Content.bin file structure
The content.bin file structure
VC games and Wii channels, when saved to a SD card, will be stored in a file named "private/wii/title/XXXX/content.bin", where XXXX is the four-character name of the game/channel.
The general layout of this file is as follows. Most of the data here is sketchy, at best.
|0x0640||Part A: Encrypted header|
|variable, padded to 64-byte boundary||Part B: Encrypted game info|
|0x70, padded to 64-byte boundary||Part C: Cleartext "Bk" header|
|0x1E4 + num_contents*0x24, padded to 64-byte boundary||Part D: Cleartext TMD block, including content_records for the following files|
|num_contents*variable, padded to 64-byte boundary||Part E: Encrypted data contents|
|0x340||Part F: Cleartext certificates|
Part A: Encrypted header
The header is encrypted by the SD key and SD IV. When decrypted, it contains the following structure:
|0x000||0x007||8||Title ID (which is 00 01 00 01 followed by the four-character code)|
|0x008||0x00B||4||Size of part B|
|0x00C||0x01D||16||MD5 Hash of header|
|0x01C||0x63F||0x624||As of yet un-analyzed data|
Part B: Encrypted game info
This part is is also encrypted by the SD key and SD IV. The contents of this part has not yet been fully analyzed. It seems to contain information of what kind of system that is emulated, and probably the image to dislay on the channel selector for this VC game.
Part C: Cleartext "Bk" header
This part is not encrypted. It is similar to the Bk header found in savegames, but the contents only partially match. The header could also be exactly 0x80 long; the size of 0x70 is a guess based on the first field being a size parameter.
|0x000||0x003||4||Size of this part (presumably; always 0x70)|
|0x004||0x007||4||Magic word, always 0x42 0x6B 0x00 0x01 (Bk..)|
|0x00C||0x06F||0x64||As of yet un-analyzed data, mostly zero.|
Part D: Cleartext TMD block
This part is not encrypted. It is well described on the TMD file format page. Some things to note:
- Only the tmd struct is included here, not the certificates.
- As described on the TMD file format page, after the main struct (with a size of 0x1E4), there follows an array of content_record structs.
- There is as many structs as the num_contents field in the tmd struct indicates. For VC, this seems to be always 7.
- The type and size file of the content_record is of special interest, since they describe part E.
- If type is 0x80 0x01, then the content is included in part E, and the size of the content is given by the size field.
- Otherwise, type will be 0x00 0x01, and the content is (presumably) shared between VCs and stored elsewere on the Wii.
Part E: Encrypted data contents
This part is encrypted. The encryption key is currently unknown. It might be unique to the Wii which saved the VC. It consists of several separate "files", one for each of the contents with the 0x80 type flag in the TMD content_record, padded to 64-byte boundary.
Part F: Cleartext certificates
This part is not encrypted. The exact details of this field is not yet analyzed, but it is likely related to the chain of certificates as described on the TMD file format page.