The data within a WAD file has the following format.
This page is horribly out of date. Expect an update when the dust of recent events settles.
NOTE: Recently updated, should the certificate/ticket/TMD data be deleted?.
Thanks to Segher for his source.
|0x000||0x003||4||Header size = 0x0020|
|0x004||0x007||4||WAD Type ('Is\0\0' or 'ib\0\0' or 'Bk\0\0')|
|0x008||0x00B||4||Certificate chain size.|
|0x00C||0x00F||4||Reserved = 0|
The contents are stored in the WAD in the same order as in the TMD. Each block (header, contents) is aligned to 0x40 bytes.
The contents are encrypted using the title key (decrypt it from the ticket) and the content index (in the TMD, the 2 first bytes of the IV are the index, the last 14 bytes are zeroes) as IV. The SHA1 of the decrypted content must match that stored in the TMD.
The "footer" is an optional, unencrypted timestamp / buildstamp.