All downloadable games for each console/handheld (DS, 3DS, Wii, Wii U, Switch)
Too many questions at once! Every console works differently...
There are many possible layers of encryption! Usually there's one on the contents of the physical disc itself (for DS, Wii onwards), maybe another layer between optical drive and console (WiiU - to obstruct the design/installation of ODEs), ...
Similiarly, the fact something is encrypted does not mean the key is a single number (actually, it is, and in 3DS terminology this is the "normal key"; but it may be generated by the mathematical combination of multiple independent factors)
Also note that, while related (one possibility is right, the other truckload of them aren't), there's a difference between signing and encryption
1. What I think how it works: All downloadable games for each console/handheld (DS, 3DS, Wii, Wii U, Switch) are in general decrypted. Each console/handheld has its own key. Once it is downloaded to the console/handheld, the console encrypt the ROM with its own key and decrypt it when it launched the game. So, at this point the ROM is no longer decrypted and it only works with the console/handheld who branded it with its key. Is this right?
There's a difference between an application before it's installed, and while it's installed
In general, titles installed to internal memory is not encrypted TO THE CONSOLE (it still has encryption specific to the title), while software stored to the SD is
A Wii channel or DSiware currently installed and playable is not encrypted; a 3DS application installed on the SD has both "console"-specific encryption and also, if enabled for that app (homebrew usually isn't, for example) title-specific encryption
2. Is it correct that only DLC games have this sort of protection? Because I think on disc based games it is not possible to encrypt the game, so ISOs are in general decrypted, right?
For the Wii, it mostly depends on where you draw the line, as the data on the disc is encrypted (you need at least the common key to view its contents on a PC) but the disc itself technically isn't (however it's not a standard DVD, so most drives will have trouble with them)
For the DS instead, the software itself is not encrypted, but the communication between rom and console is
Once you have a backup in your hands, the hardware encryption has already been decoded (for example, uncart for the 3DS could backup physical games before the keys were actually known, because they are loaded by the 3DS boot process into the hardware accelerated encryption key - even though uncart can't see the key, it can use it)
3. In emulation it works the same way, only in this case the emulator (the virtual console) encrypt the games with its own key, right?
Virtual Console are regular application titles, not different than what you would call "a game for that console" with a more straight face: the rom of the emulated game is just another file inside the game's executable or data (and is covered by title encryption, if used on that console)
Emulators of the Wii/3DS/etc - and other off-console software - either require manually fully decrypted software, or emulate correctly the console's encryption features (which requires knowledge of the keys): see how, after the 3DS bootrom was dumped, PC tools became able to decrypt and encrypt everything without needing a hacked console
4. So if this is all true, then all consoles/handhelds and emulators only can handle decrypted ROMs. But why there are so many encrypted ROMs on the Internet?
Ultimately, the CPU needs decrypted code and data; but that doesn't mean removing most/all encryption results in the best format to feed the console:
A 3DS with (most) CFWs, will accept decrypted/unsigned software; but if you are using a true flashcard (Sky or stargate) on a non-modded console, the console must receive encrypted and signed software
The Wii doesn't really have encryption on the disc itself (apart from the hardware security bypassed by a chip or ODE), but it still required signed software unless running an IOS with the trucha bug*, so you can't just write an homebrew (or game mod) to a DVD and run it with just a chip
* actually, even with the trucha bug, you still need a valid signature; it "just" makes the chance of guessing the right one 1/256 instead of 2^-32, which is almost instant for a computer you're likely to edit games on; and 3DS sighax is based on the same general principle
5. I have a 3DS decrypted ROM for Citra. I check the MD5 value with the No-Intro 3DS decrypted DAT and it matched. If Citra works like an real 3DS it should encrypt the decrypted ROM after launching and the ROM should be encrypted now, right? But when I check the MD5 it is the same like the decrypted one on the DAT.
3DS physical games have both hardware transport encryption (already removed by the time you see a .3ds file) and a title encryption (which was removed, since you have a decrypted rom)
An unmodified 3DS would not accept it
A 3DS with CFW would, depending on the CFW (decrypted 3DS roms were also popular when Gateway was at its peak; but Gateway isn't really a flashcard in the same meaning of the Sky/Stargate, it's a commercial CFW that happens to supports an accessory that fits in the game slot, which comes close but doesn't emulate correctly an original card)
The title is not "encrypted again" (if it was decrypted in the first place), because the console accepts both (CFW doesn't actually matter, on this point - support for decrypted titles is official; of course, if it was modified after Nintendo signed it, the signature is now wrong and a non-CFW console rejects it)
Citra is also not an (accurate) emulator in the strict meaning of the word: it's an HLE, meaning it doesn't emulate every single piece of the 3DS, and it doesn't aim to (for example, instead of emulating the GPU, taking the signals that on a real console go directly to the screen, and displaying them in a window - it tries to understand a game's "draw a circle in this position with this color" and turn it into the equivalent request for your PC's graphics card).
So Citra is free to take some liberties (inaccuracies), like accepting unsigned software or graphics upscaling, because its goal is "play 3DS games on a PC", not "allow a PC to accurately do the same things a 3DS does"!
6. No-Intro confused me too. I found decrypted Wii DLC ROMs, so I want to check the MD5 integrity. I go to DAT-o-MATIC and look for a Wii DLC decrypted DAT. But there is no. There is one, but its not tagged as decrypted, so I think it should be the encrypted DAT. Surprisingly when I check the MD5 of the decrypted ROM it matched with the encrypted DAT.
I don't know this one, but know that:
A Wii digital title is made of one or more "contents" (.app - encrypted on Nintendo's servers, decrypted when installed in the console), a TMD (a list of the contents and their signature), a ticket (some different information about the title as a whole - including the encryption key for the contents!* and an identifier of the console the ticket is valid for#).
The WAD format is never officially used, in a consumer Wii, but it's just a package of the above things
* the titlekey is itself encrypted with a common key (which for non-Korean titles is the famous ebe42...)
# a number that, if zero, means valid for all consoles, else it's valid only for the console internally identified with the same number
Obviously, most commercial software has a ticket individually generated and signed for the single console that bought it.
If you backup it to WAD, you get the choice of (cracking and) fakesigning the ticket and TMD: if you say no, you create a signed backup valid on your console only - if you say yes, things are changed to make it valid for all consoles (and possibly some more changes, like removing time limits on demos, making the title region free, ... - all depends on what backup tool you use)
Without knowing what exactly is the file in the database (and how it was made), it's hard to replicate it!
Sorry if you probably are now more confused, but making continuous comparisons to consoles that work each with their differences is not the best :/
I jumped in the 3DS scene in late 2014, so I obviously started reading 3DBrew, and it was all unreadable fachchinesisch: only slowly, reading more and more (including documentation and source code of programs related to the specific topic), and yes - asking some questions to people that know better (doing my best to not sound demanding), I mostly understand the software design of 3DS title packaging/signing/encryption. There certainly are some similiarities between 3DS, DSi, Wii, and WiiU (and iQue which started it all), but for a beginner they just make the picture more confused (I think)!
