3DS Boot Chain

This map expands the 3DS/CTR boot material from the mask-ROM first stage into the broader secure boot chain: BootROM, FIRM payloads, kernels, ARM9 security process, ARM11 loader, and system-service startup.

The BootROM tree starts under bootrom/CTR/private/build/bootrom. Later stages live mainly under firmware/CTR-Kernel, kernel, and processes.

Boot Chain Overview
Stage Component Primary Roots Meaning
1 Boot9 / Boot11 BootROM bootrom/CTR/private/build/bootrom/ctr_bootrom, bootrom/CTR/private/build/libraries Immutable ARM9 and ARM11 startup code. It initializes enough hardware to verify and load the selected FIRM image.
2 FIRM image family firmware/CTR-Kernel/native, twl, agb, updater1st Second-stage firmware payloads selected by boot mode: native CTR mode, DS/TWL compatibility mode, GBA/AGB mode, and updater/recovery variants.
3 Kernels and core loaders kernel, firmware/CTR-Kernel/*/kernel, processes/process9, processes/loader Kernel bring-up and first privileged process handoff. ARM9-side security and storage work lands in Process9; ARM11 executable loading lands in loader.
4 System service startup processes/*, libraries/* ARM11 services, managers, filesystems, graphics, network, and applet/application shell processes started after the core kernel and loader are alive.
Build Packaging and update tools tools/SystemUpdater, tools/makerom, firmware/CTR-Kernel/updater1st Material that assembles or deploys boot-chain images rather than running as the normal cold-boot path itself.
Stage 1 BootROM Source Shape
Stage Folder Pattern Meaning
1 bootrom/CTR/private/build/bootrom/* Top-level BootROM targets, experiments, and subsystem tests. Final bootrom-style images are assembled from these target folders.
1 ARM11/ Files compiled for the 3DS ARM11 side of a BootROM target. These are processor-specific pieces, not separate archive categories.
1 ARM9/ Files compiled for the 3DS ARM9 security/IO side. Most media, crypto, and storage boot work lands here.
1 common/ Shared target source used by one or both processor builds.
1 rom/ ROM wrapper/startup material such as crt0.c and image-level Makefile glue.
1 Makefile Target selection and build wiring. The top-level BootROM Makefile chooses which test or ROM variant to build.
Stage 1 BootROM Targets
Stage Folder Function
1alarmAlarm and timer-focused boot test target with ARM11, ARM9, and ROM wrapper pieces.
1ctr_bootromMain CTR/3DS BootROM target. Its local source is intentionally small because it links against the shared BootROM libraries.
1 -> 2firm-loader-nandFIRM loader variant aimed at NAND-backed boot media.
1 -> 2firm-loader-ngcFIRM loader variant for game-card/NGC-style boot paths.
1 -> 2firm-loader-norFIRM loader variant for NOR-backed boot media.
1jtag-onlyDebug/JTAG-only target with secure startup files for both ARM11 and ARM9.
1legacyLegacy wrapper area. It relates CTR BootROM builds to older TWL/NTR normal bootrom blobs by presence, rather than full DSi source.
1 testndma-1Small ARM9 NDMA-focused test target.
1 testsdmc-1Largest BootROM subfolder. It contains SD/MMC pattern tests, AES/raw cases, and the most detailed SDMC test harness material.
1 testsdmc-2Smaller SDMC boot/test variant with paired ARM11 and ARM9 entrypoints.
1 testsdmc-3Another SDMC test variant with a readme and paired ARM11/ARM9 source.
1 devteg-devDevelopment-board or engineering bring-up target with secure startup paths.
1 testtest_sdmcSDMC/NAND read-write regression target with shared test headers and extra ARM9 test cases.
1 testthreadThreading/runtime scheduler test shell.
1 testvfpARM11 VFP/FPU bring-up or validation target.
Stage 1 Shared BootROM Libraries
Stage Library Function
1acsignAccess/signature support: AES, SHA-1, bignum, and related signing helpers.
1aesLow-level AES hardware support, key setup, swapping, and DMA/XDMA/NDMA paths.
1i2cI2C instruction and peripheral communication helpers.
1initStartup code, secure/nonsecure CRT0 variants, MMU/protection setup, scatter-loading, and exception startup.
1lcdARM11 LCD/debug display support, fonts, printf output, GPU/LCD glue, backlight, and LCD-over-I2C pieces.
1mathChecksum, CRC, SHA, HMAC, and small math utilities.
1mcuMCU API and MCU-over-I2C communication.
1 -> 2mediaFirmware/media verification and loading, including NAND, NOR, game-card paths, AES handling, and FIRM checks.
1miMemory interface helpers: memory init/copy/remap, shared WRAM, exclusive access, NDMA, and XDMA.
1nandNAND access stack, mostly around the ARM11 NE1 NAND interface.
1 -> 2ngcGame-card and DS/TWL card support, including Blowfish tables, card init, Megachips handling, and loader glue.
1 -> 2norNOR flash instruction and low-level access helpers.
1osTiny BootROM runtime: boot, exceptions, IRQs, cache, timers, alarms, mutex/message/thread primitives, and printf.
1padButton/input reading helpers.
1pmPower-management enable/init support.
1promPROM/ROM startup wrapper source.
1pxiPXI inter-processor communication between ARM11 and ARM9.
1rsaRSA verification support, DER parsing, and PKCS#1 helpers.
1scfgSystem configuration register handling and ARM9 fuse support.
1 -> 2sdmcSD/MMC and NAND stack: commands, control, interrupts, timers, transfer, reads/writes, AES, and SHA-integrated reads.
1shaSHA/HMAC low-level support and DMA/XDMA/NDMA variants.
1swiSWI table and service dispatch material.
1vlinkVirtual link and OS-emulation glue used by the BootROM environment.
Stage 2 FIRM And Compatibility Payloads
Stage Root Function
2firmware/CTR-Kernel/nativeNormal CTR/NATIVE_FIRM build family. It splits into firmware wrapper material, kernel payloads, and title/process content.
2firmware/CTR-Kernel/native/firmwareNative-mode firmware container/wrapper area, corresponding to the second-stage image selected by BootROM.
2 payloadfirmware/CTR-Kernel/native/kernelKernel payloads carried by the native FIRM branch; these become Stage 3 code after FIRM loading.
2 payloadfirmware/CTR-Kernel/native/titleTitle/process content carried by the native FIRM branch; these feed the later loader and service-startup stages.
2 alternatefirmware/CTR-Kernel/twlTWL/DS compatibility FIRM family. Contains firmware, title content, and background-kernel variants for DS-mode execution.
2 alternatefirmware/CTR-Kernel/twl/bgKernel, twl/bgKernelPartialTWL background-kernel and partial background-kernel payload groupings.
2 alternatefirmware/CTR-Kernel/agbAGB/GBA compatibility FIRM family. Contains firmware, title content, and background-kernel variants for GBA-mode execution.
2 alternatefirmware/CTR-Kernel/agb/bgKernel, agb/bgKernelPartialAGB background-kernel and partial background-kernel payload groupings.
2 developmentfirmware/CTR-Kernel/nativedDevelopment native-firmware branch with firmware, kernel, and title subtrees.
2 developmentfirmware/CTR-Kernel/native_eiu, natived_eiuEIU/development variants of the native firmware stack.
2 updaterfirmware/CTR-Kernel/updater1st, updater1st_eiuUpdater/recovery boot branches with updater contents, card-image layouts, updater kernel/process material, and NGC updater FIRM support.
2 reffirmware/CTR/horizon_os, firmware/CTR/twl_osOlder Horizon/TWL OS source roots adjacent to the CTR-Kernel firmware family. These provide context for how the FIRM payloads relate to OS startup.
Stage 3 Kernel And Loader Roots
Stage Root Function
3kernelMain 3DS kernel source root used by FIRM payloads and system startup.
3kernel/initKernel initialization and early runtime setup.
3 ARM9kernel/ARM946ES, kernel/CTR/ARM946ESARM9-side kernel and processor-specific support.
3 ARM11kernel/MPCore, kernel/CTR/MPCoreARM11 MPCore kernel and processor-specific support.
3kernel/svcSupervisor-call interface and system-call support used by later process startup.
3 developmentkernel_eiuEIU/development kernel branch marker.
3 ARM9processes/process9, process9_eiuARM9 security and storage authority after FIRM loading: crypto, title/security policy, media, and privileged service coordination.
3 ARM11processes/loader, loader_eiuARM11 executable loading path for system modules and user processes.
3 -> 4processes/ProcessManager, ProcessManager_eiuProcess lifecycle manager used as the system moves from core boot into service startup.
3 -> 4processes/ServiceManager, ServiceManager_eiuService registration and discovery manager for the ARM11 service environment.
Stage 4 ARM11 Service And App Startup
Stage Process Root Function
4ApplicationManagerApplication/title lifecycle management for launched software and shell flows.
4CTRCTR shell and compatibility-mode front-end processes such as TWL/AGB background menus, test menu, and development shell pieces.
4 debugDebugMonitor, DebugMonitorIS, yaDebugMonitorDebug monitor processes and internal/debug-station variants.
4FileServer, FileServer_eiu, FileServerForDD, FileServerForDD_eiuFilesystem service processes and development/DD variants.
4GraphicsServerGraphics service process used by the ARM11 application environment.
4PlatformServicePlatform service process for hardware/platform coordination.
4PrintServerPrint/logging service process.
4 networkac, act, cecd, friends, http, nim, nwm, nwm_eiu, socket, sslNetwork, account, friends, notification/update, StreetPass/CEC, HTTP, socket, SSL, and wireless-manager services.
4 mediaboss, dlp, mvd, news, roBackground online storage/download tasks, download play, video/media, news, and relocatable-object loading support.
4 hardwarecamera, camera_dp2, codec, csnd, dsp, gpio, hid, i2c, ir, mcu, mcu_eiu, mic, mp, nfc, pdn, ptm, ptm_eiu, spiDevice-facing service processes for camera, audio, DSP, GPIO, input, I2C, infrared, MCU, microphone, NFC, power, PTM, and SPI hardware.
4 IPCpxi, pxi_eiuARM9/ARM11 inter-processor communication service layer after the BootROM PXI handoff has given way to OS services.
4 configcfg, ndmConfiguration and network/device-management service processes.
4 simple/testsimple, testsSmall sample/test processes used to validate service and kernel behavior.
Build And Packaging Roots
Stage Root Function
1private/build/bootromBootROM targets, tests, and top-level Makefile wiring.
1private/build/librariesThe shared implementation that makes the tiny target folders meaningful.
1include/nn/bootromHeaders, register definitions, linker templates, and public/private interfaces used across the BootROM tree.
Buildprivate/build/buildtoolsBuild-system rules, templates, and helper glue for turning targets into ROM images.
Build/inputprivate/tools/binBinary inputs referenced by the build, including legacy normal-ROM blobs and key/data material. This page records their role only at a high level.
2/Buildtools/makerom, tools/MakeMetaDataContent, tools/GetCiaInfoROM/content metadata and package tooling adjacent to firmware and title assembly.
2/Updatertools/SystemUpdater, tools/SystemUpdater_eiuUpdater applications and EIU/development variants used to deploy or test firmware/content updates.
Media toolstools/NandReader, NandReader9, NandWriter, NandWriterFromRomfs, NandVerifier, NandCleanerNAND inspection, writing, verification, and cleanup tools around boot/update media workflows.
zky.app | 2019 | Connor Kulczytzky