Difference between revisions of "Calibration"

From Nintendo Switch Brew
Jump to navigation Jump to search
Line 17: Line 17:
 
|  0x0000
 
|  0x0000
 
|  0x04
 
|  0x04
magic
+
MagicNumber
 
|  "CAL0" header magic.
 
|  "CAL0" header magic.
 
|-
 
|-
 
|  0x0004
 
|  0x0004
 
|  0x04
 
|  0x04
version
+
Version
Always 0x07.
+
|   
 
|-
 
|-
 
|  0x0008
 
|  0x0008
 
|  0x04
 
|  0x04
calib_data_size
+
BodySize
|  Total size of calibration data minus 0x40 bytes (header + calib_data_sha256).
+
|  Total size of calibration data starting at offset 0x40.
 
|-
 
|-
 
|  0x000C
 
|  0x000C
 
|  0x02
 
|  0x02
model
+
Model
Always 0x01.
+
|   
 
|-
 
|-
 
|  0x000E
 
|  0x000E
 
|  0x02
 
|  0x02
revision
+
UpdateCount
 
|  Increases each time calibration data is installed.
 
|  Increases each time calibration data is installed.
 
|-
 
|-
 
|  0x0020
 
|  0x0020
 
|  0x20
 
|  0x20
calib_data_sha256
+
BodyHash
 
|  SHA256 hash calculated over calibration data.
 
|  SHA256 hash calculated over calibration data.
 
|-
 
|-
 
|  0x0040
 
|  0x0040
0x1D
+
0x1E
config_id1
+
ConfigurationId1
 
|  Configuration ID string.
 
|  Configuration ID string.
 
|-
 
|-
 
|  0x0060
 
|  0x0060
 
|  0x20
 
|  0x20
reserved
+
Reserved
 
|  Empty.
 
|  Empty.
 
|-
 
|-
 
|  0x0080
 
|  0x0080
 
|  0x04
 
|  0x04
wlan_country_codes_num
+
WlanCountryCodesNum
|  Number of elements in the wlan_country_codes array.
+
|  Number of elements in the WlanCountryCodes array.
 
|-
 
|-
 
|  0x0084
 
|  0x0084
 
|  0x04
 
|  0x04
wlan_country_codes_last_idx
+
WlanCountryCodesLastIndex
|  Index of the last element in the wlan_country_codes array.
+
|  Index of the last element in the WlanCountryCodes array.
 
|-
 
|-
 
|  0x0088
 
|  0x0088
 
|  0x180
 
|  0x180
wlan_country_codes
+
WlanCountryCodes
 
|  Array of WLAN country code strings. Each element is 3 bytes (code + NULL terminator).
 
|  Array of WLAN country code strings. Each element is 3 bytes (code + NULL terminator).
 
|-
 
|-
 
|  0x0210
 
|  0x0210
 
|  0x06
 
|  0x06
wlan_mac_addr
+
WlanMacAddress
 
|   
 
|   
 
|-
 
|-
 
|  0x0220
 
|  0x0220
 
|  0x06
 
|  0x06
bd_addr
+
BdAddress
 
|   
 
|   
 
|-
 
|-
 
|  0x0230
 
|  0x0230
 
|  0x06
 
|  0x06
accelerometer_offset
+
AccelerometerOffset
 
|   
 
|   
 
|-
 
|-
 
|  0x0238
 
|  0x0238
 
|  0x06
 
|  0x06
accelerometer_scale
+
AccelerometerScale
 
|   
 
|   
 
|-
 
|-
 
|  0x0240
 
|  0x0240
 
|  0x06
 
|  0x06
gyroscope_offset
+
GyroscopeOffset
 
|   
 
|   
 
|-
 
|-
 
|  0x0248
 
|  0x0248
 
|  0x06
 
|  0x06
gyroscope_scale
+
GyroscopeScale
 
|   
 
|   
 
|-
 
|-
 
|  0x0250
 
|  0x0250
 
|  0x18
 
|  0x18
serial_number
+
SerialNumber
 
|   
 
|   
 
|-
 
|-
 
|  0x0270
 
|  0x0270
 
|  0x30
 
|  0x30
device_key_ecc_p256
+
EccP256DeviceKey
 
|  Device key (ECC-P256 version; empty and unused).
 
|  Device key (ECC-P256 version; empty and unused).
 
|-
 
|-
 
|  0x02B0
 
|  0x02B0
 
|  0x180
 
|  0x180
device_cert_ecc_p256
+
EccP256DeviceCertificate
 
|  Device certificate (ECC-P256 version; empty and unused).
 
|  Device certificate (ECC-P256 version; empty and unused).
 
|-
 
|-
 
|  0x0440
 
|  0x0440
 
|  0x30
 
|  0x30
device_key_ecc_b233
+
EccB233DeviceKey
 
|  Device key (ECC-B233 version; empty and unused).
 
|  Device key (ECC-B233 version; empty and unused).
 
|-
 
|-
 
|  0x0480
 
|  0x0480
 
|  0x180
 
|  0x180
device_cert_ecc_b233
+
EccB233DeviceCertificate
 
|  Device certificate (ECC-B233 version; active).
 
|  Device certificate (ECC-B233 version; active).
 
|-
 
|-
 
|  0x0610
 
|  0x0610
 
|  0x30
 
|  0x30
eticket_key_ecc_p256
+
EccP256ETicketKey
 
|  ETicket key (ECC-P256 version; empty and unused).
 
|  ETicket key (ECC-P256 version; empty and unused).
 
|-
 
|-
 
|  0x0650
 
|  0x0650
 
|  0x180
 
|  0x180
eticket_cert_ecc_p256
+
EccP256ETicketCertificate
 
|  ETicket certificate (ECC-P256 version; empty and unused).
 
|  ETicket certificate (ECC-P256 version; empty and unused).
 
|-
 
|-
 
|  0x07E0
 
|  0x07E0
 
|  0x30
 
|  0x30
eticket_key_ecc_b233
+
EccB233ETicketKey
 
|  ETicket key (ECC-B233 version; empty and unused).
 
|  ETicket key (ECC-B233 version; empty and unused).
 
|-
 
|-
 
|  0x0820
 
|  0x0820
 
|  0x180
 
|  0x180
eticket_cert_ecc_b233
+
EccB233ETicketCertificate
 
|  ETicket certificate (ECC-B233 version; empty and unused).
 
|  ETicket certificate (ECC-B233 version; empty and unused).
 
|-
 
|-
 
|  0x09B0
 
|  0x09B0
 
|  0x110
 
|  0x110
ssl_key
+
SslKey
 
|  SSL key (empty and unused).
 
|  SSL key (empty and unused).
 
|-
 
|-
 
|  0x0AD0
 
|  0x0AD0
 
|  0x04
 
|  0x04
ssl_cert_size
+
SslCertificateSize
 
|  Total size of the SSL certificate.
 
|  Total size of the SSL certificate.
 
|-
 
|-
 
|  0x0AE0
 
|  0x0AE0
 
|  0x800
 
|  0x800
ssl_cert
+
SslCertificate
|  SSL certificate. Only ssl_cert_size bytes are used.
+
|  SSL certificate. Only SslCertificateSize bytes are used.
 
|-
 
|-
 
|  0x12E0
 
|  0x12E0
 
|  0x20
 
|  0x20
ssl_cert_sha256
+
SslCertificateHash
 
|  SHA256 over the SSL certificate.
 
|  SHA256 over the SSL certificate.
 
|-
 
|-
 
|  0x1300
 
|  0x1300
 
|  0x1000
 
|  0x1000
random_number
+
RandomNumber
 
|  Random generated data.
 
|  Random generated data.
 
|-
 
|-
 
|  0x2300
 
|  0x2300
 
|  0x20
 
|  0x20
random_number_sha256
+
RandomNumberHash
 
|  SHA256 over the random data block.
 
|  SHA256 over the random data block.
 
|-
 
|-
 
|  0x2320
 
|  0x2320
 
|  0x110
 
|  0x110
gamecard_key
+
GameCardKey
GameCard key (empty and unused).
+
Gamecard key (empty and unused).
 
|-
 
|-
 
|  0x2440
 
|  0x2440
 
|  0x400
 
|  0x400
gamecard_cert
+
GameCardCertificate
GameCard certificate.
+
Gamecard certificate.
 
|-
 
|-
 
|  0x2840
 
|  0x2840
 
|  0x20
 
|  0x20
gamecard_cert_sha256
+
GameCardCertificateHash
|  SHA256 over the GameCard certificate.
+
|  SHA256 over the Gamecard certificate.
 
|-
 
|-
 
|  0x2860
 
|  0x2860
 
|  0x220
 
|  0x220
eticket_key_rsa
+
Rsa2048ETicketKey
 
|  ETicket key (RSA-2048 version; empty and unused).
 
|  ETicket key (RSA-2048 version; empty and unused).
 
|-
 
|-
 
|  0x2A90
 
|  0x2A90
 
|  0x240
 
|  0x240
eticket_cert_rsa
+
Rsa2048ETicketCertificate
 
|  ETicket certificate (RSA-2048 version; active).
 
|  ETicket certificate (RSA-2048 version; active).
 
|-
 
|-
 
|  0x2CE0
 
|  0x2CE0
 
|  0x18
 
|  0x18
battery_lot
+
BatteryLot
 
|  Battery lot string ID.
 
|  Battery lot string ID.
 
|-
 
|-
 
|  0x2D00
 
|  0x2D00
 
|  0x800
 
|  0x800
speaker_calib_value
+
SpeakerCalibrationValue
 
|  Speaker calibration values. Only 0x5A bytes are used.
 
|  Speaker calibration values. Only 0x5A bytes are used.
 
|-
 
|-
 
|  0x3510
 
|  0x3510
 
|  0x04
 
|  0x04
region_code
+
RegionCode
 
|   
 
|   
 
|-
 
|-
 
|  0x3520
 
|  0x3520
 
|  0x50
 
|  0x50
amiibo_key
+
AmiiboKey
 
|  Amiibo key (ECQV and ECDSA versions).
 
|  Amiibo key (ECQV and ECDSA versions).
 
|-
 
|-
 
|  0x3580
 
|  0x3580
 
|  0x14
 
|  0x14
amiibo_cert_ecqv
+
AmiiboEcqvCertificate
 
|  Amiibo certificate (ECQV version).
 
|  Amiibo certificate (ECQV version).
 
|-
 
|-
 
|  0x35A0
 
|  0x35A0
 
|  0x70
 
|  0x70
amiibo_cert_ecdsa
+
AmiiboEcdsaCertificate
 
|  Amiibo certificate (ECDSA version).
 
|  Amiibo certificate (ECDSA version).
 
|-
 
|-
 
|  0x3620
 
|  0x3620
 
|  0x40
 
|  0x40
amiibo_key_ecqv_bls
+
AmiiboEcqvBlsKey
 
|  Amiibo key (ECQV-BLS version).
 
|  Amiibo key (ECQV-BLS version).
 
|-
 
|-
 
|  0x3670
 
|  0x3670
 
|  0x20
 
|  0x20
amiibo_cert_ecqv_bls
+
AmiiboEcqvBlsCertificate
 
|  Amiibo certificate (ECQV-BLS version).
 
|  Amiibo certificate (ECQV-BLS version).
 
|-
 
|-
 
|  0x36A0
 
|  0x36A0
 
|  0x90
 
|  0x90
amiibo_root_cert_ecqv_bls
+
AmiiboEcqvBlsRootCertificate
 
|  Amiibo root certificate (ECQV-BLS version).
 
|  Amiibo root certificate (ECQV-BLS version).
 
|-
 
|-
 
|  0x3740
 
|  0x3740
 
|  0x04
 
|  0x04
product_model
+
ProductModel
 
|  1 = Nx, 2 = Copper
 
|  1 = Nx, 2 = Copper
 
|-
 
|-
 
|  0x3750
 
|  0x3750
 
|  0x06
 
|  0x06
color_variation
+
ColorVariation
 
|   
 
|   
 
|-
 
|-
 
|  0x3760
 
|  0x3760
 
|  0x0C
 
|  0x0C
lcd_backlight_brightness_mapping
+
LcdBacklightBrightnessMapping
 
|   
 
|   
 
|-
 
|-
 
|  0x3770
 
|  0x3770
 
|  0x50
 
|  0x50
device_ext_key_ecc_b233
+
ExtendedEccB233DeviceKey
 
|  Extended device key (ECC-B233 version; active).
 
|  Extended device key (ECC-B233 version; active).
 
|-
 
|-
 
|  0x37D0
 
|  0x37D0
 
|  0x50
 
|  0x50
eticket_ext_key_ecc_p256
+
ExtendedEccP256ETicketKey
 
|  Extended ETicket key (ECC-P256 version; empty and unused).
 
|  Extended ETicket key (ECC-P256 version; empty and unused).
 
|-
 
|-
 
|  0x3830
 
|  0x3830
 
|  0x50
 
|  0x50
eticket_ext_key_ecc_b233
+
ExtendedEccB233ETicketKey
 
|  Extended ETicket key (ECC-B233 version; empty and unused).
 
|  Extended ETicket key (ECC-B233 version; empty and unused).
 
|-
 
|-
 
|  0x3890
 
|  0x3890
 
|  0x240
 
|  0x240
eticket_ext_key_rsa
+
ExtendedRsa2048ETicketKey
 
|  Extended ETicket key (RSA-2048 version; active).
 
|  Extended ETicket key (RSA-2048 version; active).
 
|-
 
|-
 
|  0x3AE0
 
|  0x3AE0
 
|  0x130
 
|  0x130
ssl_ext_key
+
ExtendedSslKey
 
|  Extended SSL key (active).
 
|  Extended SSL key (active).
 
|-
 
|-
 
|  0x3C20
 
|  0x3C20
 
|  0x130
 
|  0x130
gamecard_ext_key
+
ExtendedGameCardKey
|  Extended GameCard key (active).
+
|  Extended Gamecard key (active).
 
|-
 
|-
 
|  0x3D60
 
|  0x3D60
 
|  0x04
 
|  0x04
lcd_vendor_id
+
LcdVendorId
 
|   
 
|   
 
|-
 
|-
 
|  0x3D70
 
|  0x3D70
 
|  0x240
 
|  0x240
|  [5.0.0+] device_cert_rsa
+
|  [5.0.0+] ExtendedRsa2048DeviceKey
Device certificate (RSA-2048 version).
+
Extended device key (RSA-2048 version; active).
 
|-
 
|-
 
|  0x3FC0
 
|  0x3FC0
 
|  0x240
 
|  0x240
|  [5.0.0+] device_ext_key_rsa
+
|  [5.0.0+] Rsa2048DeviceCertificate
Extended device key (RSA-2048 version).
+
Device certificate (RSA-2048 version; active).
 
|-
 
|-
 
|  0x4210
 
|  0x4210
0x04
+
0x01
|  [5.0.0+] usb_type_c_power_source_circuit_version
+
|  [5.0.0+] UsbTypeCPowerSourceCircuitVersion
 +
 +
|-
 +
|  0x4270
 +
|  0x01
 +
|  [9.0.0+] AnalogStickModuleTypeL
 +
 +
|-
 +
|  0x4280
 +
|  0x12
 +
|  [9.0.0+] AnalogStickModelParameterL
 +
 +
|-
 +
|  0x42A0
 +
|  0x09
 +
|  [9.0.0+] AnalogStickFactoryCalibrationL
 +
 +
|-
 +
|  0x42B0
 +
|  0x01
 +
|  [9.0.0+] AnalogStickModuleTypeR
 +
 +
|-
 +
|  0x42C0
 +
|  0x12
 +
|  [9.0.0+] AnalogStickModelParameterR
 +
 +
|-
 +
|  0x42E0
 +
|  0x09
 +
|  [9.0.0+] AnalogStickFactoryCalibrationR
 +
 +
|-
 +
|  0x42F0
 +
|  0x01
 +
|  [9.0.0+] ConsoleSixAxisSensorModuleType
 +
 +
|-
 +
|  0x4300
 +
|  0x06
 +
|  [9.0.0+] ConsoleSixAxisSensorHorizontalOffset
 
|   
 
|   
 
|-
 
|-
 
|  0x4310
 
|  0x4310
0x04
+
0x01
|  [6.0.0+] battery_version
+
|  [6.0.0+] BatteryVersion
 
|   
 
|   
 
|-
 
|-

Revision as of 16:45, 18 September 2019

During factory setup, the Switch goes through calibration and the generated data from this process is written to two NAND user partitions (PRODINFO and PRODINFOF).

PRODINFOF is a FAT12 compliant filesystem and it's structure can be found here. It's mainly used to keep calibration logs and other assorted files.

PRODINFO is a raw binary blob containing the main calibration data, which ranges from hardware IDs to system keys.

CAL0

This is the raw data stored under the PRODINFO partition.

Offset Size Field Description
0x0000 0x04 MagicNumber "CAL0" header magic.
0x0004 0x04 Version
0x0008 0x04 BodySize Total size of calibration data starting at offset 0x40.
0x000C 0x02 Model
0x000E 0x02 UpdateCount Increases each time calibration data is installed.
0x0020 0x20 BodyHash SHA256 hash calculated over calibration data.
0x0040 0x1E ConfigurationId1 Configuration ID string.
0x0060 0x20 Reserved Empty.
0x0080 0x04 WlanCountryCodesNum Number of elements in the WlanCountryCodes array.
0x0084 0x04 WlanCountryCodesLastIndex Index of the last element in the WlanCountryCodes array.
0x0088 0x180 WlanCountryCodes Array of WLAN country code strings. Each element is 3 bytes (code + NULL terminator).
0x0210 0x06 WlanMacAddress
0x0220 0x06 BdAddress
0x0230 0x06 AccelerometerOffset
0x0238 0x06 AccelerometerScale
0x0240 0x06 GyroscopeOffset
0x0248 0x06 GyroscopeScale
0x0250 0x18 SerialNumber
0x0270 0x30 EccP256DeviceKey Device key (ECC-P256 version; empty and unused).
0x02B0 0x180 EccP256DeviceCertificate Device certificate (ECC-P256 version; empty and unused).
0x0440 0x30 EccB233DeviceKey Device key (ECC-B233 version; empty and unused).
0x0480 0x180 EccB233DeviceCertificate Device certificate (ECC-B233 version; active).
0x0610 0x30 EccP256ETicketKey ETicket key (ECC-P256 version; empty and unused).
0x0650 0x180 EccP256ETicketCertificate ETicket certificate (ECC-P256 version; empty and unused).
0x07E0 0x30 EccB233ETicketKey ETicket key (ECC-B233 version; empty and unused).
0x0820 0x180 EccB233ETicketCertificate ETicket certificate (ECC-B233 version; empty and unused).
0x09B0 0x110 SslKey SSL key (empty and unused).
0x0AD0 0x04 SslCertificateSize Total size of the SSL certificate.
0x0AE0 0x800 SslCertificate SSL certificate. Only SslCertificateSize bytes are used.
0x12E0 0x20 SslCertificateHash SHA256 over the SSL certificate.
0x1300 0x1000 RandomNumber Random generated data.
0x2300 0x20 RandomNumberHash SHA256 over the random data block.
0x2320 0x110 GameCardKey Gamecard key (empty and unused).
0x2440 0x400 GameCardCertificate Gamecard certificate.
0x2840 0x20 GameCardCertificateHash SHA256 over the Gamecard certificate.
0x2860 0x220 Rsa2048ETicketKey ETicket key (RSA-2048 version; empty and unused).
0x2A90 0x240 Rsa2048ETicketCertificate ETicket certificate (RSA-2048 version; active).
0x2CE0 0x18 BatteryLot Battery lot string ID.
0x2D00 0x800 SpeakerCalibrationValue Speaker calibration values. Only 0x5A bytes are used.
0x3510 0x04 RegionCode
0x3520 0x50 AmiiboKey Amiibo key (ECQV and ECDSA versions).
0x3580 0x14 AmiiboEcqvCertificate Amiibo certificate (ECQV version).
0x35A0 0x70 AmiiboEcdsaCertificate Amiibo certificate (ECDSA version).
0x3620 0x40 AmiiboEcqvBlsKey Amiibo key (ECQV-BLS version).
0x3670 0x20 AmiiboEcqvBlsCertificate Amiibo certificate (ECQV-BLS version).
0x36A0 0x90 AmiiboEcqvBlsRootCertificate Amiibo root certificate (ECQV-BLS version).
0x3740 0x04 ProductModel 1 = Nx, 2 = Copper
0x3750 0x06 ColorVariation
0x3760 0x0C LcdBacklightBrightnessMapping
0x3770 0x50 ExtendedEccB233DeviceKey Extended device key (ECC-B233 version; active).
0x37D0 0x50 ExtendedEccP256ETicketKey Extended ETicket key (ECC-P256 version; empty and unused).
0x3830 0x50 ExtendedEccB233ETicketKey Extended ETicket key (ECC-B233 version; empty and unused).
0x3890 0x240 ExtendedRsa2048ETicketKey Extended ETicket key (RSA-2048 version; active).
0x3AE0 0x130 ExtendedSslKey Extended SSL key (active).
0x3C20 0x130 ExtendedGameCardKey Extended Gamecard key (active).
0x3D60 0x04 LcdVendorId
0x3D70 0x240 [5.0.0+] ExtendedRsa2048DeviceKey Extended device key (RSA-2048 version; active).
0x3FC0 0x240 [5.0.0+] Rsa2048DeviceCertificate Device certificate (RSA-2048 version; active).
0x4210 0x01 [5.0.0+] UsbTypeCPowerSourceCircuitVersion
0x4270 0x01 [9.0.0+] AnalogStickModuleTypeL
0x4280 0x12 [9.0.0+] AnalogStickModelParameterL
0x42A0 0x09 [9.0.0+] AnalogStickFactoryCalibrationL
0x42B0 0x01 [9.0.0+] AnalogStickModuleTypeR
0x42C0 0x12 [9.0.0+] AnalogStickModelParameterR
0x42E0 0x09 [9.0.0+] AnalogStickFactoryCalibrationR
0x42F0 0x01 [9.0.0+] ConsoleSixAxisSensorModuleType
0x4300 0x06 [9.0.0+] ConsoleSixAxisSensorHorizontalOffset
0x4310 0x01 [6.0.0+] BatteryVersion

Error detection

Each block of raw calibration data (with the exception of blocks with SHA256 hashes) is padded to 16 bytes, being the last 2 bytes a CRC-16 over said block.

XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
00 00 00 00 00 00 00 00 00 00 00 00 00 00 YY YY

XX == data
00 == padding
YY == crc

The CRC-16 is generated as follows:

unsigned int crc_16_table[16] = {
 0x0000, 0xCC01, 0xD801, 0x1400, 0xF001, 0x3C00, 0x2800, 0xE401,
 0xA001, 0x6C00, 0x7800, 0xB401, 0x5000, 0x9C01, 0x8801, 0x4400 };

unsigned short int get_crc_16 (char *p, int n) {
 unsigned short int crc = 0x55AA;
 int r;

 while (n-- > 0) {
   r = crc_16_table[crc & 0xF];
   crc = (crc >> 4) & 0x0FFF;
   crc = crc ^ r ^ crc_16_table[*p & 0xF];

   r = crc_16_table[crc & 0xF];
   crc = (crc >> 4) & 0x0FFF;
   crc = crc ^ r ^ crc_16_table[(*p >> 4) & 0xF];

   p++;
 }

 return(crc);
}