findncch.py

#!/usr/bin/env python2
import sys, binascii, math
if len(sys.argv) != 2:
	print("only need one CIA file")
	sys.exit()

f = open(sys.argv[1], "rb")

# Archive Header Size
f.seek(0x0)
cia_h_ahs = binascii.hexlify(f.read(0x4)[::-1])
print("Archive Header size: " + cia_h_ahs)

# Type
f.seek(0x4)
cia_h_type = binascii.hexlify(f.read(0x2)[::-1])
print("Type: " + cia_h_type)

# Version
f.seek(0x6)
cia_h_ver = binascii.hexlify(f.read(0x2)[::-1])
print("Version: " + cia_h_ver)

# Certificate chain size
f.seek(0x8)
cia_h_cetks = binascii.hexlify(f.read(0x4)[::-1])
print("Certificate chain size: " + cia_h_cetks)

# Ticket size
f.seek(0xC)
cia_h_tiks = binascii.hexlify(f.read(0x4)[::-1])
print("Ticket size: " + cia_h_tiks)

# TMD size
f.seek(0x10)
cia_h_tmds = binascii.hexlify(f.read(0x4)[::-1])
print("TMD size: " + cia_h_tmds)

# Meta size
f.seek(0x14)
cia_h_metas = binascii.hexlify(f.read(0x4)[::-1])
print("Meta size: " + cia_h_metas)

# Content size
f.seek(0x18)
cia_h_contents = binascii.hexlify(f.read(0x8)[::-1])
print("Content size: " + cia_h_contents)

print("") # newline
content_offset = int(math.ceil(int(cia_h_ahs, 16) / 64.0) * 64.0 + math.ceil(int(cia_h_cetks, 16) / 64.0) * 64.0 + math.ceil(int(cia_h_tiks, 16) / 64.0) * 64.0 + math.ceil(int(cia_h_tmds, 16) / 64.0) * 64.0)
print("The Content offset would probably be at: " + hex(content_offset))
f.seek(content_offset+0x100)
print("If this says NCCH, it's working as intended: \""+f.read(4)+"\"")