-
Notifications
You must be signed in to change notification settings - Fork 9
NeFS Format 1.6
NeFS format version 1.6.
The header intro contains size, encryption, and verification information.
| Start* | End* | Length | Description |
|---|---|---|---|
| 0x00 | 0x03 | 0x04 | Magic # (4E 65 46 53; ASCII: "NeFS"; 0x5346654E) |
| 0x04 | 0x23 | 0x20 | Expected hash SHA-256 value |
| 0x24 | 0x063 | 0x40 | An 256-bit key for AES ECB encryption, stored as a hex ascii string |
| 0x64 | 0x67 | 0x04 | Header size |
| 0x68 | 0x6B | 0x04 | NeFS version |
| 0x6C | 0x6F | 0x04 | Number of items in the archive |
| 0x70 | 0x77 | 0x08 | Unknown |
| 0x78 | 0x7F | 0x08 | Unknown |
*Offsets are absolute.
The table of contents contains offsets to other header parts.
| Absolute | Relative | Length | Description | Notes |
|---|---|---|---|---|
| 0x80 | 0x00 | 0x02 | Number of volumes | Usage unknown |
| 0x82 | 0x02 | 0x02 | Hash block size | Archive file data is split into blocks of this sized and hashed. Hashes are stored in part 8. This is the high 16-bits of a 32-bit value. |
| 0x84 | 0x04 | 0x02 | Block size | The size of chunks to split data up into before transforming the chunks. This is the high 16-bits of a 32-bit value. |
| 0x86 | 0x06 | 0x02 | Split size | Usage unknown. This is the high 16-bits of a 32-bit value. |
| 0x88 | 0x08 | 0x04 | Offset to Header Part 1 | Compressed item metadata |
| 0x8C | 0x0C | 0x04 | Offset to Header Part 6 | Additional item metadata |
| 0x90 | 0x10 | 0x04 | Offset to Header Part 2 | Extracted item metadata |
| 0x94 | 0x14 | 0x04 | Offset to Header Part 7 | Sibling item links |
| 0x98 | 0x18 | 0x04 | Offset to Header Part 3 | Filename strings table |
| 0x9C | 0x1C | 0x04 | Offset to Header Part 4 | Chunk sizes/offsets |
| 0xA0 | 0x20 | 0x04 | Offset to Header Part 5 | Contains size of the archive file, plus other unknown data |
| 0xA4 | 0x24 | 0x04 | Offset to Header Part 8 | Data hashes. |
| 0xA8 | 0x28 | 0x58 | Unknown | Padding? |
- Contains entries for each item (file or directory) in the archive.
- Items are not guaranteed to be sorted by id.
- The number of entries in part 1 is equal to the number of items specified in the header intro.
- It is possible to have duplicates (multiple entries with the same id).
Each entry has the following layout:
| Start* | Length | Description | Notes |
|---|---|---|---|
| 0x00 | 0x08 | Offset to compressed data | |
| 0x08 | 0x04 | Index Part 2 | Used to index into parts 2 and 7 |
| 0x0c | 0x04 | Index Part 4 | Used to index into part 4 |
| 0x10 | 0x04 | Item id |
*Offsets are relative to the start of the item's Part 1 entry.
- Entries are ordered by a depth-first traversal of the directory structure with children ordered alphabetically.
- The number of entries are not guaranteed to be the same as part 1.
Each entry has the following layout:
| Start* | Length | Description | Notes |
|---|---|---|---|
| 0x00 | 0x04 | Directory id (id of the item that is the parent of this item) | |
| 0x04 | 0x04 | Id of the first child of this item | Only directories can have children. If the item has no children, the id is the same as the item's id. The first child id is based on the children being sorted by id, not file name. |
| 0x08 | 0x04 | Offset into Header Part 3 where this item's filename/directory name string starts | |
| 0x0c | 0x04 | Extracted size of file | Will be 0 for directories |
| 0x10 | 0x04 | Item id |
*Offsets are relative to the start of the item's Part 2 entry.
Contains array of null-terminated strings. These are the filenames/directory names of the items in the archive. Each item's Header Part 2 entry has the appropriate offset into this array.
Contains information about the storage of the item's data.
An item's data can be comprised of multiple chunks of data. Each chunk of data for an item contains the following entry:
| Start* | Length | Description |
|---|---|---|
| 0x00 | 0x04 | Cumulative block size |
| 0x04 | 0x02 | Transformation type |
| 0x06 | 0x02 | Unknown, checksum (crc16 maybe) or simple checksum? |
*Offsets are relative to the start of the data chunk entry.
Data chunks can be transformed in different ways. This is indicated by the following values:
| Type | Transformation |
|---|---|
| 0x0 | No transformation |
| 0x4 | AES Decrypt |
| 0x7 | Zlib Decompress |
Part 5 has the following layout:
| Start* | Length | Description |
|---|---|---|
| 0x00 | 0x08 | Total size of file data |
| 0x08 | 0x04 | Offset into part 3 for name of file that contains the file data |
| 0x0C | 0x04 | Offset to first item data |
*Offsets are relative to the start of Header Part 5.
- Contains the same number of entries as part 1.
- Entries are ordered the same as part 1.
Each entry has the following layout:
| Start* | Length | Description |
|---|---|---|
| 0x00 | 0x02 | Volume |
| 0x02 | 0x01 | Flags (bitfield) |
| 0x03 | 0x01 | Unknown |
*Offsets are relative to the start of the item's Part 6 entry.
| Value | Description |
|---|---|
| 0x1 | isTransformed |
| 0x2 | isDirectory |
| 0x4 | isDuplicated |
| 0x8 | isCacheable |
| 0x10 | Unknown |
| 0x20 | isPatched |
| 0x40 | Unknown |
| 0x80 | Unknown |
- Contains the same number of entries as part 2.
- Entries are ordered the same as part 2.
Each entry has the following layout:
| Start* | Length | Description | Notes |
|---|---|---|---|
| 0x00 | 0x04 | Sibling item id | Id of the next item in the same directory. If this is the last item in the directory, the sibling id is equal to this item id. The sibling id is based on the children being ordered by id, not file name. |
| 0x04 | 0x04 | Item id |
*Offsets are relative to the start of the item's Part 7 entry.
File data in the archive is split up using the hash block size specified in the header table of contents, then hashed using SHA-256.
There is extra data at the end which appear to be more hashes, but it is currently unknown what this data is.