Difference between revisions of "Flash Filesystem"

From Nintendo Switch Brew
Jump to navigation Jump to search
(87 intermediate revisions by 14 users not shown)
Line 1: Line 1:
 
= NAND structure =
 
= NAND structure =
 +
The Switch's eMMC storage features a large user area, two smaller boot partitions and a replay-protected memory block which is unused (no authentication key is programmed).
 +
 +
All official partition names come from [[SystemInitializer]].
  
 
== Boot Partitions ==
 
== Boot Partitions ==
 +
'''Boot Partition 0 (0 of 1)'''
 +
 +
The official name for this partition is "BootPartition1Root" and it has [[Filesystem_services|Bis]] Partition ID == 0.
  
−
'''Boot Partition 0 (0 of 1)'''
 
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
|-
 
|-
Line 11: Line 16:
 
|-
 
|-
 
|  0x000000
 
|  0x000000
−
|   
+
|  0x4000
−
|  Title 0100000000000819 BCT
+
|  Normal Firmware [[BCT|BCT]] from [[Title_list#System_Data_Archives|Title 0100000000000819]]
 
|-
 
|-
 
|  0x004000
 
|  0x004000
−
|   
+
|  0x4000
−
|  Title 010000000000081A BCT
+
|  SafeMode Firmware [[BCT|BCT]] from [[Title_list#System_Data_Archives|Title 010000000000081A]]
 
|-
 
|-
 
|  0x008000
 
|  0x008000
−
|   
+
|  0x4000
−
|  Title 0100000000000819 BCT
+
|  Normal Firmware [[BCT|BCT]] from [[Title_list#System_Data_Archives|Title 0100000000000819]] (backup)
 
|-
 
|-
 
|  0x00C000
 
|  0x00C000
−
|   
+
|  0x4000
−
|  Title 010000000000081A BCT
+
|  SafeMode Firmware [[BCT|BCT]] from [[Title_list#System_Data_Archives|Title 010000000000081A]] (backup)
 +
|-
 +
|  0x010000
 +
|  0xEC000
 +
|  59 additional BCTs, normally unused/empty on retail systems.
 +
|-
 +
|  0x0FC000
 +
|  0x4000
 +
|  [[#System Update Control|System Update Control area]]
 
|-
 
|-
 
|  0x100000
 
|  0x100000
−
|   
+
|  0x40000
−
|  Title 0100000000000819 "package1"
+
|  Normal Firmware [[Package1|package1]] from [[Title_list#System_Data_Archives|Title 0100000000000819]]
 
|-
 
|-
 
|  0x140000
 
|  0x140000
−
|   
+
|  0x40000
−
|  Title 0100000000000819 "package1" (Backup)
+
|  Normal Firmware [[Package1|package1]] from [[Title_list#System_Data_Archives|Title 0100000000000819]] (backup)
 
|-
 
|-
 
|  0x180000
 
|  0x180000
−
|   
+
|  0x4000
−
|  Keyblob area, the first 0xB0 is identical to the console-unique "customer data" section in BCTs
+
|  [[#Keyblob|Keyblob area]]
 
|-
 
|-
 
|  0x184000
 
|  0x184000
−
|   
+
|  0x200
−
|  Unknown, 0x20-bytes hash + one u64? All zero on 1.0.
+
|  [2.0.0+] [[#NAND Patrol|NAND Patrol area]]
 
|}
 
|}
  
 
'''Boot Partition 1 (1 of 1)'''
 
'''Boot Partition 1 (1 of 1)'''
 +
 +
The official name for this partition is "BootPartition2Root" and it has [[Filesystem_services|Bis]] Partition ID == 10.
 +
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
|-
 
|-
Line 51: Line 67:
 
|-
 
|-
 
|  0x000000
 
|  0x000000
−
|   
+
|  0x40000
−
|  Title 010000000000081A "package1"
+
|  SafeMode Firmware [[Package1|package1]] from [[Title_list#System_Data_Archives|Title 010000000000081A]]
 
|-
 
|-
 
|  0x040000
 
|  0x040000
−
|   
+
|  0x40000
−
|  Title 010000000000081A "package1" (Backup)
+
|  SafeMode Firmware [[Package1|package1]] from [[Title_list#System_Data_Archives|Title 010000000000081A]] (backup)
 +
|-
 +
|  0x080000
 +
|  0x40000
 +
|  Reserved
 +
|-
 +
|  0x0C0000
 +
|  0x40000
 +
|  Reserved
 +
|}
 +
 
 +
=== System Update Control ===
 +
The 0x4000 bytes at offset 0xFC000 are used by [[NS_Services|NS]] and [[Boot|boot]] for keeping track of the status of a system update. This area is used by the [[NS_Services#ISystemUpdateControl|ISystemUpdateControl]] commands [[NS_Services#ApplyDownloadedUpdate|ApplyDownloadedUpdate]], [[NS_Services#ApplyCardUpdate|ApplyCardUpdate]] and [[NS_Services#ApplyReceivedUpdate|ApplyReceivedUpdate]].
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Offset
 +
!  Size
 +
!  Description
 +
|-
 +
| 0x0
 +
| 0x1
 +
| BootImages status. Set to 1 by [[NS_Services|NS]] during a system update and cleared by [[Boot|boot]] after restarting.
 +
|-
 +
| 0x1
 +
| 0x1
 +
| BootImagesSafe status. Set to 1 by [[NS_Services|NS]] during a system update and cleared by [[Boot|boot]] after restarting.
 +
|}
 +
 
 +
=== Keyblob ===
 +
Starting at offset 0x180000 is an array of 0x200-byte entries, for a total of 32 keyblobs. Each one is unique compared to the others and they are all console unique. This is officially known as the "EKS" (encryption key source) area.
 +
 
 +
From each 0x200-byte entry only the first 0xB0 bytes effectively form the keyblob as below.
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Offset
 +
!  Size
 +
!  Description
 +
|-
 +
| 0x0
 +
| 0x10
 +
| Keyblob AES-CMAC over the next 0xA0 bytes (safe against timing attacks)
 +
|-
 +
| 0x10
 +
| 0x10
 +
| Keyblob AES CTR
 +
|-
 +
| 0x20
 +
| 0x90
 +
| Keyblob encrypted payload
 +
|-
 +
| 0xB0
 +
| 0x150
 +
| Unused, all-zero.
 +
|}
 +
 
 +
The active bootloader's version (offset 0x2330 in the BCT) acts as an index (<code>version-1</code>) to control which keyblob should be installed into the system.
 +
[[NS_Services|NS]] uses this during system updates to install the keyblob into the [[BCT#customer_data|customer data]] section in BCTs (offset 0x450).
 +
 
 +
[[Boot]] also uses this index for repairing corrupt sectors.
 +
 
 +
The currently active keyblob is officially known as "SecureInfo".
 +
 
 +
=== NAND Patrol ===
 +
The 0x200 bytes at offset 0x184000 are used by [[Filesystem_services|FS]] for keeping track of NAND patrolling.
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Offset
 +
!  Size
 +
!  Description
 +
|-
 +
| 0x0
 +
| 0x20
 +
| HMAC-SHA-256 over the next 0x1E0 bytes
 +
|-
 +
| 0x20
 +
| 0x4
 +
| Last patrolled NAND block's offset
 +
|-
 +
| 0x24
 +
| 0x4
 +
| NAND patrol count
 +
|-
 +
| 0x28
 +
| 0x1D8
 +
| Unused, all-zero.
 
|}
 
|}
  
Line 63: Line 166:
 
|-
 
|-
 
!  Partition name
 
!  Partition name
 +
!  Partition type GUID
 
!  Offset
 
!  Offset
 
!  Size
 
!  Size
 
!  [[Filesystem_services|Bis]] Partition ID
 
!  [[Filesystem_services|Bis]] Partition ID
 +
!  Encrypted
 
!  Description
 
!  Description
 
|-
 
|-
 
|  N/A
 
|  N/A
 +
|
 
|  0x0
 
|  0x0
−
|
+
|  
 
|  20
 
|  20
−
|  GPT header, Bis-storage also allows raw access to the entire NAND eMMC sectors starting at sector0.
+
|  No
 +
|  GPT header, Bis-storage also allows raw access to the entire NAND eMMC sectors starting at sector0. The official name for this partition is "UserDataRoot".
 
|-
 
|-
−
|  PRODINFO
+
|  [[Calibration|PRODINFO]]
 +
|  {98109E25-64E2-4C95-8A77-414916F5BCEB}
 
|  0x00004400
 
|  0x00004400
 
|  0x003FBC00
 
|  0x003FBC00
 
|  27
 
|  27
−
|  "CAL0" raw partition containing set:cal data
+
|  Yes (Bis key 0)
 +
|  "CAL0" raw partition containing set:cal data. The official name for this partition is "CalibrationBinary".
 
|-
 
|-
−
|  PRODINFOF
+
|  [[Calibration|PRODINFOF]]
 +
|  {F3056AEC-5449-494C-9F2C-5FDCB75B6E6E}
 
|  0x00400000
 
|  0x00400000
 
|  0x00400000
 
|  0x00400000
 
|  28
 
|  28
−
|  FAT12 filesystem, additional calibration?
+
|  Yes (Bis key 0)
 +
|  FAT12 filesystem, additional calibration. The official name for this partition is "CalibrationFile".
 
|-
 
|-
 
|  BCPKG2-1-Normal-Main
 
|  BCPKG2-1-Normal-Main
 +
|  {5365DE36-911B-4BB4-8FF9-AA1EBCD73990}
 
|  0x00800000
 
|  0x00800000
 
|  0x00800000
 
|  0x00800000
 
|  21
 
|  21
−
|  For all these packages, data starts at offset 0x4000 and is not console-unique. This is installed from "package2": on retail it's from FIRM-A 0100000000000819, for unknown cases it's from FIRM-C, 010000000000081B.
+
|  No
 +
|  Raw partition where the first 0x4000 bytes (usually empty) contain the [[BootConfig]] and the remaining space contains the [[Package2|package2]] image from [[Title_list#System_Data_Archives|Title 0100000000000819]] by default. With the exFAT update installed, the [[Package2|package2]] image is switched to the one from [[Title_list#System_Data_Archives|Title 010000000000081B]]. The official name for this partition is "BootConfigAndPackage2Part1".
 
|-
 
|-
 
|  BCPKG2-2-Normal-Sub
 
|  BCPKG2-2-Normal-Sub
 +
|  {8455717B-BD2B-4162-8454-91695218FC38}
 
|  0x01000000
 
|  0x01000000
 
|  0x00800000
 
|  0x00800000
 
|  22
 
|  22
−
|  Identical to BCPKG2-1-Normal-Main, probably used as a backup partition.
+
|  No
 +
|  Backup partition for BCPKG2-1-Normal-Main. The official name for this partition is "BootConfigAndPackage2Part2".
 
|-
 
|-
 
|  BCPKG2-3-SafeMode-Main
 
|  BCPKG2-3-SafeMode-Main
 +
|  {8ED6C9A6-9C48-490B-BBEB-001D17A4C0F7}
 
|  0x01800000
 
|  0x01800000
 
|  0x00800000
 
|  0x00800000
 
|  23
 
|  23
−
|  This is installed from "package2" in firmware package B, 010000000000081A.
+
|  No
 +
|  Raw partition where the first 0x4000 bytes (usually empty) contain the [[BootConfig]] and the remaining space contains the [[Package2|package2]] image from [[Title_list#System_Data_Archives|Title 010000000000081A]] by default. On [4.0.0+] and with the exFAT update installed, the [[Package2|package2]] image is switched to the one from [[Title_list#System_Data_Archives|Title 010000000000081C]]. The official name for this partition is "BootConfigAndPackage2Part3".
 
|-
 
|-
 
|  BCPKG2-4-SafeMode-Sub
 
|  BCPKG2-4-SafeMode-Sub
 +
|  {5E99751C-56C9-47CC-AA30-B65039888917}
 
|  0x02000000
 
|  0x02000000
 
|  0x00800000
 
|  0x00800000
 
|  24
 
|  24
−
|  Identical to BCPKG2-3-SafeMode-Main.
+
|  No
 +
|  Backup partition for BCPKG2-3-SafeMode-Main. The official name for this partition is "BootConfigAndPackage2Part4".
 
|-
 
|-
 
|  BCPKG2-5-Repair-Main
 
|  BCPKG2-5-Repair-Main
 +
|  {C447D9A2-24B7-468A-98C8-595CD077165A}
 
|  0x02800000
 
|  0x02800000
 
|  0x00800000
 
|  0x00800000
 
|  25
 
|  25
−
|  Unknown what title this originates from.
+
|  No
 +
|  Installed at the factory, never written afterwards on retail. In one case this is identical to normal [[1.0.0]] [[Package2|package2]], except this has encrypted data at the end padded for 0x1000-byte alignment. The official name for this partition is "BootConfigAndPackage2Part5".
 
|-
 
|-
 
|  BCPKG2-6-Repair-Sub
 
|  BCPKG2-6-Repair-Sub
 +
|  {9586E1A1-3AA2-4C90-91B3-2F4A5195B4D2}
 
|  0x03000000
 
|  0x03000000
 
|  0x00800000
 
|  0x00800000
 
|  26
 
|  26
−
|  Identical to BCPKG2-5-Repair-Main.
+
|  No
 +
|  Backup partition for BCPKG2-5-Repair-Main. The official name for this partition is "BootConfigAndPackage2Part6".
 
|-
 
|-
 
|  SAFE
 
|  SAFE
 +
|  {A44F9F6B-4ED3-441F-A34A-56AAA136BC6A}
 
|  0x03800000
 
|  0x03800000
 
|  0x04000000
 
|  0x04000000
 
|  29
 
|  29
−
|  FAT32 filesystem
+
|  Yes (Bis key 1)
 +
|  FAT32 filesystem. The official name for this partition is "SafeMode".
 
|-
 
|-
 
|  SYSTEM
 
|  SYSTEM
 +
|  {ACB0CDF0-4F72-432D-AA0D-5388C733B224}
 
|  0x07800000  
 
|  0x07800000  
 
|  0xA0000000
 
|  0xA0000000
−
|  31 (and 32?(Error 0x2EE202 is returned for 32))
+
|  31, 32 and 33
−
|  FAT32 filesystem
+
|  Yes (Bis key 2)
 +
|  FAT32 filesystem. The official names for these partitions are "System", "SystemProperEncryption" and "SystemProperPartition".
 
|-
 
|-
 
|  USER
 
|  USER
 +
|  {2B777F63-E842-47AF-94C4-25A7F18B2280}
 
|  0xA7800000
 
|  0xA7800000
 
|  0x680000000
 
|  0x680000000
 
|  30
 
|  30
−
|  FAT32 filesystem
+
|  Yes (Bis key 3)
 +
|  FAT32 filesystem.
 
|-
 
|-
 +
|
 
|  
 
|  
 
| 0x747BFFE00
 
| 0x747BFFE00
 
| 0x200
 
| 0x200
 
|  
 
|  
−
| This is the backup GPT header specified by the main GPT header. This is also the last sector readable with Bis-storage paritionID 20.
+
| No
 +
|  This is the backup GPT header specified by the main GPT header. This is also the last sector readable with Bis-storage paritionID 20.
 
|}
 
|}
  
−
[[NCA]]s stored in NAND are raw, identical to the data readable with [[Content_Manager_services#ReadEntryRaw]].
+
If the client process lacks the relevant permission for any of the above partition IDs, error 0x2EE202 is returned.
  
−
The filenames for saveimages is just "<lower-case hex u64 saveID>". saveIDs aren't related to the titleID, or at least not for USER-partition saves. The high u32 of the saveID is normally either 0x00000000 or 0x80000000.
+
[[NCA]]s stored in NAND are raw, identical to the data readable with [[NCM_services#ReadContentIdFile]].
 +
 
 +
The filenames for saveimages is just "<lower-case hex u64 saveID>". SYSTEM-partition saveIDs are specified by [[Filesystem_services|FS]] commands, while USER-partition saveIDs are determined by FS-module internally. The high u32 of the saveID is normally either 0x00000000 or 0x80000000.
 +
 
 +
Encrypted partitions use AES-XTS using the same non-standard tweak (tweak[0] = sectorIdx[MSB] .. tweak[15] = sectorIdx[LSB], if using 32bit sectorIdx that means tweak[0]..tweak[11] are 0, with tweak[12]..tweak[15] containing big-endian sectorIdx) as other Nintendo AES-XTS code, initial_sector = 0, and sector size 0x4000. All encrypted partitions use console unique keydata.
  
 
=== PRODINFOF ===
 
=== PRODINFOF ===
Line 206: Line 341:
 
  ├── [[Savegames|save]]
 
  ├── [[Savegames|save]]
 
  │  └── ...
 
  │  └── ...
−
  └── saveMeta
+
  ├── saveMeta
−
    └── ...  
+
│  └── ...  
 +
└── temp
  
 
The saves for all non-system applications, regardless of where the application is located(storageID), is stored here. Each user account which has savedata has a separate saveimage. Save-common for an application is presumably a separate saveimage too. Every saveimage here is ''only'' for applications.
 
The saves for all non-system applications, regardless of where the application is located(storageID), is stored here. Each user account which has savedata has a separate saveimage. Save-common for an application is presumably a separate saveimage too. Every saveimage here is ''only'' for applications.
Line 224: Line 360:
  
 
On a v2.1 system with MountBis, the only thing under here is "PRF2SAFE.RCV".
 
On a v2.1 system with MountBis, the only thing under here is "PRF2SAFE.RCV".
 +
 +
= SystemSaveData =
 +
This is a listing of known SystemSaveData and what titles they correspond to.
 +
 +
{| class="wikitable" border="1"
 +
! SystemSaveDataId || Owner || Mount || [[Filesystem_services#SaveDataFlags|SaveDataFlags]] || Notes
 +
|-
 +
| 0x8000000000000000 || fs || <nowiki>saveDataIxrDb:/</nowiki>, <nowiki>saveDataIxrDbSf:/</nowiki>, <nowiki>saveDataIxrDbPr:/</nowiki>, <nowiki>saveDataIxrDbSd:/</nowiki> || || Contains [[IMKV|imkvdb.arc]] and "lastPublishedId".
 +
|-
 +
| 0x8000000000000010 || account || <nowiki>account:/</nowiki> || 0xC || Account database.
 +
|-
 +
| 0x8000000000000011 || account || <nowiki>idgen:/</nowiki> || 0x1 ||
 +
|-
 +
| 0x8000000000000020 || nfc || <nowiki>data:/</nowiki> || 0x0 || NFC data and backups.
 +
|-
 +
| 0x8000000000000030 || ns || <nowiki>mii:/</nowiki> || 0x4 || Mii database.
 +
|-
 +
| 0x8000000000000031 || ns || <nowiki>mii:/</nowiki> || || Mii test mode database.
 +
|-
 +
| 0x8000000000000040 || ns || <nowiki>apprecdb:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000041 || ns || <nowiki>nsaccache:/</nowiki> || 0x4 || Home menu icondata/lru list for recently played games.
 +
|-
 +
| 0x8000000000000043 || ns || <nowiki>ns_appman:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000044 || ns || <nowiki>ns_sysup:/</nowiki> || 0x0 || Content update context.
 +
|-
 +
| 0x8000000000000045 || ns || <nowiki>[7.0.0+] lrdb:/ ([1.0.0-6.2.0] vmdb:/)</nowiki> || 0x4 || Required Version List storage. Also contained Version List storage before 7.0.0.
 +
|-
 +
| 0x8000000000000046 || ns || <nowiki>dtlman:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000047 || ns || <nowiki>ns_exfat:/</nowiki> || 0x1 ||
 +
|-
 +
| 0x8000000000000048 || ns || <nowiki>ns_systemseed:/</nowiki> || 0x1 ||
 +
|-
 +
| 0x8000000000000049 || ns || <nowiki>ns_ssversion:/</nowiki> || 0x3 || Safe System version.
 +
|-
 +
| 0x800000000000004A || ns || <nowiki>ns_rightsid:/</nowiki> || 0x0 || List of RightsIDs with NCA IDs for corresponding Program title.
 +
|-
 +
| 0x8000000000000050 || settings || <nowiki>SystemSettings:/</nowiki> || 0x8 ||
 +
|-
 +
| 0x8000000000000051 || settings || <nowiki>FwdbgSettingsS:/</nowiki> || 0x3 || [4.0.0+] Only used if in [[SPL_services#IsDevelopment|development mode]].
 +
|-
 +
| 0x8000000000000052 || settings || <nowiki>PrivateSettings:/</nowiki> || 0x1 ||
 +
|-
 +
| 0x8000000000000053 || settings || <nowiki>DeviceSettings:/</nowiki> || 0x3 ||
 +
|-
 +
| 0x8000000000000054 || settings || <nowiki>ApplnSettings:/</nowiki> || 0x4 ||
 +
|-
 +
| 0x8000000000000060 || ssl || <nowiki>SslSave:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000070 || nim || <nowiki>nim_sys:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000071 || nim || <nowiki>nim_net:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000072 || nim || <nowiki>nim_tmp:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000073 || nim || <nowiki>nim_dac:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000074 || nim || <nowiki>nim_delta:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000075 || nim || <nowiki>nim_vac:/</nowiki> || ||
 +
|-
 +
| 0x8000000000000076 || nim || <nowiki>nim_local:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000077 || nim || <nowiki>nim_lsys:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000078 || nim || <nowiki>nim_eca_dbg:/</nowiki> || ||
 +
|-
 +
| 0x8000000000000080 || friends || <nowiki>friends:/</nowiki> || || Per-user savedata.
 +
|-
 +
| 0x8000000000000081 || friends || <nowiki>friends-sys:/</nowiki> || ||
 +
|-
 +
| 0x8000000000000082 || friends || <nowiki>friends-image:/</nowiki> || ||
 +
|-
 +
| 0x8000000000000090 || bcat || <nowiki>news:/</nowiki> || 0x0 || Actual news msgpack archives.
 +
|-
 +
| 0x8000000000000091 || bcat || <nowiki>news-sys:/</nowiki> || 0x0 || News metadata, tasklist, history, database, required system version, etc.
 +
|-
 +
| 0x8000000000000092 || bcat || <nowiki>news-dl:/</nowiki> || 0x0 || Storage for newly(?) downloaded news list/data.
 +
|-
 +
| 0x80000000000000A0 || bcat || <nowiki>prepo-sys:/</nowiki> || 0x8 || Play Report system information.
 +
|-
 +
| 0x80000000000000A1 || bcat || <nowiki>prepo:/</nowiki> || 0x8 || Play Report msgpack archives.
 +
|-
 +
| 0x80000000000000A2 || bcat || <nowiki>prepo-ap:/</nowiki> || 0x8 || Play Report msgpack archives of EventId "application_execution_history".
 +
|-
 +
| 0x80000000000000B0 || bsdsockets || <nowiki>nsdsave:/</nowiki> || || Socket configuration saved data.
 +
|-
 +
| 0x80000000000000C1 || bcat || <nowiki>bcat-sys:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x80000000000000C2 || bcat || <nowiki>bcat-dl:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x80000000000000D1 || erpt || <nowiki>save:/</nowiki> || 0x4 || Contains "/journal" report listing + actual crash reports ("/%08x-%04x-%04x-%02x%02x-%04x%08x"), which are serialized via [http://msgpack.org/ MsgPack].
 +
|-
 +
| 0x80000000000000E0 || es || <nowiki>escertificate:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x80000000000000E1 || es || <nowiki>escommon:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x80000000000000E2 || es || <nowiki>espersonalized:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x80000000000000E3 || es || <nowiki>esmetarecord:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x80000000000000E4 || es || <nowiki>eselicense:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x80000000000000F0 || ns || <nowiki>pdm:/</nowiki> || 0x0 || Play Data log. Per-user savedata.
 +
|-
 +
| 0x8000000000000100 || pctl || <nowiki>pctlss:/</nowiki> || 0x0 || Parental Control settings.
 +
|-
 +
| 0x8000000000000110 || npns || <nowiki>npns_save:/</nowiki> || 0x4 || Push notifications persistent storage.
 +
|-
 +
| 0x8000000000000120 || ncm || || 0x3 || meta/[[IMKV|imkvdb.arc]] for system partition. Cache of data extracted from the [[CNMT]] for installed firmware titles (including 816).
 +
|-
 +
| 0x8000000000000121 || ncm || || 0x0 || meta/[[IMKV|imkvdb.arc]] for user partition. Cache of data extracted from the [[CNMT]] for installed game, update, and DLC titles.
 +
|-
 +
| 0x8000000000000122 || ncm || || 0x0 ||
 +
|-
 +
| 0x8000000000000130 || migration || <nowiki>state:/</nowiki> || 0x4 ||
 +
|-
 +
| 0x8000000000000131 || migration || <nowiki>context:/</nowiki> || ||
 +
|-
 +
| 0x8000000000000132 || migration || <nowiki>sd_state:/</nowiki> || 0x4 ||
 +
|-
 +
| 0x8000000000000133 || migration || <nowiki>sd_context:/</nowiki> || 0x4 ||
 +
|-
 +
| 0x8000000000000140 || capsrv || <nowiki>TM:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000150 || olsc || <nowiki>olsc:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000151 || olsc || <nowiki>olsc:/</nowiki> || ||
 +
|-
 +
| 0x8000000000000152 || olsc || <nowiki>olsc:/</nowiki> || ||
 +
|-
 +
| 0x8000000000000153 || olsc || <nowiki>repair:/</nowiki> || 0x0||
 +
|-
 +
| 0x8000000000000180 || sdb || [7.0.0+] <nowiki>vmdb:/</nowiki> || 0x0 || Version list.
 +
|-
 +
| 0x8000000000000190 || glue || || 0x8 ||
 +
|-
 +
| 0x8000000000000200 || bcat || <nowiki>mnpp_m:/</nowiki> || 0xC ||
 +
|-
 +
| 0x8000000000000210 || account || <nowiki>dauth:/</nowiki> || 0x0 ||
 +
|-
 +
| 0x8000000000000220 || erpt || <nowiki>sprof:/</nowiki> || 0x1 ||
 +
|-
 +
| 0x8000000000001010 || qlaunch || <nowiki>save:/</nowiki> || 0x0 || Contains "savedata.dat".
 +
|-
 +
| 0x8000000000001011 || qlaunch || <nowiki>group:/</nowiki> || || Contains "savedata.dat".
 +
|-
 +
| 0x8000000000001020 || swkbd || <nowiki>save:/</nowiki> || || Contains "savedata.dat".
 +
|-
 +
| 0x8000000000001021 || swkbd || <nowiki>save:/</nowiki> || 0x0 || Contains "savedata.dat".
 +
|-
 +
| 0x8000000000001030 || auth || <nowiki>save:/</nowiki> || 0x0 || Contains "savedata.dat".
 +
|-
 +
| 0x8000000000001040 || miiEdit || <nowiki>save:/</nowiki> || 0x0 || Contains "savedata.dat".
 +
|-
 +
| 0x8000000000001050 || miiEdit || <nowiki>MiiImage:/</nowiki> || 0x4 || Contains "database.dat".
 +
|-
 +
| 0x8000000000001060 || LibAppletShop || <nowiki>savecommon:/</nowiki> || 0x8 ||
 +
|-
 +
| 0x8000000000001061 || LibAppletShop || <nowiki>saveuser:/</nowiki> || || Per-user savedata.
 +
|-
 +
| 0x8000000000001070 || LibAppletWeb || <nowiki>savecommon:/</nowiki> || 0x8 ||
 +
|-
 +
| 0x8000000000001071 || LibAppletWeb || <nowiki>saveuser:/</nowiki> || || Per-user savedata.
 +
|-
 +
| 0x8000000000001080 || LibAppletOff || <nowiki>savecommon:/</nowiki> || || Unused.
 +
|-
 +
| 0x8000000000001081 || LibAppletOff || <nowiki>saveuser:/</nowiki> || || Unused.
 +
|-
 +
| 0x8000000000001090 || LibAppletLns || <nowiki>savecommon:/</nowiki> || 0x8 ||
 +
|-
 +
| 0x8000000000001091 || LibAppletLns || <nowiki>saveuser:/</nowiki> || || Per-user savedata.
 +
|-
 +
| 0x80000000000010A0 || LibAppletAuth || <nowiki>savecommon:/</nowiki> || || Unused.
 +
|-
 +
| 0x80000000000010A1 || LibAppletAuth || <nowiki>saveuser:/</nowiki> || || Unused.
 +
|-
 +
| 0x80000000000010B0 || playerSelect || <nowiki>save:/</nowiki> || 0x0 || Contains "savedata.dat".
 +
|-
 +
| 0x80000000000010C0 || myPage || <nowiki>save:/</nowiki> || || Contains "savedata.dat".
 +
|-
 +
| 0x80000000000010E1 || qlaunch || <nowiki>mig:/</nowiki> || || Contains "savedata.dat".
 +
|-
 +
| 0x8000000000001100 || qlaunch || <nowiki>news:/</nowiki> || 0x0 || Contains "savedata.dat".
 +
|-
 +
| 0x8000000000002000 || DevMenu || || ||
 +
|-
 +
| 0x8000000000002020 || ns || <nowiki>ns_confidential:/</nowiki> || ||
 +
|-
 +
| 0x8000000000010002 || bcat || || || Delivery cache storage for application 010099F00D810000
 +
|-
 +
| 0x8000000000010003 || bcat || || 0x0 || Delivery cache storage for application 0100000000001033
 +
|-
 +
| 0x8000000000010004 || bcat || || 0x0 || Delivery cache storage for application 0100000000001034
 +
|-
 +
| 0x8000000000010005 || bcat || || 0x3 || Delivery cache storage for application 010000000000102E
 +
|-
 +
| 0x8000000000010006 || bcat || || 0x0 || Delivery cache storage for application 010000000000102F
 +
|-
 +
| 0x8000000000010007 || bcat || || 0x0 || Delivery cache storage for application 0100000000001007
 +
|}

Revision as of 04:07, 26 January 2024

NAND structure

The Switch's eMMC storage features a large user area, two smaller boot partitions and a replay-protected memory block which is unused (no authentication key is programmed).

All official partition names come from SystemInitializer.

Boot Partitions

Boot Partition 0 (0 of 1)

The official name for this partition is "BootPartition1Root" and it has Bis Partition ID == 0.

Offset Size Description
0x000000 0x4000 Normal Firmware BCT from Title 0100000000000819
0x004000 0x4000 SafeMode Firmware BCT from Title 010000000000081A
0x008000 0x4000 Normal Firmware BCT from Title 0100000000000819 (backup)
0x00C000 0x4000 SafeMode Firmware BCT from Title 010000000000081A (backup)
0x010000 0xEC000 59 additional BCTs, normally unused/empty on retail systems.
0x0FC000 0x4000 System Update Control area
0x100000 0x40000 Normal Firmware package1 from Title 0100000000000819
0x140000 0x40000 Normal Firmware package1 from Title 0100000000000819 (backup)
0x180000 0x4000 Keyblob area
0x184000 0x200 [2.0.0+] NAND Patrol area

Boot Partition 1 (1 of 1)

The official name for this partition is "BootPartition2Root" and it has Bis Partition ID == 10.

Offset Size Description
0x000000 0x40000 SafeMode Firmware package1 from Title 010000000000081A
0x040000 0x40000 SafeMode Firmware package1 from Title 010000000000081A (backup)
0x080000 0x40000 Reserved
0x0C0000 0x40000 Reserved

System Update Control

The 0x4000 bytes at offset 0xFC000 are used by NS and boot for keeping track of the status of a system update. This area is used by the ISystemUpdateControl commands ApplyDownloadedUpdate, ApplyCardUpdate and ApplyReceivedUpdate.

Offset Size Description
0x0 0x1 BootImages status. Set to 1 by NS during a system update and cleared by boot after restarting.
0x1 0x1 BootImagesSafe status. Set to 1 by NS during a system update and cleared by boot after restarting.

Keyblob

Starting at offset 0x180000 is an array of 0x200-byte entries, for a total of 32 keyblobs. Each one is unique compared to the others and they are all console unique. This is officially known as the "EKS" (encryption key source) area.

From each 0x200-byte entry only the first 0xB0 bytes effectively form the keyblob as below.

Offset Size Description
0x0 0x10 Keyblob AES-CMAC over the next 0xA0 bytes (safe against timing attacks)
0x10 0x10 Keyblob AES CTR
0x20 0x90 Keyblob encrypted payload
0xB0 0x150 Unused, all-zero.

The active bootloader's version (offset 0x2330 in the BCT) acts as an index (version-1) to control which keyblob should be installed into the system. NS uses this during system updates to install the keyblob into the customer data section in BCTs (offset 0x450).

Boot also uses this index for repairing corrupt sectors.

The currently active keyblob is officially known as "SecureInfo".

NAND Patrol

The 0x200 bytes at offset 0x184000 are used by FS for keeping track of NAND patrolling.

Offset Size Description
0x0 0x20 HMAC-SHA-256 over the next 0x1E0 bytes
0x20 0x4 Last patrolled NAND block's offset
0x24 0x4 NAND patrol count
0x28 0x1D8 Unused, all-zero.

User Partitions

Partition name Partition type GUID Offset Size Bis Partition ID Encrypted Description
N/A 0x0 20 No GPT header, Bis-storage also allows raw access to the entire NAND eMMC sectors starting at sector0. The official name for this partition is "UserDataRoot".
PRODINFO {98109E25-64E2-4C95-8A77-414916F5BCEB} 0x00004400 0x003FBC00 27 Yes (Bis key 0) "CAL0" raw partition containing set:cal data. The official name for this partition is "CalibrationBinary".
PRODINFOF {F3056AEC-5449-494C-9F2C-5FDCB75B6E6E} 0x00400000 0x00400000 28 Yes (Bis key 0) FAT12 filesystem, additional calibration. The official name for this partition is "CalibrationFile".
BCPKG2-1-Normal-Main {5365DE36-911B-4BB4-8FF9-AA1EBCD73990} 0x00800000 0x00800000 21 No Raw partition where the first 0x4000 bytes (usually empty) contain the BootConfig and the remaining space contains the package2 image from Title 0100000000000819 by default. With the exFAT update installed, the package2 image is switched to the one from Title 010000000000081B. The official name for this partition is "BootConfigAndPackage2Part1".
BCPKG2-2-Normal-Sub {8455717B-BD2B-4162-8454-91695218FC38} 0x01000000 0x00800000 22 No Backup partition for BCPKG2-1-Normal-Main. The official name for this partition is "BootConfigAndPackage2Part2".
BCPKG2-3-SafeMode-Main {8ED6C9A6-9C48-490B-BBEB-001D17A4C0F7} 0x01800000 0x00800000 23 No Raw partition where the first 0x4000 bytes (usually empty) contain the BootConfig and the remaining space contains the package2 image from Title 010000000000081A by default. On [4.0.0+] and with the exFAT update installed, the package2 image is switched to the one from Title 010000000000081C. The official name for this partition is "BootConfigAndPackage2Part3".
BCPKG2-4-SafeMode-Sub {5E99751C-56C9-47CC-AA30-B65039888917} 0x02000000 0x00800000 24 No Backup partition for BCPKG2-3-SafeMode-Main. The official name for this partition is "BootConfigAndPackage2Part4".
BCPKG2-5-Repair-Main {C447D9A2-24B7-468A-98C8-595CD077165A} 0x02800000 0x00800000 25 No Installed at the factory, never written afterwards on retail. In one case this is identical to normal 1.0.0 package2, except this has encrypted data at the end padded for 0x1000-byte alignment. The official name for this partition is "BootConfigAndPackage2Part5".
BCPKG2-6-Repair-Sub {9586E1A1-3AA2-4C90-91B3-2F4A5195B4D2} 0x03000000 0x00800000 26 No Backup partition for BCPKG2-5-Repair-Main. The official name for this partition is "BootConfigAndPackage2Part6".
SAFE {A44F9F6B-4ED3-441F-A34A-56AAA136BC6A} 0x03800000 0x04000000 29 Yes (Bis key 1) FAT32 filesystem. The official name for this partition is "SafeMode".
SYSTEM {ACB0CDF0-4F72-432D-AA0D-5388C733B224} 0x07800000 0xA0000000 31, 32 and 33 Yes (Bis key 2) FAT32 filesystem. The official names for these partitions are "System", "SystemProperEncryption" and "SystemProperPartition".
USER {2B777F63-E842-47AF-94C4-25A7F18B2280} 0xA7800000 0x680000000 30 Yes (Bis key 3) FAT32 filesystem.
0x747BFFE00 0x200 No This is the backup GPT header specified by the main GPT header. This is also the last sector readable with Bis-storage paritionID 20.

If the client process lacks the relevant permission for any of the above partition IDs, error 0x2EE202 is returned.

NCAs stored in NAND are raw, identical to the data readable with NCM_services#ReadContentIdFile.

The filenames for saveimages is just "<lower-case hex u64 saveID>". SYSTEM-partition saveIDs are specified by FS commands, while USER-partition saveIDs are determined by FS-module internally. The high u32 of the saveID is normally either 0x00000000 or 0x80000000.

Encrypted partitions use AES-XTS using the same non-standard tweak (tweak[0] = sectorIdx[MSB] .. tweak[15] = sectorIdx[LSB], if using 32bit sectorIdx that means tweak[0]..tweak[11] are 0, with tweak[12]..tweak[15] containing big-endian sectorIdx) as other Nintendo AES-XTS code, initial_sector = 0, and sector size 0x4000. All encrypted partitions use console unique keydata.

PRODINFOF

PRODINFOF
├── Certifications
│   └── WirelessCertification.png
└── ptd
    ├── DeviceIdWithEmsBit.dat
    ├── Ecid.dat
    ├── prodCode.dat
    └── log
        ├── Process_asm1.log
        ├── Process_board1.log
        ├── TestFlagLine.log
        ├── TestFlagQc.log
        ├── AGING
        │   └── Sequence.log
        ├── BOARD_TEST
        │   └── Sequence.log
        ├── BOARD_WIRELESS
        │   └── Sequence.log
        ├── FINAL_CHECK
        │   └── Sequence.log
        ├── LCD_AND_KEY
        │   └── Sequence.log
        └── USB_AND_HP
            └── Sequence.log

DeviceIdWithEmsBit.dat

Contains a 0x10-byte uppercase hex string, identical to the DeviceId in the DeviceCert.

SYSTEM

SYSTEM
├── PRF2SAFE.RCV
├── Contents
│   ├── registered
│   │   └── ... NCA
│   └── placehld
│       └── ... NCA
├── save
│   └── ...
└── saveMeta
    └── ... (empty?)

The saves stored under this partition are only for system-titles / etc.

USER

USER
├── PRF2SAFE.RCV
├── Album (Same layout as SD)
├── Contents
│   ├── registered
│   │   └── ... NCA
│   └── placehld
│       └── ... NCA
├── save
│   └── ...
├── saveMeta
│   └── ... 
└── temp

The saves for all non-system applications, regardless of where the application is located(storageID), is stored here. Each user account which has savedata has a separate saveimage. Save-common for an application is presumably a separate saveimage too. Every saveimage here is only for applications.

SAFE

SAFE
├── PRF2SAFE.RCV
├── Contents
│   ├── registered
│   │   └── ... NCA (nothing installed?)
│   └── placehld
│       └── ... NCA
└── save
    ├── 8000000000000000
    └── 8000000000000120

On a v2.1 system with MountBis, the only thing under here is "PRF2SAFE.RCV".

SystemSaveData

This is a listing of known SystemSaveData and what titles they correspond to.

SystemSaveDataId Owner Mount SaveDataFlags Notes
0x8000000000000000 fs saveDataIxrDb:/, saveDataIxrDbSf:/, saveDataIxrDbPr:/, saveDataIxrDbSd:/ Contains imkvdb.arc and "lastPublishedId".
0x8000000000000010 account account:/ 0xC Account database.
0x8000000000000011 account idgen:/ 0x1
0x8000000000000020 nfc data:/ 0x0 NFC data and backups.
0x8000000000000030 ns mii:/ 0x4 Mii database.
0x8000000000000031 ns mii:/ Mii test mode database.
0x8000000000000040 ns apprecdb:/ 0x0
0x8000000000000041 ns nsaccache:/ 0x4 Home menu icondata/lru list for recently played games.
0x8000000000000043 ns ns_appman:/ 0x0
0x8000000000000044 ns ns_sysup:/ 0x0 Content update context.
0x8000000000000045 ns [7.0.0+] lrdb:/ ([1.0.0-6.2.0] vmdb:/) 0x4 Required Version List storage. Also contained Version List storage before 7.0.0.
0x8000000000000046 ns dtlman:/ 0x0
0x8000000000000047 ns ns_exfat:/ 0x1
0x8000000000000048 ns ns_systemseed:/ 0x1
0x8000000000000049 ns ns_ssversion:/ 0x3 Safe System version.
0x800000000000004A ns ns_rightsid:/ 0x0 List of RightsIDs with NCA IDs for corresponding Program title.
0x8000000000000050 settings SystemSettings:/ 0x8
0x8000000000000051 settings FwdbgSettingsS:/ 0x3 [4.0.0+] Only used if in development mode.
0x8000000000000052 settings PrivateSettings:/ 0x1
0x8000000000000053 settings DeviceSettings:/ 0x3
0x8000000000000054 settings ApplnSettings:/ 0x4
0x8000000000000060 ssl SslSave:/ 0x0
0x8000000000000070 nim nim_sys:/ 0x0
0x8000000000000071 nim nim_net:/ 0x0
0x8000000000000072 nim nim_tmp:/ 0x0
0x8000000000000073 nim nim_dac:/ 0x0
0x8000000000000074 nim nim_delta:/ 0x0
0x8000000000000075 nim nim_vac:/
0x8000000000000076 nim nim_local:/ 0x0
0x8000000000000077 nim nim_lsys:/ 0x0
0x8000000000000078 nim nim_eca_dbg:/
0x8000000000000080 friends friends:/ Per-user savedata.
0x8000000000000081 friends friends-sys:/
0x8000000000000082 friends friends-image:/
0x8000000000000090 bcat news:/ 0x0 Actual news msgpack archives.
0x8000000000000091 bcat news-sys:/ 0x0 News metadata, tasklist, history, database, required system version, etc.
0x8000000000000092 bcat news-dl:/ 0x0 Storage for newly(?) downloaded news list/data.
0x80000000000000A0 bcat prepo-sys:/ 0x8 Play Report system information.
0x80000000000000A1 bcat prepo:/ 0x8 Play Report msgpack archives.
0x80000000000000A2 bcat prepo-ap:/ 0x8 Play Report msgpack archives of EventId "application_execution_history".
0x80000000000000B0 bsdsockets nsdsave:/ Socket configuration saved data.
0x80000000000000C1 bcat bcat-sys:/ 0x0
0x80000000000000C2 bcat bcat-dl:/ 0x0
0x80000000000000D1 erpt save:/ 0x4 Contains "/journal" report listing + actual crash reports ("/%08x-%04x-%04x-%02x%02x-%04x%08x"), which are serialized via MsgPack.
0x80000000000000E0 es escertificate:/ 0x0
0x80000000000000E1 es escommon:/ 0x0
0x80000000000000E2 es espersonalized:/ 0x0
0x80000000000000E3 es esmetarecord:/ 0x0
0x80000000000000E4 es eselicense:/ 0x0
0x80000000000000F0 ns pdm:/ 0x0 Play Data log. Per-user savedata.
0x8000000000000100 pctl pctlss:/ 0x0 Parental Control settings.
0x8000000000000110 npns npns_save:/ 0x4 Push notifications persistent storage.
0x8000000000000120 ncm 0x3 meta/imkvdb.arc for system partition. Cache of data extracted from the CNMT for installed firmware titles (including 816).
0x8000000000000121 ncm 0x0 meta/imkvdb.arc for user partition. Cache of data extracted from the CNMT for installed game, update, and DLC titles.
0x8000000000000122 ncm 0x0
0x8000000000000130 migration state:/ 0x4
0x8000000000000131 migration context:/
0x8000000000000132 migration sd_state:/ 0x4
0x8000000000000133 migration sd_context:/ 0x4
0x8000000000000140 capsrv TM:/ 0x0
0x8000000000000150 olsc olsc:/ 0x0
0x8000000000000151 olsc olsc:/
0x8000000000000152 olsc olsc:/
0x8000000000000153 olsc repair:/ 0x0
0x8000000000000180 sdb [7.0.0+] vmdb:/ 0x0 Version list.
0x8000000000000190 glue 0x8
0x8000000000000200 bcat mnpp_m:/ 0xC
0x8000000000000210 account dauth:/ 0x0
0x8000000000000220 erpt sprof:/ 0x1
0x8000000000001010 qlaunch save:/ 0x0 Contains "savedata.dat".
0x8000000000001011 qlaunch group:/ Contains "savedata.dat".
0x8000000000001020 swkbd save:/ Contains "savedata.dat".
0x8000000000001021 swkbd save:/ 0x0 Contains "savedata.dat".
0x8000000000001030 auth save:/ 0x0 Contains "savedata.dat".
0x8000000000001040 miiEdit save:/ 0x0 Contains "savedata.dat".
0x8000000000001050 miiEdit MiiImage:/ 0x4 Contains "database.dat".
0x8000000000001060 LibAppletShop savecommon:/ 0x8
0x8000000000001061 LibAppletShop saveuser:/ Per-user savedata.
0x8000000000001070 LibAppletWeb savecommon:/ 0x8
0x8000000000001071 LibAppletWeb saveuser:/ Per-user savedata.
0x8000000000001080 LibAppletOff savecommon:/ Unused.
0x8000000000001081 LibAppletOff saveuser:/ Unused.
0x8000000000001090 LibAppletLns savecommon:/ 0x8
0x8000000000001091 LibAppletLns saveuser:/ Per-user savedata.
0x80000000000010A0 LibAppletAuth savecommon:/ Unused.
0x80000000000010A1 LibAppletAuth saveuser:/ Unused.
0x80000000000010B0 playerSelect save:/ 0x0 Contains "savedata.dat".
0x80000000000010C0 myPage save:/ Contains "savedata.dat".
0x80000000000010E1 qlaunch mig:/ Contains "savedata.dat".
0x8000000000001100 qlaunch news:/ 0x0 Contains "savedata.dat".
0x8000000000002000 DevMenu
0x8000000000002020 ns ns_confidential:/
0x8000000000010002 bcat Delivery cache storage for application 010099F00D810000
0x8000000000010003 bcat 0x0 Delivery cache storage for application 0100000000001033
0x8000000000010004 bcat 0x0 Delivery cache storage for application 0100000000001034
0x8000000000010005 bcat 0x3 Delivery cache storage for application 010000000000102E
0x8000000000010006 bcat 0x0 Delivery cache storage for application 010000000000102F
0x8000000000010007 bcat 0x0 Delivery cache storage for application 0100000000001007
Retrieved from "https://switchbrew.org/w/index.php?title=Flash_Filesystem&oldid=12639"