NCA

The entire raw NCAs are encrypted.

The only known area which is not encrypted in the raw NCA is the logo section, when the NCA includes that section. Everything else documented on this page is for the plaintext version of that data.

Header

Offset	Size	Description
0x0	0x100	RSA-2048 signature over the 0x200-bytes starting at offset 0x200.
0x100	0x100	Unknown. All-zero in some NCAs, non-zero for others. Presumably a RSA signature?
0x200	0x4	Magicnum "NCA3"
0x208	0x8?	Size of the entire NCA.
0x210	0x8	titleID
0x230	0x8	Big-endian titleID.
0x240	0x10*0x4(0x40)	Table for each section, see below.
0x280	0x20*0x4(0x80)	Table of SHA256 hashes, over each 0x200-byte Section Header Block.

The header is 0x400-bytes, at NCA+0.

Section Table Entry

Offset	Size	Description
0x0	0x4	Media offset
0x4	0x4	Media end-offset
0x8	0x4	Unknown
0xC	0x4	Unknown

Entry size is 0x10-bytes.

Media offset is absoluteoffset/{mediasize}, where mediasize is hard-coded to 0x200.

Section Header Block

Offset	Size	Description
0x0	0x1	?
0x1	0x1	?
0x2	0x1	?
0x3	0x1	?
0x4	0x1	Crypto type. 0 and >4 are invalid. 1 = none(plaintext from raw NCA). 2 = other crypto. 3 = regular crypto. 4 = unknown.
0x5	0x1	Padding?
0x8		Start of the fs-specific header data.

The Section Header Block for each section is at absoluteoffset+0x400+(sectionid*0x200), where sectionid corresponds to the index used with the entry/hash tables.

The total size is 0x200-bytes.

Logo section

This is a PFS0. See here for the mounted-FS logo contents.

ExeFS section

This is a PFS0.

See here for mounted-FS ExeFS contents.

PFS0

Offset	Size	Description
0x0	X	Table of hashes.
X	Y	Zeros for alignment to {alignment size}.
X+Y		Start of the PFS0 header.

This is the FS which has magicnum "PFS0" at header+0.