iQueBrew - User contributions [en]

CMD

2019-02-04T08:29:33Z

Simon: Improve clarification of image type, also toilet

A '''content metadata''' or '''CMD''' is a file or structure used to store data about an iQue app, such as encryption keys, its access to secure kernel calls, and its access to various hardware. It is used on its own in [[SKSA]] (where SA1 and SA2 both have their own attached CMD) and also contained as part of every [[ticket]].

== Format ==
A CMD consists of two parts: '''contentDesc''', an optional 0x2800-byte long structure containing information about a game such as its save type, title, and thumbnail image; and '''BbContentMetaDataHead'''. The former is not used in the content metadata for SAs.

=== contentDesc ===
{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x00
| 0x04
| uint32
| EEPROM RDRAM location (typically 0x807C0000, 0 if unused)
|-
| 0x04
| 0x04
| uint32
| EEPROM size (either 0x200 or 0x800)
|-
| 0x08
| 0x04
| uint32
| Flash RDRAM location (typically 0x807C0000, 0 if unused)
|-
| 0x0C
| 0x04
| uint32
| Flash size (0x20000 if used)
|-
| 0x10
| 0x04
| uint32
| SRAM RDRAM location (typically 0x807C0000, 0 if unused)
|-
| 0x14
| 0x04
| uint32
| SRAM size (0x8000 if used)
|-
| 0x18
| 0x04
| uint32
| Controller Pak 0 RDRAM location (could be 0x807C0000 or 0x807C0000, 0 if unused)
|-
| 0x1C
| 0x04
| uint32
| Controller Pak 1 RDRAM location (0 if unused)
|-
| 0x20
| 0x04
| uint32
| Controller Pak 2 RDRAM location (0 if unused)
|-
| 0x24
| 0x04
| uint32
| Controller Pak 3 RDRAM location (0 if unused)
|-
| 0x28
| 0x04
| uint32
| Controller Pak size (0x8000 when used)
|-
| 0x2C
| 0x04
| uint32
| Probably osRomBase (always 0xB0000000?)
|-
| 0x30
| 0x04
| uint32
| Probably osTvType (always 1? which is for NTSC)
|-
| 0x34
| 0x04
| uint32
| Probably osMemSize (always 0x400000? for no expansion pak)
|-
| 0x38
| 0x04
| uint32
| Unknown, possibly another libultra boot param
|-
| 0x3C
| 0x04
| uint32
| Unknown, possibly another libultra boot param
|-
| 0x40
| 0x03
| chars
| "CAM", unknown purpose
|-
| 0x43
| 0x01
| byte
| Number of ".u0x" files for this game?
|-
| 0x44
| 0x02
| uint16
| Thumb image length (can't be more than 0x4000, decompressed size must be exactly 0x1880)
|-
| 0x46
| 0x02
| uint16
| Title image length (can't be more than 0x10000, how exactly would that even fit?)
|-
| 0x48
| ''Thumb image length''
| bytes
| DEFLATE-compressed thumb image, stored as RGBA5551 (56w * 56h)
|-
| 0x48 + ''Thumb image length''
| ''Title image length''
| bytes
| DEFLATE-compressed title image, stored as IA8 (184w * 24h)
|-
| 0x48 + ''Thumb image length'' + ''Title image length''
| 0x27B8 - image lengths
| chars
| Title name + ISBN
|}

=== BbContentMetaDataHead ===
{| class="wikitable"
|-
! Offset
! Length
! Type
! Description
! Information
|-
| 0x2800
| 0x04
| uint32
| unusedPadding
| padding
|-
| 0x2804
| 0x04
| uint32
| caCrlVersion
| Certificate Authority(?) CRL version
|-
| 0x2808
| 0x04
| uint32
| cpCrlVersion
| Content Protection(?) CRL version
|-
| 0x280C
| 0x04
| uint32
| size
| Size (in bytes) of the associated app
|-
| 0x2810
| 0x04
| uint32
| descFlags
| Seemingly unused/unchecked; bit 0 set if the associated app is SA
|-
| 0x2814
| 0x10
| uint8[16]
| commonCmdIv
| titlekey_iv; IV used to encrypt title key (with common key)
|-
| 0x2824
| 0x14
| uint8[20]
| hash
| SHA-1 hash of the plaintext of the associated app
|-
| 0x2838
| 0x10
| uint8[16]
| iv
| content_iv; IV used to encrypt content
|-
| 0x2848
| 0x04
| uint32
| execFlags
| Despite the name, only one use/flag is known: if bit 1 is set (the "recrypt flag"), the associated app will be re-encrypted on first launch
|-
| 0x284C
| 0x04
| uint32
| hwAccessRights
| bitfield, each bit enables access to some MMIO regs new to iQue Player:
* bits 0-7: new PI stuff
* bit 0: PI buffer used for aes/NAND read output and PI DMA (1KB at PI_BASE+0x10000)
* bit 1: NAND flash regs in PI
* bit 2: memory mapper for old PI dma
* bit 3: hardware AES-engine in PI
* bit 4: new PI dma engine, DMAs from/to PI buffer
* bit 5: new GPIO; power + LED
* bit 6: external IO bus stuff (debug?)
* bit 7: new PI error stuff
* bit 8: enables access to USB regs
* bit 9: enables access to internal ram used for SK stack
(0x0000 for games except for Animal Forest which is 0x0033, 0x0013 for iQue Club, 0x01F7/0x01B3 for SA)
|-
| 0x2850
| 0x04
| uint32
| secureKernelRights
| Which [[SKC|secure kernel calls]] the associated app can use, one bit per syscall: bit 0 allows SKC 0, etc.
|-
| 0x2854
| 0x04
| uint32
| bbid
| If not zero, can only be run on the specified console (used for SAs, not games)
|-
| 0x2858
| 0x40
| uint8[64]
| issuer
| Certificate used to sign the cmd
|-
| 0x2898
| 0x04
| uint32
| id
| Content ID of the associated app
|-
| 0x289C
| 0x10
| uint8[16]
| key
| The associated app's title key. It is encrypted once with the common key. If the associated app is not an SA, then it is encrypted ''again'' with a key derived using the result of ECDH with the console's private key in the Virage2 and the public key in the app's ticket.
|-
| 0x28AC
| 0x100
| uint8[256]
| contentMetaDataSign
| RSA-2048 signature over all of the above, but before the title key is encrypted a second time.
|}

[[Category:File formats]]

Games

2019-01-30T13:10:50Z

Simon: Undo revision 955 by XiongWang99 (talk)

== Released Games (14) ==

{| class="wikitable"
|-
! Title
! Chinese title
! Literal translation
! Release date
! Game CID
! Manual CID
|-
| ''[[Wave Race 64]]''
| 水上摩托
| Motorcycling on Water
| November 17, 2003
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=5101104 51011]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=5101904 51019]
|-
| ''[[Star Fox 64]]''
| 星际火狐
| Interstellar Fire Fox
| November 17, 2003
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=4101105 41011]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=4101904 41019]
|-
| ''[[Dr. Mario 64]]''
| 马力欧医生
| Dr. Mario
| November 17, 2003
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=6101104 61011]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=6101904 61019]
|-
| ''[[Super Mario 64]]''
| 神游马力欧
| iQue Mario
| November 17, 2003
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=1101104 11011]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=1101906 11019]
|-
| ''[[The Legend of Zelda: Ocarina of Time]]''
| 塞尔达传说-时光之笛-
| The Legend of Zelda: Ocarina of Time
| November 17, 2003
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=2101104 21011]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=2101904 21019]
|-
| ''[[Mario Kart 64]]''
| 马力欧卡丁车
| Mario Kart
| December 25, 2003
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=5201105 52011]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=5201906 52019]
|-
| ''[[F-Zero X]]''
| F-Zero X 未来赛车
| F-Zero X Future Racing
| February 25, 2004
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=5202103 52021]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=5202904 52029]
|-
| ''[[Yoshi's Story]]''
| 耀西故事
| Yoshi Story
| March 25, 2004
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=1102101 11021]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=1102906 11029]
|-
| ''[[Paper Mario]]''
| 纸片马力欧
| Paper Mario
| June 8, 2004
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=2102104 21021]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=2102904 21029]
|-
| ''[[Sin and Punishment: Successor of the Earth]]''
| 罪与罚-地球的继承者-
| Sin and Punishment: Successor of the Earth
| September 25, 2004
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=4102103 41021]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=4102901 41029]
|-
| ''[[Excitebike 64]]''
| 越野摩托
| Off-road Motorcycling
| June 15, 2005
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=5102108 51021]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=5102902 51029]
|-
| ''[[Super Smash Bros.]]''
| 任天堂明星大乱斗
| Nintendo Stars Great Melee
| November 15, 2005
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=1201105 12011]
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=1201901 12019]
|-
| ''[[Custom Robo]]''
| 组合机器人
| Combination Robot
| May 1, 2006
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=2105103 21051]
| N/A
|-
| ''[[Animal Crossing]]''
| 动物森林
| Animal Forest
| June 1, 2006
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=2104108 21041]
| N/A
|}

== Cancelled Games (2) ==
{| class="wikitable"
|-
! Title
! Chinese title
! Literal translation
! Planned release date
! Game CID
! Manual CID
|-
| ''[[The Legend of Zelda: Majora's Mask]]''
| 塞尔达传说-魔力面具-
| The Legend of Zelda: The Magical Mask
| 2004/2005?
| 21031 (not on CDS)
| N/A
|-
| ''[[The Legend of Zelda: Ocarina of Time (Traditional Chinese)]]''
| 塞爾達傳說：時光之笛
| The Legend of Zelda: Ocarina of Time
| 2006
| [http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=2106101 21061]
| N/A
|}

SKSA

2019-01-30T13:10:40Z

Simon: Undo revision 954 by XiongWang99 (talk)

'''SKSA''' (Secure Kernel / System App) is the "Upgradable Operating System" of the iQue Player, the main software that runs on the device.

== Parts ==
As the name implies it consists of two parts: a [[secure kernel]], and a [[system app]]. In later SKSAs the system-app area may also be divided into two sections: SA1 and SA2.

* '''Secure Kernel''': the 'boot1' of the iQue. Doesn't ever seem to change between SKSA versions, so might be similar to the Wii boot1; the hash of it is checked against a stored hash in [[Virage2]].

* '''System App 1''': Consists of a [[Ticket|ticket]], followed by the actual SA1 data. Most SA1s are just the [[iQue Menu]], though some seem to be [[Factory Tests|factory/graphics tests]]. SA1 seems to be responsible for handling USB comms too.

* '''System App 2''': Also has a ticket, followed by SA2 data. Unknown purpose, in SKSAs that have an SA2 the SA1 size is greatly reduced compared to single-SA SKSAs, presumably they moved some data from SA1 into this, but it seems like dual-SA SA1s can run without needing the corresponding SA2?

== Format ==
The format of the SKSA is simple: a 64KiB SK, followed by SA1 (ticket + data), optionally followed by SA2 (ticket + data):
{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x10000
| encrypted bytes
| Secure Kernel
|-
| 0x10000
| 0x4000
| ticket
| SA1 ticket
|-
| 0x14000
| (sa1ticket.ContentSize)
| encrypted bytes
| SA1 data
|-
| 0x14000 + sa1ticket.ContentSize
| 0x4000
| ticket
| SA2 ticket
|-
| 0x18000 + sa1ticket.ContentSize
| sa2ticket.ContentSize
| encrypted bytes
| SA2 data
|}

== NAND format ==
On NAND the format is slightly changed however: instead of storing the SA1 & SA2 data exactly as stored in the cached SKSA, the data is instead reversed in 0x4000 byte blocks (though tickets are unaffected). The NAND spare data is used to store pointers for these blocks, to allow for skipping any bad blocks in the SKSA area.

See [https://github.com/emoose/iQueTool/blob/master/iQueTool/Files/iQueNand.cs#L207 SetSKSAData in iQueTool] for an example on how the blocks are transformed, or see [https://github.com/emoose/iQueTool/blob/master/iQueTool/Files/iQueNand.cs#L506 GenerateSpareData] for how the SAData in the spare is set.

The [[NAND#BBFS|BBFS]] FAT table also sets the SKSA blocks to 0xfffd (reserved), to ensure that no files will overwrite them.

== Testing ==
A spreadsheet of the different SKSAs that have been tested (whether it boots, what happens when it boots, etc) is available [https://docs.google.com/spreadsheets/d/13wb-jwPEJ9HV2-XUbaLr3VVkGXTrX2LEf6cGce7WdU8/edit?usp=sharing here].

== [http://www.ique.com/products/Player_upgrade.htm Official update log] ==
===Jan 2004 update===

Added Settings(管理) menu and "i-Timer" Smart Clock, allowing parents to set time limit on gaming and allowing games to use real-world time.

===Sept 2004 update===

Added [[iQue@Home]] support to the console.

This update is most likely corresponds to the SKSA version 1092 as it is the first version to have [[iQue@Home]] USB support.

[[Category:File_formats]]

IQue Card

2019-01-30T13:10:31Z

Simon: Undo revision 953 by XiongWang99 (talk)

{{DISPLAYTITLE:iQue Card}}
[[File:IQue_card_disassembled.jpg|thumb|A disassembled '''iQue Card'''.]]

The '''iQue Card''' (Chinese: 神游卡) is a removable memory card of the [[iQue Player]], used to store [[games]] and the [[SKSA|"Upgradeable Operating System"]]. It is located on the bottom of every unit.

The iQue Card is housed in a plastic shell, which contains a Samsung K9F1208U0M-YCB0 NAND chip on a special PCB codenamed "DOOKIE". The contents of the NAND are documented on the [[NAND]] page.

Datasheet: [http://www.reinerziegler.de/ique/ds_k9f1208u0m.pdf]

== DOOKIE ==
The DOOKIE board is very basic, and it contains the NAND flash, a few resistors, and an edge connector to connect with an [[iQue Player]]. The connector has a 1.1mm pitch and seems to be custom made. No other commonly-available connector appears to fit in it except the MicroSD.

[[Category:Hardware]]

Category:Hardware

2019-01-30T13:10:24Z

Simon: Undo revision 952 by XiongWang99 (talk)

Various pieces of hardware were released for the [[iQue Player]], such as the player itself & the SWIM attachment (allowing for extra controllers to be connected to a single unit). Privately, devices like the [[iQue Depot]] were given (rented?) to certain stores, allowing users to buy and download games to their [[iQue Card]].

Animal Crossing

2019-01-30T13:10:05Z

Simon: Undo revision 951 by XiongWang99 (talk)

{{DISPLAYTITLE:Animal Crossing}} [[File:2104108_thumb.png]]

{{Infobox
|title= Animal Crossing
|image=[[File:21041_E.jpg]]
|titleCN= 动物森林
|ISBN=7-900427-30-9<br>025-2005-009<br>[2006]080号
|CID=21041
|developer=Nintendo
|publisher=Nintendo
|released=June 1, 2006
|genre=RPG
|modes=Single player
|GameVer=[http://web.archive.org/cds.idc.ique.com:16963/cds/download?content_id=2104108 2104108]
|ManualVer=N/A
|GameSize= 62 Blocks, 16,138,240 Bytes (15.3 MiB)
|ManualSize=N/A
}}

'''''Animal Crossing''''' (Chinese name: 动物森林, literally "Animal Forest") was released on the [[iQue Player]] on June 1, 2006.

It was the last [[iQue Player]] game ever released.

== iQue@Home description==

=== Newer version ===
'''Chinese:'''

悠闲的积累财富，还是享受社交的乐趣？在这个小村庄里，一切由你主演！

创造性的真实时间制，中国特色的传统节日，以及各种有趣的突发事件，使这个虚拟的世界充满了不可思议的真实，这就是动物森林：一人一世界！

'''English translation:'''

Accumulate wealth at leisure, or enjoy the fun of socializing? In this small village, you are the main character!

Creative real-time system, traditional Chinese festivals, and all kinds of interesting unexpected events made this virtual world unbelievably real. This is Animal Crossing: An entire world for a person!

==Trivia==

* The game features in-depth Chinese localization, providing features including Chinese input and traditional Chinese festivals like the Mid-Autumn Festival.

* Like [[Custom Robo]], the last two games released on the [[iQue Player]] do not have on-console manuals, nor do they appear on the older iQue@Home site.

* This is the only iQue Player title to officially use [[iQue Card]] hotswapping. To accept a visitor from another [[iQue Player]], the host's card must be removed to read [[Memory Area]] data from the visitor card, and then continue the game using the host's OWN iQue Card.

* Animal Forest is the only game with a non-zero ''allowed hardware'' value in its [[CMD]].

== Gallery ==
<gallery>
File:21041_A.jpg|Manual boxart
File:21041_B.gif|Game title with boxart (lower resolution)
File:21041_C.gif|Game title with boxart (higher resolution)
File:21041_D.gif|Game title
File:21041_E.jpg|Poster
File:2104108_thumb.png|Game icon on console
</gallery>

==External links==
*[https://archive.org/download/iQuePlayerManuals/14%20Animal%20Crossing.pdf Instruction Manual]
*[http://www.ique.com/games/21041.htm Official game site on iQue.com (in Chinese)]
*[http://web.archive.org/osc.idc.ique.com:16976/osc/public/htm?OscAction=purchase_title&playerID=undefined&titleID=21041&locale=zh_CN&OscSessId=%22%22 New iQue@Home shop page (in Chinese)]
*[https://nookipedia.com/wiki/Doubutsu_no_Mori_(game) Nookipedia article]
*[https://en.wikipedia.org/wiki/Animal_Crossing_(video_game) Wikipedia article]

[[Category:Games]]

CMD

2018-12-11T10:46:08Z

Simon: Compression type incorrectly listed as gzip; its true type being DEFLATE

A '''content metadata''' or '''CMD''' is a file or structure used to store data about an iQue app, such as encryption keys, its access to secure kernel calls, and its access to various hardware. It is used on its own in [[SKSA]] (where SA1 and SA2 both have their own attached CMD) and also contained as part of every [[ticket]].

== Format ==
A CMD consists of two parts: '''contentDesc''', an optional 0x2800-byte long structure containing information about a game such as its save type, title, and thumbnail image; and '''BbContentMetaDataHead'''. The former is not used in the content metadata for SAs.

=== contentDesc ===
{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x00
| 0x04
| uint32
| EEPROM RDRAM location (typically 0x807C0000, 0 if unused)
|-
| 0x04
| 0x04
| uint32
| EEPROM size (either 0x200 or 0x800)
|-
| 0x08
| 0x04
| uint32
| Flash RDRAM location (typically 0x807C0000, 0 if unused)
|-
| 0x0C
| 0x04
| uint32
| Flash size (0x20000 if used)
|-
| 0x10
| 0x04
| uint32
| SRAM RDRAM location (typically 0x807C0000, 0 if unused)
|-
| 0x14
| 0x04
| uint32
| SRAM size (0x8000 if used)
|-
| 0x18
| 0x04
| uint32
| Controller Pak 0 RDRAM location (could be 0x807C0000 or 0x807C0000, 0 if unused)
|-
| 0x1C
| 0x04
| uint32
| Controller Pak 1 RDRAM location (0 if unused)
|-
| 0x20
| 0x04
| uint32
| Controller Pak 2 RDRAM location (0 if unused)
|-
| 0x24
| 0x04
| uint32
| Controller Pak 3 RDRAM location (0 if unused)
|-
| 0x28
| 0x04
| uint32
| Controller Pak size (0x8000 when used)
|-
| 0x2C
| 0x04
| uint32
| Probably osRomBase (always 0xB0000000?)
|-
| 0x30
| 0x04
| uint32
| Probably osTvType (always 1? which is for NTSC)
|-
| 0x34
| 0x04
| uint32
| Probably osMemSize (always 0x400000? for no expansion pak)
|-
| 0x38
| 0x04
| uint32
| Unknown, possibly another libultra boot param
|-
| 0x3C
| 0x04
| uint32
| Unknown, possibly another libultra boot param
|-
| 0x40
| 0x03
| chars
| "CAM", unknown purpose
|-
| 0x43
| 0x01
| byte
| Number of ".u0x" files for this game?
|-
| 0x44
| 0x02
| uint16
| Thumb image length (can't be more than 0x4000, decompressed size must be exactly 0x1880)
|-
| 0x46
| 0x02
| uint16
| Title image length (can't be more than 0x10000, how exactly would that even fit?)
|-
| 0x48
| ''Thumb image length''
| bytes
| DEFLATE-compressed thumb image RGBA5551 (56px * 56px)
|-
| 0x48 + ''Thumb image length''
| ''Title image length''
| bytes
| DEFLATE-compressed title image RGBA5551 (184px * 24px)
|-
| 0x48 + ''Thumb image length'' + ''Title image length''
| 0x27B8 - image lengths
| chars
| Title name + ISBN
|}

=== BbContentMetaDataHead ===
{| class="wikitable"
|-
! Offset
! Length
! Type
! Description
! Information
|-
| 0x2800
| 0x04
| uint32
| unusedPadding
| padding
|-
| 0x2804
| 0x04
| uint32
| caCrlVersion
| Certificate Authority(?) CRL version
|-
| 0x2808
| 0x04
| uint32
| cpCrlVersion
| Content Protection(?) CRL version
|-
| 0x280C
| 0x04
| uint32
| size
| Size (in bytes) of the associated app
|-
| 0x2810
| 0x04
| uint32
| descFlags
| Seemingly unused/unchecked; bit 0 set if the associated app is SA
|-
| 0x2814
| 0x10
| uint8[16]
| commonCmdIv
| titlekey_iv; IV used to encrypt title key (with common key)
|-
| 0x2824
| 0x14
| uint8[20]
| hash
| SHA-1 hash of the plaintext of the associated app
|-
| 0x2838
| 0x10
| uint8[16]
| iv
| content_iv; IV used to encrypt content
|-
| 0x2848
| 0x04
| uint32
| execFlags
| Despite the name, only one use/flag is known: if bit 1 is set (the "recrypt flag"), the associated app will be re-encrypted on first launch
|-
| 0x284C
| 0x04
| uint32
| hwAccessRights
| bitfield, each bit enables access to some MMIO regs new to iQue Player:
* bits 0-7: new PI stuff
* bit 0: PI buffer used for aes/NAND read output and PI DMA (1KB at PI_BASE+0x10000)
* bit 1: NAND flash regs in PI
* bit 2: memory mapper for old PI dma
* bit 3: hardware AES-engine in PI
* bit 4: new PI dma engine, DMAs from/to PI buffer
* bit 5: new GPIO; power + LED
* bit 6: external IO bus stuff (debug?)
* bit 7: new PI error stuff
* bit 8: enables access to USB regs
* bit 9: enables access to internal ram used for SK stack
(0x0000 for games except for Animal Forest which is 0x0033, 0x0013 for iQue Club, 0x01F7/0x01B3 for SA)
|-
| 0x2850
| 0x04
| uint32
| secureKernelRights
| Which [[SKC|secure kernel calls]] the associated app can use, one bit per syscall: bit 0 allows SKC 0, etc.
|-
| 0x2854
| 0x04
| uint32
| bbid
| If not zero, can only be run on the specified console (used for SAs, not games)
|-
| 0x2858
| 0x40
| uint8[64]
| issuer
| Certificate used to sign the cmd
|-
| 0x2898
| 0x04
| uint32
| id
| Content ID of the associated app
|-
| 0x289C
| 0x10
| uint8[16]
| key
| The associated app's title key. It is encrypted once with the common key. If the associated app is not an SA, then it is encrypted ''again'' with a key derived using the result of ECDH with the console's private key in the Virage2 and the public key in the app's ticket.
|-
| 0x28AC
| 0x100
| uint8[256]
| contentMetaDataSign
| RSA-2048 signature over all of the above, but before the title key is encrypted a second time.
|}

[[Category:File formats]]