Difference between revisions of "NCA"

From Nintendo Switch Brew
Jump to navigation Jump to search
Line 1: Line 1:
−
Raw NCAs are encrypted.
+
The entire raw NCAs are encrypted.
  
−
The only known section which is not encrypted in the raw NCA is the logo section, when the NCA includes that section.
+
The only known area which is not encrypted in the raw NCA is the logo section, when the NCA includes that section.
 +
 
 +
=Header=
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x100
 +
| RSA-2048 signature over the 0x200-bytes starting at offset 0x200.
 +
|-
 +
| 0x100
 +
| 0x100
 +
| Unknown. All-zero in some NCAs, non-zero for others. Presumably a RSA signature?
 +
|-
 +
| 0x200
 +
| 0x4
 +
| Magicnum "NCA3"
 +
|-
 +
| 0x208
 +
| 0x8?
 +
| Size of the entire NCA.
 +
|-
 +
| 0x210
 +
| 0x8
 +
| titleID
 +
|-
 +
| 0x230
 +
| 0x8
 +
| Big-endian titleID.
 +
|-
 +
| 0x240
 +
| 0x10*0x4(0x40)
 +
| Table for each section, see below.
 +
|-
 +
| 0x280
 +
| 0x20*0x4(0x80)
 +
| Table of SHA256 hashes, over each 0x200-byte Section Header Block.
 +
|}
 +
 
 +
The header is 0x400-bytes, at NCA+0.
 +
 
 +
==Section Table Entry==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x4
 +
| Media offset
 +
|-
 +
| 0x4
 +
| 0x4
 +
| Media end-offset
 +
|-
 +
| 0x8
 +
| 0x4
 +
| Unknown
 +
|-
 +
| 0xC
 +
| 0x4
 +
| Unknown
 +
|}
 +
 
 +
Entry size is 0x10-bytes.
 +
 
 +
Media offset is absoluteoffset/{mediasize}, where mediasize is hard-coded to 0x200.
 +
 
 +
=Section Header Block=
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x1
 +
| ?
 +
|-
 +
|-
 +
| 0x1
 +
| 0x1
 +
| ?
 +
|-
 +
| 0x2
 +
| 0x1
 +
| ?
 +
|-
 +
| 0x3
 +
| 0x1
 +
| ?
 +
|-
 +
| 0x4
 +
| 0x1
 +
| Crypto type. 0 and >4 are invalid. 1 = none(plaintext from raw NCA). 2 = other crypto. 3 = regular crypto. 4 = unknown.
 +
|-
 +
| 0x5
 +
| 0x1
 +
| Padding?
 +
|-
 +
| 0x8
 +
|
 +
| Start of the fs-specific header data.
 +
|}
 +
 
 +
The Section Header Block for each section is at absoluteoffset+0x400+(sectionid*0x200), where sectionid corresponds to the index used with the entry/hash tables.
 +
 
 +
The total size is 0x200-bytes.
  
 
==Logo section==
 
==Logo section==
−
Contains the raw FS for the logo FS, see [[NCA_Content_FS|here]] for mounted-FS contents.
+
This is a PFS0. See [[NCA_Content_FS|here]] for the mounted-FS logo contents.
  
 +
==ExeFS section ==
 
This is a PFS0.
 
This is a PFS0.
 +
 +
See [[ExeFS|here]] for mounted-FS ExeFS contents.
  
 
=PFS0=
 
=PFS0=

Revision as of 01:55, 18 July 2017

The entire raw NCAs are encrypted.

The only known area which is not encrypted in the raw NCA is the logo section, when the NCA includes that section.

Header

Offset Size Description
0x0 0x100 RSA-2048 signature over the 0x200-bytes starting at offset 0x200.
0x100 0x100 Unknown. All-zero in some NCAs, non-zero for others. Presumably a RSA signature?
0x200 0x4 Magicnum "NCA3"
0x208 0x8? Size of the entire NCA.
0x210 0x8 titleID
0x230 0x8 Big-endian titleID.
0x240 0x10*0x4(0x40) Table for each section, see below.
0x280 0x20*0x4(0x80) Table of SHA256 hashes, over each 0x200-byte Section Header Block.

The header is 0x400-bytes, at NCA+0.

Section Table Entry

Offset Size Description
0x0 0x4 Media offset
0x4 0x4 Media end-offset
0x8 0x4 Unknown
0xC 0x4 Unknown

Entry size is 0x10-bytes.

Media offset is absoluteoffset/{mediasize}, where mediasize is hard-coded to 0x200.

Section Header Block

Offset Size Description
0x0 0x1 ?
0x1 0x1 ?
0x2 0x1 ?
0x3 0x1 ?
0x4 0x1 Crypto type. 0 and >4 are invalid. 1 = none(plaintext from raw NCA). 2 = other crypto. 3 = regular crypto. 4 = unknown.
0x5 0x1 Padding?
0x8 Start of the fs-specific header data.

The Section Header Block for each section is at absoluteoffset+0x400+(sectionid*0x200), where sectionid corresponds to the index used with the entry/hash tables.

The total size is 0x200-bytes.

Logo section

This is a PFS0. See here for the mounted-FS logo contents.

ExeFS section

This is a PFS0.

See here for mounted-FS ExeFS contents.

PFS0

Offset Size Description
0x0 X Table of hashes.
X Y Zeros for alignment to {alignment size}.
X+Y Start of the PFS0 header.

This is the FS which has magicnum "PFS0" at header+0.

Retrieved from "https://switchbrew.org/w/index.php?title=NCA&oldid=1641"