 0x4&lt;br /&gt;
| Magic (&amp;quot;CERT&amp;quot;)&lt;br /&gt;
|-&lt;br /&gt;
| 0x104&lt;br /&gt;
| 0x4&lt;br /&gt;
| Version&lt;br /&gt;
|-&lt;br /&gt;
| 0x108&lt;br /&gt;
| 0x1&lt;br /&gt;
| KekIndex&lt;br /&gt;
|-&lt;br /&gt;
| 0x109&lt;br /&gt;
| 0x7&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x110&lt;br /&gt;
| 0x10&lt;br /&gt;
| T1CardDeviceId&lt;br /&gt;
|-&lt;br /&gt;
| 0x120&lt;br /&gt;
| 0x10&lt;br /&gt;
| Iv&lt;br /&gt;
|-&lt;br /&gt;
| 0x130&lt;br /&gt;
| 0x10&lt;br /&gt;
| HwKey (encrypted)&lt;br /&gt;
|-&lt;br /&gt;
| 0x140&lt;br /&gt;
| 0xC0&lt;br /&gt;
| Reserved (encrypted)&lt;br /&gt;
|-&lt;br /&gt;
| 0x200&lt;br /&gt;
| 0x7E00&lt;br /&gt;
| Reserved&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NormalArea ==&lt;br /&gt;
This region contains all non-secure partitions of the Gamecard file system.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#PartitionFsHeader|RootPartitionHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#PartitionFsHeader|UpdatePartitionHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#UpdatePartition|UpdatePartition]]&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [4.0.0+] [[#PartitionFsHeader|LogoPartitionHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [4.0.0+] [[#LogoPartition|LogoPartition]]&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#PartitionFsHeader|NormalPartitionHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#NormalPartition|NormalPartition]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== UpdatePartition ===&lt;br /&gt;
This partition contains .cnmt.nca + .nca files for the entire system update required to play the game. Launch day carts contain a full copy of 1.0 ncas, newer carts contain newer sysupdate NCAs etc.&lt;br /&gt;
&lt;br /&gt;
=== NormalPartition ===&lt;br /&gt;
This partition contains the .cnmt.nca and the game icondata nca. This is presumably for future compatibility so that if a future update changes the cryptographic protocol for the secure partition. Game icon data can still be shown in the home menu on old firmwares.&lt;br /&gt;
&lt;br /&gt;
[4.0.0+] This partition is now empty.&lt;br /&gt;
&lt;br /&gt;
=== LogoPartition ===&lt;br /&gt;
[4.0.0+] This partition now contains the contents of the [[#NormalPartition]].&lt;br /&gt;
&lt;br /&gt;
== RomArea ==&lt;br /&gt;
This region contains all secure partitions of the Gamecard file system.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#PartitionFsHeader|SecurePartitionHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| Variable&lt;br /&gt;
| Variable&lt;br /&gt;
| [[#SecurePartition|SecurePartition]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== SecurePartition ===&lt;br /&gt;
This partition contains an identical copy of the .cnmt.nca and game icondata nca, as well as all other ncas required for the game.&lt;br /&gt;
&lt;br /&gt;
== PartitionFs ==&lt;br /&gt;
This is the Gamecard file system which starts with magicnum &amp;quot;HFS0&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
=== PartitionFsHeader ===&lt;br /&gt;
The &amp;quot;SHA-256 File System&amp;quot; or &amp;quot;HFS0&amp;quot; starts at offset 0x10000 in the Gamecard. The first 0x200 bytes act as a global header and represent the root partition which points to the other partitions (&amp;quot;normal&amp;quot;, &amp;quot;logo&amp;quot;, &amp;quot;update&amp;quot; and &amp;quot;secure&amp;quot;).&lt;br /&gt;
&lt;br /&gt;
A hash for this header is stored at offset 0x140 in the [[#CardHeader]].&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x4&lt;br /&gt;
| Magic (&amp;quot;HFS0&amp;quot;)&lt;br /&gt;
|-&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x4&lt;br /&gt;
| FileCount&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x4&lt;br /&gt;
| StringTableSize&lt;br /&gt;
|-&lt;br /&gt;
| 0xC&lt;br /&gt;
| 0x4&lt;br /&gt;
| Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| X&lt;br /&gt;
| [[#FileEntryTable]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x10 + X&lt;br /&gt;
| Y&lt;br /&gt;
| StringTable&lt;br /&gt;
|-&lt;br /&gt;
| 0x10 + X + Y&lt;br /&gt;
| Z&lt;br /&gt;
| RawFileData&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== FileEntryTable ====&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x8&lt;br /&gt;
| Offset of file in Data&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x8&lt;br /&gt;
| Size of file in Data&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0x4&lt;br /&gt;
| Offset of filename in String Table&lt;br /&gt;
|-&lt;br /&gt;
| 0x14&lt;br /&gt;
| 0x4&lt;br /&gt;
| Size of Hashed region of file (for HFS0s, this is the size of the pre-filedata portion, for NCAs this is usually 0x200)&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| 8&lt;br /&gt;
| Zero/Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| 0x20&lt;br /&gt;
| SHA-256 hash of the first (size of hashed region) bytes of filedata&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The string table is 00-padded to align the start of raw filedata with a sector/media unit boundary (usually?).&lt;/div&gt;</summary>
		<author><name>DarkMatterCore</name></author>
	</entry>
	<entry>
		<id>https://switchbrew.org/w/index.php?title=Ticket&amp;diff=12553</id>
		<title>Ticket</title>
		<link rel="alternate" type="text/html" href="https://switchbrew.org/w/index.php?title=Ticket&amp;diff=12553"/>
		<updated>2023-10-15T22:08:49Z</updated>

		<summary type="html">&lt;p&gt;DarkMatterCore: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Tickets are a format used to store an encrypted title key. The format has been updated again since 3DS.&lt;br /&gt;
&lt;br /&gt;
== Structure ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000 || Y || Signature data&lt;br /&gt;
|-&lt;br /&gt;
| Y || 0x2C0 || Ticket data&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Y denotes the total size of the &amp;quot;signature data&amp;quot; section and depends on the signature type.&lt;br /&gt;
&lt;br /&gt;
=== Signature data ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0 || 0x4 || Signature type&lt;br /&gt;
|-&lt;br /&gt;
| 0x4 || X || Signature&lt;br /&gt;
|-&lt;br /&gt;
| 0x4 + X || || Padding to align the signature data to 0x40 bytes&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Signature type ====&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Value&lt;br /&gt;
! Signature method&lt;br /&gt;
! Signature size&lt;br /&gt;
! Padding size&lt;br /&gt;
|-&lt;br /&gt;
| 0x010000&lt;br /&gt;
| RSA-4096 PKCS#1 v1.5 with SHA-1&lt;br /&gt;
| 0x200&lt;br /&gt;
| 0x3C&lt;br /&gt;
|-&lt;br /&gt;
| 0x010001&lt;br /&gt;
| RSA-2048 PKCS#1 v1.5 with SHA-1&lt;br /&gt;
| 0x100&lt;br /&gt;
| 0x3C&lt;br /&gt;
|-&lt;br /&gt;
| 0x010002&lt;br /&gt;
| ECDSA with SHA-1&lt;br /&gt;
| 0x3C&lt;br /&gt;
| 0x40&lt;br /&gt;
|-&lt;br /&gt;
| 0x010003&lt;br /&gt;
| RSA-4096 PKCS#1 v1.5 with SHA-256&lt;br /&gt;
| 0x200&lt;br /&gt;
| 0x3C&lt;br /&gt;
|-&lt;br /&gt;
| 0x010004&lt;br /&gt;
| RSA-2048 PKCS#1 v1.5 with SHA-256&lt;br /&gt;
| 0x100&lt;br /&gt;
| 0x3C&lt;br /&gt;
|-&lt;br /&gt;
| 0x010005&lt;br /&gt;
| ECDSA with SHA-256&lt;br /&gt;
| 0x3C&lt;br /&gt;
| 0x40&lt;br /&gt;
|-&lt;br /&gt;
| 0x010006&lt;br /&gt;
| HMAC-SHA1-160&lt;br /&gt;
| 0x14&lt;br /&gt;
| 0x28&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The hash for the signature is calculated over the ticket data.&lt;br /&gt;
&lt;br /&gt;
=== Ticket data ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0 || 0x40 || Issuer&lt;br /&gt;
|-&lt;br /&gt;
| 0x40 || 0x100 || Title key block&lt;br /&gt;
|-&lt;br /&gt;
| 0x140 || 0x1 || Ticket Version (Always 2 for Switch (ES) Tickets)&lt;br /&gt;
|-&lt;br /&gt;
| 0x141 || 0x1 || Title key type&lt;br /&gt;
|-&lt;br /&gt;
| 0x142 || 0x2 || Ticket Version&lt;br /&gt;
|-&lt;br /&gt;
| 0x144 || 0x1 || License Type&lt;br /&gt;
|-&lt;br /&gt;
| 0x145 || 0x1 || Master key revision&lt;br /&gt;
|-&lt;br /&gt;
| 0x146 || 0x2 || Properties Bitfield&lt;br /&gt;
|-&lt;br /&gt;
| 0x148 || 0x8 || Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x150 || 0x8 || Ticket ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x158 || 0x8 || Device ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x160 || 0x10 || Rights ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x170 || 0x4 || Account ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x174 || 0xC || Unknown&lt;br /&gt;
|-&lt;br /&gt;
| 0x180 || 0x140 || Unknown&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The title key can be stored as a 16-byte block when tickets are &amp;quot;common&amp;quot; [2.0.0+] with title key type 0, or as a &amp;quot;personalized&amp;quot; RSA-2048 message when title key type is 1. The latter is used for titles requiring stronger licensing (applications, add-on content), while the former (old) method is used for patches.&lt;br /&gt;
&lt;br /&gt;
When RSA is used, this uses an SPL key handle that is initialized with the console-unique RSA-2048 ticket key.&lt;br /&gt;
&lt;br /&gt;
== Certificate chain ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!  Certificate&lt;br /&gt;
!  Signature type&lt;br /&gt;
!  Retail cert name&lt;br /&gt;
!  Debug cert name&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  Ticket&lt;br /&gt;
|  RSA-2048&lt;br /&gt;
|  colspan=&amp;quot;2&amp;quot; style=&amp;quot;text-align:center;&amp;quot; | XS00000020&lt;br /&gt;
|  Used to verify ticket signatures using AES title key block (&amp;quot;common&amp;quot; tickets)&lt;br /&gt;
|-&lt;br /&gt;
|  Ticket&lt;br /&gt;
|  RSA-2048&lt;br /&gt;
|  colspan=&amp;quot;2&amp;quot; style=&amp;quot;text-align:center;&amp;quot; | XS00000021&lt;br /&gt;
|  Used to verify ticket signatures using RSA title key block (&amp;quot;personalized&amp;quot; tickets)&lt;br /&gt;
|-&lt;br /&gt;
|  Ticket&lt;br /&gt;
|  RSA-2048&lt;br /&gt;
|  colspan=&amp;quot;2&amp;quot; style=&amp;quot;text-align:center;&amp;quot; | [9.0.0+] XS00000024&lt;br /&gt;
|  Used to verify ticket signatures using RSA title key block (&amp;quot;personalized&amp;quot; tickets)&lt;br /&gt;
|-&lt;br /&gt;
|  CA&lt;br /&gt;
|  RSA-4096&lt;br /&gt;
|  style=&amp;quot;text-align:center;&amp;quot; | CA00000003&lt;br /&gt;
|  style=&amp;quot;text-align:center;&amp;quot; | CA00000004&lt;br /&gt;
|  Used to verify the ticket certificate&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The CA certificate is issued by &#039;Root&#039;, the public key for which is stored in ES.&lt;/div&gt;</summary>
		<author><name>DarkMatterCore</name></author>
	</entry>
	<entry>
		<id>https://switchbrew.org/w/index.php?title=Ticket&amp;diff=12540</id>
		<title>Ticket</title>
		<link rel="alternate" type="text/html" href="https://switchbrew.org/w/index.php?title=Ticket&amp;diff=12540"/>
		<updated>2023-10-14T13:35:23Z</updated>

		<summary type="html">&lt;p&gt;DarkMatterCore: Update debug cert names + change certificate chain table entry order&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Tickets are a format used to store an encrypted title key. The format has been updated again since 3DS.&lt;br /&gt;
&lt;br /&gt;
== Structure ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000 || Y || Signature data&lt;br /&gt;
|-&lt;br /&gt;
| Y || 0x2C0 || Ticket data&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Y denotes the total size of the &amp;quot;signature data&amp;quot; section and depends on the signature type.&lt;br /&gt;
&lt;br /&gt;
=== Signature data ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0 || 0x4 || Signature type&lt;br /&gt;
|-&lt;br /&gt;
| 0x4 || X || Signature&lt;br /&gt;
|-&lt;br /&gt;
| 0x4 + X || || Padding to align the signature data to 0x40 bytes&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Signature type ====&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Value&lt;br /&gt;
! Signature method&lt;br /&gt;
! Signature size&lt;br /&gt;
! Padding size&lt;br /&gt;
|-&lt;br /&gt;
| 0x010000&lt;br /&gt;
| RSA_4096 SHA1&lt;br /&gt;
| 0x200&lt;br /&gt;
| 0x3C&lt;br /&gt;
|-&lt;br /&gt;
| 0x010001&lt;br /&gt;
| RSA_2048 SHA1&lt;br /&gt;
| 0x100&lt;br /&gt;
| 0x3C&lt;br /&gt;
|-&lt;br /&gt;
| 0x010002&lt;br /&gt;
| ECDSA SHA1&lt;br /&gt;
| 0x3C&lt;br /&gt;
| 0x40&lt;br /&gt;
|-&lt;br /&gt;
| 0x010003&lt;br /&gt;
| RSA_4096 SHA256&lt;br /&gt;
| 0x200&lt;br /&gt;
| 0x3C&lt;br /&gt;
|-&lt;br /&gt;
| 0x010004&lt;br /&gt;
| RSA_2048 SHA256&lt;br /&gt;
| 0x100&lt;br /&gt;
| 0x3C&lt;br /&gt;
|-&lt;br /&gt;
| 0x010005&lt;br /&gt;
| ECDSA SHA256&lt;br /&gt;
| 0x3C&lt;br /&gt;
| 0x40&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The hash for the signature is calculated over the ticket data.&lt;br /&gt;
&lt;br /&gt;
=== Ticket data ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset&lt;br /&gt;
! Size&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0 || 0x40 || Issuer&lt;br /&gt;
|-&lt;br /&gt;
| 0x40 || 0x100 || Title key block&lt;br /&gt;
|-&lt;br /&gt;
| 0x140 || 0x1 || Ticket Version (Always 2 for Switch (ES) Tickets)&lt;br /&gt;
|-&lt;br /&gt;
| 0x141 || 0x1 || Title key type&lt;br /&gt;
|-&lt;br /&gt;
| 0x142 || 0x2 || Ticket Version&lt;br /&gt;
|-&lt;br /&gt;
| 0x144 || 0x1 || License Type&lt;br /&gt;
|-&lt;br /&gt;
| 0x145 || 0x1 || Master key revision&lt;br /&gt;
|-&lt;br /&gt;
| 0x146 || 0x2 || Properties Bitfield&lt;br /&gt;
|-&lt;br /&gt;
| 0x148 || 0x8 || Reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x150 || 0x8 || Ticket ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x158 || 0x8 || Device ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x160 || 0x10 || Rights ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x170 || 0x4 || Account ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x174 || 0xC || Unknown&lt;br /&gt;
|-&lt;br /&gt;
| 0x180 || 0x140 || Unknown&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The title key can be stored as a 16-byte block when tickets are &amp;quot;common&amp;quot; [2.0.0+] with title key type 0, or as a &amp;quot;personalized&amp;quot; RSA-2048 message when title key type is 1. The latter is used for titles requiring stronger licensing (applications, add-on content), while the former (old) method is used for patches.&lt;br /&gt;
&lt;br /&gt;
When RSA is used, this uses an SPL key handle that is initialized with the console-unique RSA-2048 ticket key.&lt;br /&gt;
&lt;br /&gt;
== Certificate chain ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!  Certificate&lt;br /&gt;
!  Signature type&lt;br /&gt;
!  Retail cert name&lt;br /&gt;
!  Debug cert name&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  Ticket&lt;br /&gt;
|  RSA-2048&lt;br /&gt;
|  colspan=&amp;quot;2&amp;quot; style=&amp;quot;text-align:center;&amp;quot; | XS00000020&lt;br /&gt;
|  Used to verify ticket signatures using AES title key block (&amp;quot;common&amp;quot; tickets)&lt;br /&gt;
|-&lt;br /&gt;
|  Ticket&lt;br /&gt;
|  RSA-2048&lt;br /&gt;
|  colspan=&amp;quot;2&amp;quot; style=&amp;quot;text-align:center;&amp;quot; | XS00000021&lt;br /&gt;
|  Used to verify ticket signatures using RSA title key block (&amp;quot;personalized&amp;quot; tickets)&lt;br /&gt;
|-&lt;br /&gt;
|  CA&lt;br /&gt;
|  RSA-4096&lt;br /&gt;
|  CA00000003&lt;br /&gt;
|  CA00000004&lt;br /&gt;
|  Used to verify the ticket certificate&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The CA certificate is issued by &#039;Root&#039;, the public key for which is stored in ES.&lt;/div&gt;</summary>
		<author><name>DarkMatterCore</name></author>
	</entry>
	<entry>
		<id>https://switchbrew.org/w/index.php?title=Talk:XCI&amp;diff=10801</id>
		<title>Talk:XCI</title>
		<link rel="alternate" type="text/html" href="https://switchbrew.org/w/index.php?title=Talk:XCI&amp;diff=10801"/>
		<updated>2021-04-06T23:13:53Z</updated>

		<summary type="html">&lt;p&gt;DarkMatterCore: Created page with &amp;quot;== CardInfo UppHash value ==  I have successfully decrypted the &amp;lt;code&amp;gt;CardInfo&amp;lt;/code&amp;gt; area from a personal gamecard dump retrieved through my own application ([https://github....&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== CardInfo UppHash value ==&lt;br /&gt;
&lt;br /&gt;
I have successfully decrypted the &amp;lt;code&amp;gt;CardInfo&amp;lt;/code&amp;gt; area from a personal gamecard dump retrieved through my own application ([https://github.com/DarkMatterCore/nxdumptool nxdumptool]). The AES-CBC key for this area was manually retrieved from a FS process memory dump at runtime, much like [https://github.com/shchmue/Lockpick vanilla Lockpick] used to work.&lt;br /&gt;
&lt;br /&gt;
The wiki page mentions that the &amp;lt;code&amp;gt;UppHash&amp;lt;/code&amp;gt; field represents the SHA-256 checksum from &amp;lt;code&amp;gt;UpdatePartition&amp;lt;/code&amp;gt; - the question is, how is this checksum calculated? I have tried to use different start offsets and sizes, and none of the generated SHA-256 checksums holds a matching byte sequence:&lt;br /&gt;
&lt;br /&gt;
* Hashing the full update partition (starting at the &amp;lt;code&amp;gt;HFS0&amp;lt;/code&amp;gt; magic word, and using the full partition size specified in the root partition).&lt;br /&gt;
* Hashing the update partition without zero padding (starting at the &amp;lt;code&amp;gt;HFS0&amp;lt;/code&amp;gt; magic word, and ending right after the data for the last file entry).&lt;br /&gt;
* Hashing the raw update partition data (starting right after the HFS string table, and using the full partition size *minus* the full HFS header size).&lt;br /&gt;
* Hashing the raw update partition data without zero padding (starting right after the HFS string table, and ending right after the data for the last file entry).&lt;br /&gt;
&lt;br /&gt;
It&#039;s worth noting that all offsets and sizes are page-aligned. The start offsets for both the partition header and raw partition data are always page-aligned, and the partition size without zero padding is also page-aligned.&lt;br /&gt;
&lt;br /&gt;
I have no actual use for this information - it&#039;s just something I&#039;d like to comprehend and document, if possible. Thanks in advance. [[User:DarkMatterCore|DarkMatterCore]] ([[User talk:DarkMatterCore|talk]]) 01:13, 7 April 2021 (UTC)&lt;/div&gt;</summary>
		<author><name>DarkMatterCore</name></author>
	</entry>
</feed>