The entire raw NCAs are encrypted.
The only known area which is not encrypted in the raw NCA is the logo section, when the NCA includes that section.
Header
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x100 | RSA-2048 signature over the 0x200-bytes starting at offset 0x200. |
| 0x100 | 0x100 | Unknown. All-zero in some NCAs, non-zero for others. Presumably a RSA signature? |
| 0x200 | 0x4 | Magicnum "NCA3" |
| 0x208 | 0x8? | Size of the entire NCA. |
| 0x210 | 0x8 | titleID |
| 0x230 | 0x8 | Big-endian titleID. |
| 0x240 | 0x10*0x4(0x40) | Table for each section, see below. |
| 0x280 | 0x20*0x4(0x80) | Table of SHA256 hashes, over each 0x200-byte Section Header Block. |
The header is 0x400-bytes, at NCA+0.
Section Table Entry
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | Media offset |
| 0x4 | 0x4 | Media end-offset |
| 0x8 | 0x4 | Unknown |
| 0xC | 0x4 | Unknown |
Entry size is 0x10-bytes.
Media offset is absoluteoffset/{mediasize}, where mediasize is hard-coded to 0x200.
Section Header Block
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x1 | ? |
| 0x1 | 0x1 | ? |
| 0x2 | 0x1 | ? |
| 0x3 | 0x1 | ? |
| 0x4 | 0x1 | Crypto type. 0 and >4 are invalid. 1 = none(plaintext from raw NCA). 2 = other crypto. 3 = regular crypto. 4 = unknown. |
| 0x5 | 0x1 | Padding? |
| 0x8 | Start of the fs-specific header data. |
The Section Header Block for each section is at absoluteoffset+0x400+(sectionid*0x200), where sectionid corresponds to the index used with the entry/hash tables.
The total size is 0x200-bytes.
Logo section
This is a PFS0. See here for the mounted-FS logo contents.
ExeFS section
This is a PFS0.
See here for mounted-FS ExeFS contents.
PFS0
| Offset | Size | Description |
|---|---|---|
| 0x0 | X | Table of hashes. |
| X | Y | Zeros for alignment to {alignment size}. |
| X+Y | Start of the PFS0 header. |
This is the FS which has magicnum "PFS0" at header+0.