So recently I got the idea to research how theme shop works to be able to host custom themes which will probably be hosted via pretendo network and so far I have found interesting stuff.
Here is the HTTPS requests
before opening the theme shop on theme select screen:
https://nppl.c.app.nintendowifi.net/p01/policylist/3/GR (requires CTR common certificate)
After opening the theme shop:
https://npdl.cdn.nintendowifi.net/p01/nsa/dMtiFHzm5OOf0y2O/thmtop/GR/en/top
clicking new themes:
https://npfl.c.app.nintendowifi.net/p01/filelist/dMtiFHzm5OOf0y2O/thmdtls?c=GR&l=en&a3=1(requires CTR common certificate)
https://npfl.c.app.nintendowifi.net/p01/filelist/dMtiFHzm5OOf0y2O/thmdtls?c=GR&l=en&a3=2(requires CTR common certificate)
https://npdl.cdn.nintendowifi.net/p01/nsa/dMtiFHzm5OOf0y2O/thmlist/GR/en/5180
clicking the simple colour set theme:
https://npdl.cdn.nintendowifi.net/p01/nsa/dMtiFHzm5OOf0y2O/thmdtls/GR/en/00000094
The first file it downloads is the BOSS Task policy in XML file format while the thmdtls are in txt format with contains the theme id, prices, and some other data. Now the rest of the data is BOSS data which are encrypted using the AES BOSS key located on keyslot 0x38 decrypting it we find that from "top" file we have 0x2BE which is the New theme entry witch the weird thing is by replacing the text to "Awesome theme it didn't change the text by opening the theme shop. The second thing I found is the banner that displays on the top screen with an image size of 408x176.
And finally, on offset 0x8466, I found an icon for the list entry at offset 0x396 which is 64x48 in size.
Here is the HTTPS requests
before opening the theme shop on theme select screen:
https://nppl.c.app.nintendowifi.net/p01/policylist/3/GR (requires CTR common certificate)
After opening the theme shop:
https://npdl.cdn.nintendowifi.net/p01/nsa/dMtiFHzm5OOf0y2O/thmtop/GR/en/top
clicking new themes:
https://npfl.c.app.nintendowifi.net/p01/filelist/dMtiFHzm5OOf0y2O/thmdtls?c=GR&l=en&a3=1(requires CTR common certificate)
https://npfl.c.app.nintendowifi.net/p01/filelist/dMtiFHzm5OOf0y2O/thmdtls?c=GR&l=en&a3=2(requires CTR common certificate)
https://npdl.cdn.nintendowifi.net/p01/nsa/dMtiFHzm5OOf0y2O/thmlist/GR/en/5180
clicking the simple colour set theme:
https://npdl.cdn.nintendowifi.net/p01/nsa/dMtiFHzm5OOf0y2O/thmdtls/GR/en/00000094
The first file it downloads is the BOSS Task policy in XML file format while the thmdtls are in txt format with contains the theme id, prices, and some other data. Now the rest of the data is BOSS data which are encrypted using the AES BOSS key located on keyslot 0x38 decrypting it we find that from "top" file we have 0x2BE which is the New theme entry witch the weird thing is by replacing the text to "Awesome theme it didn't change the text by opening the theme shop. The second thing I found is the banner that displays on the top screen with an image size of 408x176.
And finally, on offset 0x8466, I found an icon for the list entry at offset 0x396 which is 64x48 in size.