Difference between revisions of "Content.bin file structure"

From WiiBrew
Jump to navigation Jump to search
(Layout cleanup. Some better way of referencing the code needs to be made.)
(Added links to locally hosted code. [Code reference issue resolved.])
Line 3: Line 3:
 
VC games and Wii channels, when saved to a SD card, will be stored in a file named "private/wii/title/XXXX/content.bin", where XXXX is the four-character name of the game/channel.
 
VC games and Wii channels, when saved to a SD card, will be stored in a file named "private/wii/title/XXXX/content.bin", where XXXX is the four-character name of the game/channel.
  
A program to help parse and analyze the structure of content.bin files, parse-channel.c, is available [http://pastebin.com/f6ea7673f here]. '''Put it in the same directory as a compiled version of segher's Wii tools, since it depends on them.'''
+
A program to help parse and analyze the structure of content.bin files, parse-channel.c ([[parse-channel.c|local]] & [http://pastebin.com/f6ea7673f mirror]). '''Put it in the same directory as a compiled version of [[Segher's Wii.git]] tools, since it depends on them.'''
  
 
=== General layout ===
 
=== General layout ===
Line 178: Line 178:
 
This part is is also encrypted by the SD key and SD IV. The precise format of this part has not yet been fully analyzed. It seems to contain code/data for displaying the animated logo/channel preview in the channel selector.
 
This part is is also encrypted by the SD key and SD IV. The precise format of this part has not yet been fully analyzed. It seems to contain code/data for displaying the animated logo/channel preview in the channel selector.
  
: This part is compressed using a LZ77 like algorithm (just like the Nintendo DS). [http://pastebin.com/f43e9b2cc Here] is a little snippet of code to decompress it (uses XXXX_02_gameinfo.bin files as output by [[User:Magicus|Magicus]] parse-channel.c, downloadable up here). This code is NOT fully functional, because sometimes the algorithm request data not present in the buffer, and fills it with 'X' instead. Maybe someone can fix it, I think it's not difficult ;) [[User:Arcnor|Arcnor]] 21:40, 27 February 2008 (GMT)
+
: This part is compressed using a LZ77 like algorithm (just like the Nintendo DS). Here ([[Content.bin Part B decompresser|local]] & [http://pastebin.com/f43e9b2cc mirror]) is a little snippet of code to decompress it (uses XXXX_02_gameinfo.bin files as output by [[User:Magicus|Magicus]] [[parse-channel.c]], downloadable here). This code is NOT fully functional, because sometimes the algorithm request data not present in the buffer, and fills it with 'X' instead. Maybe someone can fix it, I think it's not difficult ;) [[User:Arcnor|Arcnor]] 21:40, 27 February 2008 (GMT)
  
 
===Part C: Cleartext "Bk" header===
 
===Part C: Cleartext "Bk" header===

Revision as of 14:49, 1 March 2008

These are the details of the Content.bin file structure.

VC games and Wii channels, when saved to a SD card, will be stored in a file named "private/wii/title/XXXX/content.bin", where XXXX is the four-character name of the game/channel.

A program to help parse and analyze the structure of content.bin files, parse-channel.c (local & mirror). Put it in the same directory as a compiled version of Segher's Wii.git tools, since it depends on them.

General layout

The general layout of this file is as follows. Most of the data here is sketchy, at best.

Length Description
0x0640 Part A: Encrypted header
variable, padded to 64-byte boundary Part B: Encrypted channel logo/preview
0x70, padded to 64-byte boundary Part C: Cleartext "Bk" header
0x1E4 + num_contents*0x24, padded to 64-byte boundary Part D: Cleartext TMD block, including content_records for the following files
num_contents*variable, padded to 64-byte boundary Part E: Encrypted data contents
0x340 Part F: Cleartext certificates

Part A: Encrypted header

The header is encrypted by the SD key and SD IV. When decrypted, it contains the following structure: (* means the field is discussed below)

Start End Length Description
0x000 0x007 8 Title ID (which is 00 01 00 01 followed by the four-character code)
0x008 0x00B 4 Size of part B
0x00C 0x01B 16 MD5 Hash of header
0x01C 0x02B 16 unknown_1 (crypto usage, md5 hash of something?)
0x02C 0x02F 4 * unknown_2
0x030 0x037 8 * Title-ID-reference_1
0x038 0x03F 8 * Title-ID-reference_2
0x040 0x07F 64 * Zeroes_1
0x080 0x09B 28 * IMET data
0x09C 0x0EF 42 Channel name in Unicode, padded with 00 (Japanse version -- can be empty).
0x0F0 0x143 42 Channel name in Unicode, padded with 00 (English version).
0x144 0x197 42 Channel name in Unicode, padded with 00 (German version).
0x198 0x1EB 42 Channel name in Unicode, padded with 00 (French version).
0x1EC 0x23F 42 Channel name in Unicode, padded with 00 (Spanish version).
0x240 0x293 42 Channel name in Unicode, padded with 00 (Italian version).
0x294 0x2E7 42 Channel name in Unicode, padded with 00 (Dutch version).
0x2E8 0x63F 0x358 * Padding (normally zero)
  • unknown_2

This value looks almost like the four-letter code of a channel/game. I have found HADP on most files, but HAGP on Super Mario/NES and '\0UPD' (that is, the first byte is 00, then UPD) on two N64-games.

  • Title-ID-reference_1 and Title-ID-reference_2

These two looks like two Title-ID:s. On most files I have analyzed they are: 00 01 00 08 HALP and 00 01 00 08 HAKP (this is from a PAL Wii). However, on Super Mario/NES I found 00 01 00 02 HAFP and 00 01 00 02 HAGA. A guess is that they might stipulate some kind of dependencies on system files.

  • Zeroes_1

If the guess about depencencies is correct, then this might be a padding field which is zero only if not more than two dependencies are needed.

  • IMET data

The IMET data follows a quite strict format, with a few changes between files. I don't have any good idea what those changes represent. The only major difference is found i Metroid Prime 3 Preview, which have everyting zero except the "IMET" header. The values indicated below is for all other files I've studied, which was non-zero.

Start End Length Description
0x000 0x003 4 IMET header "IMET"
0x004 0x00B 8 Fixed value, always 00 00 06 00 00 00 00 03.
0x00C 0x017 12 Three 32-bit numbers (sizes?), typically in the range of 0x84BC to 0x56318.
0x018 0x01B 4 Flags? This is normally just zero, but Everybody Votes has 0050 0000 and Mii Contest has 0060 4100.
  • Padding (normally zero)

For Metroid Prime 3 Preview, this field was not completely zero. The three bytes with positions 0x313, 0x367 and 0x3BB was 0x20 instead of 0. My guess is that this doesn't matter, but then again, it could have something to do with the weird IMET data of MP3preview.

Part B: Encrypted channel logo/preview

This part is is also encrypted by the SD key and SD IV. The precise format of this part has not yet been fully analyzed. It seems to contain code/data for displaying the animated logo/channel preview in the channel selector.

This part is compressed using a LZ77 like algorithm (just like the Nintendo DS). Here (local & mirror) is a little snippet of code to decompress it (uses XXXX_02_gameinfo.bin files as output by Magicus parse-channel.c, downloadable here). This code is NOT fully functional, because sometimes the algorithm request data not present in the buffer, and fills it with 'X' instead. Maybe someone can fix it, I think it's not difficult ;) Arcnor 21:40, 27 February 2008 (GMT)

Part C: Cleartext "Bk" header

This part is not encrypted. It is similar to the Bk header found in savegames, but the contents only partially match. The header could also be exactly 0x80 long; the size of 0x70 is a guess based on the first field being a size parameter.

Start End Length Description
0x000 0x003 4 Size of this part (presumably; always 0x70)
0x004 0x007 4 Magic word, always 0x42 0x6B 0x00 0x01 (Bk..)
0x008 0x00B 4 NG-id
0x00C 0x015 10 Always zero.
0x016 0x021 12 Not yet analyzed, first byte is 0x03 or 0x02. On VCs, this always starts with 0x02 0xE0 and ends with 0x63 0x00.
0x022 0x06F 0x4E Always zero.

Part D: Cleartext TMD block

This part is not encrypted. It is well described on the TMD file format page. Some things to note:

  • Only the tmd struct is included here, not the certificates.
  • As described on the TMD file format page, after the main struct (with a size of 0x1E4), there follows an array of content_record structs.
  • There is as many structs as the num_contents field in the tmd struct indicates. For VC, this seems to be always 7.
  • The type and size file of the content_record is of special interest, since they describe part E.
  • If type is 0x80 0x01, then the content is included in part E, and the size of the content is given by the size field.
  • Otherwise, type will be 0x00 0x01, and the content is (presumably) shared between VCs and stored elsewere on the Wii.

Part E: Encrypted data contents

This part is encrypted. The encryption key is currently unknown. It might be unique to the Wii which saved the VC. It consists of several separate "files", one for each of the contents with the 0x80 type flag in the TMD content_record, padded to 64-byte boundary.

This part is probably the same for every Wii, but unique to each VC. It's probably encrypted with the title key, stored in a ticket somewhere. Bushing 03:42, 11 February 2008 (PST)

Part F: Cleartext certificates

This part is not encrypted. The exact details of this field is not yet analyzed, but it is likely related to the chain of certificates as described on the TMD file format page.