XCI
Header
The header is 0x200-bytes, at Gamecard+0.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x100 | RSA-2048 signature, presumably. |
| 0x100 | 0x4 | Magicnum "HEAD" |
| 0x104 | 0x4 | Offset of Secure partition (Size of non-secure data?), in Media Units |
| 0x108 | 0x4 | 0xFFFFFFFF |
| 0x10C | 0x4 | ? |
| 0x110 | 0x8 | ? |
| 0x118 | 0x8 | Size of the Gamecart, in Media Units |
| 0x120 | 0x10 | ? |
| 0x130 | 0x8 | Offset of HFS0 FS partition |
| 0x138 | 8 | HFS0 Header size |
| 0x140 | 0x20 | SHA256 hash of the HFS0 Header |
| 0x160 | 0x20 | SHA256 hash of ? |
| 0x180 | 0x4 | 1? |
| 0x184 | 0x4 | 2? |
| 0x188 | 0x4 | 0? |
| 0x18C | 0x4 | Offset of Secure partition (Size of non-secure data?), in Media Units, again. |
| 0x190 | 0x70 | Encrypted data/hashes of some kind |
Cert
This is for the CERT, located at Gamecard + 0x7000 (always?). This matches exactly the output from fsp-srv IDeviceOperator cmd 206 "GetGameCardDeviceCertificate".
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x100 | RSA-2048 signature, presumably. |
| 0x100 | 0x4 | Magicnum "CERT" |
| 0x110 | 0x10 | ? |
| 0x12A | 0xD6 | Encrypted data. Some kind of key? |
The data between the CERT and the start of the HFS0 is all 0xFF.
HFS0
This is the FS which has magicnum "HFS0" at header+0.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | HFS0 Magic |
| 0x4 | 0x4 | Number of files |
| 0x8 | 0x4 | Size of the string table |
| 0xC | 0x4 | Zero/Reserved |
| 0x10 | X | File Entry Table |
| 0x10 + X | Y | String Table |
| 0x10 + X + Y | Z | Raw File Data |