6
edits
Changes
m
Renamed OSv12 to OSv10
Line 17:
Line 17:
The icon database is encrypted with AES-128-CBC. There's a two byte header:
−byte 0: always zero.
−byte 1: aes key index
−followed by encrypted data.
+
+
+
+
+
+
+
+
+
+
+
+
+There's a SHA256 of the data at the beginning of the file. After the sha, there's some stuff that contains UTF-16 text of the game name and publisher, then image data begins.
−The image data is given as Truevision TGA and usually starts 0x2050 bytes into the decrypted buffer.+
== Encryption ==
== Encryption ==
−nn_idbe contains hardcoded keys in one 0x50 sized block (0x10 * 5), consisting of the 16-byte hardcoded IV, and 4 hardcoded 16-byte AES-128 keys.
nn_idbe contains hardcoded keys in one 0x50 sized block (0x10 * 5), consisting of the 16-byte hardcoded IV, and 4 hardcoded 16-byte AES-128 keys.
−In OSv12 (000500101000400A), the keys are located at $.rodata+0x4c of nn_idbe.rpl.
+In OSv10 (000500101000400A), the keys are located at $.rodata+0x4c of nn_idbe.rpl.
−Here are the keys: (no copyright issue as OSv12 is a free title Kappa)
+Here are the keys:
<syntaxhighlight lang="Python">
<syntaxhighlight lang="Python">
Line 44:
Line 37:
</syntaxhighlight>
</syntaxhighlight>
−== Decrypted icon format ==
+== Icon format ==
+=== Encrypted ===
+{| class="wikitable"
+! Offset
+! Length
+! Description
+|-
+| 0x0
+| 0x1
+| Always 0
+|-
+| 0x1
+| 0x1
+| AES key index
+|-
+| 0x2
+| Remainder
+| Encrypted file contents
+|}
+=== Decrypted ===
+{| class="wikitable"
+! Offset
+! Length
+! Description
+|-
+| 0x0
+| 0x20
+| SHA256 hash of the rest of the data
+|-
+| 0x20
+| 0x8
+| Title ID
+|-
+| 0x28
+| 0x18
+| Unknown (See note 1 below)
+|-
+| 0x40
+| 0x4
+| Magic (ÀÀÀÀ)
+|-
+| 0x44
+| 0xC
+| Padding?
+|-
+| 0x50
+| 0x200*16
+| Title Info (See note 2 below)
+|-
+| 0x2050
+| Remainder
+| Original TGA
+|}
+=== Title Info ===
+{| class="wikitable"
+! Offset
+! Length
+! Description
+|-
+| 0x0
+| 0x80
+| Short title name
+|-
+| 0x80
+| 0x100
+| Full title name
+|-
+| 0x180
+| 0x80
+| Publisher
+|}
+'''Note 1:'''
+The first 8 bytes of this section seem to always be relatively empty, where as the last 16 seem to always been some combination of the characters € and À.
+'''Examples:'''
+# Breath of The Wild: https://i.imgur.com/qI9ehUQ.png
+# Super Mario Maker: https://i.imgur.com/lNfcAM5.png
+# Tekken Tag Tournament 2: https://i.imgur.com/8bJeD56.png
+# Minecraft WiiU: https://i.imgur.com/fiC840J.png
+'''Note 2:'''
+Each of the 16 0x200-length groups has 3 UTF-16-BE text blocks. There is always 3 blocks, even if the string does not take up the entire (or any of the) block. Each group is for a different language/region. The first group is for Japanese, the order of the other languages is unknown.
+'''Examples:'''
+# New SUPER MARIO BROS. U + New SUPER LUIGI U: https://i.imgur.com/IeAAKuZ.png
+# Super Mario Maker: https://i.imgur.com/Q6yWYiO.png
+# Tekken Tag Tournament 2: https://i.imgur.com/f4ENuT5.png
+# Minecraft WiiU: https://i.imgur.com/xZPCbdQ.png
−Example decryptor here: https://github.com/NexoDevelopment/idbe_decrypt/