<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://www.3dbrew.org/w/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Guiand</id>
	<title>3dbrew - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://www.3dbrew.org/w/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Guiand"/>
	<link rel="alternate" type="text/html" href="https://www.3dbrew.org/wiki/Special:Contributions/Guiand"/>
	<updated>2026-04-24T20:08:47Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.43.1</generator>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=NDMA_Registers&amp;diff=21123</id>
		<title>NDMA Registers</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=NDMA_Registers&amp;diff=21123"/>
		<updated>2019-12-17T08:19:05Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* Startup modes (27-24) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;3DS NDMA has 8 channels. The first 0x100-bytes of this IO mem is mirrored at 0x10002100, repeated every 0x100-bytes until the end of the 0x1000-byte IO mem. NDMA can access the ARM9 bootrom, including the protected part before it is locked out.&lt;br /&gt;
&lt;br /&gt;
= Registers =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Old3DS&lt;br /&gt;
!  Name&lt;br /&gt;
!  Address&lt;br /&gt;
!  Width&lt;br /&gt;
!  Used by&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|  [[#NDMA_GLOBAL_CNT|NDMA_GLOBAL_CNT]]&lt;br /&gt;
|  0x10002000&lt;br /&gt;
|  4&lt;br /&gt;
|  Boot9, Kernel9&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|  [[#NDMA_SRC_ADDR|NDMA_SRC_ADDR]](n)&lt;br /&gt;
|  0x10002004 + (n*0x1c)&lt;br /&gt;
|  4&lt;br /&gt;
|  Boot9, Kernel9&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|  [[#NDMA_DST_ADDR|NDMA_DST_ADDR]](n)&lt;br /&gt;
|  0x10002008 + (n*0x1c)&lt;br /&gt;
|  4&lt;br /&gt;
|  Boot9, Kernel9&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|  [[#NDMA_TRANSFER_CNT|NDMA_TRANSFER_CNT]](n)&lt;br /&gt;
|  0x1000200c + (n*0x1c)&lt;br /&gt;
|  4&lt;br /&gt;
|  Boot9, Kernel9&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|  [[#NDMA_WRITE_CNT|NDMA_WRITE_CNT]](n)&lt;br /&gt;
|  0x10002010 + (n*0x1c)&lt;br /&gt;
|  4&lt;br /&gt;
|  Boot9, Kernel9&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|  [[#NDMA_BLOCK_CNT|NDMA_BLOCK_CNT]](n)&lt;br /&gt;
|  0x10002014 + (n*0x1c)&lt;br /&gt;
|  4&lt;br /&gt;
|  Boot9, Kernel9&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|  [[#NDMA_FILL_DATA|NDMA_FILL_DATA]](n)&lt;br /&gt;
|  0x10002018 + (n*0x1c)&lt;br /&gt;
|  4&lt;br /&gt;
|  Boot9, Kernel9&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|  [[#NDMA_CNT|NDMA_CNT]](n)&lt;br /&gt;
|  0x1000201C + (n*0x1c)&lt;br /&gt;
|  4&lt;br /&gt;
|  Boot9, Kernel9&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NDMA_GLOBAL_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  0&lt;br /&gt;
|  Global enable?&lt;br /&gt;
|-&lt;br /&gt;
|  19-16&lt;br /&gt;
|  Cycle selection.&lt;br /&gt;
|-&lt;br /&gt;
|  31&lt;br /&gt;
|  DMA arbitration method. 0=Fixed method, 1=Round robin&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NDMA_SRC_ADDR ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  31-0&lt;br /&gt;
|  Source data address. Must be multiple of 4.&lt;br /&gt;
|}&lt;br /&gt;
Like old DMA, NDMA_SRC_ADDR is copied to internal registers when written to.&lt;br /&gt;
&lt;br /&gt;
== NDMA_DST_ADDR ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  BIT&lt;br /&gt;
!  DESCRIPTION&lt;br /&gt;
|-&lt;br /&gt;
|  31-0&lt;br /&gt;
|  Destination data address. Must be multiple of 4.&lt;br /&gt;
|}&lt;br /&gt;
Like old DMA, NDMA_DST_ADDR is copied to internal registers when written to.&lt;br /&gt;
&lt;br /&gt;
== NDMA_TRANSFER_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  27-0&lt;br /&gt;
|  Total number of words transferred.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NDMA_WRITE_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  23-0&lt;br /&gt;
|  Number of words to transfer.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NDMA_BLOCK_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  15-0&lt;br /&gt;
|  Interval timer.&lt;br /&gt;
|-&lt;br /&gt;
|  17-16&lt;br /&gt;
|  Prescaler. 0=System freq, 1=1/4th freq, 2=1/16th freq, 3=1/64th freq.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NDMA_FILL_DATA ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  31-0&lt;br /&gt;
|  Fill data.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== NDMA_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  11-10&lt;br /&gt;
|  Destination address update method. 0=Increment, 1=Decrement, 2=Fixed.&lt;br /&gt;
|-&lt;br /&gt;
|  12&lt;br /&gt;
|  Destination address reload flag.&lt;br /&gt;
|-&lt;br /&gt;
|  14-13&lt;br /&gt;
|  Source address update method. 0=Increment, 1=Decrement, 2=Fixed, 3=No address (for filling)&lt;br /&gt;
|-&lt;br /&gt;
|  15&lt;br /&gt;
|  Source address reload flag.&lt;br /&gt;
|-&lt;br /&gt;
|  19-16&lt;br /&gt;
|  Block transfer word count = (1&amp;lt;&amp;lt;x) words.&lt;br /&gt;
|-&lt;br /&gt;
|  27-24&lt;br /&gt;
|  Startup mode.&lt;br /&gt;
|-&lt;br /&gt;
|  28&lt;br /&gt;
|  Immediate mode.&lt;br /&gt;
|-&lt;br /&gt;
|  29&lt;br /&gt;
|  Repeating mode.&lt;br /&gt;
|-&lt;br /&gt;
|  30&lt;br /&gt;
|  IRQ enable&lt;br /&gt;
|-&lt;br /&gt;
|  31&lt;br /&gt;
|  Enable/busy flag.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Startup modes (27-24) ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Value&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| TIMER0&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| TIMER1&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| TIMER2&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| TIMER3&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| CTRCARD0&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| CTRCARD1&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| MMC1&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| MMC2?&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| AES in ([[AES_Registers#AES_WRFIFO.2FAES_RDFIFO|WRFIFO]])&lt;br /&gt;
|-&lt;br /&gt;
| 9&lt;br /&gt;
| AES out ([[AES_Registers#AES_WRFIFO.2FAES_RDFIFO|RDFIFO]])&lt;br /&gt;
|-&lt;br /&gt;
| 10&lt;br /&gt;
| SHA in ([[SHA_Registers#SHA_FIFO|INFIFO]])&lt;br /&gt;
|-&lt;br /&gt;
| 11&lt;br /&gt;
| SHA out ([[SHA_Registers#SHA_FIFO|INFIFO]])&lt;br /&gt;
|-&lt;br /&gt;
| 12&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 13&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 14&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 15&lt;br /&gt;
| Boot9 Uses this to copy from the AES out FIFO to the SHA in FIFO&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Block transfers ==&lt;br /&gt;
First, a word is always 32 bits. Second, the block transfer specified in NDMA_CNT is the smallest atom of data that will be transferred in a burst. The bus is monopolized until this block is transferred, without splitting up.&lt;br /&gt;
&lt;br /&gt;
The next block transfer will happen after the specified time in the NDMA_BLOCK_CNT interval timer, until done.&lt;br /&gt;
&lt;br /&gt;
== Immediate mode ==&lt;br /&gt;
Transfers the words specified in NDMA_WRITE_CNT immediately following block transfer rules. NDMA_TRANSFER_CNT and repeating mode are ignored.&lt;br /&gt;
&lt;br /&gt;
== Repeating mode ==&lt;br /&gt;
Transfers the words specified in NDMA_WRITE_CNT following the startup mode event. NDMA_TRANSFER_CNT is ignored.&lt;br /&gt;
&lt;br /&gt;
== No immediate and no repeating mode ==&lt;br /&gt;
Transfers the words specified in NDMA_WRITE_CNT for each startup event, and gets disabled when the total number of words in NDMA_TRANSFER_CNT are transferred.&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=AES_Registers&amp;diff=21121</id>
		<title>AES Registers</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=AES_Registers&amp;diff=21121"/>
		<updated>2019-12-15T08:15:46Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Fix typo&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Registers ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Old3DS&lt;br /&gt;
!  Name&lt;br /&gt;
!  Address&lt;br /&gt;
!  Width&lt;br /&gt;
!  RW&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_CNT|AES_CNT]]&lt;br /&gt;
| 0x10009000&lt;br /&gt;
| 4&lt;br /&gt;
| RW&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_MACEXTRABLKCNT|AES_MACBLKCNT]]&lt;br /&gt;
| 0x10009004&lt;br /&gt;
| 2&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_BLKCNT|AES_BLKCNT]]&lt;br /&gt;
| 0x10009006&lt;br /&gt;
| 2&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_WRFIFO/AES_RDFIFO|AES_WRFIFO]]&lt;br /&gt;
| 0x10009008&lt;br /&gt;
| 4&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_WRFIFO/AES_RDFIFO|AES_RDFIFO]]&lt;br /&gt;
| 0x1000900C&lt;br /&gt;
| 4&lt;br /&gt;
| R&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEYSEL&lt;br /&gt;
| 0x10009010&lt;br /&gt;
| 1&lt;br /&gt;
| RW&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_KEYCNT|AES_KEYCNT]]&lt;br /&gt;
| 0x10009011&lt;br /&gt;
| 1&lt;br /&gt;
| RW&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_CTR|AES_CTR]]&lt;br /&gt;
| 0x10009020&lt;br /&gt;
| 16&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_MAC|AES_MAC]]&lt;br /&gt;
| 0x10009030&lt;br /&gt;
| 16&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEY0&lt;br /&gt;
| 0x10009040&lt;br /&gt;
| 48&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEY1&lt;br /&gt;
| 0x10009070&lt;br /&gt;
| 48&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEY2&lt;br /&gt;
| 0x100090A0&lt;br /&gt;
| 48&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEY3&lt;br /&gt;
| 0x100090D0&lt;br /&gt;
| 48&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEYFIFO&lt;br /&gt;
| 0x10009100&lt;br /&gt;
| 4&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEYXFIFO&lt;br /&gt;
| 0x10009104&lt;br /&gt;
| 4&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEYYFIFO&lt;br /&gt;
| 0x10009108&lt;br /&gt;
| 4&lt;br /&gt;
| W&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== AES_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 4-0&lt;br /&gt;
| Write FIFO count (0-16)&lt;br /&gt;
|-&lt;br /&gt;
| 9-5&lt;br /&gt;
| Read FIFO count (0-16)&lt;br /&gt;
|-&lt;br /&gt;
| 10&lt;br /&gt;
| Flush write FIFO (1=Clear write FIFO)&lt;br /&gt;
|-&lt;br /&gt;
| 11&lt;br /&gt;
| Flush read fifo (1=Clear read FIFO)&lt;br /&gt;
|-&lt;br /&gt;
| 12-13&lt;br /&gt;
| Write FIFO DMA size (0=16, 1=12, 2=8, 3=4 words)&lt;br /&gt;
|-&lt;br /&gt;
| 14-15&lt;br /&gt;
| Read FIFO DMA size (0=4, 1=8, 2=12, 3=16 words)&lt;br /&gt;
|-&lt;br /&gt;
| 18-16&lt;br /&gt;
| MAC size (encoding = (maclen-2)/2)&lt;br /&gt;
|-&lt;br /&gt;
| 19&lt;br /&gt;
|? (MAC related)&lt;br /&gt;
|-&lt;br /&gt;
| 20&lt;br /&gt;
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)&lt;br /&gt;
|-&lt;br /&gt;
| 21&lt;br /&gt;
| MAC status (0 = invalid, 1 = verified)&lt;br /&gt;
|-&lt;br /&gt;
| 22&lt;br /&gt;
| Output endianness (1=Big endian, 0=Little endian)&lt;br /&gt;
|-&lt;br /&gt;
| 23&lt;br /&gt;
| Input endianness (1=Big endian, 0=Little endian)&lt;br /&gt;
|-&lt;br /&gt;
| 24&lt;br /&gt;
| Output word order (1=Normal order, 0=Reversed order)&lt;br /&gt;
|-&lt;br /&gt;
| 25&lt;br /&gt;
| Input word order (1=Normal order, 0=Reversed order)&lt;br /&gt;
|-&lt;br /&gt;
| 26&lt;br /&gt;
| Update keyslot (selects the keyslot specified by AES_KEYSEL when this bit is set)&lt;br /&gt;
|-&lt;br /&gt;
| 29-27&lt;br /&gt;
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)&lt;br /&gt;
|-&lt;br /&gt;
| 30&lt;br /&gt;
| Interrupt enable (1=enable, 0=disable)&lt;br /&gt;
|-&lt;br /&gt;
| 31&lt;br /&gt;
| Start (1=enable/busy, 0=idle)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When bit31 is set, this register essentially becomes locked and doesn&#039;t change when written to. However if bit26 is &amp;quot;set&amp;quot;, keyslot-selection is cued to be handled when bit31 is cleared.&lt;br /&gt;
&lt;br /&gt;
Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.&lt;br /&gt;
&lt;br /&gt;
Read/Write FIFO counts and the MAC status can never be set by writing to AES_CNT, they are read-only.&lt;br /&gt;
&lt;br /&gt;
Changing the input word order triggers the key/keyX/keyY FIFOs to be flushed.&lt;br /&gt;
&lt;br /&gt;
== AES_MACEXTRABLKCNT ==&lt;br /&gt;
(CCM-MAC extra data length)&amp;gt;&amp;gt;4, i.e. the number of block of CCM-MAC extra data.&lt;br /&gt;
&lt;br /&gt;
== AES_BLKCNT ==&lt;br /&gt;
(Data length)&amp;gt;&amp;gt;4, i.e. the number of blocks to process&lt;br /&gt;
&lt;br /&gt;
== AES_WRFIFO/AES_RDFIFO ==&lt;br /&gt;
The AES engine can accept up to 64 bytes of input data (16 32-bit words) and can hold up to 64 bytes of output data at a time (for a total of 128 bytes of buffered data). Bits 12-13 and 14-15 in AES_CNT configure the DMA request for the relevant FIFO (see above).&lt;br /&gt;
&lt;br /&gt;
The input data for the AES crypto operation is written to AES_WRFIFO, the output data is read from AES_RDFIFO.&lt;br /&gt;
&lt;br /&gt;
Reading from AES_RDFIFO when there&#039;s no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.&lt;br /&gt;
&lt;br /&gt;
When triggering either RDFIFO or WRFIFO to be flushed, the AES Engine does not clear either buffer.&lt;br /&gt;
&lt;br /&gt;
Word order and endianness can be changed between each read/write to these FIFOs. However changing the word order when writing to WRFIFO can cause the word to be written outside the current block, leaving uninitialized data in its place. Attempts to change endianness or word order are not honored when reading from RDFIFO when no more data is available.&lt;br /&gt;
&lt;br /&gt;
== AES_KEYCNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 5-0&lt;br /&gt;
| Keyslot&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| Hardware key-generator type: 0 = 3DS, 1 = DSi.&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Bit6 is only used when keyslots &amp;gt;=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.&lt;br /&gt;
&lt;br /&gt;
== AES_CTR ==&lt;br /&gt;
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.&lt;br /&gt;
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.&lt;br /&gt;
The AES engine will automatically increment the counter up to the maximum BLKCNT, after which point it must be manually incremented and set again.&lt;br /&gt;
&lt;br /&gt;
== AES_MAC ==&lt;br /&gt;
This register specifies the message authentication code (MAC) for use in CCM mode.&lt;br /&gt;
&lt;br /&gt;
== AES_KEY0/1/2/3 ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Byte&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0-15&lt;br /&gt;
| Normalkey&lt;br /&gt;
|-&lt;br /&gt;
| 16-31&lt;br /&gt;
| KeyX&lt;br /&gt;
|-&lt;br /&gt;
| 32-47&lt;br /&gt;
| KeyY&lt;br /&gt;
|-}&lt;br /&gt;
&lt;br /&gt;
These registers are the same as they were on TWL, and are likely preserved for compatibility reasons. The keyslot is updated immediately after *any* data(u8/u32/...) is written here, which was used on DSi to [[3DS_System_Flaws|break]] the key-generator.&lt;br /&gt;
&lt;br /&gt;
== Endianness and word order ==&lt;br /&gt;
&lt;br /&gt;
=== AES_CNT.input_endianness ===&lt;br /&gt;
&lt;br /&gt;
Swaps the bytes of 32-bit writes to AES_CTR, AES_WRFIFO, AES_KEY*FIFO according to specified endianness. AES_MAC?&lt;br /&gt;
&lt;br /&gt;
=== AES_CNT.output_endianness ===&lt;br /&gt;
&lt;br /&gt;
Swaps the bytes of 32-bit reads from AES_RDFIFO.&lt;br /&gt;
&lt;br /&gt;
=== AES_CNT.input_word_order ===&lt;br /&gt;
&lt;br /&gt;
If reversed, writes to AES_KEY*FIFO and AES_WRFIFO fill the FIFO backwards. For AES_WRFIFO, this means that every 16-byte block will have its words in the reverse order, but the order of these blocks remains the same. AES_CTR is unaffected by this field. AES_MAC?&lt;br /&gt;
&lt;br /&gt;
=== AES_CNT.output_word_order ===&lt;br /&gt;
&lt;br /&gt;
If reversed, reads from AES_RDFIFO will drain the FIFO backwards. This means that every 16-byte output block will have its words in the reverse order, but the order of these blocks remains the same.&lt;br /&gt;
&lt;br /&gt;
== CCM mode pitfall ==&lt;br /&gt;
Non-standard AES-CCM behaviour is observed on [[APT:Wrap|Wrap]]/[[APT:Unwrap|Unwrap]] function. According to [https://tools.ietf.org/html/rfc3610 RFC 3610], the first block B_0 for authentication should be generated from the message length and some other parameters. Using these function, it seems that the message length is aligned up to 16 when generating B_0. This makes the generated MAC not compliant with the standard when (inputsize-noncesize)%16!=0. It is very likely that this non-standard behaviour happens on the hardware level, but not confirmed yet.&lt;br /&gt;
&lt;br /&gt;
== Keyslot ranges ==&lt;br /&gt;
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Keyslot&lt;br /&gt;
!  Name&lt;br /&gt;
!  KeyX&lt;br /&gt;
!  KeyY/Normal-key&lt;br /&gt;
!  Console unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x00-0x03&lt;br /&gt;
| TWL keys.&lt;br /&gt;
| Probably unset.&lt;br /&gt;
| Probably unset.&lt;br /&gt;
| -&lt;br /&gt;
|-&lt;br /&gt;
| 0x04-0x07&lt;br /&gt;
| NAND partition keys.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Different for all.&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x08-0x0B&lt;br /&gt;
| See below.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Different for all.&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x0C-0x0F&lt;br /&gt;
| SSL cert key.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyXs are console-unique, however the normalkeys setup by Boot9 later during keyinit are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x10-0x17&lt;br /&gt;
| -&lt;br /&gt;
| Set for all except 0x11..0x13. Keydata is different for these.&lt;br /&gt;
| Normalkey, same for all except the last 4 are all different.&lt;br /&gt;
| -&lt;br /&gt;
|-&lt;br /&gt;
| 0x18-0x1B&lt;br /&gt;
| Never used.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyXs are console-unique, however the normalkeys setup by Boot9 later during keyinit are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x1C-0x1F&lt;br /&gt;
| Never used.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyXs are console-unique, however the normalkeys setup by Boot9 later during keyinit are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x20-0x23&lt;br /&gt;
| Never used.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyXs are console-unique, however the normalkeys setup by Boot9 later during keyinit are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x24&lt;br /&gt;
| Never used.&lt;br /&gt;
| Individually set.&lt;br /&gt;
| Individually set, normalkey-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyX is console-unique, however the normalkey setup by Boot9 later during keyinit is not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x25-0x27&lt;br /&gt;
| -&lt;br /&gt;
| Not set.&lt;br /&gt;
| Same for all, normalkeys-only. Same keydata as keyslot 0x24.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x28-0x2B&lt;br /&gt;
| Never used.&lt;br /&gt;
| Individually set.&lt;br /&gt;
| Individually set, normalkeys-only. Keyslot 0x28 has same normalkey as keyslot 0x24.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyX is console-unique, however the normalkey setup by Boot9 later during keyinit is not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x2C-0x2F&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x30-0x33&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x34-0x37&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x38-0x3B&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x3C-0x3F&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Individually set.&lt;br /&gt;
| Individually set, normalkeys-only. Keyslot 0x3C has same normalkey as 0x38-0x3B.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX&#039;s. This suggests they were set to same normal-key by bootrom.&lt;br /&gt;
&lt;br /&gt;
== Keyslots ==&lt;br /&gt;
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key generator instead (see [[#Hardware_key_generator|below]]). There is no way to read the contents of a keyslot.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Keyslot&lt;br /&gt;
!  Description&lt;br /&gt;
!  KeyX set by&lt;br /&gt;
!  KeyY set by&lt;br /&gt;
!  Normal-key&lt;br /&gt;
!  Old3DS&lt;br /&gt;
|-&lt;br /&gt;
| 0x00-0x03&lt;br /&gt;
| TWL keys.&lt;br /&gt;
| NATIVE_FIRM hard-boot.&lt;br /&gt;
| NATIVE_FIRM hard-boot.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x04..0x07&lt;br /&gt;
| [[Flash_Filesystem|NAND]] partition keys.&lt;br /&gt;
&lt;br /&gt;
Keyslot is determined by [[NCSD]] partition FS type and encryption type. &lt;br /&gt;
The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data. Its keyX is console-unique and set by the bootloader.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x0A&lt;br /&gt;
| DSiWare export key.&lt;br /&gt;
&lt;br /&gt;
Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.&lt;br /&gt;
| See above keyslot info.&lt;br /&gt;
| See above keyslot info.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x0B&lt;br /&gt;
| This is console-unique. This keyslot is used for the NAND [[Title_Database|dbs]] images AES-CMACs, and the [[Nand/private/movable.sed]] AES-CMAC(when used).&lt;br /&gt;
| See above keyslot info.&lt;br /&gt;
| See above keyslot info.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x0D&lt;br /&gt;
| SSL-certificate key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| -&lt;br /&gt;
| -&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x11&lt;br /&gt;
| Temporary keyslot.&lt;br /&gt;
&lt;br /&gt;
Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.&lt;br /&gt;
| Arm9Loader. &lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x14&lt;br /&gt;
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots&#039; keyYs from [[PSPXI:EncryptDecryptAes|here]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM boot.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x15&lt;br /&gt;
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| See previous info for this keyslot.&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x16&lt;br /&gt;
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| See previous info for this keyslot.&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x18..0x1F&lt;br /&gt;
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.6.0-24|9.6.0-X]] keyslots 0x1C..0x1F are not yet used by Process9.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM / see previous info for these keyslots.&lt;br /&gt;
| See previous info for these keyslots.&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| New3DS [[9.3.0-21|9.3.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0A.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM&lt;br /&gt;
| -&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x19&lt;br /&gt;
| New3DS gamecard [[Savegames|savedata]] AES-CMAC key.&lt;br /&gt;
&lt;br /&gt;
Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM&lt;br /&gt;
| -&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x1A&lt;br /&gt;
| New3DS gamecard [[Savegames|savedata]] actual key.&lt;br /&gt;
&lt;br /&gt;
Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM&lt;br /&gt;
| -&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x1B&lt;br /&gt;
| New3DS [[9.6.0-24|9.6.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0B.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM&lt;br /&gt;
| -&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x24&lt;br /&gt;
| AGB_FIRM savegame AES-CMAC key.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| AGB/NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x25&lt;br /&gt;
| [[7.0.0-13|v7.0]] [[NCCH]] key, when ncchflag[3] is 0x01.&lt;br /&gt;
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x2C&lt;br /&gt;
| Original [[NCCH|NCCH]] key, when ncchflag[3] is 0x00 and always for certain NCCH sections.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Process9.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x2D&lt;br /&gt;
| UDS local-WLAN CCMP key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x2E&lt;br /&gt;
| Streetpass key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x2F&lt;br /&gt;
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| SD/NAND AES-CMAC key.&lt;br /&gt;
&lt;br /&gt;
This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AES-CMACs under SD [[SD_Filesystem|/Nintendo 3DS/&amp;lt;ID0&amp;gt;/&amp;lt;ID1&amp;gt;/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x31&lt;br /&gt;
| APT wrap key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x32&lt;br /&gt;
| Unknown.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x33&lt;br /&gt;
| Gamecard [[Savegames|savedata]] AES-CMAC.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x34&lt;br /&gt;
| SD key.&lt;br /&gt;
&lt;br /&gt;
This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/&amp;lt;ID0&amp;gt;/&amp;lt;ID1&amp;gt;/]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x35&lt;br /&gt;
| Movable.sed key.&lt;br /&gt;
&lt;br /&gt;
This is the keyslot used for movable.sed encryption + AES-CBC MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x36&lt;br /&gt;
| Unknown. Used by friends module.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x37&lt;br /&gt;
| Gamecard [[Savegames|savedata]] actual key.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x38&lt;br /&gt;
| BOSS key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x39&lt;br /&gt;
| Download Play key, and the actual NFC key for generating retail [[Amiibo]] keys.&lt;br /&gt;
&lt;br /&gt;
This keyslot is used for two different keys. Both are available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x3A&lt;br /&gt;
| DSiWare export key.&lt;br /&gt;
&lt;br /&gt;
This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AES-CMACs for SD [[DSiWare_Exports]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x3B&lt;br /&gt;
| [[CTRCARD_Registers#CTRCARD_SECSEED|CTR-CARD hardware-crypto seed]] decryption key.&lt;br /&gt;
&lt;br /&gt;
AES-CCM is used, the keyY, nonce and MAC are stored in the [[NCSD#Card_Info_Header|Card Info Header]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x3D&lt;br /&gt;
| Common key.&lt;br /&gt;
&lt;br /&gt;
Used to decrypt title keys in [[Ticket]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x3F&lt;br /&gt;
| Used for various internal Boot9 crypto operations, different keydata for each one. Used to decrypt the [[OTP_Registers|OTP]], the FIRM sections when [[Bootloader#Non-NAND_FIRM_boot|booting from non-NAND]], and when generating the console-unique keys.&lt;br /&gt;
&lt;br /&gt;
The keydata for this keyslot is overwritten with other keydata before booting FIRM. This keyslot is not known to be used post-Boot9.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Yes&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Updating keydata ===&lt;br /&gt;
The contents of the keyslot specified in AES_KEYCNT can be updated by consecutively writing four words to AES_KEYXFIFO (keyX), AES_KEYYFIFO(keyY), or AES_KEYFIFO (normalkey).&lt;br /&gt;
&lt;br /&gt;
After writing to a keyslot, the keyslot must be selected again(write AES_KEYSEL + set AES_CNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.&lt;br /&gt;
&lt;br /&gt;
Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval&amp;lt;&amp;lt;8) | (byteval&amp;lt;&amp;lt;16) | (byteval&amp;lt;&amp;lt;24). The result is the same regardless of which FIFO register byte was written to.&lt;br /&gt;
&lt;br /&gt;
The TWL keyslots 0x00-0x03 can be set directly by writing to the AES_KEY0-AES_KEY3 registers.&lt;br /&gt;
&lt;br /&gt;
The key FIFOs can be written simultaneously. For example, executing the following will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);&lt;br /&gt;
&lt;br /&gt;
Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by AES_KEYCNT at the time the last word was written.&lt;br /&gt;
&lt;br /&gt;
=== Hardware key generator ===&lt;br /&gt;
A dedicated hardware key generator can be used to generate a keyslot&#039;s normal-key from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots.&lt;br /&gt;
&lt;br /&gt;
The algorithm for generating the normal-key from keyX and keyY is as follows, in big-endian 128-bit unsigned wraparound arithmetic:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Mode&lt;br /&gt;
! Formula&lt;br /&gt;
|-&lt;br /&gt;
| 3DS&lt;br /&gt;
| NormalKey = (((KeyX ROL 2) XOR KeyY) + C1) ROR 41&lt;br /&gt;
|-&lt;br /&gt;
| DSi&lt;br /&gt;
| NormalKey = ((KeyX XOR KeyY) + C2) ROL 42&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Unless noted otherwise, all keyslots on retail units use the hardware key generator.&lt;br /&gt;
&lt;br /&gt;
=== FIRM-launch key clearing ===&lt;br /&gt;
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now &amp;quot;clears&amp;quot; the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.&lt;br /&gt;
&lt;br /&gt;
=== AES key-init ===&lt;br /&gt;
See [[Bootloader|here]] for how Boot9 initializes the AES keyslots.&lt;br /&gt;
&lt;br /&gt;
For an issue with console-unique key-init, see [[OTP_Registers|here]].&lt;br /&gt;
&lt;br /&gt;
Some of the Boot9 key-init appears to have a bug(?) when initializing a chunk of keyslots at once: normally it does &amp;lt;code&amp;gt;for(i=0; i&amp;lt;4; i++){... &amp;lt;setup_keyslot_keydata(keyslotbase+i, keydata)&amp;gt; ...}&amp;lt;/code&amp;gt;, however in some cases it does that except with &amp;lt;code&amp;gt;(keyslotbase,&amp;lt;/code&amp;gt; instead. This results in the keyslot specified by keyslotbase being initialized 4 times in a row, with the remaining 3 keyslots following keyslotbase being left uninitialized.&lt;br /&gt;
&lt;br /&gt;
initialize_aeskeys() works as follows:&lt;br /&gt;
* Validates input, calls panic() on failure. conunique_dataptr and bootrom_dataptr are both input parameters for initialize_aeskeys().&lt;br /&gt;
* Calls crypto_initialize().&lt;br /&gt;
* Then it &#039;&#039;basically&#039;&#039;: copies 0x1C-bytes from conunique_dataptr to tmpbuf+0(sp+12), and copies data from bootrom_dataptr with size 0x40-0x1C to tmpbuf+0x1C(conunique_dataptr and bootrom_dataptr are updated afterwards).&lt;br /&gt;
* The 0x40-byte tmpbuf is hashed with SHA256.&lt;br /&gt;
* Keyslot 0x3F is then initialized using the above hash: keyX = first 0x10-bytes of the hash, keyY = last 0x10-bytes of the hash.&lt;br /&gt;
* Then with each console-unique key-init code-block: IV is loaded from bootrom_dataptr(which is updated afterwards), then the 0x40-bytes from bootrom_dataptr is encrypted with AES-CBC. The output is then used as 4 keyXs for initializing keyslots. How bootrom_dataptr is updated if at all varies per code-block. Hashing similar to the code at the start of this function is also run(when the remaining size for conunique_dataptr is non-zero), but the output hash isn&#039;t used(this code is also slightly different for one code-block).&lt;br /&gt;
* Once finished with that, the non-console-unique keyslots are initialized. This is done with keydata loaded directly from bootrom_dataptr.&lt;br /&gt;
* The last initialized keyslot is 0x3F, via normalkey. The keydata for this is copied to 0xFFF00618. This is for restoring the keydata when non-NAND FIRM boot &#039;&#039;fails&#039;&#039;, since those use keyslot 0x3F with other keydata.&lt;br /&gt;
* Lastly it clears the 0x40-bytes at tmpbuf with the u32 loaded from bootrom_dataptr(the word following the above keyslot 0x3F keydata), then returns.&lt;br /&gt;
&lt;br /&gt;
The keyslots are initialized with the same order of keyslots+keydata_type listed below:&lt;br /&gt;
&lt;br /&gt;
Console-unique keydata, after the initialization for the key-generation keyslot(0x3F):&lt;br /&gt;
  0x04..0x07 keyX&lt;br /&gt;
  0x08..0x0B keyX&lt;br /&gt;
  0x0C..0x0F keyX&lt;br /&gt;
  0x10       keyX&lt;br /&gt;
  0x14..0x17 keyX&lt;br /&gt;
  0x18..0x1B keyX&lt;br /&gt;
  0x1C..0x1F keyX&lt;br /&gt;
  0x20..0x23 keyX&lt;br /&gt;
  0x24       keyX&lt;br /&gt;
  0x28..0x2B keyX&lt;br /&gt;
&lt;br /&gt;
Common keydata:&lt;br /&gt;
&lt;br /&gt;
  0x2C..0x2F keyX&lt;br /&gt;
  0x30..0x33 keyX&lt;br /&gt;
  0x34..0x37 keyX&lt;br /&gt;
  0x38..0x3B keyX&lt;br /&gt;
  0x3C..0x3F keyX&lt;br /&gt;
  0x04..0x0B keyY&lt;br /&gt;
  0x0C..0x0F normalkey&lt;br /&gt;
  0x10..0x13 normalkey&lt;br /&gt;
  0x14..0x17 normalkey&lt;br /&gt;
  0x18..0x1B normalkey&lt;br /&gt;
  0x1C..0x1F normalkey&lt;br /&gt;
  0x20..0x23 normalkey&lt;br /&gt;
  0x24..0x27 normalkey&lt;br /&gt;
  0x28..0x2B normalkey&lt;br /&gt;
  0x2C..0x2F normalkey&lt;br /&gt;
  0x30..0x33 normalkey&lt;br /&gt;
  0x34..0x37 normalkey&lt;br /&gt;
  0x38..0x3B normalkey&lt;br /&gt;
  0x3C..0x3F normalkey&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=AES_Registers&amp;diff=21120</id>
		<title>AES Registers</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=AES_Registers&amp;diff=21120"/>
		<updated>2019-12-15T03:26:40Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Clarify endianness and word order docs&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Registers ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Old3DS&lt;br /&gt;
!  Name&lt;br /&gt;
!  Address&lt;br /&gt;
!  Width&lt;br /&gt;
!  RW&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_CNT|AES_CNT]]&lt;br /&gt;
| 0x10009000&lt;br /&gt;
| 4&lt;br /&gt;
| RW&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_MACEXTRABLKCNT|AES_MACBLKCNT]]&lt;br /&gt;
| 0x10009004&lt;br /&gt;
| 2&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_BLKCNT|AES_BLKCNT]]&lt;br /&gt;
| 0x10009006&lt;br /&gt;
| 2&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_WRFIFO/AES_RDFIFO|AES_WRFIFO]]&lt;br /&gt;
| 0x10009008&lt;br /&gt;
| 4&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_WRFIFO/AES_RDFIFO|AES_RDFIFO]]&lt;br /&gt;
| 0x1000900C&lt;br /&gt;
| 4&lt;br /&gt;
| R&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEYSEL&lt;br /&gt;
| 0x10009010&lt;br /&gt;
| 1&lt;br /&gt;
| RW&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_KEYCNT|AES_KEYCNT]]&lt;br /&gt;
| 0x10009011&lt;br /&gt;
| 1&lt;br /&gt;
| RW&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_CTR|AES_CTR]]&lt;br /&gt;
| 0x10009020&lt;br /&gt;
| 16&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#AES_MAC|AES_MAC]]&lt;br /&gt;
| 0x10009030&lt;br /&gt;
| 16&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEY0&lt;br /&gt;
| 0x10009040&lt;br /&gt;
| 48&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEY1&lt;br /&gt;
| 0x10009070&lt;br /&gt;
| 48&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEY2&lt;br /&gt;
| 0x100090A0&lt;br /&gt;
| 48&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEY3&lt;br /&gt;
| 0x100090D0&lt;br /&gt;
| 48&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEYFIFO&lt;br /&gt;
| 0x10009100&lt;br /&gt;
| 4&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEYXFIFO&lt;br /&gt;
| 0x10009104&lt;br /&gt;
| 4&lt;br /&gt;
| W&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| AES_KEYYFIFO&lt;br /&gt;
| 0x10009108&lt;br /&gt;
| 4&lt;br /&gt;
| W&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== AES_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 4-0&lt;br /&gt;
| Write FIFO count (0-16)&lt;br /&gt;
|-&lt;br /&gt;
| 9-5&lt;br /&gt;
| Read FIFO count (0-16)&lt;br /&gt;
|-&lt;br /&gt;
| 10&lt;br /&gt;
| Flush write FIFO (1=Clear write FIFO)&lt;br /&gt;
|-&lt;br /&gt;
| 11&lt;br /&gt;
| Flush read fifo (1=Clear read FIFO)&lt;br /&gt;
|-&lt;br /&gt;
| 12-13&lt;br /&gt;
| Write FIFO DMA size (0=16, 1=12, 2=8, 3=4 words)&lt;br /&gt;
|-&lt;br /&gt;
| 14-15&lt;br /&gt;
| Read FIFO DMA size (0=4, 1=8, 2=12, 3=16 words)&lt;br /&gt;
|-&lt;br /&gt;
| 18-16&lt;br /&gt;
| MAC size (encoding = (maclen-2)/2)&lt;br /&gt;
|-&lt;br /&gt;
| 19&lt;br /&gt;
|? (MAC related)&lt;br /&gt;
|-&lt;br /&gt;
| 20&lt;br /&gt;
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)&lt;br /&gt;
|-&lt;br /&gt;
| 21&lt;br /&gt;
| MAC status (0 = invalid, 1 = verified)&lt;br /&gt;
|-&lt;br /&gt;
| 22&lt;br /&gt;
| Output endianness (1=Big endian, 0=Little endian)&lt;br /&gt;
|-&lt;br /&gt;
| 23&lt;br /&gt;
| Input endianness (1=Big endian, 0=Little endian)&lt;br /&gt;
|-&lt;br /&gt;
| 24&lt;br /&gt;
| Output word order (1=Normal order, 0=Reversed order)&lt;br /&gt;
|-&lt;br /&gt;
| 25&lt;br /&gt;
| Input word order (1=Normal order, 0=Reversed order)&lt;br /&gt;
|-&lt;br /&gt;
| 26&lt;br /&gt;
| Update keyslot (selects the keyslot specified by AES_KEYSEL when this bit is set)&lt;br /&gt;
|-&lt;br /&gt;
| 29-27&lt;br /&gt;
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)&lt;br /&gt;
|-&lt;br /&gt;
| 30&lt;br /&gt;
| Interrupt enable (1=enable, 0=disable)&lt;br /&gt;
|-&lt;br /&gt;
| 31&lt;br /&gt;
| Start (1=enable/busy, 0=idle)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When bit31 is set, this register essentially becomes locked and doesn&#039;t change when written to. However if bit26 is &amp;quot;set&amp;quot;, keyslot-selection is cued to be handled when bit31 is cleared.&lt;br /&gt;
&lt;br /&gt;
Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.&lt;br /&gt;
&lt;br /&gt;
Read/Write FIFO counts and the MAC status can never be set by writing to AES_CNT, they are read-only.&lt;br /&gt;
&lt;br /&gt;
Changing the input word order triggers the key/keyX/keyY FIFOs to be flushed.&lt;br /&gt;
&lt;br /&gt;
== AES_MACEXTRABLKCNT ==&lt;br /&gt;
(CCM-MAC extra data length)&amp;gt;&amp;gt;4, i.e. the number of block of CCM-MAC extra data.&lt;br /&gt;
&lt;br /&gt;
== AES_BLKCNT ==&lt;br /&gt;
(Data length)&amp;gt;&amp;gt;4, i.e. the number of blocks to process&lt;br /&gt;
&lt;br /&gt;
== AES_WRFIFO/AES_RDFIFO ==&lt;br /&gt;
The AES engine can accept up to 64 bytes of input data (16 32-bit words) and can hold up to 64 bytes of output data at a time (for a total of 128 bytes of buffered data). Bits 12-13 and 14-15 in AES_CNT configure the DMA request for the relevant FIFO (see above).&lt;br /&gt;
&lt;br /&gt;
The input data for the AES crypto operation is written to AES_WRFIFO, the output data is read from AES_RDFIFO.&lt;br /&gt;
&lt;br /&gt;
Reading from AES_RDFIFO when there&#039;s no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.&lt;br /&gt;
&lt;br /&gt;
When triggering either RDFIFO or WRFIFO to be flushed, the AES Engine does not clear either buffer.&lt;br /&gt;
&lt;br /&gt;
Word order and endianness can be changed between each read/write to these FIFOs. However changing the word order when writing to WRFIFO can cause the word to be written outside the current block, leaving uninitialized data in its place. Attempts to change endianness or word order are not honored when reading from RDFIFO when no more data is available.&lt;br /&gt;
&lt;br /&gt;
== AES_KEYCNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 5-0&lt;br /&gt;
| Keyslot&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| Hardware key-generator type: 0 = 3DS, 1 = DSi.&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Bit6 is only used when keyslots &amp;gt;=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.&lt;br /&gt;
&lt;br /&gt;
== AES_CTR ==&lt;br /&gt;
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.&lt;br /&gt;
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.&lt;br /&gt;
The AES engine will automatically increment the counter up to the maximum BLKCNT, after which point it must be manually incremented and set again.&lt;br /&gt;
&lt;br /&gt;
== AES_MAC ==&lt;br /&gt;
This register specifies the message authentication code (MAC) for use in CCM mode.&lt;br /&gt;
&lt;br /&gt;
== AES_KEY0/1/2/3 ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Byte&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0-15&lt;br /&gt;
| Normalkey&lt;br /&gt;
|-&lt;br /&gt;
| 16-31&lt;br /&gt;
| KeyX&lt;br /&gt;
|-&lt;br /&gt;
| 32-47&lt;br /&gt;
| KeyY&lt;br /&gt;
|-}&lt;br /&gt;
&lt;br /&gt;
These registers are the same as they were on TWL, and are likely preserved for compatibility reasons. The keyslot is updated immediately after *any* data(u8/u32/...) is written here, which was used on DSi to [[3DS_System_Flaws|break]] the key-generator.&lt;br /&gt;
&lt;br /&gt;
== Endianness and word order ==&lt;br /&gt;
&lt;br /&gt;
=== AES_CNT.input_endianness ===&lt;br /&gt;
&lt;br /&gt;
Swaps the bytes of 32-bit writes to AES_CTR, AES_WRFIFO, AES_KEY*FIFO according to specified endianness. AES_MAC?&lt;br /&gt;
&lt;br /&gt;
=== AES_CNT.output_endianness ===&lt;br /&gt;
&lt;br /&gt;
Swaps the bytes of 32-bit reads from AES_RDFIFO.&lt;br /&gt;
&lt;br /&gt;
=== AES_CNT.input_word_order ===&lt;br /&gt;
&lt;br /&gt;
If reversed, writes to AES_KEY*FIFO and AES_WRFIFO fill the FIFO backwards. For AES_WRFIFO, this means that every 16-byte block will have its words in the reverse order, but the order of these blocks remains the same. AES_CNT is unaffected by this field. AES_MAC?&lt;br /&gt;
&lt;br /&gt;
=== AES_CNT.output_word_order ===&lt;br /&gt;
&lt;br /&gt;
If reversed, reads from AES_RDFIFO will drain the FIFO backwards. This means that every 16-byte output block will have its words in the reverse order, but the order of these blocks remains the same.&lt;br /&gt;
&lt;br /&gt;
== CCM mode pitfall ==&lt;br /&gt;
Non-standard AES-CCM behaviour is observed on [[APT:Wrap|Wrap]]/[[APT:Unwrap|Unwrap]] function. According to [https://tools.ietf.org/html/rfc3610 RFC 3610], the first block B_0 for authentication should be generated from the message length and some other parameters. Using these function, it seems that the message length is aligned up to 16 when generating B_0. This makes the generated MAC not compliant with the standard when (inputsize-noncesize)%16!=0. It is very likely that this non-standard behaviour happens on the hardware level, but not confirmed yet.&lt;br /&gt;
&lt;br /&gt;
== Keyslot ranges ==&lt;br /&gt;
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Keyslot&lt;br /&gt;
!  Name&lt;br /&gt;
!  KeyX&lt;br /&gt;
!  KeyY/Normal-key&lt;br /&gt;
!  Console unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x00-0x03&lt;br /&gt;
| TWL keys.&lt;br /&gt;
| Probably unset.&lt;br /&gt;
| Probably unset.&lt;br /&gt;
| -&lt;br /&gt;
|-&lt;br /&gt;
| 0x04-0x07&lt;br /&gt;
| NAND partition keys.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Different for all.&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x08-0x0B&lt;br /&gt;
| See below.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Different for all.&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x0C-0x0F&lt;br /&gt;
| SSL cert key.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyXs are console-unique, however the normalkeys setup by Boot9 later during keyinit are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x10-0x17&lt;br /&gt;
| -&lt;br /&gt;
| Set for all except 0x11..0x13. Keydata is different for these.&lt;br /&gt;
| Normalkey, same for all except the last 4 are all different.&lt;br /&gt;
| -&lt;br /&gt;
|-&lt;br /&gt;
| 0x18-0x1B&lt;br /&gt;
| Never used.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyXs are console-unique, however the normalkeys setup by Boot9 later during keyinit are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x1C-0x1F&lt;br /&gt;
| Never used.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyXs are console-unique, however the normalkeys setup by Boot9 later during keyinit are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x20-0x23&lt;br /&gt;
| Never used.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyXs are console-unique, however the normalkeys setup by Boot9 later during keyinit are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x24&lt;br /&gt;
| Never used.&lt;br /&gt;
| Individually set.&lt;br /&gt;
| Individually set, normalkey-only.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyX is console-unique, however the normalkey setup by Boot9 later during keyinit is not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x25-0x27&lt;br /&gt;
| -&lt;br /&gt;
| Not set.&lt;br /&gt;
| Same for all, normalkeys-only. Same keydata as keyslot 0x24.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x28-0x2B&lt;br /&gt;
| Never used.&lt;br /&gt;
| Individually set.&lt;br /&gt;
| Individually set, normalkeys-only. Keyslot 0x28 has same normalkey as keyslot 0x24.&lt;br /&gt;
| style=&amp;quot;background: orange&amp;quot; | The keyX is console-unique, however the normalkey setup by Boot9 later during keyinit is not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x2C-0x2F&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x30-0x33&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x34-0x37&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x38-0x3B&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Same for all.&lt;br /&gt;
| Same for all, normalkeys-only.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|-&lt;br /&gt;
| 0x3C-0x3F&lt;br /&gt;
| Various uniques.&lt;br /&gt;
| Individually set.&lt;br /&gt;
| Individually set, normalkeys-only. Keyslot 0x3C has same normalkey as 0x38-0x3B.&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX&#039;s. This suggests they were set to same normal-key by bootrom.&lt;br /&gt;
&lt;br /&gt;
== Keyslots ==&lt;br /&gt;
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key generator instead (see [[#Hardware_key_generator|below]]). There is no way to read the contents of a keyslot.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Keyslot&lt;br /&gt;
!  Description&lt;br /&gt;
!  KeyX set by&lt;br /&gt;
!  KeyY set by&lt;br /&gt;
!  Normal-key&lt;br /&gt;
!  Old3DS&lt;br /&gt;
|-&lt;br /&gt;
| 0x00-0x03&lt;br /&gt;
| TWL keys.&lt;br /&gt;
| NATIVE_FIRM hard-boot.&lt;br /&gt;
| NATIVE_FIRM hard-boot.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x04..0x07&lt;br /&gt;
| [[Flash_Filesystem|NAND]] partition keys.&lt;br /&gt;
&lt;br /&gt;
Keyslot is determined by [[NCSD]] partition FS type and encryption type. &lt;br /&gt;
The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data. Its keyX is console-unique and set by the bootloader.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x0A&lt;br /&gt;
| DSiWare export key.&lt;br /&gt;
&lt;br /&gt;
Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.&lt;br /&gt;
| See above keyslot info.&lt;br /&gt;
| See above keyslot info.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x0B&lt;br /&gt;
| This is console-unique. This keyslot is used for the NAND [[Title_Database|dbs]] images AES-CMACs, and the [[Nand/private/movable.sed]] AES-CMAC(when used).&lt;br /&gt;
| See above keyslot info.&lt;br /&gt;
| See above keyslot info.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x0D&lt;br /&gt;
| SSL-certificate key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| -&lt;br /&gt;
| -&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x11&lt;br /&gt;
| Temporary keyslot.&lt;br /&gt;
&lt;br /&gt;
Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.&lt;br /&gt;
| Arm9Loader. &lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x14&lt;br /&gt;
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots&#039; keyYs from [[PSPXI:EncryptDecryptAes|here]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM boot.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x15&lt;br /&gt;
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| See previous info for this keyslot.&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x16&lt;br /&gt;
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| See previous info for this keyslot.&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x18..0x1F&lt;br /&gt;
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.6.0-24|9.6.0-X]] keyslots 0x1C..0x1F are not yet used by Process9.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM / see previous info for these keyslots.&lt;br /&gt;
| See previous info for these keyslots.&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| New3DS [[9.3.0-21|9.3.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0A.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM&lt;br /&gt;
| -&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x19&lt;br /&gt;
| New3DS gamecard [[Savegames|savedata]] AES-CMAC key.&lt;br /&gt;
&lt;br /&gt;
Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM&lt;br /&gt;
| -&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x1A&lt;br /&gt;
| New3DS gamecard [[Savegames|savedata]] actual key.&lt;br /&gt;
&lt;br /&gt;
Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM&lt;br /&gt;
| -&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x1B&lt;br /&gt;
| New3DS [[9.6.0-24|9.6.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0B.&lt;br /&gt;
| Arm9Loader.&lt;br /&gt;
| NATIVE_FIRM&lt;br /&gt;
| -&lt;br /&gt;
| No&lt;br /&gt;
|-&lt;br /&gt;
| 0x24&lt;br /&gt;
| AGB_FIRM savegame AES-CMAC key.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| AGB/NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x25&lt;br /&gt;
| [[7.0.0-13|v7.0]] [[NCCH]] key, when ncchflag[3] is 0x01.&lt;br /&gt;
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x2C&lt;br /&gt;
| Original [[NCCH|NCCH]] key, when ncchflag[3] is 0x00 and always for certain NCCH sections.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Process9.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x2D&lt;br /&gt;
| UDS local-WLAN CCMP key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x2E&lt;br /&gt;
| Streetpass key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x2F&lt;br /&gt;
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| SD/NAND AES-CMAC key.&lt;br /&gt;
&lt;br /&gt;
This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AES-CMACs under SD [[SD_Filesystem|/Nintendo 3DS/&amp;lt;ID0&amp;gt;/&amp;lt;ID1&amp;gt;/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x31&lt;br /&gt;
| APT wrap key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x32&lt;br /&gt;
| Unknown.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x33&lt;br /&gt;
| Gamecard [[Savegames|savedata]] AES-CMAC.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x34&lt;br /&gt;
| SD key.&lt;br /&gt;
&lt;br /&gt;
This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/&amp;lt;ID0&amp;gt;/&amp;lt;ID1&amp;gt;/]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x35&lt;br /&gt;
| Movable.sed key.&lt;br /&gt;
&lt;br /&gt;
This is the keyslot used for movable.sed encryption + AES-CBC MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x36&lt;br /&gt;
| Unknown. Used by friends module.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x37&lt;br /&gt;
| Gamecard [[Savegames|savedata]] actual key.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x38&lt;br /&gt;
| BOSS key.&lt;br /&gt;
&lt;br /&gt;
See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x39&lt;br /&gt;
| Download Play key, and the actual NFC key for generating retail [[Amiibo]] keys.&lt;br /&gt;
&lt;br /&gt;
This keyslot is used for two different keys. Both are available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x3A&lt;br /&gt;
| DSiWare export key.&lt;br /&gt;
&lt;br /&gt;
This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AES-CMACs for SD [[DSiWare_Exports]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x3B&lt;br /&gt;
| [[CTRCARD_Registers#CTRCARD_SECSEED|CTR-CARD hardware-crypto seed]] decryption key.&lt;br /&gt;
&lt;br /&gt;
AES-CCM is used, the keyY, nonce and MAC are stored in the [[NCSD#Card_Info_Header|Card Info Header]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x3D&lt;br /&gt;
| Common key.&lt;br /&gt;
&lt;br /&gt;
Used to decrypt title keys in [[Ticket]].&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| NATIVE_FIRM.&lt;br /&gt;
| -&lt;br /&gt;
| Yes&lt;br /&gt;
|-&lt;br /&gt;
| 0x3F&lt;br /&gt;
| Used for various internal Boot9 crypto operations, different keydata for each one. Used to decrypt the [[OTP_Registers|OTP]], the FIRM sections when [[Bootloader#Non-NAND_FIRM_boot|booting from non-NAND]], and when generating the console-unique keys.&lt;br /&gt;
&lt;br /&gt;
The keydata for this keyslot is overwritten with other keydata before booting FIRM. This keyslot is not known to be used post-Boot9.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Bootrom.&lt;br /&gt;
| Yes&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Updating keydata ===&lt;br /&gt;
The contents of the keyslot specified in AES_KEYCNT can be updated by consecutively writing four words to AES_KEYXFIFO (keyX), AES_KEYYFIFO(keyY), or AES_KEYFIFO (normalkey).&lt;br /&gt;
&lt;br /&gt;
After writing to a keyslot, the keyslot must be selected again(write AES_KEYSEL + set AES_CNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.&lt;br /&gt;
&lt;br /&gt;
Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval&amp;lt;&amp;lt;8) | (byteval&amp;lt;&amp;lt;16) | (byteval&amp;lt;&amp;lt;24). The result is the same regardless of which FIFO register byte was written to.&lt;br /&gt;
&lt;br /&gt;
The TWL keyslots 0x00-0x03 can be set directly by writing to the AES_KEY0-AES_KEY3 registers.&lt;br /&gt;
&lt;br /&gt;
The key FIFOs can be written simultaneously. For example, executing the following will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);&lt;br /&gt;
&lt;br /&gt;
Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by AES_KEYCNT at the time the last word was written.&lt;br /&gt;
&lt;br /&gt;
=== Hardware key generator ===&lt;br /&gt;
A dedicated hardware key generator can be used to generate a keyslot&#039;s normal-key from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots.&lt;br /&gt;
&lt;br /&gt;
The algorithm for generating the normal-key from keyX and keyY is as follows, in big-endian 128-bit unsigned wraparound arithmetic:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Mode&lt;br /&gt;
! Formula&lt;br /&gt;
|-&lt;br /&gt;
| 3DS&lt;br /&gt;
| NormalKey = (((KeyX ROL 2) XOR KeyY) + C1) ROR 41&lt;br /&gt;
|-&lt;br /&gt;
| DSi&lt;br /&gt;
| NormalKey = ((KeyX XOR KeyY) + C2) ROL 42&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Unless noted otherwise, all keyslots on retail units use the hardware key generator.&lt;br /&gt;
&lt;br /&gt;
=== FIRM-launch key clearing ===&lt;br /&gt;
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now &amp;quot;clears&amp;quot; the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.&lt;br /&gt;
&lt;br /&gt;
=== AES key-init ===&lt;br /&gt;
See [[Bootloader|here]] for how Boot9 initializes the AES keyslots.&lt;br /&gt;
&lt;br /&gt;
For an issue with console-unique key-init, see [[OTP_Registers|here]].&lt;br /&gt;
&lt;br /&gt;
Some of the Boot9 key-init appears to have a bug(?) when initializing a chunk of keyslots at once: normally it does &amp;lt;code&amp;gt;for(i=0; i&amp;lt;4; i++){... &amp;lt;setup_keyslot_keydata(keyslotbase+i, keydata)&amp;gt; ...}&amp;lt;/code&amp;gt;, however in some cases it does that except with &amp;lt;code&amp;gt;(keyslotbase,&amp;lt;/code&amp;gt; instead. This results in the keyslot specified by keyslotbase being initialized 4 times in a row, with the remaining 3 keyslots following keyslotbase being left uninitialized.&lt;br /&gt;
&lt;br /&gt;
initialize_aeskeys() works as follows:&lt;br /&gt;
* Validates input, calls panic() on failure. conunique_dataptr and bootrom_dataptr are both input parameters for initialize_aeskeys().&lt;br /&gt;
* Calls crypto_initialize().&lt;br /&gt;
* Then it &#039;&#039;basically&#039;&#039;: copies 0x1C-bytes from conunique_dataptr to tmpbuf+0(sp+12), and copies data from bootrom_dataptr with size 0x40-0x1C to tmpbuf+0x1C(conunique_dataptr and bootrom_dataptr are updated afterwards).&lt;br /&gt;
* The 0x40-byte tmpbuf is hashed with SHA256.&lt;br /&gt;
* Keyslot 0x3F is then initialized using the above hash: keyX = first 0x10-bytes of the hash, keyY = last 0x10-bytes of the hash.&lt;br /&gt;
* Then with each console-unique key-init code-block: IV is loaded from bootrom_dataptr(which is updated afterwards), then the 0x40-bytes from bootrom_dataptr is encrypted with AES-CBC. The output is then used as 4 keyXs for initializing keyslots. How bootrom_dataptr is updated if at all varies per code-block. Hashing similar to the code at the start of this function is also run(when the remaining size for conunique_dataptr is non-zero), but the output hash isn&#039;t used(this code is also slightly different for one code-block).&lt;br /&gt;
* Once finished with that, the non-console-unique keyslots are initialized. This is done with keydata loaded directly from bootrom_dataptr.&lt;br /&gt;
* The last initialized keyslot is 0x3F, via normalkey. The keydata for this is copied to 0xFFF00618. This is for restoring the keydata when non-NAND FIRM boot &#039;&#039;fails&#039;&#039;, since those use keyslot 0x3F with other keydata.&lt;br /&gt;
* Lastly it clears the 0x40-bytes at tmpbuf with the u32 loaded from bootrom_dataptr(the word following the above keyslot 0x3F keydata), then returns.&lt;br /&gt;
&lt;br /&gt;
The keyslots are initialized with the same order of keyslots+keydata_type listed below:&lt;br /&gt;
&lt;br /&gt;
Console-unique keydata, after the initialization for the key-generation keyslot(0x3F):&lt;br /&gt;
  0x04..0x07 keyX&lt;br /&gt;
  0x08..0x0B keyX&lt;br /&gt;
  0x0C..0x0F keyX&lt;br /&gt;
  0x10       keyX&lt;br /&gt;
  0x14..0x17 keyX&lt;br /&gt;
  0x18..0x1B keyX&lt;br /&gt;
  0x1C..0x1F keyX&lt;br /&gt;
  0x20..0x23 keyX&lt;br /&gt;
  0x24       keyX&lt;br /&gt;
  0x28..0x2B keyX&lt;br /&gt;
&lt;br /&gt;
Common keydata:&lt;br /&gt;
&lt;br /&gt;
  0x2C..0x2F keyX&lt;br /&gt;
  0x30..0x33 keyX&lt;br /&gt;
  0x34..0x37 keyX&lt;br /&gt;
  0x38..0x3B keyX&lt;br /&gt;
  0x3C..0x3F keyX&lt;br /&gt;
  0x04..0x0B keyY&lt;br /&gt;
  0x0C..0x0F normalkey&lt;br /&gt;
  0x10..0x13 normalkey&lt;br /&gt;
  0x14..0x17 normalkey&lt;br /&gt;
  0x18..0x1B normalkey&lt;br /&gt;
  0x1C..0x1F normalkey&lt;br /&gt;
  0x20..0x23 normalkey&lt;br /&gt;
  0x24..0x27 normalkey&lt;br /&gt;
  0x28..0x2B normalkey&lt;br /&gt;
  0x2C..0x2F normalkey&lt;br /&gt;
  0x30..0x33 normalkey&lt;br /&gt;
  0x34..0x37 normalkey&lt;br /&gt;
  0x38..0x3B normalkey&lt;br /&gt;
  0x3C..0x3F normalkey&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Codec_Services&amp;diff=21025</id>
		<title>Codec Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Codec_Services&amp;diff=21025"/>
		<updated>2019-07-19T05:19:47Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* Legacy Codec &amp;quot;cdc:LGY&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=HID Codec &amp;quot;cdc:HID&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010042&lt;br /&gt;
| [[Cdc:HID:GetData|GetData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030000&lt;br /&gt;
| Finalize&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Touchscreen ==&lt;br /&gt;
The touchscreen is the SPI [[SPI_Registers#SPI_NEW_CNT|device number 3]], so it uses the [[SPI_Services|0x10142XXX]] SPI registers. It is initialized by issuing the following SPI commands:&lt;br /&gt;
 spi_select_reg(3, 0x67);&lt;br /&gt;
 spi_offset_mask(3, 0x26, 0x80, 0x80);&lt;br /&gt;
 spi_select_reg(3, 0x67);&lt;br /&gt;
 spi_offset_mask(3, 0x24, 0, 0x80);&lt;br /&gt;
 spi_select_reg(3, 0x67);&lt;br /&gt;
 spi_offset_mask(3, 0x25, 0x10, 0x3C);&lt;br /&gt;
&lt;br /&gt;
Once the touchscreen is initialized, you can start polling touch data:&lt;br /&gt;
 u8 raw_touchdata[0x40];&lt;br /&gt;
 spi_select_reg(3, 0x67);&lt;br /&gt;
 spi_read_offset(3, 0x26); //The return value of this is checked against &amp;quot;&amp;amp; 2&amp;quot;&lt;br /&gt;
 spi_select_reg(3, 0xFB);&lt;br /&gt;
 spi_read_offset_array(3, 1, raw_touchdata, 0x34);&lt;br /&gt;
&lt;br /&gt;
This is the format of the touchdata report:&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Width&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00&lt;br /&gt;
| 2*5&lt;br /&gt;
| Five Touchscreen X Coordinates (big-endian MSB,LSB each. 12 bits number)&lt;br /&gt;
|-&lt;br /&gt;
| 0x0A&lt;br /&gt;
| 2*5&lt;br /&gt;
| Five Touchscreen Y Coordinates (big-endian MSB,LSB each. 12 bits number)&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| ??&lt;br /&gt;
| ??&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the touchscreen is not touched, all the coordinates report 0xFFFF, and since touch coordinates have only 12 bits, you can check if the touchscreen is pressed by checking the 4th bit of the MSB. For example: pendown = !(raw_touchdata[0] &amp;amp; BIT(4))&lt;br /&gt;
&lt;br /&gt;
=MIC Codec &amp;quot;cdc:MIC&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010040&lt;br /&gt;
| SetGain&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020080&lt;br /&gt;
| GetGain&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| SetPower&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040080&lt;br /&gt;
| GetPower&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050042&lt;br /&gt;
| SetIirFilterMic&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=CSN Codec &amp;quot;cdc:CSN&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040080&lt;br /&gt;
| ? &lt;br /&gt;
|-&lt;br /&gt;
| 0x00050040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00060080&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080080&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090040&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=DSP Codec &amp;quot;cdc:DSP&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040042&lt;br /&gt;
| ? &lt;br /&gt;
|-&lt;br /&gt;
| 0x000500C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00060080&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080040&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Legacy Codec &amp;quot;cdc:LGY&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010040&lt;br /&gt;
| Powers on microphone ADC and clears bank3:idx3, then clears bank0xFF:idx5&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020040&lt;br /&gt;
| Sets unknown CONFIG11 CODEC bits, writes 0x40 to bank0x67:idx0x25&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| Modifies bit5 in bank0x65:idx0x33&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=CHK Codec &amp;quot;cdc:CHK&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C0&lt;br /&gt;
| rowspan=2 | [[CDCCHK:ReadSPI|ReadSPI]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000200C0&lt;br /&gt;
|-&lt;br /&gt;
| 0x000300C2&lt;br /&gt;
| rowspan=2 | [[CDCCHK:WriteSPI|WriteSPI]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000400C2&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=RSA_Registers&amp;diff=20913</id>
		<title>RSA Registers</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=RSA_Registers&amp;diff=20913"/>
		<updated>2019-04-08T01:08:19Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Overview =&lt;br /&gt;
&lt;br /&gt;
The RSA module is essentially a hardware-accelerated modular exponentiation engine. It is specially optimized for RSA applications, so its behavior can be incoherent when RSA&#039;s invariants are broken.&lt;br /&gt;
&lt;br /&gt;
=== Observed edge cases ===&lt;br /&gt;
* if 2 divides mod, output == 0&lt;br /&gt;
&lt;br /&gt;
= Registers =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Old3DS&lt;br /&gt;
!  Name&lt;br /&gt;
!  Address&lt;br /&gt;
!  Width&lt;br /&gt;
!  Used by&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_CNT|RSA_CNT]]&lt;br /&gt;
| 0x1000B000&lt;br /&gt;
| 0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| RSA_?&lt;br /&gt;
| 0x1000B0F0&lt;br /&gt;
| 0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_SLOT|RSA_SLOT]]0&lt;br /&gt;
| 0x1000B100&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_SLOT|RSA_SLOT]]1&lt;br /&gt;
| 0x1000B110&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_SLOT|RSA_SLOT]]2&lt;br /&gt;
| 0x1000B120&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_SLOT|RSA_SLOT]]3&lt;br /&gt;
| 0x1000B130&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_EXPFIFO|RSA_EXPFIFO]]&lt;br /&gt;
| 0x1000B200&lt;br /&gt;
| 0x100 (can handle u32 writes to any aligned position in the FIFO)&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_MOD|RSA_MOD]]&lt;br /&gt;
| 0x1000B400&lt;br /&gt;
| 0x100&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_TXT|RSA_TXT]]&lt;br /&gt;
| 0x1000B800&lt;br /&gt;
| 0x100&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== RSA_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Start (1=Enable/Busy, 0=Idle)&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 4-7&lt;br /&gt;
| Keyslot (Bit6-7 don&#039;t actually affect the keyslot)&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| Endianness (1=Little endian, 0=Big endian). Affects RSA_EXPFIFO, RSA_MOD, and RSA_TXT.&lt;br /&gt;
|-&lt;br /&gt;
| 9&lt;br /&gt;
| Word order (1=Normal order, 0=Reversed order). Affects RSA_MOD and RSA_TXT.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== RSA_SLOT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Width&lt;br /&gt;
|-&lt;br /&gt;
| [[#RSA_SLOTCNT|RSA_SLOTCNT]]&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x4&lt;br /&gt;
|-&lt;br /&gt;
| [[#RSA_SLOTSIZE|RSA_SLOTSIZE]]&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x4&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x4&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0xC&lt;br /&gt;
| 0x4&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== RSA_SLOTCNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bits&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Key status (1=Key has been set, 0=Key has not been set yet)&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Key write-protect, this bit is RW. (0 = no protection, 1 = protected)&lt;br /&gt;
|-&lt;br /&gt;
| 30-2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 31&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Before writing RSA_EXPFIFO/RSA_MOD, bit0 here should be cleared when bit31 is already clear. Otherwise, the ARM9 will hang when attempting to write to RSA_EXPFIFO.&lt;br /&gt;
&lt;br /&gt;
== RSA_SLOTSIZE ==&lt;br /&gt;
This contains the RSA size for this slot, in words. Normally this is 0x40 for RSA-2048.&lt;br /&gt;
&lt;br /&gt;
== RSA_EXPFIFO ==&lt;br /&gt;
The 0x100-byte private or public exponent is written to this write-only FIFO.&lt;br /&gt;
&lt;br /&gt;
== RSA_MOD ==&lt;br /&gt;
The RSA key modulus for the selected keyslot can be written here. When writing the RSA modulus, the modulus must align with the end of the register area.&lt;br /&gt;
&lt;br /&gt;
Writing to RSA_MOD does not change the exponent written with RSA_EXPFIFO.  An attack based on the [[wikipedia:Pohlig-Hellman algorithm|Pohlig-Hellman algorithm]] exists to &amp;quot;read&amp;quot; the contents of RSA_EXPFIFO as a result (see [[3DS System Flaws#Hardware|3DS System Flaws]]).&lt;br /&gt;
&lt;br /&gt;
== RSA_TXT ==&lt;br /&gt;
The RSA signature can be written here, and the data read from here is the message. When writing the RSA signature, the signature must be prepended with zeroes until it is a multiple of 8 bytes, and the end of the signature must align with the end of the register area.&lt;br /&gt;
&lt;br /&gt;
The PKCS message padding must be manually checked by software, as hardware will only do raw RSA operations.&lt;br /&gt;
&lt;br /&gt;
== Keyslots usage ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Keyslot&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Arbitrary&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| [[NCCH#CXI|CXI]] access desc (following the exheader)&lt;br /&gt;
|-&lt;br /&gt;
| 2-3&lt;br /&gt;
| Initialized by the ARM9 bootrom, but not used by any of the [[FIRM]]s. It&#039;s unknown what the ARM9 bootrom uses these for, if anything.&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=RSA_Registers&amp;diff=20887</id>
		<title>RSA Registers</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=RSA_Registers&amp;diff=20887"/>
		<updated>2019-02-03T06:56:52Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Clarifications and edge cases&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Overview =&lt;br /&gt;
&lt;br /&gt;
The RSA module is essentially a hardware-accelerated modular exponentiation engine. It is specially optimized for RSA applications, so its behavior can be incoherent when RSA&#039;s invariants are broken.&lt;br /&gt;
&lt;br /&gt;
=== Observed edge cases ===&lt;br /&gt;
* if 2 divides mod, output == 0&lt;br /&gt;
&lt;br /&gt;
= Registers =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Old3DS&lt;br /&gt;
!  Name&lt;br /&gt;
!  Address&lt;br /&gt;
!  Width&lt;br /&gt;
!  Used by&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_CNT|RSA_CNT]]&lt;br /&gt;
| 0x1000B000&lt;br /&gt;
| 0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| RSA_?&lt;br /&gt;
| 0x1000B0F0&lt;br /&gt;
| 0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_SLOT|RSA_SLOT]]0&lt;br /&gt;
| 0x1000B100&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_SLOT|RSA_SLOT]]1&lt;br /&gt;
| 0x1000B110&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_SLOT|RSA_SLOT]]2&lt;br /&gt;
| 0x1000B120&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_SLOT|RSA_SLOT]]3&lt;br /&gt;
| 0x1000B130&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_EXPFIFO|RSA_EXPFIFO]]&lt;br /&gt;
| 0x1000B200&lt;br /&gt;
| 0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_MOD|RSA_MOD]]&lt;br /&gt;
| 0x1000B400&lt;br /&gt;
| 0x100&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#RSA_TXT|RSA_TXT]]&lt;br /&gt;
| 0x1000B800&lt;br /&gt;
| 0x100&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== RSA_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Start (1=Enable/Busy, 0=Idle)&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 4-7&lt;br /&gt;
| Keyslot (Bit6-7 don&#039;t actually affect the keyslot)&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| Endianness (1=Little endian, 0=Big endian). Affects RSA_EXPFIFO, RSA_MOD, and RSA_TXT.&lt;br /&gt;
|-&lt;br /&gt;
| 9&lt;br /&gt;
| Word order (1=Normal order, 0=Reversed order). Affects RSA_MOD and RSA_TXT.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== RSA_SLOT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Width&lt;br /&gt;
|-&lt;br /&gt;
| [[#RSA_SLOTCNT|RSA_SLOTCNT]]&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x4&lt;br /&gt;
|-&lt;br /&gt;
| [[#RSA_SLOTSIZE|RSA_SLOTSIZE]]&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x4&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x4&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0xC&lt;br /&gt;
| 0x4&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== RSA_SLOTCNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bits&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Key status (1=Key has been set, 0=Key has not been set yet)&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Key write-protect, this bit is RW. (0 = no protection, 1 = protected)&lt;br /&gt;
|-&lt;br /&gt;
| 30-2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 31&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Before writing RSA_EXPFIFO/RSA_MOD, bit0 here should be cleared when bit31 is already clear. Otherwise, the ARM9 will hang when attempting to write to RSA_EXPFIFO.&lt;br /&gt;
&lt;br /&gt;
== RSA_SLOTSIZE ==&lt;br /&gt;
This contains the RSA size for this slot, in words. Normally this is 0x40 for RSA-2048.&lt;br /&gt;
&lt;br /&gt;
== RSA_EXPFIFO ==&lt;br /&gt;
The 0x100-byte private or public exponent is written to this write-only FIFO.&lt;br /&gt;
&lt;br /&gt;
== RSA_MOD ==&lt;br /&gt;
The RSA key modulus for the selected keyslot can be written here. When writing the RSA modulus, the modulus must align with the end of the register area.&lt;br /&gt;
&lt;br /&gt;
Writing to RSA_MOD does not change the exponent written with RSA_EXPFIFO.  An attack based on the [[wikipedia:Pohlig-Hellman algorithm|Pohlig-Hellman algorithm]] exists to &amp;quot;read&amp;quot; the contents of RSA_EXPFIFO as a result (see [[3DS System Flaws#Hardware|3DS System Flaws]]).&lt;br /&gt;
&lt;br /&gt;
== RSA_TXT ==&lt;br /&gt;
The RSA signature can be written here, and the data read from here is the message. When writing the RSA signature, the signature must be prepended with zeroes until it is a multiple of 8 bytes, and the end of the signature must align with the end of the register area.&lt;br /&gt;
&lt;br /&gt;
The PKCS message padding must be manually checked by software, as hardware will only do raw RSA operations.&lt;br /&gt;
&lt;br /&gt;
== Keyslots usage ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Keyslot&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Arbitrary&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| [[NCCH#CXI|CXI]] access desc (following the exheader)&lt;br /&gt;
|-&lt;br /&gt;
| 2-3&lt;br /&gt;
| Initialized by the ARM9 bootrom, but not used by any of the [[FIRM]]s. It&#039;s unknown what the ARM9 bootrom uses these for, if anything.&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Codec_Services&amp;diff=20578</id>
		<title>Codec Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Codec_Services&amp;diff=20578"/>
		<updated>2018-01-23T23:55:20Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Fill in CDC:MIC commands from MIC:U&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=HID Codec &amp;quot;cdc:HID&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010042&lt;br /&gt;
| [[Cdc:HID:GetData|GetData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030000&lt;br /&gt;
| Finalize&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Touchscreen ==&lt;br /&gt;
The touchscreen is the SPI [[SPI_Registers#SPI_NEW_CNT|device number 3]], so it uses the [[SPI_Services|0x10142XXX]] SPI registers. It is initialized by issuing the following SPI commands:&lt;br /&gt;
 spi_select_reg(3, 0x67);&lt;br /&gt;
 spi_offset_mask(3, 0x26, 0x80, 0x80);&lt;br /&gt;
 spi_select_reg(3, 0x67);&lt;br /&gt;
 spi_offset_mask(3, 0x24, 0, 0x80);&lt;br /&gt;
 spi_select_reg(3, 0x67);&lt;br /&gt;
 spi_offset_mask(3, 0x25, 0x10, 0x3C);&lt;br /&gt;
&lt;br /&gt;
Once the touchscreen is initialized, you can start polling touch data:&lt;br /&gt;
 u8 raw_touchdata[0x40];&lt;br /&gt;
 spi_select_reg(3, 0x67);&lt;br /&gt;
 spi_read_offset(3, 0x26); //The return value of this is checked against &amp;quot;&amp;amp; 2&amp;quot;&lt;br /&gt;
 spi_select_reg(3, 0xFB);&lt;br /&gt;
 spi_read_offset_array(3, 1, raw_touchdata, 0x34);&lt;br /&gt;
&lt;br /&gt;
This is the format of the touchdata report:&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Width&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00&lt;br /&gt;
| 2*5&lt;br /&gt;
| Five Touchscreen X Coordinates (big-endian MSB,LSB each. 12 bits number)&lt;br /&gt;
|-&lt;br /&gt;
| 0x0A&lt;br /&gt;
| 2*5&lt;br /&gt;
| Five Touchscreen Y Coordinates (big-endian MSB,LSB each. 12 bits number)&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| ??&lt;br /&gt;
| ??&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the touchscreen is not touched, all the coordinates report 0xFFFF, and since touch coordinates have only 12 bits, you can check if the touchscreen is pressed by checking the 4th bit of the MSB. For example: pendown = !(raw_touchdata[0] &amp;amp; BIT(4))&lt;br /&gt;
&lt;br /&gt;
=MIC Codec &amp;quot;cdc:MIC&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010040&lt;br /&gt;
| SetGain&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020080&lt;br /&gt;
| GetGain&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| SetPower&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040080&lt;br /&gt;
| GetPower&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050042&lt;br /&gt;
| SetIirFilterMic&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=CSN Codec &amp;quot;cdc:CSN&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040080&lt;br /&gt;
| ? &lt;br /&gt;
|-&lt;br /&gt;
| 0x00050040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00060080&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080080&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090040&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=DSP Codec &amp;quot;cdc:DSP&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040042&lt;br /&gt;
| ? &lt;br /&gt;
|-&lt;br /&gt;
| 0x000500C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00060080&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080040&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Legacy Codec &amp;quot;cdc:LGY&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=CHK Codec &amp;quot;cdc:CHK&amp;quot;=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C0&lt;br /&gt;
| rowspan=2 | [[CDCCHK:ReadSPI|ReadSPI]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000200C0&lt;br /&gt;
|-&lt;br /&gt;
| 0x000300C2&lt;br /&gt;
| rowspan=2 | [[CDCCHK:WriteSPI|WriteSPI]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000400C2&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=MIC_Registers&amp;diff=20577</id>
		<title>MIC Registers</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=MIC_Registers&amp;diff=20577"/>
		<updated>2018-01-23T23:43:32Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Add REG_MIC_CNT Sampling Rate bits&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Registers ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  NAME&lt;br /&gt;
!  PHYSICAL ADDRESS&lt;br /&gt;
!  PROCESS VIRTUAL ADDRESS&lt;br /&gt;
!  WIDTH&lt;br /&gt;
|-&lt;br /&gt;
| [[#REG_MIC_CNT|REG_MIC_CNT]]&lt;br /&gt;
| 0x10162000&lt;br /&gt;
| 0x1EC62000&lt;br /&gt;
| 0x2&lt;br /&gt;
|-&lt;br /&gt;
| REG_MIC_DATA&lt;br /&gt;
| 0x10162004&lt;br /&gt;
| 0x1EC62004&lt;br /&gt;
| 0x4&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
These are the registers for the microphone hardware, see [[MIC_Services|here]] also.&lt;br /&gt;
&lt;br /&gt;
REG_MIC_DATA contains the current audio data from the microphone.&lt;br /&gt;
&lt;br /&gt;
== REG_MIC_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Bit&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 3-2&lt;br /&gt;
| [[MIC_Services#SampleRate|Sampling rate]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17707</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17707"/>
		<updated>2016-07-16T22:48:58Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
&lt;br /&gt;
Streetpass stuff.&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| OpenMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ReadRawMessageFile&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| WriteMessageToMailbox (16*length+10 of CecMessageId buffer in cmdbuff[9] (always 16*8+10), CecMessageId* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| DeleteMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessageId buffer in cmdbuff[4] (always 16*8+10), CecMessageId* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| GetSystemInfo&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| RunCommand&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| RunCommandAlt (seems to be the same as RunCommand besides some extra checks)&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:OpenAndRead|OpenAndRead]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecDataPathType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_LIST || 1&lt;br /&gt;
| data:/CEC/MBoxList____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_INFO || 2&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxInfo____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_INFO || 3&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INFO  || 4&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INDEX  || 5&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/OBIndex_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_MSG  || 6&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_MSG  || 7&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_ROOT_DIR  || 10&lt;br /&gt;
| data:/CEC&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_DIR  || 11&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_DIR  || 12&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_DIR  || 13&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__&lt;br /&gt;
|-&lt;br /&gt;
| || 101 thru 199 (inclusive)&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxData.0&amp;lt;i-100&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_INACTIVE&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageId ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17706</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17706"/>
		<updated>2016-07-16T22:39:17Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
&lt;br /&gt;
Streetpass stuff.&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| OpenMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ReadRawMessageFile&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| WriteMessageToMailbox (16*length+10 of CecMessageId buffer in cmdbuff[9] (always 16*8+10), CecMessageId* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| DeleteMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessageId buffer in cmdbuff[4] (always 16*8+10), CecMessageId* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| GetSystemInfo&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| RunCommand&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| RunCommandAlt (seems to be the same as RunCommand besides some extra checks)&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:OpenAndRead|OpenAndRead]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecDataPathType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_LIST || 1&lt;br /&gt;
| data:/CEC/MBoxList____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_INFO || 2&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxInfo____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_INFO || 3&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INFO  || 4&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INDEX  || 5&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/OBIndex_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_MSG  || 6&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_MSG  || 7&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_ROOT_DIR  || 10&lt;br /&gt;
| data:/CEC&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_DIR  || 11&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_DIR  || 12&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_DIR  || 13&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__&lt;br /&gt;
|-&lt;br /&gt;
| || 101 thru 199 (inclusive)&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxData.0&amp;lt;i-100&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageId ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17705</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17705"/>
		<updated>2016-07-16T22:33:07Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* CECD Service &amp;quot;cecd:u&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
&lt;br /&gt;
Streetpass stuff.&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| OpenMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ReadRawMessageFile&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| WriteMessageToMailbox (16*length+10 of CecMessageId buffer in cmdbuff[9] (always 16*8+10), CecMessageId* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| DeleteMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessageId buffer in cmdbuff[4] (always 16*8+10), CecMessageId* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| GetSystemInfo&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| RunCommand&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:OpenAndRead|OpenAndRead]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecDataPathType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_LIST || 1&lt;br /&gt;
| data:/CEC/MBoxList____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_INFO || 2&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxInfo____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_INFO || 3&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INFO  || 4&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INDEX  || 5&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/OBIndex_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_MSG  || 6&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_MSG  || 7&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_ROOT_DIR  || 10&lt;br /&gt;
| data:/CEC&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_DIR  || 11&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_DIR  || 12&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_DIR  || 13&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__&lt;br /&gt;
|-&lt;br /&gt;
| || 101 thru 199 (inclusive)&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxData.0&amp;lt;i-100&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageId ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17546</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17546"/>
		<updated>2016-06-17T22:23:36Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* CECD Service &amp;quot;cecd:u&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
&lt;br /&gt;
Streetpass stuff.&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| OpenMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ReadRawMessageFile&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| WriteMessageToMailbox (16*length+10 of CecMessageId buffer in cmdbuff[9] (always 16*8+10), CecMessageId* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| DeleteMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessageId buffer in cmdbuff[4] (always 16*8+10), CecMessageId* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| GetSystemInfo&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:OpenAndRead|OpenAndRead]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecDataPathType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_LIST || 1&lt;br /&gt;
| data:/CEC/MBoxList____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_INFO || 2&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxInfo____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_INFO || 3&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INFO  || 4&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INDEX  || 5&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/OBIndex_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_MSG  || 6&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_MSG  || 7&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_ROOT_DIR  || 10&lt;br /&gt;
| data:/CEC&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_DIR  || 11&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_DIR  || 12&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_DIR  || 13&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__&lt;br /&gt;
|-&lt;br /&gt;
| || 101 thru 199 (inclusive)&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxData.0&amp;lt;i-100&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageId ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17542</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17542"/>
		<updated>2016-06-16T21:45:02Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* CECD Service &amp;quot;cecd:u&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
&lt;br /&gt;
Streetpass stuff.&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| OpenMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ReadRawMessageFile&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| DeleteMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| GetSystemInfo&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:OpenAndRead|OpenAndRead]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecDataPathType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_LIST || 1&lt;br /&gt;
| data:/CEC/MBoxList____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_INFO || 2&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxInfo____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_INFO || 3&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INFO  || 4&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INDEX  || 5&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/OBIndex_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_MSG  || 6&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_MSG  || 7&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_ROOT_DIR  || 10&lt;br /&gt;
| data:/CEC&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_DIR  || 11&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_DIR  || 12&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_DIR  || 13&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__&lt;br /&gt;
|-&lt;br /&gt;
| || 101 thru 199 (inclusive)&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxData.0&amp;lt;i-100&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17541</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17541"/>
		<updated>2016-06-16T20:27:43Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
&lt;br /&gt;
Streetpass stuff.&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| OpenMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| DeleteMailbox&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| GetSystemInfo&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:OpenAndRead|OpenAndRead]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecDataPathType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_LIST || 1&lt;br /&gt;
| data:/CEC/MBoxList____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_INFO || 2&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxInfo____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_INFO || 3&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INFO  || 4&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INDEX  || 5&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/OBIndex_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_MSG  || 6&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_MSG  || 7&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_ROOT_DIR  || 10&lt;br /&gt;
| data:/CEC&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_DIR  || 11&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_DIR  || 12&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_DIR  || 13&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__&lt;br /&gt;
|-&lt;br /&gt;
| || 101 thru 199 (inclusive)&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxData.0&amp;lt;i-100&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17540</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17540"/>
		<updated>2016-06-16T20:06:27Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
&lt;br /&gt;
Streetpass stuff.&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| Open mail box&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| Delete mail box&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:OpenAndRead|OpenAndRead]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecDataPathType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_LIST || 1&lt;br /&gt;
| data:/CEC/MBoxList____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_INFO || 2&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxInfo____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_INFO || 3&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INFO  || 4&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INDEX  || 5&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/OBIndex_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_MSG  || 6&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_MSG  || 7&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_ROOT_DIR  || 10&lt;br /&gt;
| data:/CEC&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_DIR  || 11&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_DIR  || 12&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_DIR  || 13&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__&lt;br /&gt;
|-&lt;br /&gt;
| || 101 thru 199 (inclusive)&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxData.0&amp;lt;i-100&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=17539</id>
		<title>CECDU:OpenAndRead</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=17539"/>
		<updated>2016-06-16T20:05:55Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Request=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code [0x00120104]&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| buffer size (unused)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| NCCH Program ID&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| [[CECD_Services#CecDataPathType|Path type]]&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 0x20&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| (buffer size &amp;lt;&amp;lt; 4) &amp;lt;nowiki&amp;gt;|&amp;lt;/nowiki&amp;gt; 0xC&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| buffer&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Response=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Result code&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Total bytes read&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=17538</id>
		<title>CECDU:OpenAndRead</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=17538"/>
		<updated>2016-06-16T20:05:44Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Request=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code [0x00120104]&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| buffer size (unused)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| NCCH Program ID&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| [[CECD_Services#CecDataPathType|Path type]]&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 0x20&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| (buffer size &amp;lt;&amp;lt; 4) &amp;lt;nowiki&amp;gt;|&amp;lt;/nowiki&amp;gt; 0xC&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| buffer&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Response=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Result code&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Total bytes read&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Notes=&lt;br /&gt;
This reads to the buffer some data stored in &amp;quot;data:/CEC/&amp;lt;file&amp;gt;&amp;quot; (where &amp;quot;data:/&amp;quot; is mapped to the SystemSaveData archive).&lt;br /&gt;
&amp;lt;file&amp;gt; is determined by the &amp;quot;data type&amp;quot; argument.&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECDU:ReadSavedData&amp;diff=17537</id>
		<title>CECDU:ReadSavedData</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECDU:ReadSavedData&amp;diff=17537"/>
		<updated>2016-06-16T20:03:15Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Guiand moved page CECDU:ReadSavedData to CECDU:OpenAndRead&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;#REDIRECT [[CECDU:OpenAndRead]]&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=17536</id>
		<title>CECDU:OpenAndRead</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=17536"/>
		<updated>2016-06-16T20:03:15Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Guiand moved page CECDU:ReadSavedData to CECDU:OpenAndRead&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Request=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code [0x00120104]&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| buffer size (unused)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| NCCH Program ID?&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| data type&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 0x20&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| (buffer size &amp;lt;&amp;lt; 4) &amp;lt;nowiki&amp;gt;|&amp;lt;/nowiki&amp;gt; 0xC&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| buffer&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Response=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Result code&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Total bytes read&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Notes=&lt;br /&gt;
This reads to the buffer some data stored in &amp;quot;data:/CEC/&amp;lt;file&amp;gt;&amp;quot; (where &amp;quot;data:/&amp;quot; is mapped to the SystemSaveData archive).&lt;br /&gt;
&amp;lt;file&amp;gt; is determined by the &amp;quot;data type&amp;quot; argument.&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17535</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=17535"/>
		<updated>2016-06-16T20:00:51Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
&lt;br /&gt;
Streetpass stuff.&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| Open mail box&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020042&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| Delete mail box&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:ReadSavedData|OpenAndRead]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecDataPathType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_LIST || 1&lt;br /&gt;
| data:/CEC/MBoxList____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_INFO || 2&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxInfo____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_INFO || 3&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INFO  || 4&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/BoxInfo_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_INDEX  || 5&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/OBIndex_____&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_MSG  || 6&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_MSG  || 7&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__/_&amp;lt;message_id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_ROOT_DIR  || 10&lt;br /&gt;
| data:/CEC&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_MBOX_DIR  || 11&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_INBOX_DIR  || 12&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/InBox__&lt;br /&gt;
|-&lt;br /&gt;
| CEC_PATH_OUTBOX_DIR  || 13&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/OutBox__&lt;br /&gt;
|-&lt;br /&gt;
| || 101 thru 199 (inclusive)&lt;br /&gt;
| data:/CEC/&amp;lt;id&amp;gt;/MBoxData.0&amp;lt;i-100&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Config_Savegame&amp;diff=17466</id>
		<title>Config Savegame</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Config_Savegame&amp;diff=17466"/>
		<updated>2016-06-04T04:34:19Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.&lt;br /&gt;
&lt;br /&gt;
==Structure of save-file &amp;quot;/config&amp;quot;==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x2&lt;br /&gt;
| Total entries&lt;br /&gt;
|-&lt;br /&gt;
| 0x2&lt;br /&gt;
| 0x2&lt;br /&gt;
| Data entries offset&lt;br /&gt;
|-&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x4558&lt;br /&gt;
| Block entries&lt;br /&gt;
|-&lt;br /&gt;
| 0x455C&lt;br /&gt;
| &lt;br /&gt;
| Data for the entries&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The filesize for this /config file is 0x8000-bytes.&lt;br /&gt;
&lt;br /&gt;
==Configuration block entry ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x4&lt;br /&gt;
| BlkID&lt;br /&gt;
|-&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x4&lt;br /&gt;
| Offset to the data for this block when size is &amp;gt;4, otherwise this word is the data for this block&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x2&lt;br /&gt;
| Size&lt;br /&gt;
|-&lt;br /&gt;
| 0xA&lt;br /&gt;
| 0x2&lt;br /&gt;
| Flags&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==Configuration blocks==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  BlkID&lt;br /&gt;
!  Size&lt;br /&gt;
!  Flags&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00000000&lt;br /&gt;
| 0x2&lt;br /&gt;
| ?&lt;br /&gt;
| Config savegame version?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030001&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0xE&lt;br /&gt;
| ? (read by CECD)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040000&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0x8&lt;br /&gt;
| ? (read by HID)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040001&lt;br /&gt;
| 0x1C&lt;br /&gt;
| 0x8&lt;br /&gt;
| ? (read by HID)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040002&lt;br /&gt;
| 0x12&lt;br /&gt;
| 0x8&lt;br /&gt;
| ? (read by HID)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040003&lt;br /&gt;
| 0xC&lt;br /&gt;
| 0x8&lt;br /&gt;
| ? (read by HID)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050001&lt;br /&gt;
| 0x2&lt;br /&gt;
| 0x8&lt;br /&gt;
| ? (read by GSP)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050002&lt;br /&gt;
| 0x38&lt;br /&gt;
| 0x8&lt;br /&gt;
| ? (read by GSP)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050003&lt;br /&gt;
| 0x20&lt;br /&gt;
| 0x8&lt;br /&gt;
| ? (read by GSP)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050005&lt;br /&gt;
| 0x20&lt;br /&gt;
|?&lt;br /&gt;
| Stereo camera settings?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050006&lt;br /&gt;
| 0x2&lt;br /&gt;
| 0x8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070001&lt;br /&gt;
| 0x1&lt;br /&gt;
|?&lt;br /&gt;
| Sound output mode?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| 0xC00&lt;br /&gt;
| 0x2?&lt;br /&gt;
| WiFi configuration slot 0&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080001&lt;br /&gt;
| 0xC00&lt;br /&gt;
| 0x2?&lt;br /&gt;
| WiFi configuration slot 1&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080002&lt;br /&gt;
| 0xC00&lt;br /&gt;
| 0x2?&lt;br /&gt;
| WiFi configuration slot 2&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090000&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x2?&lt;br /&gt;
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090001&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0xE&lt;br /&gt;
| This console-unique u64 used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]] is generated with the LocalFriendCodeSeed and with random data&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A0000&lt;br /&gt;
| 0x1C&lt;br /&gt;
| 0xE&lt;br /&gt;
| Username&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A0001&lt;br /&gt;
| 0x2&lt;br /&gt;
| 0xE&lt;br /&gt;
| Birthday (u8 month, u8 day)&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A0002&lt;br /&gt;
| 0x1&lt;br /&gt;
| 0xA&lt;br /&gt;
| Language&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0000&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x8&lt;br /&gt;
| CountryInfo&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0001&lt;br /&gt;
| 0x800&lt;br /&gt;
| 0x2?&lt;br /&gt;
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0002&lt;br /&gt;
| 0x800&lt;br /&gt;
| 0x2?&lt;br /&gt;
| State name in UTF-16, every 0x80-bytes is an entry for each language&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0003&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0xE&lt;br /&gt;
| Pair of 16-bit values, meaning unknown but related to address (ZIP code?)&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0000&lt;br /&gt;
| 0xC0&lt;br /&gt;
| 0x8&lt;br /&gt;
| Restricted photo exchange data, and other info&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0001&lt;br /&gt;
| 0x14&lt;br /&gt;
|?&lt;br /&gt;
| Same as above?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0000&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x2&lt;br /&gt;
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to.&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0x8?&lt;br /&gt;
| Unknown, used by [[NS]] on dev-units for [[SVC|svcKernelSetState]], where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don&#039;t match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0004&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x8?&lt;br /&gt;
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110000&lt;br /&gt;
| 0x4&lt;br /&gt;
|?&lt;br /&gt;
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110001&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0xA?&lt;br /&gt;
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120000&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x8&lt;br /&gt;
| ? (read by HID)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00130000&lt;br /&gt;
| 0x4&lt;br /&gt;
|?&lt;br /&gt;
| If response is 0x100 then debug mode is enabled.&lt;br /&gt;
|-&lt;br /&gt;
| 0x00160000&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x8?&lt;br /&gt;
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00190000&lt;br /&gt;
| 0x1&lt;br /&gt;
| 0x8?&lt;br /&gt;
| Unknown. NFC-module checks for value1/non-value1.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The developer unit TID block only exists on developer units.&lt;br /&gt;
&lt;br /&gt;
===Languages===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  ID&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| JP&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| EN&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| FR&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| DE&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| IT&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| ES&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| ZH&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| KO&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| NL&lt;br /&gt;
|-&lt;br /&gt;
| 9&lt;br /&gt;
| PT&lt;br /&gt;
|-&lt;br /&gt;
| 10&lt;br /&gt;
| RU&lt;br /&gt;
|-&lt;br /&gt;
| 11&lt;br /&gt;
| TW&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
===CountryInfo===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Byte&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
|?&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
|?&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
|?&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
===0x000A0000 Block===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Byte&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0-0x13&lt;br /&gt;
| UTF-16 username, with no NULL-terminator.&lt;br /&gt;
|-&lt;br /&gt;
| 0x14-17&lt;br /&gt;
| Usually zero?&lt;br /&gt;
|-&lt;br /&gt;
| 0x18-0x1B&lt;br /&gt;
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA &amp;quot;romfs:/version.dat&amp;quot;, the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===LCD display config===&lt;br /&gt;
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Friend_Services&amp;diff=16063</id>
		<title>Friend Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Friend_Services&amp;diff=16063"/>
		<updated>2016-03-19T02:59:49Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= Friend Service &amp;quot;frd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| [[FRDU:HasLoggedIn|HasLoggedIn]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020000&lt;br /&gt;
| [[FRDU:IsOnline|IsOnline]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030002&lt;br /&gt;
| [[FRDU:Login|Login]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040000&lt;br /&gt;
| [[FRDU:Logout|Logout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050000&lt;br /&gt;
| [[FRDU:GetMyFriendKey|GetMyFriendKey]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00060000&lt;br /&gt;
| [[FRDU:GetMyPreference|GetMyPreference]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070000&lt;br /&gt;
| [[FRDU:GetMyProfile|GetMyProfile]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| [[FRDU:GetMyPresence|GetMyPresence]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090000&lt;br /&gt;
| [[FRDU:GetMyScreenName|GetMyScreenName]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A0000&lt;br /&gt;
| [[FRDU:GetMyMii|GetMyMii]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0000&lt;br /&gt;
| [[FRDU:GetMyLocalAccountId|GetMyLocalAccountId]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0000&lt;br /&gt;
| [[FRDU:GetMyPlayingGame|GetMyPlayingGame]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0000&lt;br /&gt;
| [[FRDU:GetMyFavoriteGame|GetMyFavoriteGame]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| [[FRDU:GetMyNcPrincipalId|GetMyNcPrincipalId]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| [[FRDU:GetMyComment|GetMyComment]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100040&lt;br /&gt;
| [[FRDU:GetMyPassword|GetMyPassword]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110080&lt;br /&gt;
| [[FRDU:GetFriendKeyList|GetFriendKeyList]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120042&lt;br /&gt;
| [[FRDU:GetFriendPresence|GetFriendPresence]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00130142&lt;br /&gt;
| [[FRDU:GetFriendScreenName|GetFriendScreenName]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00140044&lt;br /&gt;
| [[FRDU:GetFriendMii|GetFriendMii]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00150042&lt;br /&gt;
| [[FRDU:GetFriendProfile|GetFriendProfile]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00160042&lt;br /&gt;
| [[FRDU:GetFriendRelationship|GetFriendRelationship]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00170042&lt;br /&gt;
| [[FRDU:GetFriendAttributeFlags|GetFriendAttributeFlags]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00180044&lt;br /&gt;
| [[FRDU:GetFriendPlayingGame|GetFriendPlayingGame]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00190042&lt;br /&gt;
| [[FRDU:GetFriendFavoriteGame|GetFriendFavoriteGame]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001A00C4&lt;br /&gt;
| [[FRDU:GetFriendInfo|GetFriendInfo]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001B0080&lt;br /&gt;
| [[FRDU:IsIncludedInFriendList|IsIncludedInFriendList]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001C0042&lt;br /&gt;
| [[FRDU:UnscrambleLocalFriendCode|UnscrambleLocalFriendCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001D0002&lt;br /&gt;
| [[FRDU:UpdateGameModeDescription|UpdateGameModeDescription]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001E02C2&lt;br /&gt;
| [[FRDU:UpdateGameMode|UpdateGameMode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001F0042&lt;br /&gt;
| [[FRDU:SendInvitation|SendInvitation]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00200002&lt;br /&gt;
| [[FRDU:AttachToEventNotification|AttachToEventNotification]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00210040&lt;br /&gt;
| [[FRDU:SetNotificationMask|SetNotificationMask]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00220040&lt;br /&gt;
| [[FRDU:GetEventNotification|GetEventNotification]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00230000&lt;br /&gt;
| [[FRDU:GetLastResponseResult|GetLastResponseResult]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00240040&lt;br /&gt;
| [[FRDU:PrincipalIdToFriendCode|PrincipalIdToFriendCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00250080&lt;br /&gt;
| [[FRDU:FriendCodeToPrincipalId|FriendCodeToPrincipalId]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00260080&lt;br /&gt;
| [[FRDU:IsValidFriendCode|IsValidFriendCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00270040&lt;br /&gt;
| [[FRDU:ResultToErrorCode|ResultToErrorCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00280244&lt;br /&gt;
| [[FRDU:RequestGameAuthentication|RequestGameAuthentication]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00290000&lt;br /&gt;
| [[FRDU:GetGameAuthenticationData|GetGameAuthenticationData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002A0204&lt;br /&gt;
| [[FRDU:RequestServiceLocator|RequestServiceLocator]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002B0000&lt;br /&gt;
| [[FRDU:GetServiceLocatorData|GetServiceLocatorData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002C0002&lt;br /&gt;
| [[FRDU:DetectNatProperties|DetectNatProperties]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002D0000&lt;br /&gt;
| [[FRDU:GetNatProperties|GetNatProperties]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002E0000&lt;br /&gt;
| [[FRDU:GetServerTimeInterval|GetServerTimeInterval]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002F0040&lt;br /&gt;
| [[FRDU:AllowHalfAwake|AllowHalfAwake]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00300000&lt;br /&gt;
| [[FRDU:GetServerTypes|GetServerTypes]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00310082&lt;br /&gt;
| [[FRDU:GetFriendComment|GetFriendComment]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00320042&lt;br /&gt;
| [[FRDU:SetClientSdkVersion|SetClientSdkVersion]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00330000&lt;br /&gt;
| [[FRDU:GetMyApproachContext|GetMyApproachContext]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00340046&lt;br /&gt;
| [[FRDU:AddFriendWithApproach|AddFriendWithApproach]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00350082&lt;br /&gt;
| [[FRDU:DecryptApproachContext|DecryptApproachContext]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= &amp;quot;frd:n&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040000&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= &amp;quot;frd:a&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x04050000&lt;br /&gt;
| Used in creating the user Mii. No cmdbuff parameters.&lt;br /&gt;
|-&lt;br /&gt;
| 0x040C0800&lt;br /&gt;
| Used in creating the user Mii. 128-byte struct as cmdbuff parameters.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=HTTPS Requests=&lt;br /&gt;
&lt;br /&gt;
==Trusted RootCAs==&lt;br /&gt;
No RootCertChain(s) are used. For the nasc site, friends-module uses [[HTTPC:AddDefaultCert]] with the following certIDs: 0x1, 0x2, and 0x3.&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Friend_Services&amp;diff=16062</id>
		<title>Friend Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Friend_Services&amp;diff=16062"/>
		<updated>2016-03-19T02:54:54Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* &amp;quot;frd:a&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= Friend Service &amp;quot;frd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| [[FRDU:HasLoggedIn|HasLoggedIn]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020000&lt;br /&gt;
| [[FRDU:IsOnline|IsOnline]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030002&lt;br /&gt;
| [[FRDU:Login|Login]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040000&lt;br /&gt;
| [[FRDU:Logout|Logout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050000&lt;br /&gt;
| [[FRDU:GetMyFriendKey|GetMyFriendKey]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00060000&lt;br /&gt;
| [[FRDU:GetMyPreference|GetMyPreference]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070000&lt;br /&gt;
| [[FRDU:GetMyProfile|GetMyProfile]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| [[FRDU:GetMyPresence|GetMyPresence]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090000&lt;br /&gt;
| [[FRDU:GetMyScreenName|GetMyScreenName]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A0000&lt;br /&gt;
| [[FRDU:GetMyMii|GetMyMii]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0000&lt;br /&gt;
| [[FRDU:GetMyLocalAccountId|GetMyLocalAccountId]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0000&lt;br /&gt;
| [[FRDU:GetMyPlayingGame|GetMyPlayingGame]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0000&lt;br /&gt;
| [[FRDU:GetMyFavoriteGame|GetMyFavoriteGame]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| [[FRDU:GetMyNcPrincipalId|GetMyNcPrincipalId]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| [[FRDU:GetMyComment|GetMyComment]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100040&lt;br /&gt;
| [[FRDU:GetMyPassword|GetMyPassword]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110080&lt;br /&gt;
| [[FRDU:GetFriendKeyList|GetFriendKeyList]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120042&lt;br /&gt;
| [[FRDU:GetFriendPresence|GetFriendPresence]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00130142&lt;br /&gt;
| [[FRDU:GetFriendScreenName|GetFriendScreenName]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00140044&lt;br /&gt;
| [[FRDU:GetFriendMii|GetFriendMii]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00150042&lt;br /&gt;
| [[FRDU:GetFriendProfile|GetFriendProfile]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00160042&lt;br /&gt;
| [[FRDU:GetFriendRelationship|GetFriendRelationship]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00170042&lt;br /&gt;
| [[FRDU:GetFriendAttributeFlags|GetFriendAttributeFlags]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00180044&lt;br /&gt;
| [[FRDU:GetFriendPlayingGame|GetFriendPlayingGame]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00190042&lt;br /&gt;
| [[FRDU:GetFriendFavoriteGame|GetFriendFavoriteGame]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001A00C4&lt;br /&gt;
| [[FRDU:GetFriendInfo|GetFriendInfo]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001B0080&lt;br /&gt;
| [[FRDU:IsIncludedInFriendList|IsIncludedInFriendList]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001C0042&lt;br /&gt;
| [[FRDU:UnscrambleLocalFriendCode|UnscrambleLocalFriendCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001D0002&lt;br /&gt;
| [[FRDU:UpdateGameModeDescription|UpdateGameModeDescription]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001E02C2&lt;br /&gt;
| [[FRDU:UpdateGameMode|UpdateGameMode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001F0042&lt;br /&gt;
| [[FRDU:SendInvitation|SendInvitation]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00200002&lt;br /&gt;
| [[FRDU:AttachToEventNotification|AttachToEventNotification]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00210040&lt;br /&gt;
| [[FRDU:SetNotificationMask|SetNotificationMask]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00220040&lt;br /&gt;
| [[FRDU:GetEventNotification|GetEventNotification]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00230000&lt;br /&gt;
| [[FRDU:GetLastResponseResult|GetLastResponseResult]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00240040&lt;br /&gt;
| [[FRDU:PrincipalIdToFriendCode|PrincipalIdToFriendCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00250080&lt;br /&gt;
| [[FRDU:FriendCodeToPrincipalId|FriendCodeToPrincipalId]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00260080&lt;br /&gt;
| [[FRDU:IsValidFriendCode|IsValidFriendCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00270040&lt;br /&gt;
| [[FRDU:ResultToErrorCode|ResultToErrorCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00280244&lt;br /&gt;
| [[FRDU:RequestGameAuthentication|RequestGameAuthentication]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00290000&lt;br /&gt;
| [[FRDU:GetGameAuthenticationData|GetGameAuthenticationData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002A0204&lt;br /&gt;
| [[FRDU:RequestServiceLocator|RequestServiceLocator]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002B0000&lt;br /&gt;
| [[FRDU:GetServiceLocatorData|GetServiceLocatorData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002C0002&lt;br /&gt;
| [[FRDU:DetectNatProperties|DetectNatProperties]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002D0000&lt;br /&gt;
| [[FRDU:GetNatProperties|GetNatProperties]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002E0000&lt;br /&gt;
| [[FRDU:GetServerTimeInterval|GetServerTimeInterval]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002F0040&lt;br /&gt;
| [[FRDU:AllowHalfAwake|AllowHalfAwake]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00300000&lt;br /&gt;
| [[FRDU:GetServerTypes|GetServerTypes]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00310082&lt;br /&gt;
| [[FRDU:GetFriendComment|GetFriendComment]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00320042&lt;br /&gt;
| [[FRDU:SetClientSdkVersion|SetClientSdkVersion]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00330000&lt;br /&gt;
| [[FRDU:GetMyApproachContext|GetMyApproachContext]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00340046&lt;br /&gt;
| [[FRDU:AddFriendWithApproach|AddFriendWithApproach]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00350082&lt;br /&gt;
| [[FRDU:DecryptApproachContext|DecryptApproachContext]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= &amp;quot;frd:n&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040000&lt;br /&gt;
| ?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= &amp;quot;frd:a&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x04050000&lt;br /&gt;
| SetMyMii?&lt;br /&gt;
|-&lt;br /&gt;
| 0x040C0800&lt;br /&gt;
| CreateMii?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=HTTPS Requests=&lt;br /&gt;
&lt;br /&gt;
==Trusted RootCAs==&lt;br /&gt;
No RootCertChain(s) are used. For the nasc site, friends-module uses [[HTTPC:AddDefaultCert]] with the following certIDs: 0x1, 0x2, and 0x3.&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=I2C_Registers&amp;diff=16019</id>
		<title>I2C Registers</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=I2C_Registers&amp;diff=16019"/>
		<updated>2016-03-14T17:19:06Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* Device 13 */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Registers =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Old3DS&lt;br /&gt;
!  Name&lt;br /&gt;
!  Address&lt;br /&gt;
!  Width&lt;br /&gt;
!  Used by&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C1_DATA&lt;br /&gt;
| 0x10161000&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 1 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#I2C_CNT|I2C1_CNT]]&lt;br /&gt;
| 0x10161001&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 1 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C1_CNTEX&lt;br /&gt;
| 0x10161002&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 1 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C1_SCL&lt;br /&gt;
| 0x10161004&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 1 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C2_DATA&lt;br /&gt;
| 0x10144000&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 2 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#I2C_CNT|I2C2_CNT]]&lt;br /&gt;
| 0x10144001&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 2 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C2_CNTEX&lt;br /&gt;
| 0x10144002&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 2 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C2_SCL&lt;br /&gt;
| 0x10144004&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 2 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C3_DATA&lt;br /&gt;
| 0x10148000&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 3 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#I2C_CNT|I2C3_CNT]]&lt;br /&gt;
| 0x10148001&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 3 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C3_CNTEX&lt;br /&gt;
| 0x10148002&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 3 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C3_SCL&lt;br /&gt;
| 0x10148004&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 3 devices&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== I2C_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  BIT&lt;br /&gt;
!  DESCRIPTION&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Stop (0=No, 1=Stop/last byte)&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Start (0=No, 1=Start/first byte)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Pause (0=Transfer Data, 1=Pause after Error, used with/after Stop)&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| Ack Flag         (0=Error, 1=Okay)  (For DataRead: W, for DataWrite: R)&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| Data Direction   (0=Write, 1=Read)&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| Interrupt Enable (0=Disable, 1=Enable)&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| Start/busy       (0=Ready, 1=Start/busy)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= I2C Devices =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!   [[I2C_Registers|Device id]]&lt;br /&gt;
!   Device bus id&lt;br /&gt;
!   Device Write Address&lt;br /&gt;
!   Accessible via I2C [[I2C_Services|service]]&lt;br /&gt;
!   Device description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| 1&lt;br /&gt;
| 0x4a&lt;br /&gt;
| &amp;quot;i2c::MCU&amp;quot;&lt;br /&gt;
| Power management?(same device addr as the DSi power-management)&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| 1&lt;br /&gt;
| 0x7a&lt;br /&gt;
| &amp;quot;i2c::CAM&amp;quot;&lt;br /&gt;
| Camera0?(same dev-addr as DSi cam0)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| 1&lt;br /&gt;
| 0x78&lt;br /&gt;
| &amp;quot;i2c::CAM&amp;quot;&lt;br /&gt;
| Camera1?(same dev-addr as DSi cam1)&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| 2&lt;br /&gt;
| 0x4a&lt;br /&gt;
| &amp;quot;i2c::MCU&amp;quot;&lt;br /&gt;
| MCU&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| 2&lt;br /&gt;
| 0x78&lt;br /&gt;
| &amp;quot;i2c::CAM&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 2&lt;br /&gt;
| 0x2c&lt;br /&gt;
| &amp;quot;i2c::LCD&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| 2&lt;br /&gt;
| 0x2e&lt;br /&gt;
| &amp;quot;i2c::LCD&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| 2&lt;br /&gt;
| 0x40&lt;br /&gt;
| &amp;quot;i2c::DEB&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| 2&lt;br /&gt;
| 0x44&lt;br /&gt;
| &amp;quot;i2c::DEB&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 9&lt;br /&gt;
| 3&lt;br /&gt;
| 0xa6&lt;br /&gt;
| &amp;quot;i2c::HID&amp;quot;&lt;br /&gt;
| Unknown. The device table in I2C-module had the device address changed from 0xA6 to 0xD6 with [[8.0.0-18]].&lt;br /&gt;
|-&lt;br /&gt;
| 10&lt;br /&gt;
| 3&lt;br /&gt;
| 0xd0&lt;br /&gt;
| &amp;quot;i2c::HID&amp;quot;&lt;br /&gt;
| Gyroscope&lt;br /&gt;
|-&lt;br /&gt;
| 11&lt;br /&gt;
| 3&lt;br /&gt;
| 0xd2&lt;br /&gt;
| &amp;quot;i2c::HID&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 12&lt;br /&gt;
| 3&lt;br /&gt;
| 0xa4&lt;br /&gt;
| &amp;quot;i2c::HID&amp;quot;&lt;br /&gt;
| DebugPad&lt;br /&gt;
|-&lt;br /&gt;
| 13&lt;br /&gt;
| 3&lt;br /&gt;
| 0x9a&lt;br /&gt;
| &amp;quot;i2c::IR&amp;quot;&lt;br /&gt;
| IR&lt;br /&gt;
|-&lt;br /&gt;
| 14&lt;br /&gt;
| 3&lt;br /&gt;
| 0xa0&lt;br /&gt;
| &amp;quot;i2c::EEP&amp;quot;&lt;br /&gt;
| eeprom?&lt;br /&gt;
|-&lt;br /&gt;
| 15&lt;br /&gt;
| 2&lt;br /&gt;
| 0xee&lt;br /&gt;
| &amp;quot;i2c::NFC&amp;quot;&lt;br /&gt;
| New3DS-only [[NFC_Services|NFC]]&lt;br /&gt;
|-&lt;br /&gt;
| 16&lt;br /&gt;
| 1&lt;br /&gt;
| 0x40&lt;br /&gt;
| &amp;quot;i2c::QTM&amp;quot;&lt;br /&gt;
| New3DS-only [[QTM_Services|QTM]]&lt;br /&gt;
|-&lt;br /&gt;
| 17&lt;br /&gt;
| 3&lt;br /&gt;
| 0x54&lt;br /&gt;
| &amp;quot;i2c::IR&amp;quot;&lt;br /&gt;
| Used by IR-module starting with [[8.0.0-18]], for New3DS-only HID via &amp;quot;ir:rst&amp;quot;. This deviceid doesn&#039;t seem to be supported by i2c module on [[8.0.0-18]](actual support was later added in New3DS i2c module).&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Notice&#039;&#039;&#039;: These device addresses are used for writing to the respective device, for reading bit0 must be set (see I2C protocol). Thus, the actual device address is &amp;gt;&amp;gt; 1.&lt;br /&gt;
&lt;br /&gt;
== Device 3 ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  REGISTER&lt;br /&gt;
!  WIDTH&lt;br /&gt;
!  DESCRIPTION &lt;br /&gt;
|-&lt;br /&gt;
| 0x03&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x04&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x08&lt;br /&gt;
| 1&lt;br /&gt;
| 3D slider position 0x9..0xFB&lt;br /&gt;
|-&lt;br /&gt;
| 0x09&lt;br /&gt;
| 1&lt;br /&gt;
| Sound volume: 0x0..0x3F.&lt;br /&gt;
|-&lt;br /&gt;
| 0xB&lt;br /&gt;
| 1&lt;br /&gt;
| Battery level: 0x0..0x40.&lt;br /&gt;
|-&lt;br /&gt;
| 0xF&lt;br /&gt;
| 1&lt;br /&gt;
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of these are read via [[MCU_Services|mcu::RTC]]: bit4 = BatteryChargeState. bit3 = AdapterState. bit1 = ShellState.&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 1&lt;br /&gt;
| Special HID status flags: bit0 = power button pressed, bit1 = power button pressed long, bit2 = home button pressed, bit3 = home button released, bit4 = wifi slider enabled, bit5 = shell got closed, bit6 = shell got opened. If nothing has changed this register is 0.&lt;br /&gt;
|-&lt;br /&gt;
| 0x12&lt;br /&gt;
| 1&lt;br /&gt;
| 0x40 if volume slider position changed&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| 8&lt;br /&gt;
| Writing u8 value 4 here triggers a hardware system reboot. Writing u8 value 1 (repeatedly) triggers a shutdown via power-off?&lt;br /&gt;
|-&lt;br /&gt;
| 0x22&lt;br /&gt;
| 8&lt;br /&gt;
| Used to set LCD states. bit0 = don&#039;t push to LCDs, bit1 = push to LCDs, bit2 = bottom screen backlight off, bit3 = bottom screen backlight on, bit4 = top screen backlight off, bit5 = top screen backlight on&lt;br /&gt;
|-&lt;br /&gt;
| 0x23&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x24&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x28&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x29&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x2A&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x2B&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x2C&lt;br /&gt;
| 8&lt;br /&gt;
| setting bits 1, 3 and 4 turn on the 3D LED on the original 3ds&lt;br /&gt;
|-&lt;br /&gt;
| 0x2D&lt;br /&gt;
| 0x64&lt;br /&gt;
| This is used for [[MCURTC:SetInfoLEDPattern|controlling]] the notification LED(see [[MCURTC:SetInfoLEDPatternHeader]] as well), when this register is written.&lt;br /&gt;
|-&lt;br /&gt;
| 0x2E&lt;br /&gt;
| 1&lt;br /&gt;
| This [[MCURTC:GetInfoLEDStatus|returns]] the notification LED status when read.&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| 8&lt;br /&gt;
| RTC time (system clock)&lt;br /&gt;
|-&lt;br /&gt;
| 0x31&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x32&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x33&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x34&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x35&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x36&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x37&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x38&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x39&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x3A&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x3B&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x3C&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x41&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x43&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x4E&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x50&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x51&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x58&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x60&lt;br /&gt;
| 8&lt;br /&gt;
| Offset in u8 array accessed via address 0x61 (written before any read/write below)&lt;br /&gt;
|-&lt;br /&gt;
| 0x61&lt;br /&gt;
| 0x100&lt;br /&gt;
| Reads/writes to an MCU u8 array, repeats after 0x100 bytes?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Device 5 &amp;amp; 6 ==&lt;br /&gt;
LCD controllers for main/sub displays, most likely.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Register&lt;br /&gt;
!  Width&lt;br /&gt;
!  Name&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x1&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x11&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x40&lt;br /&gt;
| 8&lt;br /&gt;
| CMD_IN/CMD_RESULT1&lt;br /&gt;
| Write to trigger a command? Seen commands: 0xFF=Reset?, 0x62=IsFinished?. Result is stored in CMD_RESULT1:CMD_RESULT0.&lt;br /&gt;
|-&lt;br /&gt;
| 0x41&lt;br /&gt;
| 8&lt;br /&gt;
| CMD_RESULT0&lt;br /&gt;
| Read result &lt;br /&gt;
|-&lt;br /&gt;
| 0x50&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x60&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0xFE&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Device 10 ==&lt;br /&gt;
See the datasheet linked to on the [[Hardware]] page for reference.&lt;br /&gt;
&lt;br /&gt;
== Device 12 ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  REGISTER&lt;br /&gt;
!  WIDTH&lt;br /&gt;
!  DESCRIPTION &lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 21&lt;br /&gt;
| DebugPad state.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
This is the DebugPad device, see [[HID_Shared_Memory|here]].&lt;br /&gt;
&lt;br /&gt;
== Device 13 ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Raw I2C register address&lt;br /&gt;
!  Internal register address&lt;br /&gt;
!  Width&lt;br /&gt;
!  Description &lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x40&lt;br /&gt;
| RHR / THR (data receive/send FIFO)&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x1&lt;br /&gt;
| 0x1&lt;br /&gt;
| IER&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0x2&lt;br /&gt;
| 0x1&lt;br /&gt;
| FCR/IIR&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| 0x3&lt;br /&gt;
| 0x1&lt;br /&gt;
| LCR&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x1&lt;br /&gt;
| MCR&lt;br /&gt;
|-&lt;br /&gt;
| 0x28&lt;br /&gt;
| 0x5&lt;br /&gt;
| 0x1&lt;br /&gt;
| LSR&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| 0x6&lt;br /&gt;
| 0x1&lt;br /&gt;
| MSR/TCR&lt;br /&gt;
|-&lt;br /&gt;
| 0x38&lt;br /&gt;
| 0x7&lt;br /&gt;
| 0x1&lt;br /&gt;
| SPR/TLR&lt;br /&gt;
|-&lt;br /&gt;
| 0x40&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x1&lt;br /&gt;
| TXLVL&lt;br /&gt;
|-&lt;br /&gt;
| 0x48&lt;br /&gt;
| 0x9&lt;br /&gt;
| 0x1&lt;br /&gt;
| RXLVL&lt;br /&gt;
|-&lt;br /&gt;
| 0x50&lt;br /&gt;
| 0xA&lt;br /&gt;
| 0x1&lt;br /&gt;
| IODir&lt;br /&gt;
|-&lt;br /&gt;
| 0x58&lt;br /&gt;
| 0xB&lt;br /&gt;
| 0x1&lt;br /&gt;
| IOState&lt;br /&gt;
|-&lt;br /&gt;
| 0x60&lt;br /&gt;
| 0xC&lt;br /&gt;
| 0x1&lt;br /&gt;
| IoIntEna&lt;br /&gt;
|-&lt;br /&gt;
| 0x68&lt;br /&gt;
| 0xD&lt;br /&gt;
| 0x1&lt;br /&gt;
| reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x70&lt;br /&gt;
| 0xE&lt;br /&gt;
| 0x1&lt;br /&gt;
| IOControl&lt;br /&gt;
|-&lt;br /&gt;
| 0x78&lt;br /&gt;
| 0xF&lt;br /&gt;
| 0x1&lt;br /&gt;
| EFCR&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
See the [http://www.alldatasheet.net/datasheet-pdf/pdf/347838/NXP/SC16IS750IBS.html datasheet] linked to on the [[Hardware]] page for reference. From that datasheet, for the structure of the I2C register address u8: &amp;quot;Bit 0 is not used, bits 2:1 select the channel, bits 6:3 select one of the UART internal registers. Bit 7 is not used with the I2C-bus interface, but it is used by the SPI interface to indicate a read or a write operation.&amp;quot;&lt;br /&gt;
&lt;br /&gt;
== Device 15 ==&lt;br /&gt;
This the New3DS [[NFC_Services|NFC]] controller &amp;quot;I2C&amp;quot; interface. This device is accessed via the WriteDeviceRaw/ReadDeviceRaw I2C service [[I2C_Services|commands]].&lt;br /&gt;
&lt;br /&gt;
Since the *Raw commands are used with this, this device has no I2C registers. Instead, raw data is transfered after the I2C device is selected. Hence, WriteDeviceRaw is used for sending commands to the controller, while ReadDeviceRaw is for receiving responses from the controller. Certain commands may return multiple command responses.&lt;br /&gt;
&lt;br /&gt;
Command request / response structure:&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x1&lt;br /&gt;
| Normally 0x10?&lt;br /&gt;
|-&lt;br /&gt;
| 0x1&lt;br /&gt;
| 0x1&lt;br /&gt;
| Command source / destination.&lt;br /&gt;
|-&lt;br /&gt;
| 0x2&lt;br /&gt;
| 0x1&lt;br /&gt;
| CmdID&lt;br /&gt;
|-&lt;br /&gt;
| 0x3&lt;br /&gt;
| 0x1&lt;br /&gt;
| Payload size.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Following the above header is the payload data(when payload size is non-zero), with the size specified in the header. The command response payload is usually at least 1-byte, where that byte appears to be normally 0x0. For command requests the payload data is the command parameters.&lt;br /&gt;
&lt;br /&gt;
For command requests sent to the NFC tag itself, Cmd[1]=0x0 and CmdID=0x0. The command request payload data here is the actual command request data for the NFC tag, starting with the CmdID u8 at payload+0.&lt;br /&gt;
&lt;br /&gt;
During NFC module startup, a certain command is sent to the controller which eventually(after various cmd-reply headers etc) returns the following the payload after the first byte in the payload:&lt;br /&gt;
 000000: 44 65 63 20 32 32 20 32 30 31 32 31 34 3a 35 33  Dec 22 201214:53 &lt;br /&gt;
 000010: 3a 35 30 01 05 0d 46 05 1b 79 20 07 32 30 37 39  :50...F..y .2079&lt;br /&gt;
 000020: 31 42 35                                         1B5&lt;br /&gt;
&lt;br /&gt;
Or that is: &amp;quot;Dec 22 201214:53:50&amp;lt;binary&amp;gt;20791B5&amp;quot;. Therefore, this appears to return the part-number of the NFC controller(other command request(s) / response(s) use this part-number value too).&lt;br /&gt;
&lt;br /&gt;
=== NFC controller commands  ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  CmdRequest[1]&lt;br /&gt;
!  CmdID&lt;br /&gt;
!  Payload data for parameters&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x2E&lt;br /&gt;
| 0x2F&lt;br /&gt;
| Firmware image for this chunk, size varies.&lt;br /&gt;
| This is used during NFC module startup to upload the firmware image to the NFC controller. This is used repeatedly to upload multiple chunks of the image.&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=I2C_Registers&amp;diff=16012</id>
		<title>I2C Registers</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=I2C_Registers&amp;diff=16012"/>
		<updated>2016-03-13T09:15:32Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Registers =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Old3DS&lt;br /&gt;
!  Name&lt;br /&gt;
!  Address&lt;br /&gt;
!  Width&lt;br /&gt;
!  Used by&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C1_DATA&lt;br /&gt;
| 0x10161000&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 1 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#I2C_CNT|I2C1_CNT]]&lt;br /&gt;
| 0x10161001&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 1 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C1_CNTEX&lt;br /&gt;
| 0x10161002&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 1 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C1_SCL&lt;br /&gt;
| 0x10161004&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 1 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C2_DATA&lt;br /&gt;
| 0x10144000&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 2 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#I2C_CNT|I2C2_CNT]]&lt;br /&gt;
| 0x10144001&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 2 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C2_CNTEX&lt;br /&gt;
| 0x10144002&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 2 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C2_SCL&lt;br /&gt;
| 0x10144004&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 2 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C3_DATA&lt;br /&gt;
| 0x10148000&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 3 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| [[#I2C_CNT|I2C3_CNT]]&lt;br /&gt;
| 0x10148001&lt;br /&gt;
| 1&lt;br /&gt;
| I2C bus 3 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C3_CNTEX&lt;br /&gt;
| 0x10148002&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 3 devices&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| I2C3_SCL&lt;br /&gt;
| 0x10148004&lt;br /&gt;
| 2&lt;br /&gt;
| I2C bus 3 devices&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== I2C_CNT ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  BIT&lt;br /&gt;
!  DESCRIPTION&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Stop (0=No, 1=Stop/last byte)&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Start (0=No, 1=Start/first byte)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Pause (0=Transfer Data, 1=Pause after Error, used with/after Stop)&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| Ack Flag         (0=Error, 1=Okay)  (For DataRead: W, for DataWrite: R)&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| Data Direction   (0=Write, 1=Read)&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| Interrupt Enable (0=Disable, 1=Enable)&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| Start/busy       (0=Ready, 1=Start/busy)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= I2C Devices =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!   [[I2C_Registers|Device id]]&lt;br /&gt;
!   Device bus id&lt;br /&gt;
!   Device Write Address&lt;br /&gt;
!   Accessible via I2C [[I2C_Services|service]]&lt;br /&gt;
!   Device description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| 1&lt;br /&gt;
| 0x4a&lt;br /&gt;
| &amp;quot;i2c::MCU&amp;quot;&lt;br /&gt;
| Power management?(same device addr as the DSi power-management)&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| 1&lt;br /&gt;
| 0x7a&lt;br /&gt;
| &amp;quot;i2c::CAM&amp;quot;&lt;br /&gt;
| Camera0?(same dev-addr as DSi cam0)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| 1&lt;br /&gt;
| 0x78&lt;br /&gt;
| &amp;quot;i2c::CAM&amp;quot;&lt;br /&gt;
| Camera1?(same dev-addr as DSi cam1)&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| 2&lt;br /&gt;
| 0x4a&lt;br /&gt;
| &amp;quot;i2c::MCU&amp;quot;&lt;br /&gt;
| MCU&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| 2&lt;br /&gt;
| 0x78&lt;br /&gt;
| &amp;quot;i2c::CAM&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 2&lt;br /&gt;
| 0x2c&lt;br /&gt;
| &amp;quot;i2c::LCD&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| 2&lt;br /&gt;
| 0x2e&lt;br /&gt;
| &amp;quot;i2c::LCD&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| 2&lt;br /&gt;
| 0x40&lt;br /&gt;
| &amp;quot;i2c::DEB&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| 2&lt;br /&gt;
| 0x44&lt;br /&gt;
| &amp;quot;i2c::DEB&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 9&lt;br /&gt;
| 3&lt;br /&gt;
| 0xa6&lt;br /&gt;
| &amp;quot;i2c::HID&amp;quot;&lt;br /&gt;
| Unknown. The device table in I2C-module had the device address changed from 0xA6 to 0xD6 with [[8.0.0-18]].&lt;br /&gt;
|-&lt;br /&gt;
| 10&lt;br /&gt;
| 3&lt;br /&gt;
| 0xd0&lt;br /&gt;
| &amp;quot;i2c::HID&amp;quot;&lt;br /&gt;
| Gyroscope&lt;br /&gt;
|-&lt;br /&gt;
| 11&lt;br /&gt;
| 3&lt;br /&gt;
| 0xd2&lt;br /&gt;
| &amp;quot;i2c::HID&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 12&lt;br /&gt;
| 3&lt;br /&gt;
| 0xa4&lt;br /&gt;
| &amp;quot;i2c::HID&amp;quot;&lt;br /&gt;
| DebugPad&lt;br /&gt;
|-&lt;br /&gt;
| 13&lt;br /&gt;
| 3&lt;br /&gt;
| 0x9a&lt;br /&gt;
| &amp;quot;i2c::IR&amp;quot;&lt;br /&gt;
| IR&lt;br /&gt;
|-&lt;br /&gt;
| 14&lt;br /&gt;
| 3&lt;br /&gt;
| 0xa0&lt;br /&gt;
| &amp;quot;i2c::EEP&amp;quot;&lt;br /&gt;
| eeprom?&lt;br /&gt;
|-&lt;br /&gt;
| 15&lt;br /&gt;
| 2&lt;br /&gt;
| 0xee&lt;br /&gt;
| &amp;quot;i2c::NFC&amp;quot;&lt;br /&gt;
| New3DS-only [[NFC_Services|NFC]]&lt;br /&gt;
|-&lt;br /&gt;
| 16&lt;br /&gt;
| 1&lt;br /&gt;
| 0x40&lt;br /&gt;
| &amp;quot;i2c::QTM&amp;quot;&lt;br /&gt;
| New3DS-only [[QTM_Services|QTM]]&lt;br /&gt;
|-&lt;br /&gt;
| 17&lt;br /&gt;
| 3&lt;br /&gt;
| 0x54&lt;br /&gt;
| &amp;quot;i2c::IR&amp;quot;&lt;br /&gt;
| Used by IR-module starting with [[8.0.0-18]], for New3DS-only HID via &amp;quot;ir:rst&amp;quot;. This deviceid doesn&#039;t seem to be supported by i2c module on [[8.0.0-18]](actual support was later added in New3DS i2c module).&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Notice&#039;&#039;&#039;: These device addresses are used for writing to the respective device, for reading bit0 must be set (see I2C protocol). Thus, the actual device address is &amp;gt;&amp;gt; 1.&lt;br /&gt;
&lt;br /&gt;
== Device 3 ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  REGISTER&lt;br /&gt;
!  WIDTH&lt;br /&gt;
!  DESCRIPTION &lt;br /&gt;
|-&lt;br /&gt;
| 0x03&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x04&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x08&lt;br /&gt;
| 1&lt;br /&gt;
| 3D slider position 0x9..0xFB&lt;br /&gt;
|-&lt;br /&gt;
| 0x09&lt;br /&gt;
| 1&lt;br /&gt;
| Sound volume: 0x0..0x3F.&lt;br /&gt;
|-&lt;br /&gt;
| 0xB&lt;br /&gt;
| 1&lt;br /&gt;
| Battery level: 0x0..0x40.&lt;br /&gt;
|-&lt;br /&gt;
| 0xF&lt;br /&gt;
| 1&lt;br /&gt;
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of these are read via [[MCU_Services|mcu::RTC]]: bit4 = BatteryChargeState. bit3 = AdapterState. bit1 = ShellState.&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 1&lt;br /&gt;
| Special HID status flags: bit0 = power button pressed, bit1 = power button pressed long, bit2 = home button pressed, bit3 = home button released, bit4 = wifi slider enabled, bit5 = shell got closed, bit6 = shell got opened. If nothing has changed this register is 0.&lt;br /&gt;
|-&lt;br /&gt;
| 0x12&lt;br /&gt;
| 1&lt;br /&gt;
| 0x40 if volume slider position changed&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| 8&lt;br /&gt;
| Writing u8 value 4 here triggers a hardware system reboot. Writing u8 value 1 (repeatedly) triggers a shutdown via power-off?&lt;br /&gt;
|-&lt;br /&gt;
| 0x22&lt;br /&gt;
| 8&lt;br /&gt;
| Used to set LCD states. bit0 = don&#039;t push to LCDs, bit1 = push to LCDs, bit2 = bottom screen backlight off, bit3 = bottom screen backlight on, bit4 = top screen backlight off, bit5 = top screen backlight on&lt;br /&gt;
|-&lt;br /&gt;
| 0x23&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x24&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x28&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x29&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x2A&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x2B&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x2C&lt;br /&gt;
| 8&lt;br /&gt;
| setting bits 1, 3 and 4 turn on the 3D LED on the original 3ds&lt;br /&gt;
|-&lt;br /&gt;
| 0x2D&lt;br /&gt;
| 0x64&lt;br /&gt;
| This is used for [[MCURTC:SetInfoLEDPattern|controlling]] the notification LED(see [[MCURTC:SetInfoLEDPatternHeader]] as well), when this register is written.&lt;br /&gt;
|-&lt;br /&gt;
| 0x2E&lt;br /&gt;
| 1&lt;br /&gt;
| This [[MCURTC:GetInfoLEDStatus|returns]] the notification LED status when read.&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| 8&lt;br /&gt;
| RTC time (system clock)&lt;br /&gt;
|-&lt;br /&gt;
| 0x31&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x32&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x33&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x34&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x35&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x36&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x37&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x38&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x39&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x3A&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x3B&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x3C&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x41&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x43&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x4E&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x50&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x51&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x58&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x60&lt;br /&gt;
| 8&lt;br /&gt;
| Offset in u8 array accessed via address 0x61 (written before any read/write below)&lt;br /&gt;
|-&lt;br /&gt;
| 0x61&lt;br /&gt;
| 0x100&lt;br /&gt;
| Reads/writes to an MCU u8 array, repeats after 0x100 bytes?&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Device 5 &amp;amp; 6 ==&lt;br /&gt;
LCD controllers for main/sub displays, most likely.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Register&lt;br /&gt;
!  Width&lt;br /&gt;
!  Name&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x1&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x11&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x40&lt;br /&gt;
| 8&lt;br /&gt;
| CMD_IN/CMD_RESULT1&lt;br /&gt;
| Write to trigger a command? Seen commands: 0xFF=Reset?, 0x62=IsFinished?. Result is stored in CMD_RESULT1:CMD_RESULT0.&lt;br /&gt;
|-&lt;br /&gt;
| 0x41&lt;br /&gt;
| 8&lt;br /&gt;
| CMD_RESULT0&lt;br /&gt;
| Read result &lt;br /&gt;
|-&lt;br /&gt;
| 0x50&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x60&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0xFE&lt;br /&gt;
| 8&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Device 10 ==&lt;br /&gt;
See the datasheet linked to on the [[Hardware]] page for reference.&lt;br /&gt;
&lt;br /&gt;
== Device 12 ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  REGISTER&lt;br /&gt;
!  WIDTH&lt;br /&gt;
!  DESCRIPTION &lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 21&lt;br /&gt;
| DebugPad state.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
This is the DebugPad device, see [[HID_Shared_Memory|here]].&lt;br /&gt;
&lt;br /&gt;
== Device 13 ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Raw I2C register address&lt;br /&gt;
!  Internal register address&lt;br /&gt;
!  Width&lt;br /&gt;
!  Description &lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x40&lt;br /&gt;
| RHR / THR (data receive/send FIFO)&lt;br /&gt;
|-&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x1&lt;br /&gt;
| 0x1&lt;br /&gt;
| IER&lt;br /&gt;
|-&lt;br /&gt;
| 0x10&lt;br /&gt;
| 0x2&lt;br /&gt;
| 0x1&lt;br /&gt;
| FCR/IIR&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| 0x3&lt;br /&gt;
| 0x1&lt;br /&gt;
| LCR&lt;br /&gt;
|-&lt;br /&gt;
| 0x20&lt;br /&gt;
| 0x4&lt;br /&gt;
| 0x1&lt;br /&gt;
| MCR&lt;br /&gt;
|-&lt;br /&gt;
| 0x28&lt;br /&gt;
| 0x5&lt;br /&gt;
| 0x1&lt;br /&gt;
| LSR&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| 0x6&lt;br /&gt;
| 0x1&lt;br /&gt;
| MSR/TCR&lt;br /&gt;
|-&lt;br /&gt;
| 0x38&lt;br /&gt;
| 0x7&lt;br /&gt;
| 0x1&lt;br /&gt;
| SPR/TLR&lt;br /&gt;
|-&lt;br /&gt;
| 0x40&lt;br /&gt;
| 0x8&lt;br /&gt;
| 0x1&lt;br /&gt;
| TXLVL&lt;br /&gt;
|-&lt;br /&gt;
| 0x48&lt;br /&gt;
| 0x9&lt;br /&gt;
| 0x1&lt;br /&gt;
| RXLVL&lt;br /&gt;
|-&lt;br /&gt;
| 0x50&lt;br /&gt;
| 0xA&lt;br /&gt;
| 0x1&lt;br /&gt;
| IODir&lt;br /&gt;
|-&lt;br /&gt;
| 0x58&lt;br /&gt;
| 0xB&lt;br /&gt;
| 0x1&lt;br /&gt;
| IOState&lt;br /&gt;
|-&lt;br /&gt;
| 0x60&lt;br /&gt;
| 0xC&lt;br /&gt;
| 0x1&lt;br /&gt;
| IoIntEna&lt;br /&gt;
|-&lt;br /&gt;
| 0x68&lt;br /&gt;
| 0xD&lt;br /&gt;
| 0x1&lt;br /&gt;
| reserved&lt;br /&gt;
|-&lt;br /&gt;
| 0x70&lt;br /&gt;
| 0xE&lt;br /&gt;
| 0x1&lt;br /&gt;
| IOControl&lt;br /&gt;
|-&lt;br /&gt;
| 0x78&lt;br /&gt;
| 0xF&lt;br /&gt;
| 0x1&lt;br /&gt;
| EFCR&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
See the datasheet linked to on the [[Hardware]] page for reference. From that datasheet, for the structure of the I2C register address u8: &amp;quot;Bit 0 is not used, bits 2:1 select the channel, bits 6:3 select one of the UART internal registers. Bit 7 is not used with the I2C-bus interface, but it is used by the SPI interface to indicate a read or a write operation.&amp;quot;&lt;br /&gt;
&lt;br /&gt;
== Device 15 ==&lt;br /&gt;
This the New3DS [[NFC_Services|NFC]] controller &amp;quot;I2C&amp;quot; interface. This device is accessed via the WriteDeviceRaw/ReadDeviceRaw I2C service [[I2C_Services|commands]].&lt;br /&gt;
&lt;br /&gt;
Since the *Raw commands are used with this, this device has no I2C registers. Instead, raw data is transfered after the I2C device is selected. Hence, WriteDeviceRaw is used for sending commands to the controller, while ReadDeviceRaw is for receiving responses from the controller. Certain commands may return multiple command responses.&lt;br /&gt;
&lt;br /&gt;
Command request / response structure:&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x1&lt;br /&gt;
| Normally 0x10?&lt;br /&gt;
|-&lt;br /&gt;
| 0x1&lt;br /&gt;
| 0x1&lt;br /&gt;
| Command source / destination.&lt;br /&gt;
|-&lt;br /&gt;
| 0x2&lt;br /&gt;
| 0x1&lt;br /&gt;
| CmdID&lt;br /&gt;
|-&lt;br /&gt;
| 0x3&lt;br /&gt;
| 0x1&lt;br /&gt;
| Payload size.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Following the above header is the payload data(when payload size is non-zero), with the size specified in the header. The command response payload is usually at least 1-byte, where that byte appears to be normally 0x0. For command requests the payload data is the command parameters.&lt;br /&gt;
&lt;br /&gt;
For command requests sent to the NFC tag itself, Cmd[1]=0x0 and CmdID=0x0. The command request payload data here is the actual command request data for the NFC tag, starting with the CmdID u8 at payload+0.&lt;br /&gt;
&lt;br /&gt;
During NFC module startup, a certain command is sent to the controller which eventually(after various cmd-reply headers etc) returns the following the payload after the first byte in the payload:&lt;br /&gt;
 000000: 44 65 63 20 32 32 20 32 30 31 32 31 34 3a 35 33  Dec 22 201214:53 &lt;br /&gt;
 000010: 3a 35 30 01 05 0d 46 05 1b 79 20 07 32 30 37 39  :50...F..y .2079&lt;br /&gt;
 000020: 31 42 35                                         1B5&lt;br /&gt;
&lt;br /&gt;
Or that is: &amp;quot;Dec 22 201214:53:50&amp;lt;binary&amp;gt;20791B5&amp;quot;. Therefore, this appears to return the part-number of the NFC controller(other command request(s) / response(s) use this part-number value too).&lt;br /&gt;
&lt;br /&gt;
=== NFC controller commands  ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  CmdRequest[1]&lt;br /&gt;
!  CmdID&lt;br /&gt;
!  Payload data for parameters&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x2E&lt;br /&gt;
| 0x2F&lt;br /&gt;
| Firmware image for this chunk, size varies.&lt;br /&gt;
| This is used during NFC module startup to upload the firmware image to the NFC controller. This is used repeatedly to upload multiple chunks of the image.&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Glossary&amp;diff=15786</id>
		<title>Glossary</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Glossary&amp;diff=15786"/>
		<updated>2016-02-16T07:26:45Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;A miniature dictionary for terms that may be encountered on 3DSBrew.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div class=&amp;quot;noautonum&amp;quot;&amp;gt;__TOC__&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== A ==&lt;br /&gt;
&lt;br /&gt;
=== AXI WRAM ===&lt;br /&gt;
&lt;br /&gt;
The name given to 512KiB of SRAM (&amp;quot;Work&amp;quot; RAM) connected to the SOC via AXI. It is where the ARM11 kernel resides. &lt;br /&gt;
&lt;br /&gt;
=== appcore ===&lt;br /&gt;
&lt;br /&gt;
appcore is the name given to one of the Old 3DS&#039;s ARM11 CPU cores. It refers to the core that is used to run games and other [[NCCH]] content. The other core is called [[#syscore|syscore]].&lt;br /&gt;
&lt;br /&gt;
== C ==&lt;br /&gt;
&lt;br /&gt;
=== C ===&lt;br /&gt;
&lt;br /&gt;
A language homebrew developers program in, also used to make everything from web browsers to timers for computers.&lt;br /&gt;
&lt;br /&gt;
=== C++ ===&lt;br /&gt;
&lt;br /&gt;
An object oriented language homebrew developers program in. Like its name suggests, C++ is essentially a step up from C.&lt;br /&gt;
&lt;br /&gt;
== D ==&lt;br /&gt;
&lt;br /&gt;
=== DSi ===&lt;br /&gt;
&lt;br /&gt;
A handheld console created by Nintendo. It is the second successor to the Nintendo DS, and the 6th generation portable Nintendo gaming system. It features two (larger) screens, two cameras, and an online shop system. The menu is also overhauled, now using similar channels as used on the Wii. It has a screen brightness that can be set to one step higher than the DS Lite.&lt;br /&gt;
&lt;br /&gt;
=== DS Lite ===&lt;br /&gt;
&lt;br /&gt;
The predecessor to the DSi. It came after the original DS PHAT and has a screen that can be set to 4x as bright as the DS PHAT.&lt;br /&gt;
&lt;br /&gt;
=== DS &amp;quot;PHAT&amp;quot; ===&lt;br /&gt;
&lt;br /&gt;
The original Nintendo DS. It ended up being the successor to the Game Boy, though Nintendo did not intend for this to happen. It added a touch screen.&lt;br /&gt;
&lt;br /&gt;
=== DSP ===&lt;br /&gt;
&lt;br /&gt;
Digital Signal Processor. The 3DS uses a DSP core to do the audio mixing instead of relaying on dedicated mixing hardware like the predecessor.&lt;br /&gt;
&lt;br /&gt;
=== DSiWare ===&lt;br /&gt;
&lt;br /&gt;
A platform started by Nintendo that allows developers to cheaply create and then sell original content at low prices (compared to the prices of brand new DSi games). All DSiWare games are available on the DSi Shop Channel on the main menu.&lt;br /&gt;
&lt;br /&gt;
=== Dump ===&lt;br /&gt;
&lt;br /&gt;
To extract the protected contents of something like a chip, NAND drive or disc which are otherwise inaccessible and/or incomprehensible under normal circumstances.&lt;br /&gt;
&lt;br /&gt;
=== DS Download Play ===&lt;br /&gt;
&lt;br /&gt;
Another application built into the Nintendo 3DS firmware. It is a place where people can download multiplayer games from another DS or 3DS. With those compatible games it is possible to use only one game card while playing with several people.&lt;br /&gt;
&lt;br /&gt;
== E ==&lt;br /&gt;
&lt;br /&gt;
=== Exploit ===&lt;br /&gt;
&lt;br /&gt;
A circumvention of security allowing a user to perform tasks that are not normally permitted. Often several exploits will be employed in a series with the user gaining increased authority over a system at each step, the goal typically being complete access and control.&lt;br /&gt;
&lt;br /&gt;
== F ==&lt;br /&gt;
&lt;br /&gt;
=== FCRAM ===&lt;br /&gt;
&lt;br /&gt;
FCRAM (Fast Cycle RAM) is a new technology developed by the Fujitsu Corporation that approaches the problem of DRAM/Processor speed in a different way. It is one of the components of 3DS hardware.&lt;br /&gt;
&lt;br /&gt;
== G ==&lt;br /&gt;
&lt;br /&gt;
=== gx ===&lt;br /&gt;
&lt;br /&gt;
The official API provided by Nintendo to access the 3DS&#039;s graphics subsystem.&lt;br /&gt;
&lt;br /&gt;
== H ==&lt;br /&gt;
&lt;br /&gt;
=== Hexadecimal (Hex) ===&lt;br /&gt;
&lt;br /&gt;
A term used to describe the base 16 number system, in which each digit represents four bits. After the digits 0-9, the letters A-F are used to represent the values 10-15. Hexadecimal is the preferred format for displaying binary data, as it is easy to mentally convert to/from binary and uses only 2 characters per byte.&lt;br /&gt;
&lt;br /&gt;
=== Home Menu ===&lt;br /&gt;
&lt;br /&gt;
The 3DS&#039;s [[Home Menu]] is the main interface which appears after the health warning screen when the system is powered on. In the 3DS this is where all of your default and downloaded channels and games are.&lt;br /&gt;
&lt;br /&gt;
== I ==&lt;br /&gt;
&lt;br /&gt;
=== IRC ===&lt;br /&gt;
&lt;br /&gt;
Internet Relay Chat is, real-time text-based chat over the Internet.&lt;br /&gt;
&lt;br /&gt;
== M ==&lt;br /&gt;
&lt;br /&gt;
=== MPO ===&lt;br /&gt;
&lt;br /&gt;
[[MPO|Multi-Picture Object]] is the open file-format used by Nintendo to make 3D images. It uses Exif tags and MP tags with JPG. MPO files can be read like two JPG files stuck together.&lt;br /&gt;
&lt;br /&gt;
== P ==&lt;br /&gt;
&lt;br /&gt;
=== PICA200 ===&lt;br /&gt;
&lt;br /&gt;
The GPU used by the 3DS. See [[Hardware#GPU]].&lt;br /&gt;
&lt;br /&gt;
== S ==&lt;br /&gt;
&lt;br /&gt;
=== SD Card ===&lt;br /&gt;
&lt;br /&gt;
Secure Digital Cards are common type of memory cards used by the 3DS, digital cameras, music players, etc. The standard SD card has a maximum capacity of 2 gigabytes (2048 megabytes); however, some 4 GB cards exist but are rare. These cards usually do not have great compatibility with non-SDHC products, even though they are not SDHC, so 2 GB is the preferable size.&lt;br /&gt;
&lt;br /&gt;
=== SDHC ===&lt;br /&gt;
&lt;br /&gt;
Secure Digital High Capacity Card are a type of SD cards with a higher storage capacity than normal ones. These are theoretically capable of holding up to 2 terabytes of space, but are politically limited by the current standards to 32 gigabytes.&lt;br /&gt;
&lt;br /&gt;
=== syscore ===&lt;br /&gt;
&lt;br /&gt;
syscore is the name given to one of the Old 3DS&#039;s ARM11 CPU cores. It refers to the core that is used to run the operating system software stack. The other core is called [[#appcore|appcore]].&lt;br /&gt;
&lt;br /&gt;
== T ==&lt;br /&gt;
&lt;br /&gt;
=== Ticket ===&lt;br /&gt;
A [[ticket]] is a file containing signature and encryption information on a particular [[Glossary#Title|title]]. Tickets may be console-unique: In particular, tickets for [[eShop]] contents are issued uniquely for each 3DS and hence cannot be transferred directly to other devices. System titles (and other content not available on eShop) are using tickets called [[Ticket#Some_facts|CommonETickets]], which are common to all devices.&lt;br /&gt;
&lt;br /&gt;
=== Title ===&lt;br /&gt;
&lt;br /&gt;
A title is a 3DS Game on a card or in a 3DS. This includes the built-in channels and menus. A title is identified by a unique title ID, an 8 byte (4 character) long code used for title identification. All titles are encrypted for security purposes.&lt;br /&gt;
&lt;br /&gt;
Related pages: [[Title_Data_Structure]], [[Title_list]], [[Glossary#Title_Metadata_.28TMD.29|Title Metadata]], [[Glossary#Ticket|Ticket]], [[Title_Database]]&lt;br /&gt;
&lt;br /&gt;
=== Title Metadata (TMD) ===&lt;br /&gt;
&lt;br /&gt;
[[Title metadata]] is a format used for storing metadata about a title and its installed contents, including which contents they consist of and their SHA1 hashes.&lt;br /&gt;
&lt;br /&gt;
=== TWL ===&lt;br /&gt;
&lt;br /&gt;
Codename used for the Nintendo DSi.&lt;br /&gt;
&lt;br /&gt;
Related pages: [[FIRM#TWL_FIRM_and_AGB_FIRM|TWL FIRM]], [[ARM7_Registers]]&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Glossary&amp;diff=15785</id>
		<title>Glossary</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Glossary&amp;diff=15785"/>
		<updated>2016-02-16T07:24:47Z</updated>

		<summary type="html">&lt;p&gt;Guiand: So we all know what AXI WRAM means!&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;A miniature dictionary for terms that may be encountered on 3DSBrew.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div class=&amp;quot;noautonum&amp;quot;&amp;gt;__TOC__&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== A ==&lt;br /&gt;
&lt;br /&gt;
=== AXI WRAM ===&lt;br /&gt;
&lt;br /&gt;
The name given to 32KB of SRAM (&amp;quot;Work&amp;quot; RAM) connected to the SOC via AXI. It is where the ARM11 kernel resides. &lt;br /&gt;
&lt;br /&gt;
=== appcore ===&lt;br /&gt;
&lt;br /&gt;
appcore is the name given to one of the Old 3DS&#039;s ARM11 CPU cores. It refers to the core that is used to run games and other [[NCCH]] content. The other core is called [[#syscore|syscore]].&lt;br /&gt;
&lt;br /&gt;
== C ==&lt;br /&gt;
&lt;br /&gt;
=== C ===&lt;br /&gt;
&lt;br /&gt;
A language homebrew developers program in, also used to make everything from web browsers to timers for computers.&lt;br /&gt;
&lt;br /&gt;
=== C++ ===&lt;br /&gt;
&lt;br /&gt;
An object oriented language homebrew developers program in. Like its name suggests, C++ is essentially a step up from C.&lt;br /&gt;
&lt;br /&gt;
== D ==&lt;br /&gt;
&lt;br /&gt;
=== DSi ===&lt;br /&gt;
&lt;br /&gt;
A handheld console created by Nintendo. It is the second successor to the Nintendo DS, and the 6th generation portable Nintendo gaming system. It features two (larger) screens, two cameras, and an online shop system. The menu is also overhauled, now using similar channels as used on the Wii. It has a screen brightness that can be set to one step higher than the DS Lite.&lt;br /&gt;
&lt;br /&gt;
=== DS Lite ===&lt;br /&gt;
&lt;br /&gt;
The predecessor to the DSi. It came after the original DS PHAT and has a screen that can be set to 4x as bright as the DS PHAT.&lt;br /&gt;
&lt;br /&gt;
=== DS &amp;quot;PHAT&amp;quot; ===&lt;br /&gt;
&lt;br /&gt;
The original Nintendo DS. It ended up being the successor to the Game Boy, though Nintendo did not intend for this to happen. It added a touch screen.&lt;br /&gt;
&lt;br /&gt;
=== DSP ===&lt;br /&gt;
&lt;br /&gt;
Digital Signal Processor. The 3DS uses a DSP core to do the audio mixing instead of relaying on dedicated mixing hardware like the predecessor.&lt;br /&gt;
&lt;br /&gt;
=== DSiWare ===&lt;br /&gt;
&lt;br /&gt;
A platform started by Nintendo that allows developers to cheaply create and then sell original content at low prices (compared to the prices of brand new DSi games). All DSiWare games are available on the DSi Shop Channel on the main menu.&lt;br /&gt;
&lt;br /&gt;
=== Dump ===&lt;br /&gt;
&lt;br /&gt;
To extract the protected contents of something like a chip, NAND drive or disc which are otherwise inaccessible and/or incomprehensible under normal circumstances.&lt;br /&gt;
&lt;br /&gt;
=== DS Download Play ===&lt;br /&gt;
&lt;br /&gt;
Another application built into the Nintendo 3DS firmware. It is a place where people can download multiplayer games from another DS or 3DS. With those compatible games it is possible to use only one game card while playing with several people.&lt;br /&gt;
&lt;br /&gt;
== E ==&lt;br /&gt;
&lt;br /&gt;
=== Exploit ===&lt;br /&gt;
&lt;br /&gt;
A circumvention of security allowing a user to perform tasks that are not normally permitted. Often several exploits will be employed in a series with the user gaining increased authority over a system at each step, the goal typically being complete access and control.&lt;br /&gt;
&lt;br /&gt;
== F ==&lt;br /&gt;
&lt;br /&gt;
=== FCRAM ===&lt;br /&gt;
&lt;br /&gt;
FCRAM (Fast Cycle RAM) is a new technology developed by the Fujitsu Corporation that approaches the problem of DRAM/Processor speed in a different way. It is one of the components of 3DS hardware.&lt;br /&gt;
&lt;br /&gt;
== G ==&lt;br /&gt;
&lt;br /&gt;
=== gx ===&lt;br /&gt;
&lt;br /&gt;
The official API provided by Nintendo to access the 3DS&#039;s graphics subsystem.&lt;br /&gt;
&lt;br /&gt;
== H ==&lt;br /&gt;
&lt;br /&gt;
=== Hexadecimal (Hex) ===&lt;br /&gt;
&lt;br /&gt;
A term used to describe the base 16 number system, in which each digit represents four bits. After the digits 0-9, the letters A-F are used to represent the values 10-15. Hexadecimal is the preferred format for displaying binary data, as it is easy to mentally convert to/from binary and uses only 2 characters per byte.&lt;br /&gt;
&lt;br /&gt;
=== Home Menu ===&lt;br /&gt;
&lt;br /&gt;
The 3DS&#039;s [[Home Menu]] is the main interface which appears after the health warning screen when the system is powered on. In the 3DS this is where all of your default and downloaded channels and games are.&lt;br /&gt;
&lt;br /&gt;
== I ==&lt;br /&gt;
&lt;br /&gt;
=== IRC ===&lt;br /&gt;
&lt;br /&gt;
Internet Relay Chat is, real-time text-based chat over the Internet.&lt;br /&gt;
&lt;br /&gt;
== M ==&lt;br /&gt;
&lt;br /&gt;
=== MPO ===&lt;br /&gt;
&lt;br /&gt;
[[MPO|Multi-Picture Object]] is the open file-format used by Nintendo to make 3D images. It uses Exif tags and MP tags with JPG. MPO files can be read like two JPG files stuck together.&lt;br /&gt;
&lt;br /&gt;
== P ==&lt;br /&gt;
&lt;br /&gt;
=== PICA200 ===&lt;br /&gt;
&lt;br /&gt;
The GPU used by the 3DS. See [[Hardware#GPU]].&lt;br /&gt;
&lt;br /&gt;
== S ==&lt;br /&gt;
&lt;br /&gt;
=== SD Card ===&lt;br /&gt;
&lt;br /&gt;
Secure Digital Cards are common type of memory cards used by the 3DS, digital cameras, music players, etc. The standard SD card has a maximum capacity of 2 gigabytes (2048 megabytes); however, some 4 GB cards exist but are rare. These cards usually do not have great compatibility with non-SDHC products, even though they are not SDHC, so 2 GB is the preferable size.&lt;br /&gt;
&lt;br /&gt;
=== SDHC ===&lt;br /&gt;
&lt;br /&gt;
Secure Digital High Capacity Card are a type of SD cards with a higher storage capacity than normal ones. These are theoretically capable of holding up to 2 terabytes of space, but are politically limited by the current standards to 32 gigabytes.&lt;br /&gt;
&lt;br /&gt;
=== syscore ===&lt;br /&gt;
&lt;br /&gt;
syscore is the name given to one of the Old 3DS&#039;s ARM11 CPU cores. It refers to the core that is used to run the operating system software stack. The other core is called [[#appcore|appcore]].&lt;br /&gt;
&lt;br /&gt;
== T ==&lt;br /&gt;
&lt;br /&gt;
=== Ticket ===&lt;br /&gt;
A [[ticket]] is a file containing signature and encryption information on a particular [[Glossary#Title|title]]. Tickets may be console-unique: In particular, tickets for [[eShop]] contents are issued uniquely for each 3DS and hence cannot be transferred directly to other devices. System titles (and other content not available on eShop) are using tickets called [[Ticket#Some_facts|CommonETickets]], which are common to all devices.&lt;br /&gt;
&lt;br /&gt;
=== Title ===&lt;br /&gt;
&lt;br /&gt;
A title is a 3DS Game on a card or in a 3DS. This includes the built-in channels and menus. A title is identified by a unique title ID, an 8 byte (4 character) long code used for title identification. All titles are encrypted for security purposes.&lt;br /&gt;
&lt;br /&gt;
Related pages: [[Title_Data_Structure]], [[Title_list]], [[Glossary#Title_Metadata_.28TMD.29|Title Metadata]], [[Glossary#Ticket|Ticket]], [[Title_Database]]&lt;br /&gt;
&lt;br /&gt;
=== Title Metadata (TMD) ===&lt;br /&gt;
&lt;br /&gt;
[[Title metadata]] is a format used for storing metadata about a title and its installed contents, including which contents they consist of and their SHA1 hashes.&lt;br /&gt;
&lt;br /&gt;
=== TWL ===&lt;br /&gt;
&lt;br /&gt;
Codename used for the Nintendo DSi.&lt;br /&gt;
&lt;br /&gt;
Related pages: [[FIRM#TWL_FIRM_and_AGB_FIRM|TWL FIRM]], [[ARM7_Registers]]&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Memory_layout&amp;diff=15783</id>
		<title>Memory layout</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Memory_layout&amp;diff=15783"/>
		<updated>2016-02-16T07:15:36Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Clarify meaning of &amp;quot;AXI WRAM&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=ARM11 Physical memory regions =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Old 3DS&lt;br /&gt;
!  Address&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x00000000&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| Bootrom (super secret code/data @ 0x8000)&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| Bootrom mirror&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x10000000&lt;br /&gt;
|?&lt;br /&gt;
| [[IO]] memory&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x17E00000&lt;br /&gt;
| 0x00002000&lt;br /&gt;
| MPCore private memory region&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
| 0x17E10000&lt;br /&gt;
| 0x00001000&lt;br /&gt;
| L2C-310 Level 2 Cache Controller (2MB)&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x18000000&lt;br /&gt;
| 0x00600000&lt;br /&gt;
| VRAM (divided in two banks, VRAM and VRAMB)&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
| 0x1F000000&lt;br /&gt;
| 0x00400000&lt;br /&gt;
| [[New_3DS]] additional memory&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x1FF00000&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| DSP memory&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x1FF80000&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| AXI-connected WRAM (&amp;quot;Work&amp;quot; SRAM)&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x20000000&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| FCRAM&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
| 0x28000000&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| [[New_3DS]] FCRAM extension&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0xFFFF0000&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| Bootrom mirror&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==0x17E10000==&lt;br /&gt;
The 32bit register at 0x17E10000+0x100 only has bit0 set when, on New3DS, [[PTMSYSM:ConfigureNew3DSCPU]] was used with bit1 set for the input value(the L2 cache flag). All other bits in this register are normally all-zero. Therefore: bit0 set = new cache hardware enabled, clear = new cache hardware disabled(this bit is how the ARM11-kernel checks whether the additional cache hw is enabled).&lt;br /&gt;
&lt;br /&gt;
To enable the additional cache hw, the following is used by the ARM11-kernel:&lt;br /&gt;
* Sets bit0 in 32bit register 0x17E10000+0x100.&lt;br /&gt;
&lt;br /&gt;
To disable the additional cache hw, the following is used by the ARM11-kernel:&lt;br /&gt;
* Writes value 0xFFFF to 32bit register 0x17E10000+0x77C.&lt;br /&gt;
* Waits for bit0 in 32bit register 0x17E10000+0x730 to become clear.&lt;br /&gt;
* Writes value 0x0 to 32bit register 0x17E10000+0x0.&lt;br /&gt;
* Clears bit0 in 32bit register 0x17E10000+0x100.&lt;br /&gt;
&lt;br /&gt;
=ARM9 Physical memory regions =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Old 3DS&lt;br /&gt;
!  Address&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x00000000&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| Instruction TCM, repeating each 0x8000 bytes.&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x01FF8000&lt;br /&gt;
| 0x00008000&lt;br /&gt;
| Instruction TCM (Accessed by the kernel and process by this address)&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x07FF8000&lt;br /&gt;
| 0x00008000&lt;br /&gt;
| Instruction TCM (Accessed by bootrom by this address)&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ARM9-only internal memory (ARM7&#039;s internal regions are mapped here as well)&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
| 0x08100000&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| [[New_3DS]] ARM9-only extension, only enabled when a certain [[CONFIG_Registers|CONFIG]] register is set.&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x10000000&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| [[IO]] memory&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x18000000&lt;br /&gt;
| 0x00600000&lt;br /&gt;
| VRAM (divided in two banks, VRAM and VRAMB) &lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x1FF00000&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| DSP memory&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x1FF80000&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| AXI-connected WRAM&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0x20000000&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| FCRAM&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: red&amp;quot; | No&lt;br /&gt;
| 0x28000000&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| [[New_3DS]] FCRAM extension&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0xFFF00000&lt;br /&gt;
| 0x00004000&lt;br /&gt;
| Data TCM (Mapped during bootrom)&lt;br /&gt;
|-&lt;br /&gt;
| style=&amp;quot;background: green&amp;quot; | Yes&lt;br /&gt;
| 0xFFFF0000&lt;br /&gt;
| 0x00010000&lt;br /&gt;
| Bootrom, the main region is at +0x8000, which is disabled during system boot.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==ARM9 MPU regions==&lt;br /&gt;
For the below instruction permissions: RO = memory is executable, while None = not-executable.&lt;br /&gt;
&lt;br /&gt;
===NATIVE_FIRM/SAFE_MODE_FIRM ARM9 kernel===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Region&lt;br /&gt;
!  Address&lt;br /&gt;
!  Size&lt;br /&gt;
!  Privileged-mode data permissions&lt;br /&gt;
!  User-mode data permissions&lt;br /&gt;
!  Privileged-mode instruction permissions&lt;br /&gt;
!  User-mode instruction permissions&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| 0xFFFF0000&lt;br /&gt;
| 32KB/0x8000&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| 0x01FF8000&lt;br /&gt;
| 32KB/0x8000&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| RO&lt;br /&gt;
| RO&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| 1MB/0x100000. &amp;gt;=[[8.0.0-18|8.0.0-X]]: 2MB/0x200000.&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| RO&lt;br /&gt;
| RO&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| 0x10000000&lt;br /&gt;
| 128KB/0x20000&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| 0x10100000&lt;br /&gt;
| 512KB/0x80000&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 0x20000000&lt;br /&gt;
| 128MB/0x8000000. &amp;gt;=[[8.0.0-18|8.0.0-X]]: 256MB/0x10000000.&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| 128KB/0x20000&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| 0x08020000&lt;br /&gt;
| &amp;lt;[[3.0.0-5]]: 64KB/0x10000. &amp;gt;=[[3.0.0-5]]: 32KB/0x8000.&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The above is the MPU region settings setup by the ARM9-kernel in the crt0.&lt;br /&gt;
&lt;br /&gt;
The New3DS ARM9-kernel MPU region settings are the same as the Old3DS MPU region settings for &amp;gt;=[[8.0.0-18|8.0.0-X]].&lt;br /&gt;
&lt;br /&gt;
At the start of the Process9 function executed in kernel-mode via svc7b during firm-launching, it changes some MPU region settings. At the end of that function, before it uses the ARM9/ARM11 entrypoint fields, it disables MPU.&lt;br /&gt;
&lt;br /&gt;
===New3DS [[FIRM|ARM9-loader]]===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Region&lt;br /&gt;
!  Address&lt;br /&gt;
!  Size&lt;br /&gt;
!  Privileged-mode data permissions&lt;br /&gt;
!  User-mode data permissions&lt;br /&gt;
!  Privileged-mode instruction permissions&lt;br /&gt;
!  User-mode instruction permissions&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| 0xFFFF0000&lt;br /&gt;
| 32KB/0x8000&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| 0x01FF8000&lt;br /&gt;
| 32KB/0x8000&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| 2MB/0x200000&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| 0x10000000&lt;br /&gt;
| 128KB/0x20000&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| None&lt;br /&gt;
| None&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
MPU regions 4-7 are disabled. Note that the entire ARM9-loader runs in SVC-mode.&lt;br /&gt;
&lt;br /&gt;
===TWL_FIRM/AGB_FIRM ARM9 kernel===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Region&lt;br /&gt;
!  Address&lt;br /&gt;
!  Size&lt;br /&gt;
!  Privileged-mode data permissions&lt;br /&gt;
!  User-mode data permissions&lt;br /&gt;
!  Privileged-mode instruction permissions&lt;br /&gt;
!  User-mode instruction permissions&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| 0xFFFF0000&lt;br /&gt;
| 32KB/0x8000&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| 0x01FF8000&lt;br /&gt;
| 32KB/0x8000&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| RO&lt;br /&gt;
| RO&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| 1MB/0x100000. New3DS: 2MB/0x200000.&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| RO&lt;br /&gt;
| RO&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| 0x10000000&lt;br /&gt;
| 2MB/0x200000.&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| 0x1FF00000&lt;br /&gt;
| 512KB/0x80000&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 0x20000000&lt;br /&gt;
| 128MB/0x8000000. New3DS: 256MB/0x10000000.&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| &amp;lt;[[3.0.0-5|3.0.0-X]]: 256KB/0x40000. &amp;gt;=[[3.0.0-5|3.0.0-X]]: 128KB/0x20000&lt;br /&gt;
| RW&lt;br /&gt;
| None&lt;br /&gt;
| RO&lt;br /&gt;
| None&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| 0x08080000&lt;br /&gt;
| 128KB/0x20000&lt;br /&gt;
| RW&lt;br /&gt;
| RW&lt;br /&gt;
| RO&lt;br /&gt;
| RO&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==ARM9 ITCM==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  ITCM mirror address&lt;br /&gt;
!  ITCM bootrom mirror address&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FF8000&lt;br /&gt;
| &lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x3700&lt;br /&gt;
| Uninitialized memory.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB700&lt;br /&gt;
| 0x07FFB700&lt;br /&gt;
| 0x3700&lt;br /&gt;
| 0x100&lt;br /&gt;
| The unprotected ARM9-bootrom code copies code from unprotected bootrom to 0x07FFB700(ITCM mirror) size 0x100, then calls the code at 0x07FFB700. The code located here is the code used for disabling access to the bootroms.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB800&lt;br /&gt;
| &lt;br /&gt;
| 0x3800&lt;br /&gt;
| 0x4&lt;br /&gt;
| This is always 0xDEADB00F.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB804&lt;br /&gt;
| &lt;br /&gt;
| 0x3804&lt;br /&gt;
| 0x4&lt;br /&gt;
| This is the u32 DeviceId.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB808&lt;br /&gt;
| &lt;br /&gt;
| 0x3808&lt;br /&gt;
| 0x10&lt;br /&gt;
| This is the fall-back keyY used for movable.sed keyY when movable.sed doesn&#039;t exist in NAND(the last two words here are used on retail for generating console-unique TWL keydata/etc). This is also used for &amp;quot;LocalFriendCodeSeed&amp;quot;, etc.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB818&lt;br /&gt;
| &lt;br /&gt;
| 0x3818&lt;br /&gt;
| 0x1&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB819&lt;br /&gt;
| &lt;br /&gt;
| 0x3819&lt;br /&gt;
| 0x1&lt;br /&gt;
| This is the [[CTCert]] issuer type: 0 = retail &amp;quot;Nintendo CA - G3_NintendoCTR2prod&amp;quot;, non-zero = dev &amp;quot;Nintendo CA - G3_NintendoCTR2dev&amp;quot;.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB81A&lt;br /&gt;
| &lt;br /&gt;
| 0x381A&lt;br /&gt;
| 0x6&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB820&lt;br /&gt;
| &lt;br /&gt;
| 0x3820&lt;br /&gt;
| 0x4&lt;br /&gt;
| This is the CTCert ECDSA exponent, this is byte-swapped when *((u8*)(0x01FFB800+0x18)) is &amp;gt;=5.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB824&lt;br /&gt;
| &lt;br /&gt;
| 0x3824&lt;br /&gt;
| 0x2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB826&lt;br /&gt;
| &lt;br /&gt;
| 0x3826&lt;br /&gt;
| 0x1E&lt;br /&gt;
| This is the CTCert ECDSA privk.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB844&lt;br /&gt;
| &lt;br /&gt;
| 0x3844&lt;br /&gt;
| 0x3C&lt;br /&gt;
| This is the CTCert ECDSA signature.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB880&lt;br /&gt;
| &lt;br /&gt;
| 0x3880&lt;br /&gt;
| 0x80&lt;br /&gt;
| This is all-zero.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFB900&lt;br /&gt;
| &lt;br /&gt;
| 0x3900&lt;br /&gt;
| 0x200&lt;br /&gt;
| This is the 0x200-bytes from NAND sector0.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFBB00&lt;br /&gt;
| &lt;br /&gt;
| 0x3B00&lt;br /&gt;
| 0x200&lt;br /&gt;
| This is the 0x200-bytes from the plaintext NAND firm partition FIRM header, read by bootrom.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFBD00&lt;br /&gt;
| &lt;br /&gt;
| 0x3D00&lt;br /&gt;
| 0x200&lt;br /&gt;
| Unknown, not used by [[FIRM]]. Probably RSA related going by the data right after this? These are not console-unique.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFBF00&lt;br /&gt;
| &lt;br /&gt;
| 0x3F00&lt;br /&gt;
| 0x100&lt;br /&gt;
| This is the RSA-2048 modulus for [[RSA_Registers|RSA]]-engine slot2.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFC000&lt;br /&gt;
| &lt;br /&gt;
| 0x4000&lt;br /&gt;
| 0x100&lt;br /&gt;
| This is the RSA-2048 modulus for RSA-engine slot3.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFC100&lt;br /&gt;
| &lt;br /&gt;
| 0x4100&lt;br /&gt;
| 0x800&lt;br /&gt;
| These are RSA-2048 keys: 4 slots, each slot is 0x200-bytes. Slot+0 is the modulus, slot+0x100 is the private exponent. This can be confirmed by RSA-decrypting a message into a signature, then RSA-encrypting the signature back into a message, and comparing the original message with the output from the last operation.&lt;br /&gt;
&lt;br /&gt;
[[FIRM]] doesn&#039;t seem to ever use these. None of these are related to RSA-keyslot0 used for v6.0/v7.0 key generation. These moduli are separate from all other moduli used elsewhere.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFC900&lt;br /&gt;
| 0x07FFC900&lt;br /&gt;
| 0x4900&lt;br /&gt;
| 0x400&lt;br /&gt;
| The unprotected ARM9-bootrom copies data to 0x07FFC900(mirror of 0x01FFC900) size 0x400. This data is copied from the AXI-connected WRAM, initialized by ARM11-bootrom(the addr used for the src is determined by [[CONFIG_Registers|REG_UNITINFO]]). These are RSA moduli: retailsrcptr = 0x1FFFD000, devsrvptr = 0x1FFFD400.&lt;br /&gt;
* The first 0x100-bytes here is the RSA-2048 modulus for the CFA NCCH header, and for the gamecard NCSD header.&lt;br /&gt;
* 0x01FFCA00 is the RSA-2048 modulus for the CXI accessdesc signature, written to rsaengine keyslot1 by NATIVE_FIRM.&lt;br /&gt;
* 0x01FFCB00 size 0x200 is unknown, probably RSA related, these aren&#039;t used by [[FIRM]](these are not console-unique).&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFCD00&lt;br /&gt;
| &lt;br /&gt;
| 0x4D00&lt;br /&gt;
| 0x80&lt;br /&gt;
| Unknown, not used by [[FIRM]]. This isn&#039;t console-unique.&lt;br /&gt;
The first 0x10-bytes are checked by the v6.0/v7.0 NATIVE_FIRM keyinit function, when non-zero it clears this block and continues to do the key generation. Otherwise when this block was already all-zero, it immediately returns.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFCD80&lt;br /&gt;
| &lt;br /&gt;
| 0x4D80&lt;br /&gt;
| 0x64&lt;br /&gt;
| 0x01FFCD84 size 0x10-bytes is the NAND CID(the 0x64-byte region at 0x01FFCD80 is initialized by Process9 + ARM9-bootrom). The u32 at 0x01FFCDC4 is the total number of NAND sectors, read from a MMC command.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFCDE4&lt;br /&gt;
| &lt;br /&gt;
| 0x4DE4&lt;br /&gt;
| 0x21C&lt;br /&gt;
| Uninitialized memory.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFD000&lt;br /&gt;
| 0x07FFD000&lt;br /&gt;
| 0x5000&lt;br /&gt;
| 0x2470&lt;br /&gt;
| The unprotected ARM9-bootrom copies 0x1FFFA000(AXIWRAM mem initialized by ARM11-bootrom) size 0x2470 to 0x07FFD000(mirror of 0x01FFD000). This block contains DSi keys.&lt;br /&gt;
* 0x01FFD000 is the RSA-1024 modulus for the retail System Menu&lt;br /&gt;
* 0x01FFD080 is the RSA-1024 modulus for DSi Wifi firmware and DSi Sound&lt;br /&gt;
* 0x01FFD100 is the RSA-1024 modulus for base DSi apps (Settings, Shop, etc.)&lt;br /&gt;
* 0x01FFD180 is the RSA-1024 modulus for DSiWare and RSA-signed cartridge headers&lt;br /&gt;
* 0x01FFD210 is the keyY for per-console-encrypted ES blocks&lt;br /&gt;
* 0x01FFD220 is the keyY for fixed-keyX ES blocks&lt;br /&gt;
* 0x01FFD300 is the DSi common (normal)key&lt;br /&gt;
* 0x01FFD350 is a normalkey set on keyslot 0x02, and is likely only used during boot&lt;br /&gt;
* 0x01FFD380 is the keyslot 0x00 keyX and the first half of the retail keyX for modcrypt crypto &amp;quot;Nintendo&amp;quot;&lt;br /&gt;
* 0x01FFD398 is the keyX used for &#039;Tad&#039; crypto, usually in keyslot 0x02 &amp;quot;Nintendo DS&amp;quot;, ..&lt;br /&gt;
* 0x01FFD3A8 is set as the middle two words of keyslot 0x03&#039;s keyX, before being overwritten &amp;quot;NINTENDO&amp;quot;&lt;br /&gt;
* 0x01FFD3BC is the keyY for keyslot 0x01, see below&lt;br /&gt;
* 0x01FFD3C8 is the fixed keyY used for eMMC partition crypto on retail DSi, see below (keyslot 0x03)&lt;br /&gt;
* 0x01FFD3E0 is the 0x1048-byte Blowfish data for DSi cart crypto&lt;br /&gt;
* 0x01FFE428 is the 0x1048-byte Blowfish data for DS cart crypto&lt;br /&gt;
On the 3DS, keyslots 0x01 and 0x03 have the last word set as 0xE1A00005 instead of the next word in ITCM. This is consistent with retail DSis.&lt;br /&gt;
|-&lt;br /&gt;
| 0x01FFF470&lt;br /&gt;
| &lt;br /&gt;
| 0x7470&lt;br /&gt;
| 0xB90&lt;br /&gt;
| Uninitialized memory.&lt;br /&gt;
0x01FFFC00 size 0x100-bytes starting with [[9.5.0-22|9.5.0-X]] is the FIRM header used during FIRM-launching.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=[[New_3DS]] physical 0x1F000000 memory=&lt;br /&gt;
This area is used by [[QTM Services]](starting at offset 0x200000, size 0x180000). This area is not accessible to the GPU on the old 3DS. The old 3DS and New 3DS GSP module has vaddr-&amp;gt;physaddr conversion code for this entire region. On the New 3DS, only the first 0x200000-bytes (half of this memory) are accessible to the GPU.&lt;br /&gt;
&lt;br /&gt;
=Memory map by firmware=&lt;br /&gt;
* [[Virtual address mapping FW0B]]&lt;br /&gt;
* [[Virtual address mapping FW1F]]&lt;br /&gt;
* [[Virtual address mapping FW25]]&lt;br /&gt;
* [[Virtual address mapping FW2E]]&lt;br /&gt;
* [[Virtual address mapping FW37]]&lt;br /&gt;
* [[Virtual address mapping FW38‎]]&lt;br /&gt;
* [[Virtual address mapping FW3F]]&lt;br /&gt;
* FW49([[9.6.0-24|9.6.0-X]]) and [[10.0.0-27|10.0.0-X]] ARM11-kernel vmem mapping is identical to FW40([[9.5.0-22|9.5.0-X]]).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* [[Virtual address mapping TWLFIRM04]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* [[Virtual address mapping New3DS v8.1]]&lt;br /&gt;
* [[Virtual address mapping New3DS v9.0]]&lt;br /&gt;
* [[Virtual address mapping New3DS v9.2]]&lt;br /&gt;
&lt;br /&gt;
=ARM11 Detailed physical memory map=&lt;br /&gt;
 18000000 - 18600000: VRAM&lt;br /&gt;
 &lt;br /&gt;
 1FF80000 - 1FFAB000: Kernel code&lt;br /&gt;
 1FFAB000 - 1FFF0000: SlabHeap [temporarily contains boot processes]&lt;br /&gt;
 1FFF0000 - 1FFF1000: ?&lt;br /&gt;
 1FFF1000 - 1FFF2000: ?&lt;br /&gt;
 1FFF2000 - 1FFF3000: ?&lt;br /&gt;
 1FFF3000 - 1FFF4000: ?&lt;br /&gt;
 1FFF4000 - 1FFF5000: Exception vectors&lt;br /&gt;
 1FFF5000 - 1FFF5800: Unused?&lt;br /&gt;
 1FFF5800 - 1FFF5C00: 256-entry L2 MMU table for VA FF4xx000&lt;br /&gt;
 1FFF5C00 - 1FFF6000: 256-entry L2 MMU table for VA FF5xx000&lt;br /&gt;
 1FFF6000 - 1FFF6400: 256-entry L2 MMU table for VA FF6xx000&lt;br /&gt;
 1FFF6400 - 1FFF6800: 256-entry L2 MMU table for VA FF7xx000&lt;br /&gt;
 1FFF6800 - 1FFF6C00: 256-entry L2 MMU table for VA FF8xx000&lt;br /&gt;
 1FFF6C00 - 1FFF7000: 256-entry L2 MMU table for VA FF9xx000&lt;br /&gt;
 1FFF7000 - 1FFF7400: 256-entry L2 MMU table for VA FFAxx000&lt;br /&gt;
 1FFF7400 - 1FFF7800: 256-entry L2 MMU table for VA FFBxx000&lt;br /&gt;
 1FFF7800 - 1FFF7C00: MMU table but unused?&lt;br /&gt;
 1FFF7C00 - 1FFF8000: 256-entry L2 MMU table for VA FFFxx000 &lt;br /&gt;
 1FFF8000 - 1FFFC000: 4096-entry L1 MMU table for VA xxx00000 (CPU 0)&lt;br /&gt;
 1FFFC000 - 20000000: 4096-entry L1 MMU table for VA xxx00000 (CPU 1)&lt;br /&gt;
 20000000 - 28000000: Main memory&lt;br /&gt;
&lt;br /&gt;
The entire FCRAM is cleared during NATIVE_FIRM boot. This is done by the ARM11 kernel in order by region as it initializes after loading [[FIRM]] launch parameters from FCRAM.&lt;br /&gt;
&lt;br /&gt;
== FCRAM memory-regions layout ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  [[Configuration_Memory#APPMEMTYPE|Configmem-APPMEMTYPE]] Value&lt;br /&gt;
!  Base address relative to FCRAM+0, for APPLICATION mem-region&lt;br /&gt;
!  Region size, for APPLICATION mem-region&lt;br /&gt;
!  Base address relative to FCRAM+0, for SYSTEM mem-region&lt;br /&gt;
!  Region size, for SYSTEM mem-region&lt;br /&gt;
!  Base address relative to FCRAM+0, for BASE mem-region&lt;br /&gt;
!  Region size, for BASE mem-region&lt;br /&gt;
|-&lt;br /&gt;
| 0 (default with regular 3DS kernel, used when the type is not 2-5)&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x04000000(64MB)&lt;br /&gt;
| 0x04000000&lt;br /&gt;
| 0x02C00000&lt;br /&gt;
| 0x06C00000&lt;br /&gt;
| 0x01400000&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x06000000(96MB)&lt;br /&gt;
| 0x06000000&lt;br /&gt;
| 0x00C00000&lt;br /&gt;
| 0x06C00000&lt;br /&gt;
| 0x01400000&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x05000000(80MB)&lt;br /&gt;
| 0x05000000&lt;br /&gt;
| 0x01C00000&lt;br /&gt;
| 0x06C00000&lt;br /&gt;
| 0x01400000&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x04800000(72MB)&lt;br /&gt;
| 0x04800000&lt;br /&gt;
| 0x02400000&lt;br /&gt;
| 0x06C00000&lt;br /&gt;
| 0x01400000&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x02000000(32MB)&lt;br /&gt;
| 0x02000000&lt;br /&gt;
| 0x04C00000&lt;br /&gt;
| 0x06C00000&lt;br /&gt;
| 0x01400000&lt;br /&gt;
|-&lt;br /&gt;
| 6 (This is the default on New3DS. With [[New_3DS]] kernel this is the type used when the value is not 7)&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x07C00000(124MB)&lt;br /&gt;
| 0x07C00000&lt;br /&gt;
| 0x06400000&lt;br /&gt;
| 0x0E000000&lt;br /&gt;
| 0x02000000&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x0B200000(178MB)&lt;br /&gt;
| 0x0B200000&lt;br /&gt;
| 0x02E00000&lt;br /&gt;
| 0x0E000000&lt;br /&gt;
| 0x02000000&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The SYSTEM mem-region size is calculated with: size = FCRAMTOTALSIZE - (APPLICATION_MEMREGIONSIZE + BASE_MEMREGIONSIZE).&lt;br /&gt;
&lt;br /&gt;
Support for type6/7 was [[NCCH/Extended Header|implemented]] in [[NS]] with [[8.0.0-18]], these are only supported in the [[New_3DS]] ARM11-kernel not the regular 3DS kernel. These two types are the only ones supported by the New3DS kernel.&lt;br /&gt;
&lt;br /&gt;
All memory allocated by the kernel itself for kernel use is located under BASE. Most system-modules run under the BASE memregion too.&lt;br /&gt;
&lt;br /&gt;
Free/used memory on [[4.5.0-10]] with Home Menu / Internet Browser, with the default APPMEMTYPE on retail:&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Region&lt;br /&gt;
!  Base address relative to FCRAM+0&lt;br /&gt;
!  Region size&lt;br /&gt;
!  Used memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]&lt;br /&gt;
!  Used memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]&lt;br /&gt;
!  Free memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]&lt;br /&gt;
!  Free memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]&lt;br /&gt;
|-&lt;br /&gt;
| APPLICATION&lt;br /&gt;
| 0x0&lt;br /&gt;
| 0x04000000&lt;br /&gt;
| 0x0&lt;br /&gt;
| &lt;br /&gt;
| 0x04000000&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| SYSTEM&lt;br /&gt;
| 0x04000000&lt;br /&gt;
| 0x02C00000&lt;br /&gt;
| 0x01488000&lt;br /&gt;
| 0x02A50000&lt;br /&gt;
| 0x01778000&lt;br /&gt;
| 0x001B0000&lt;br /&gt;
|-&lt;br /&gt;
| BASE&lt;br /&gt;
| 0x06C00000&lt;br /&gt;
| 0x01400000&lt;br /&gt;
| 0x01202000&lt;br /&gt;
| 0x01236000&lt;br /&gt;
| 0x001FE000&lt;br /&gt;
| 0x001CA000&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=ARM11 Detailed virtual memory map=&lt;br /&gt;
(valid only for FW0B, see [[#Memory map by firmware|Memory map by firmware]] for subsequent versions)&lt;br /&gt;
&lt;br /&gt;
 E8000000 - E8600000: mapped VRAM (18000000 - 18600000)&lt;br /&gt;
 &lt;br /&gt;
 EFF00000 - F0000000: mapped Internal memory (1FF00000 - 20000000)&lt;br /&gt;
 F0000000 - F8000000: mapped Main memory&lt;br /&gt;
 &lt;br /&gt;
 FF401000 - FF402000: mapped ? (27FC7000 - 27FC8000)&lt;br /&gt;
 &lt;br /&gt;
 FF403000 - FF404000: mapped ? (27FC2000 - 27FC3000)&lt;br /&gt;
 &lt;br /&gt;
 FF405000 - FF406000: mapped ? (27FBB000 - 27FBC000)&lt;br /&gt;
 &lt;br /&gt;
 FF407000 - FF408000: mapped ? (27FB3000 - 27FB4000)&lt;br /&gt;
 &lt;br /&gt;
 FF409000 - FF40A000: mapped ? (27F8E000 - 27F8F000)&lt;br /&gt;
 &lt;br /&gt;
 FFF00000 - FFF45000: mapped SlabHeap &lt;br /&gt;
 &lt;br /&gt;
 FFF60000 - FFF8B000: mapped Kernel code&lt;br /&gt;
 &lt;br /&gt;
 FFFCC000 - FFFCD000: mapped IO [[I2C|I2C]] second bus (10144000 - 10145000)&lt;br /&gt;
 &lt;br /&gt;
 FFFCE000 - FFFCF000: mapped IO PDC([[LCD]]) (10400000 - 10401000)&lt;br /&gt;
 &lt;br /&gt;
 FFFD0000 - FFFD1000: mapped IO PDN (10141000 - 10142000)&lt;br /&gt;
 &lt;br /&gt;
 FFFD2000 - FFFD3000: mapped IO PXI (10163000 - 10164000)&lt;br /&gt;
 &lt;br /&gt;
 FFFD4000 - FFFD5000: mapped IO PAD (10146000 - 10147000)&lt;br /&gt;
 &lt;br /&gt;
 FFFD6000 - FFFD7000: mapped IO LCD (10202000 - 10203000)&lt;br /&gt;
 &lt;br /&gt;
 FFFD8000 - FFFD9000: mapped IO DSP (10140000 - 10141000)&lt;br /&gt;
 &lt;br /&gt;
 FFFDA000 - FFFDB000: mapped IO XDMA (10200000 - 10201000)&lt;br /&gt;
 &lt;br /&gt;
 FFFDC000 - FFFE0000: mapped ? (1FFF8000 - 1FFFC000)&lt;br /&gt;
 &lt;br /&gt;
 FFFE1000 - FFFE2000: mapped ? (1FFF0000 - 1FFF1000)&lt;br /&gt;
 &lt;br /&gt;
 FFFE3000 - FFFE4000: mapped ? (1FFF2000 - 1FFF3000)&lt;br /&gt;
 &lt;br /&gt;
 FFFE5000 - FFFE9000: mapped L1 MMU table for VA xxx00000&lt;br /&gt;
 &lt;br /&gt;
 FFFEA000 - FFFEB000: mapped ? (1FFF1000 - 1FFF2000)&lt;br /&gt;
 &lt;br /&gt;
 FFFEC000 - FFFED000: mapped ? (1FFF3000 - 1FFF4000)&lt;br /&gt;
 &lt;br /&gt;
 FFFEE000 - FFFF0000: mapped IO IRQ (17E00000 - 17E02000)&lt;br /&gt;
 &lt;br /&gt;
 FFFF0000 - FFFF1000: mapped Exception vectors&lt;br /&gt;
 &lt;br /&gt;
 FFFF2000 - FFFF6000: mapped L1 MMU table for VA xxx00000&lt;br /&gt;
 &lt;br /&gt;
 FFFF7000 - FFFF8000: mapped ? (1FFF1000 - 1FFF2000)&lt;br /&gt;
 &lt;br /&gt;
 FFFF9000 - FFFFA000: mapped ? (1FFF3000 - 1FFF4000)&lt;br /&gt;
 &lt;br /&gt;
 FFFFB000 - FFFFE000: mapped L2 MMU tables (1FFF5000 - 1FFF8000)&lt;br /&gt;
&lt;br /&gt;
==0xFF4XX000==&lt;br /&gt;
Each [[KThread|thread]] is allocated a 0x1000-byte page in this region: the first page at 0xFF401000 is for the first created thread, 0xFF403000 for the second thread. This region is used to store the SVC-mode stack for the thread, and thread context data used for context switching. When the IRQ handler, prefetch/data abort handlers, and undefined instruction handler are entered where the SPSR-mode=user, these handlers then store LR+SPSR for the current mode on the SVC-mode stack, then these handlers switch to SVC-mode.&lt;br /&gt;
&lt;br /&gt;
This page does not contain a dedicated block for storing R0-PC(etc). For user-mode, the user-mode regs are instead saved on the SVC-mode stack when IRQs such as timers for context switching are triggered.&lt;br /&gt;
&lt;br /&gt;
Structure of this page, relative to page_endaddr-0xC8:&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0&lt;br /&gt;
| &lt;br /&gt;
| SVC-mode stack-top. The 0x10-byte SVC-access-control for this thread is also located here, which is checked by the SVC-handler.&lt;br /&gt;
|-&lt;br /&gt;
| 0x18&lt;br /&gt;
| 0x28&lt;br /&gt;
| SVC-mode saved registers, stored/loaded during context switches: R4-R9, SL, FP, SP, LR. After loading these registers, the context switch code will jump to the loaded LR.&lt;br /&gt;
|-&lt;br /&gt;
| 0xC0&lt;br /&gt;
| 4&lt;br /&gt;
| fpexc from vmrs, used during context switches with the above saved registers.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
For NATIVE_FIRM the memory pages for this region are located in FCRAM, however for TWL_FIRM these are located in AXI WRAM. For TWL_FIRM v6704 the first thread&#039;s page for this region is located at physical address 0x1FF93000, the next one at 0x1FF92000, etc.&lt;br /&gt;
&lt;br /&gt;
=ARM11 User-land memory regions=&lt;br /&gt;
==NATIVE_FIRM/SAFE_MODE_FIRM Userland Memory==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Virtual Address Base&lt;br /&gt;
!  Physical Address Base&lt;br /&gt;
!  Region Max Size&lt;br /&gt;
!  Address-range available for svcMapMemoryBlock&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000 / 0x14000000&lt;br /&gt;
| &lt;br /&gt;
| 0x03F00000&lt;br /&gt;
| No&lt;br /&gt;
| The [[ExeFS]]:/.code is loaded here, executables must be loaded to the 0x00100000 region when the exheader &amp;quot;special memory&amp;quot; flag is clear. The 0x03F00000-byte size restriction only applies when this flag is clear. Executables are usually loaded to 0x14000000 when the exheader &amp;quot;special memory&amp;quot; flag is set, however this address can be arbitrary.&lt;br /&gt;
|-&lt;br /&gt;
| 0x04000000&lt;br /&gt;
| ?&lt;br /&gt;
| ?&lt;br /&gt;
| No&lt;br /&gt;
| Used for mapping buffers during IPC, see [[IPC Command Structure]].&lt;br /&gt;
|-&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| Main stack physaddr - &amp;lt;heap size for the allocated vaddr 0x08000000 memory&amp;gt;&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| Yes&lt;br /&gt;
| Heap mapped by [[SVC|ControlMemory]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x10000000-StackSize&lt;br /&gt;
| .bss physical address - total stack pages&lt;br /&gt;
| StackSize from process exheader&lt;br /&gt;
| &lt;br /&gt;
| Stack for the main-thread, initialized by the ARM11 kernel. The StackSize from the exheader is usually 0x4000, therefore the stack-bottom is usually 0x0FFFC000. The stack for the other threads is normally located in the process .data section however this can be arbitrary.&lt;br /&gt;
|-&lt;br /&gt;
| 0x10000000&lt;br /&gt;
| &lt;br /&gt;
| 0x04000000&lt;br /&gt;
| Yes&lt;br /&gt;
| [[SVC|Shared]] memory&lt;br /&gt;
|-&lt;br /&gt;
| 0x14000000&lt;br /&gt;
| FCRAM+0&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| No&lt;br /&gt;
| Can be mapped by [[SVC|ControlMemory]], this is used for processes&#039; [[SVC|LINEAR]]/GSP heap.&lt;br /&gt;
|-&lt;br /&gt;
| 0x1E800000&lt;br /&gt;
| 0x1F000000&lt;br /&gt;
| 0x00400000&lt;br /&gt;
| No&lt;br /&gt;
| [[New_3DS]] additional memory, access to this is specified by the exheader. Added with [[8.0.0-18]], see above section regarding this memory.&lt;br /&gt;
|-&lt;br /&gt;
| 0x1EC00000&lt;br /&gt;
| 0x10100000&lt;br /&gt;
| 0x01000000&lt;br /&gt;
| No&lt;br /&gt;
| [[IO]] registers, the mapped IO pages which each process can access is specified in the [[NCCH#CXI|CXI]] exheader.(Applications normally don&#039;t have access to registers in this range)&lt;br /&gt;
|-&lt;br /&gt;
| 0x1F000000&lt;br /&gt;
| 0x18000000&lt;br /&gt;
| 0x00600000&lt;br /&gt;
| No&lt;br /&gt;
| VRAM, access to this is specified by the exheader.&lt;br /&gt;
|-&lt;br /&gt;
| 0x1FF00000&lt;br /&gt;
| 0x1FF00000&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| No&lt;br /&gt;
| DSP memory, access to this is specified by the exheader.&lt;br /&gt;
|-&lt;br /&gt;
| 0x1FF80000&lt;br /&gt;
| FCRAM memory page allocated by the ARM11 kernel.&lt;br /&gt;
| 0x1000&lt;br /&gt;
| No&lt;br /&gt;
| [[Configuration Memory]], all processes have read-only access to this.&lt;br /&gt;
|-&lt;br /&gt;
| 0x1FF81000&lt;br /&gt;
| FCRAM memory page allocated by the ARM11 kernel.&lt;br /&gt;
| 0x1000&lt;br /&gt;
| No&lt;br /&gt;
| [[Configuration Memory|Shared]] page, all processes have read-access to this. Write access to this is specified by the exheader &amp;quot;Shared page writing&amp;quot; kernel flag.&lt;br /&gt;
|-&lt;br /&gt;
| 0x1FF82000&lt;br /&gt;
| ?&lt;br /&gt;
| ?&lt;br /&gt;
| No&lt;br /&gt;
| [[Thread Local Storage]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x30000000&lt;br /&gt;
| FCRAM+0&lt;br /&gt;
| 0x08000000(Old3DS) / 0x10000000([[New_3DS]])&lt;br /&gt;
| No&lt;br /&gt;
| This LINEAR memory mapping was added with [[8.0.0-18]], see [[SVC#enum_MemoryOperation|here]]. This replaces the original 0x14000000 mapping, for system(memory-region=BASE)/newer titles. The Old3DS kernel uses size 0x08000000 for LINEAR-memory address range checks, while the New3DS kernel uses size 0x10000000 for those range checks. Old3DS/New3DS system-module code doing vaddr-&amp;gt;phys-addr conversion uses size 0x10000000.&lt;br /&gt;
|-&lt;br /&gt;
| 0x20000000 / 0x40000000&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
| This is the end-address of userland memory, memory under this address is process-unique. Memory starting at this address is only accessible in privileged-mode. This address was changed from 0x20000000 to 0x40000000 with [[8.0.0-18]].&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
All executable pages are read-only, and data pages have the execute-never permission set. Normally .text from the loaded ExeFS:/.code is the only mapped executable memory. Executable [[RO Services|CROs]] can be loaded into memory, once loaded the CRO .text section memory page permissions are changed via [[SVC|ControlProcessMemory]] from RW- to R-X. The address and size of each ExeFS:/.code section is stored in the exheader, the permissions for each section is: .text R-X, .rodata R--, .data RW-, and .bss RW-. The loaded .code is mapped to the addresses specified in the exheader by the ARM11 kernel. The stack permissions is initialized by the ARM11 kernel: RW-. The heap permissions is normally RW-.&lt;br /&gt;
&lt;br /&gt;
All userland memory is mapped with RW permissions for privileged-mode. However, normally the ARM11 kernel only uses userland read/write instructions(or checks that the memory can be written from userland first) for accessing memory specified by [[SVC|SVCs]].&lt;br /&gt;
&lt;br /&gt;
Processes can&#039;t directly access memory for other processes. When service [[Services API|commands]] are used, the kernel maps memory in the destination process for input/output buffers, where the addresses in the command received by the process is replaced by this mapped memory. When this is an input buffer, the buffer data is copied to the mapped memory. When this is an output buffer, the data stored in the mapped memory is copied to the destination buffer specified in the command.&lt;br /&gt;
&lt;br /&gt;
The physical address which memory for the application memory-type is mapped to begins at FCRAM+0, the total memory allocated for this memory-type is stored in [[Configuration_Memory]]. Applications&#039; .text + .rodata + .data under the application memory-type is mapped at FCRAM + APPMEMALLOC - (aligned page-size for .text + .rodata + .data). The application .bss is mapped at CODEADDR - .bss size aligned down to the page size.&lt;br /&gt;
&lt;br /&gt;
==TWL_FIRM Userland Memory==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Virtual Address Base&lt;br /&gt;
!  Physical Address Base&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| 0x1FFAB000 (with newer TWL_FIRM such as v6704 this is located at 0x1FFAC000)&lt;br /&gt;
| 0x00055000&lt;br /&gt;
| Code + .(ro)data copied from the process 0x00300000 region is located here(.bss is located here as well).&lt;br /&gt;
|-&lt;br /&gt;
| 0x00155000&lt;br /&gt;
| 0x18555000&lt;br /&gt;
| 0x000AB000&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00200000&lt;br /&gt;
| 0x18500000&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00300000&lt;br /&gt;
| 0x24000000&lt;br /&gt;
| 0x04000000&lt;br /&gt;
| The beginning of the ARM11 process .text is located here.&lt;br /&gt;
|-&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| 0x20000000&lt;br /&gt;
| 0x07E00000&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x1EC00000&lt;br /&gt;
| 0x10100000&lt;br /&gt;
| 0x00400000&lt;br /&gt;
| [[IO]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x1F000000&lt;br /&gt;
| 0x18000000&lt;br /&gt;
| 0x00600000&lt;br /&gt;
| VRAM&lt;br /&gt;
|-&lt;br /&gt;
| 0x1FF00000&lt;br /&gt;
| 0x1FF00000&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| This is mapped to the DSP memory.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The above regions are mapped by the ARM11 kernel. Later when the ARM11 process uses [[SVC|svcKernelSetState]] with type4, the kernel unmaps(?) the following regions: 0x00300000..0x04300000, 0x08000000..0x0FE00000, and 0x10000000..0xF8000000.&lt;br /&gt;
&lt;br /&gt;
=== Detailed TWL_FIRM ARM11 Memory ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Process Virtual Address&lt;br /&gt;
!  Physical Address&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x08000000&lt;br /&gt;
| 0x20000000&lt;br /&gt;
| 0x01000000*4&lt;br /&gt;
| DS(i) 0x02000000 RAM. Vaddr = (DSRAMOffset*4) + 0x08000000, where DSRAMOffset is DSRAMAddr-0x02000000.&lt;br /&gt;
|-&lt;br /&gt;
| 0x0FC00000&lt;br /&gt;
| 0x27C00000&lt;br /&gt;
| &lt;br /&gt;
| Loaded SRL binary, initially the dev DSi launcher SRL is located here(copied here by the ARM11 process).&lt;br /&gt;
|-&lt;br /&gt;
| 0x0FD00000&lt;br /&gt;
| 0x27D00000&lt;br /&gt;
| &lt;br /&gt;
| The data located here is copied to here by the ARM11 process. The data located here is a TWL NAND [http://dsibrew.org/wiki/Bootloader bootloader] image, using the same format+encryption/verification methods as the DSi NAND bootloader(stage2). The keyX for this bootloader keyslot is initially set to the retail DSi key-data, however when TWL_FIRM is launched this keyX key-data is replaced with a separate keyX. TWL_FIRM can use either the retail DSi bootloader RSA-1024 modulus, or a seperate modulus: normally only the latter is used(the former is only used when loading the image from FS instead of FCRAM). When using the image from FCRAM(default code-path), TWL_FIRM will not calculate+check the hashes for the bootloader code binaries(this is done when loading from FS however).&lt;br /&gt;
|-&lt;br /&gt;
| 0x0FDF7000&lt;br /&gt;
| 0x27DF7000&lt;br /&gt;
| 0x1000&lt;br /&gt;
| SRL header&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= System memory details  =&lt;br /&gt;
 0xFFFF9000 Pointer to the current KThread instance&lt;br /&gt;
 0xFFFF9004 Pointer to the current KProcess instance&lt;br /&gt;
 0xFFFF9008 Pointer to the current KScheduler instance&lt;br /&gt;
 0xFFFF9010 Pointer to the last KThread to encounter an exception&lt;br /&gt;
&lt;br /&gt;
 0x8000040 Pointer to the current KThread instance on the ARM9&lt;br /&gt;
 0x8000044 Pointer to the current KProcess instance on the ARM9&lt;br /&gt;
 0x8000048 Pointer to the current KScheduler instance on the ARM9&lt;br /&gt;
&lt;br /&gt;
= Handles =&lt;br /&gt;
 The handle 0xFFFF8001 is a reference to the current KProcess.&lt;br /&gt;
 The handle 0xFFFF8000 is a reference to the current KThread.&lt;br /&gt;
&lt;br /&gt;
= IO Process/Kernel virtual addressing equivalence = &lt;br /&gt;
It seems an IO register&#039;s process virtual address can be calculated by adding 0xEB00000 to its physical address.&lt;br /&gt;
&lt;br /&gt;
= VRAM Map While Running System Applets =&lt;br /&gt;
*0x1E6000-0x22C500 -- top screen 3D left framebuffer 0(240x400x3) (The &amp;quot;3D right first-framebuf&amp;quot; addr stored in the LCD register is set to this, when the 3D is set to &amp;quot;off&amp;quot;)&lt;br /&gt;
*0x22C800-0x272D00 -- top screen 3D left framebuffer 1(240x400x3)&lt;br /&gt;
*0x273000-0x2B9500 -- top screen 3D right framebuffer 0(240x400x3)&lt;br /&gt;
*0x2B9800-0x2FFD00 -- top screen 3D right framebuffer 1(240x400x3)&lt;br /&gt;
*0x48F000-0x4C7400 -- bottom screen framebuffer 0(240x320x3)&lt;br /&gt;
*0x4C7800-0x4FF800 -- bottom screen framebuffer 1(240x320x3)&lt;br /&gt;
&lt;br /&gt;
These LCD framebuffer addresses are not changed by the system when launching regular applications, the application itself handles that if needed. These VRAM framebuffers are cleared when launching regular applications.&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=15145</id>
		<title>CECDU:OpenAndRead</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=15145"/>
		<updated>2016-01-04T08:26:01Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Request=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code [0x00120104]&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| buffer size (unused)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| NCCH Program ID?&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| data type&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 0x20&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| (buffer size &amp;lt;&amp;lt; 4) &amp;lt;nowiki&amp;gt;|&amp;lt;/nowiki&amp;gt; 0xC&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| buffer&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Response=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Result code&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Total bytes read&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Notes=&lt;br /&gt;
This reads to the buffer some data stored in &amp;quot;data:/CEC/&amp;lt;file&amp;gt;&amp;quot; (where &amp;quot;data:/&amp;quot; is mapped to the SystemSaveData archive).&lt;br /&gt;
&amp;lt;file&amp;gt; is determined by the &amp;quot;data type&amp;quot; argument.&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15144</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15144"/>
		<updated>2016-01-04T07:32:49Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| [[CECDU:ReadSavedData|ReadSavedData]]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=15143</id>
		<title>CECDU:OpenAndRead</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECDU:OpenAndRead&amp;diff=15143"/>
		<updated>2016-01-04T07:32:36Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Created page with &amp;quot;=Request= {| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot; |- !  Index Word !  Description |- | 0 | Header code [0x00120104] |- | 1 | buffer size (unused) |- | 2 | CEC ID? |- | 3 | data type |...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Request=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code [0x00120104]&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| buffer size (unused)&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| CEC ID?&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| data type&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| 0x20&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| (buffer size &amp;lt;&amp;lt; 4) &amp;lt;nowiki&amp;gt;|&amp;lt;/nowiki&amp;gt; 0xC&lt;br /&gt;
|-&lt;br /&gt;
| 8&lt;br /&gt;
| buffer&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Response=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Result code&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Total bytes read&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Notes=&lt;br /&gt;
This reads to the buffer some data stored in &amp;quot;data:/CEC/&amp;lt;file&amp;gt;&amp;quot; (where &amp;quot;data:/&amp;quot; is mapped to the SystemSaveData archive).&lt;br /&gt;
&amp;lt;file&amp;gt; is determined by the &amp;quot;data type&amp;quot; argument.&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15142</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15142"/>
		<updated>2016-01-04T00:25:51Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ? (copies some data into a supplied buffer)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15141</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15141"/>
		<updated>2016-01-04T00:05:21Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecStateAbbreviated ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_IDLE&lt;br /&gt;
| 1&lt;br /&gt;
| Corresponds to CEC_STATE_IDLE&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_NOT_LOCAL?&lt;br /&gt;
| 2&lt;br /&gt;
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_SCANNING&lt;br /&gt;
| 3&lt;br /&gt;
| Corresponds to CEC_STATE_SCANNING&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_WLREADY?&lt;br /&gt;
| 4&lt;br /&gt;
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true&lt;br /&gt;
|-&lt;br /&gt;
| CEC_STATE_ABBREV_OTHER&lt;br /&gt;
| 5&lt;br /&gt;
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15136</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15136"/>
		<updated>2016-01-03T11:15:59Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* CECD Service &amp;quot;cecd:ndm&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004....&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15135</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15135"/>
		<updated>2016-01-03T11:15:32Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Add info for cecd:ndm&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= CECD Service &amp;quot;cecd:ndm&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x0001....&lt;br /&gt;
| Initialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0002....&lt;br /&gt;
| Deinitialize&lt;br /&gt;
|-&lt;br /&gt;
| 0x0003....&lt;br /&gt;
| ResumeDaemon&lt;br /&gt;
|-&lt;br /&gt;
| 0x0004&lt;br /&gt;
| SuspendDaemon(bool immediately)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15134</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=15134"/>
		<updated>2016-01-03T08:29:38Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Add an enum from the CECD service&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecCommand ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Name&lt;br /&gt;
!  Value&lt;br /&gt;
!  Notes&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NONE&lt;br /&gt;
| 0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_START&lt;br /&gt;
| 1&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_START&lt;br /&gt;
| 2&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCAN&lt;br /&gt;
| 3&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_READYSCANWAIT&lt;br /&gt;
| 4&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STARTSCAN&lt;br /&gt;
| 5&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESCAN&lt;br /&gt;
| 6&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_RESUME&lt;br /&gt;
| 7&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND&lt;br /&gt;
| 8&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE&lt;br /&gt;
| 9&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOPWAIT&lt;br /&gt;
| 0xA&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP&lt;br /&gt;
| 0xB&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE&lt;br /&gt;
| 0xC&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_STOP_FORCE_WAIT&lt;br /&gt;
| 0xD&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_RESET_FILTER&lt;br /&gt;
| 0xE&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_STOP&lt;br /&gt;
| 0xF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_DAEMON_START&lt;br /&gt;
| 0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_EXIT&lt;br /&gt;
| 0x11&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS&lt;br /&gt;
| 0x12&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE&lt;br /&gt;
| 0x13&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT&lt;br /&gt;
| 0x14&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| CEC_COMMAND_END&lt;br /&gt;
| 0x15&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=Services&amp;diff=15133</id>
		<title>Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=Services&amp;diff=15133"/>
		<updated>2016-01-03T01:51:15Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* Notifications */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Services are an abstraction of ports and are the commonly used way of inter-process communication outside of the kernel. While handles of regular ports are retrieved from [[SVC|svcConnectToPort]], service handles are retrieved through the port &#039;&#039;srv:&#039;&#039; (&amp;quot;service manager&amp;quot;).&lt;br /&gt;
&lt;br /&gt;
When a service is registered, [[SVC|svcCreatePort]] is used without a port-name. This means that the port is inaccessible via the port SVCs outside of sm-module. See below for getting a session handle for sending commands to services.&lt;br /&gt;
&lt;br /&gt;
Processes with PID less than or equal to the number of NATIVE_FIRM built-in modules (fs, sm, pm, pxi, ldr) have access to all services. This value is obtained from [[SVC|svcGetSystemInfo]].&lt;br /&gt;
&lt;br /&gt;
Attempting to use [[SRV:GetServiceSession|GetServiceSession]] with a service that the process has access to when that service isn&#039;t registered, results in [[SVC|svcSendSyncRequest]] never returning(the exact cause is unknown).&lt;br /&gt;
&lt;br /&gt;
==Service Manager Port &amp;quot;srv:&amp;quot;==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010002&lt;br /&gt;
| [[SRV:RegisterClient|RegisterClient]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020000&lt;br /&gt;
| [[SRV:EnableNotification|EnableNotification]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030100&lt;br /&gt;
| [[SRV:RegisterService|RegisterService]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000400C0&lt;br /&gt;
| [[SRV:UnregisterService|UnregisterService]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050100&lt;br /&gt;
| [[SRV:GetServiceHandle|GetServiceHandle]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000600C2&lt;br /&gt;
| [[SRV:RegisterPort|RegisterPort]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000700C0&lt;br /&gt;
| [[SRV:UnregisterPort|UnregisterPort]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080100&lt;br /&gt;
| [[SRV:GetPort|GetPort]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090040&lt;br /&gt;
| [[SRV:Subscribe|Subscribe]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A0040&lt;br /&gt;
| [[SRV:Unsubscribe|Unsubscribe]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0000&lt;br /&gt;
| [[SRV:ReceiveNotification|ReceiveNotification]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0080&lt;br /&gt;
| [[SRV:PublishToSubscriber|PublishToSubscriber]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0040&lt;br /&gt;
| [[SRV:PublishAndGetSubscriber|PublishAndGetSubscriber]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E00C0&lt;br /&gt;
| [[SRV:IsServiceRegistered|IsServiceRegistered]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==Service Manager Process-Manager Port/Service &amp;quot;srv:pm&amp;quot;==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header (port), prior to [[7.0.0-13]]&lt;br /&gt;
!  Command Header (service), post [[7.0.0-13]]&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x04010042&lt;br /&gt;
| 0x00010042&lt;br /&gt;
| [[SRVPM:PublishToProcess|PublishToProcess]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x04020040&lt;br /&gt;
| 0x00020040&lt;br /&gt;
| [[SRVPM:PublishToAll|PublishToAll]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x04030082&lt;br /&gt;
| 0x00030082&lt;br /&gt;
| [[SRVPM:RegisterProcess|RegisterProcess]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x04040040&lt;br /&gt;
| 0x00040040&lt;br /&gt;
| [[SRVPM:UnregisterProcess|UnregisterProcess]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Prior to to [[7.0.0-13]], the commands listed for &amp;quot;srv:&amp;quot; were also accessible under this port with the same command-headers. Starting with [[7.0.0-13]], the &amp;quot;srv:pm&amp;quot; port was changed to a service. With this change, commandIDs for these commands were changed. &amp;quot;srv:pm&amp;quot; was originally vulnerable, this was fixed with [[7.0.0-13]], see [[3DS_exploits|here]]. Originally any process could use &amp;quot;srv:pm&amp;quot;, however starting with [[7.0.0-13]] only the built-in NATIVE_FIRM sysmodules have access to it. The only system title which uses &amp;quot;srv:pm&amp;quot; is the [[Process_Manager_Services|Process Manager]].&lt;br /&gt;
&lt;br /&gt;
==Notifications==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  ID&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x100&lt;br /&gt;
| This indicates that all processes must terminate: power-off, reboot, or [[FIRM]]-launch.&lt;br /&gt;
|-&lt;br /&gt;
| 0x104&lt;br /&gt;
| This indicates that the system is entering sleep mode. (PTM:NotifySleepPreparationComplete needed for this and the following?)&lt;br /&gt;
|-&lt;br /&gt;
| 0x105&lt;br /&gt;
| This indicates that the system has exited sleep mode.&lt;br /&gt;
|-&lt;br /&gt;
| 0x107&lt;br /&gt;
| Unknown. Subscribed to by CECD module.&lt;br /&gt;
|-&lt;br /&gt;
| 0x108&lt;br /&gt;
| error at boot?&lt;br /&gt;
|-&lt;br /&gt;
| 0x10C&lt;br /&gt;
| Unknown.&lt;br /&gt;
|-&lt;br /&gt;
| 0x110-0x11F&lt;br /&gt;
| Unknown. See [[PMApp:LaunchTitle#Launch_Flags|PM launch flags]].&lt;br /&gt;
|-&lt;br /&gt;
| 0x179&lt;br /&gt;
| Unknown.&lt;br /&gt;
|-&lt;br /&gt;
| 0x202&lt;br /&gt;
| POWER button pressed&lt;br /&gt;
|-&lt;br /&gt;
| 0x203&lt;br /&gt;
| POWER button held long&lt;br /&gt;
|-&lt;br /&gt;
| 0x204&lt;br /&gt;
| HOME button pressed&lt;br /&gt;
|-&lt;br /&gt;
| 0x205&lt;br /&gt;
| HOME button released&lt;br /&gt;
|-&lt;br /&gt;
| 0x206&lt;br /&gt;
| This is signaled by [[NWMEXT:ControlWirelessEnabled]] and when the physical Wi-Fi slider is enabled&lt;br /&gt;
|-&lt;br /&gt;
| 0x207&lt;br /&gt;
| SD card inserted&lt;br /&gt;
|-&lt;br /&gt;
| 0x208&lt;br /&gt;
| Game cartridge inserted&lt;br /&gt;
|-&lt;br /&gt;
| 0x209&lt;br /&gt;
| SD card removed&lt;br /&gt;
|-&lt;br /&gt;
| 0x20A&lt;br /&gt;
| Game cartridge removed&lt;br /&gt;
|-&lt;br /&gt;
| 0x20B&lt;br /&gt;
| Game cartridge inserted or removed&lt;br /&gt;
|-&lt;br /&gt;
| 0x302&lt;br /&gt;
| Unknown. Signaled by nwm module.&lt;br /&gt;
|-&lt;br /&gt;
| 0x303&lt;br /&gt;
| Unknown. Subscribed to by CECD module.&lt;br /&gt;
|-&lt;br /&gt;
| 0x304&lt;br /&gt;
| Unknown. Subscribed to by CECD module.&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=3DS_System_Flaws&amp;diff=15128</id>
		<title>3DS System Flaws</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=3DS_System_Flaws&amp;diff=15128"/>
		<updated>2016-01-02T03:29:09Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of publicly known system flaws, for userland applications/applets flaws see [[3DS_Userland_Flaws|here]].&lt;br /&gt;
&lt;br /&gt;
=Stale / Rejected Efforts=&lt;br /&gt;
* Neimod has been working on a RAM dumping setup for a little while now. He&#039;s de-soldered the 3DS&#039;s RAM chip and hooked it and the RAM pinouts on the 3DS&#039; PCB up to a custom RAM dumping setup. A while ago he published photos showing his setup to be working quite well, with the 3DS successfully booting up. However, his flickr stream is now private along with most of his work.&lt;br /&gt;
&lt;br /&gt;
* Someone (who will remain unnamed) has released CFW and CIA installers, all of which is copied from the work of others, or copyrighted material.&lt;br /&gt;
&lt;br /&gt;
==Tips and info==&lt;br /&gt;
The 3DS uses the XN feature of the ARM11 processor. There&#039;s no official way from applications to enable executable permission for memory containing arbitrary unsigned code(there&#039;s a [[SVC]] for this, but only [[RO_Services|RO-module]] has access to it). An usable userland exploit would still be useful: you could only do return-oriented-programming with it initially. From ROP one could then exploit system flaw(s), see below.&lt;br /&gt;
&lt;br /&gt;
SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped(accessing SD data is far easier by running code on the target 3DS however).&lt;br /&gt;
&lt;br /&gt;
=System flaws=&lt;br /&gt;
== Hardware ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Fixed with hardware model/revision&lt;br /&gt;
!  Newest hardware model/revision this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| ARM9/ARM11 bootrom vectors point at unitialized RAM&lt;br /&gt;
| ARM9&#039;s and ARM11&#039;s exception vectors are hardcoded to point at the CPU&#039;s internal memory (0x08000000 region for ARM9, AXIWRAM for ARM11). While the bootrom does set them up to point to an endless loop at some point during boot, it does not do so immediately. As such, a carefully-timed fault injection (via hardware) to trigger an exception (such as an invalid instruction) will cause execution to fall into ARM9 RAM. &lt;br /&gt;
Since RAM isn&#039;t cleared on boot (see below), one can immediately start execution of their own code here to dump bootrom, OTP, etc.&lt;br /&gt;
The ARM9 bootrom does the following at reset:  reset vector branches to another instruction, then branches to bootrom+0x8000. Hence, there&#039;s no way to know for certain when exactly the ARM9 exception-vector data stored in memory gets initialized.&lt;br /&gt;
&lt;br /&gt;
This requires *very* *precise* timing for triggering the hardware fault: it&#039;s unknown if anyone actually exploited this successfully at the time of writing(the one who attempted+discovered it *originally* as listed in this wiki section hasn&#039;t).&lt;br /&gt;
| None: all available 3DS models at the time of writing have the exact same ARM9/ARM11 bootrom for the unprotected areas.&lt;br /&gt;
| New3DS&lt;br /&gt;
| End of February 2014&lt;br /&gt;
| [[User:Derrek|derrek]], WulfyStylez (May 2015) independently&lt;br /&gt;
|-&lt;br /&gt;
| Missing AES key clearing&lt;br /&gt;
| The hardware AES engine does not clear keys when doing a hard reset/reboot.&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| August 2014&lt;br /&gt;
| Mathieulh/Others&lt;br /&gt;
|-&lt;br /&gt;
| No RAM clearing on reboots&lt;br /&gt;
| On an MCU-triggered reboot all RAM including FCRAM/ARM9 memory/AXIWRAM/VRAM keeps its contents.&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| March 2014&lt;br /&gt;
| [[User:Derrek|derrek]]&lt;br /&gt;
|-&lt;br /&gt;
| 32bits of actual console-unique TWLNAND keydata&lt;br /&gt;
| On retail the 8-bytes at ARM9 address [[Memory_layout|0x01FFB808]] are XORed with hard-coded data, to generate the TWL console-unique keys, including TWLNAND. On Old3DS the high u32 is always 0x0, while on New3DS that u32 is always 0x2. On top of this, the lower u32&#039;s highest bit is always ORed. only 31 bits of the TWL console-unique keydata / TWL consoleID are actually console-unique.&lt;br /&gt;
This allows one to easily bruteforce the TWL console-unique keydata with *just* data from TWLNAND. On DSi the actual console-unique data for key generation is 8-bytes(all bytes actually set).&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| 2012?&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| DSi / 3DS-TWL key-generator&lt;br /&gt;
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the TWL key-generator function.&lt;br /&gt;
This applies to the keyX/keyY too.&lt;br /&gt;
&lt;br /&gt;
This attack does not work for the 3DS key-generator because keyslots 0-3 are only for TWL keys.&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| 2011&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| 3DS key-generator&lt;br /&gt;
| The algorithm for generating the normal-keys for keyslots is cryptographically weak.  As a result, it is easily susceptible to differential cryptanalysis if the normal-key corresponding to any scrambler-generated keyslot is discovered.&lt;br /&gt;
&lt;br /&gt;
Several such pairs of matching normal-keys and KeyY values were found, leading to deducing the key-generator function.&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| February 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]], [[User:Plutooo|plutoo]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== ARM9 software ==&lt;br /&gt;
=== arm9loader ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| Missing verification-block for the 9.6 keys&lt;br /&gt;
| Starting with [[9.6.0-24|9.6.0-X]] a new set of NAND-based keys were introduced. However, no verification block was added to verify that the new key read from NAND is correct. This was technically an issue from [[9.5.0-22|9.5.0-X]] with the original sector+0 keydata, however the below is only possible with [[9.6.0-24|9.6.0-X]] since keyslots 0x15 and 0x16 are generated from different 0x11 keyXs.&lt;br /&gt;
&lt;br /&gt;
Writing an incorrect key to NAND will cause arm9loader to decrypt the ARM9 kernel as garbage and then jump to it.&lt;br /&gt;
&lt;br /&gt;
This allows an hardware-based attack where you can boot into an older exploited firmware, fill all memory with NOP sleds/jump-instructions, and then reboot into executing garbage. By automating this process with various input keydata, eventually you&#039;ll find some garbage that jumps to your code.&lt;br /&gt;
&lt;br /&gt;
This should give very early ARM9 code execution (pre-ARM9 kernel). As such, it is possible to dump RSA keyslots with this and calculate the 6.x [[Savegames#6.0.0-11_Savegame_keyY|save]], and 7.x [[NCCH]] keys. This cannot be used to recover keys initialized by arm9loader itself. This is due to it wiping the area used for its stack during NAND sector decryption and keyslot init. &lt;br /&gt;
&lt;br /&gt;
Due to FIRMs on both Old and New 3DS using the same RSA data, this can be exploited on Old3DS as well, but only if one already has the actual plaintext normalkey from New3DS NAND sector 0x96 offset-0 and has dumped the OTP area of the Old3DS.&lt;br /&gt;
| Recovery of 6.x [[Savegames#6.0.0-11_Savegame_keyY|save key]]/7.x [[NCCH]] key&lt;br /&gt;
| None&lt;br /&gt;
| [[9.6.0-24|9.6.0-X]]&lt;br /&gt;
| March, 2015&lt;br /&gt;
| [[User:Plutooo|plutoo]]&lt;br /&gt;
|-&lt;br /&gt;
| Uncleared New3DS keyslot 0x11&lt;br /&gt;
| Originally the New3DS [[FIRM]] arm9bin loader only cleared keyslot 0x11 when it gets executed at firmlaunch. This was fixed with [[9.5.0-22|9.5.0-X]] by completely clearing keyslot 0x11 immediately after the loader finishes using keyslot 0x11.&lt;br /&gt;
This means that any ARM9 code that can execute before the loader clears the keyslot at firmlaunch(including firmlaunch-hax) can get access to the uncleared keyslot 0x11, which then allows one to generate all &amp;lt;=v9.5 New3DS keyXs which are generated by keyslot 0x11.&lt;br /&gt;
&lt;br /&gt;
Therefore, to completely fix this the loader would have to generate more keys using different keyslot 0x11 keydata. This was done with [[9.6.0-24|9.6.0-X]].&lt;br /&gt;
| New3DS keyXs generation&lt;br /&gt;
| Mostly fixed with [[9.5.0-22|9.5.0-X]], completely fixed with new keys with [[9.6.0-24|9.6.0-X]].&lt;br /&gt;
| &lt;br /&gt;
| February 3, 2015 (one day after [[9.5.0-22|9.5.0-X]] release)&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Process9 ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Public disclosure timeframe&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| Leak of normal-key matching a key-scrambler key&lt;br /&gt;
| New 3DS firmware versions [[8.1.0-0 New3DS|8.1.0]] through [[9.2.0-20|9.2.0]] set the encryption key for [[Amiibo]] data using a hardcoded normal-key in Process9.  In firmware [[9.3.0-21|9.3.0]], Nintendo &amp;quot;fixed&amp;quot; this by using the key scrambler instead, by calculating the keyY value for keyslot 0x39 that results in the same normal-key, then hardcoding that keyY into Process9.&lt;br /&gt;
&lt;br /&gt;
Nintendo&#039;s fix is actually the problem: Nintendo revealed the normal-key matching an unknown keyX and a known keyY.  Combined with the key scrambler using an insecure scrambling algorithm (see &amp;quot;Hardware&amp;quot; above), the key scrambler function could be deduced.&lt;br /&gt;
| Deducing the keyX for keyslot 0x39 and the key scrambler algorithm&lt;br /&gt;
| New 3DS [[9.3.0-21|9.3.0-X]], sort of&lt;br /&gt;
| [[10.0.0-27|10.0.0-X]]&lt;br /&gt;
| Sometime in 2015 after the hardware key-generator was broken.&lt;br /&gt;
| 32c3 3ds talk (December 27, 2015)&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| Title downgrading via [[Application_Manager_Services|AM]]([[Application_Manager_Services_PXI|PXI]])&lt;br /&gt;
| When a title is *already* installed, Process9 will compare the installed title-version with the title-version being installed. When the one being installed is older, Process9 would return an error.&lt;br /&gt;
&lt;br /&gt;
However, this can be bypassed by just deleting the title first via the service command(s) for that: with the title removed from the [[Title_Database]], Process9 can&#039;t compare the input title-version with anything. Hence, titles can be downgraded this way.&lt;br /&gt;
| Bypassing title version check at installation, which then allows downgrading any title.&lt;br /&gt;
| None&lt;br /&gt;
| NATIVE_FIRM / AM-sysmodule [[10.0.0-27|10.0.0-X]]&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| FAT FS code null-deref&lt;br /&gt;
| When FSFile:Read is used with a file which is corrupted on a FAT filesystem(in particular SD), Process9 can crash. This particular crash is caused by a function returning NULL instead of an actual ptr due to an error. The caller of that function doesn&#039;t check for NULL which then triggers a read based at NULL.&lt;br /&gt;
&lt;br /&gt;
Sample &amp;quot;fsck.vfat -n -v -V &amp;lt;fat image backup&amp;gt;&amp;quot; output for the above crash:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;...&lt;br /&gt;
Starting check/repair pass.&lt;br /&gt;
&amp;lt;FilePath0&amp;gt; and&lt;br /&gt;
&amp;lt;FilePath1&amp;gt;&lt;br /&gt;
 share clusters.&lt;br /&gt;
 Truncating second to 3375104 bytes.&lt;br /&gt;
&amp;lt;FilePath1&amp;gt;&lt;br /&gt;
 File size is 2787392 bytes, cluster chain length is 16384 bytes.&lt;br /&gt;
 Truncating file to 16384 bytes.&lt;br /&gt;
Checking for unused clusters.&lt;br /&gt;
Reclaimed 1 unused cluster (16384 bytes).&lt;br /&gt;
Checking free cluster summary.&lt;br /&gt;
Free cluster summary wrong (1404490 vs. really 1404491)&lt;br /&gt;
 Auto-correcting.&lt;br /&gt;
Starting verification pass.&lt;br /&gt;
Checking for unused clusters.&lt;br /&gt;
Leaving filesystem unchanged.&amp;lt;/pre&amp;gt;&lt;br /&gt;
| Useless null-based-read&lt;br /&gt;
| None&lt;br /&gt;
| [[9.6.0-24|9.6.0-X]]&lt;br /&gt;
| July 8-9, 2015&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| RSA signature padding checks&lt;br /&gt;
| The TWL_FIRM RSA sig padding check code used for all TWL RSA sig-checks has issues, see [[FIRM|here]].&lt;br /&gt;
The main 3DS RSA padding check code(non-certificate, including NATIVE_FIRM) uses the function used with the above to extract more padding + the actual hash from the additional padding. This isn&#039;t really a problem here because there&#039;s proper padding check code which is executed prior to this.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.5.0-22|9.5.0-X]]&lt;br /&gt;
| March 2015&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[AMPXI:ValidateDSiWareSectionMAC]] [[AES_Registers|AES]] keyslot reuse&lt;br /&gt;
| When the input DSiWare section index is higher than &amp;lt;max number of DSiWare sections supported by this FIRM&amp;gt;, Process9 uses keyid 0x40 for calculating the AESMAC, which translates to keyslot 0x40. The result is that the keyslot is left at whatever was already selected before, since the AES selectkeyslot code will immediately  return when keyslot is &amp;gt;=0x40. However, actually exploiting this is difficult: the calculated AESMAC is never returned, this command just compares the calculated AESMAC with the input AESMAC(result-code depends on whether the AESMACs match). It&#039;s unknown whether a timing attack would work with this.&lt;br /&gt;
This is basically a different form of the pxips9 keyslot vuln, except with AESMAC etc.&lt;br /&gt;
| See description.&lt;br /&gt;
| None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
| March 15, 2015&lt;br /&gt;
| December 29, 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| pxips9 [[AES_Registers|AES]] keyslot reuse&lt;br /&gt;
| This requires access to the [[Process_Services|ps:ps]]/pxi:ps9 services. One way to get access to this would be snshax on system-version &amp;lt;=10.1.0-X(see 32c3 3ds talk).&lt;br /&gt;
When an invalid key-type value is passed to any of the PS commands, Process9 will try to select keyslot 0x40. That aesengine_setkeyslot() code will then immediately return due to the invalid keyslot value. Since that function doesn&#039;t return any errors, Process9 will just continue to do crypto with whatever AES keyslot was selected before the PS command was sent.&lt;br /&gt;
| Reusing the previously used keyslot, for crypto with PS.&lt;br /&gt;
| None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
| Roughly the same time(same day?) as firmlaunch-hax.&lt;br /&gt;
| December 29, 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| firmlaunch-hax: FIRM header ToCToU&lt;br /&gt;
| This can&#039;t be exploited from ARM11 userland.&lt;br /&gt;
During [[FIRM]] launch, the only FIRM header the ARM9 uses at all is stored in FCRAM, this is 0x200-bytes(the actual used FIRM RSA signature is read to the Process9 stack however). The ARM9 doesn&#039;t expect &amp;quot;anything&amp;quot; besides the ARM9 to access this data.&lt;br /&gt;
With [[9.5.0-22]] the address of this FIRM header was changed from a FCRAM address, to ARM9-only address 0x01fffc00.&lt;br /&gt;
| ARM9 code execution&lt;br /&gt;
| [[9.5.0-22]]&lt;br /&gt;
| &lt;br /&gt;
| 2012, 3 days after [[User:Yellows8|Yellows8]] started Process9 code RE.&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| Uninitialized data output for (PXI) command replies&lt;br /&gt;
| PXI commands for various services(including some [[Filesystem_services_PXI|here]] and many others) can write uninitialized data (like from ARM registers) to the command reply. This happens with stubbed commands, but this can also occur with certain commands when returning an error.&lt;br /&gt;
Certain ARM11 service commands have this same issue as well.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.3.0-21|9.3.0-X]]&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[Filesystem_services_PXI|FSPXI]] OpenArchive SD permissions&lt;br /&gt;
| Process9 does not use the exheader ARM9 access-mount permission flag for SD at all.&lt;br /&gt;
This would mean ARM11-kernelmode code / fs-module itself could directly use FSPXI to access SD card without ARM9 checking for SD access, but this is rather useless since a process is usually running with SD access(Home Menu for example) anyway.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.3.0-21|9.3.0-X]]&lt;br /&gt;
| 2012&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[AMPXI:ExportDSiWare]] export path&lt;br /&gt;
| Process9 allocates memory on Process9 heap for the export path then verifies that the actual allocated size matches the input size. Then Process9 copies the input path from FCRAM to this buffer, and uses it with the Process9 FS openfile code, which use paths in the form of &amp;quot;&amp;lt;mountpoint&amp;gt;:/&amp;lt;path&amp;gt;&amp;quot;.&lt;br /&gt;
Process9 does not check the contents of this path at all before passing it to the FS code, besides writing a NUL-terminator to the end of the buffer.&lt;br /&gt;
| Exporting of DSiWare to arbitrary Process9 file-paths, such as &amp;quot;nand:/&amp;lt;path&amp;gt;&amp;quot; etc. This isn&#039;t really useful since the data which gets written can&#039;t be controlled.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.5.0-22]]&lt;br /&gt;
| April 2013&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[DSiWare_Exports]] [[CTCert]] verification&lt;br /&gt;
| Just like DSi originally did, 3DS verifies the APCert for DSiWare on SD with the CTCert also in the DSiWare .bin. On DSi this was fixed with with system-version 1.4.2 by verifying with the actual console-unique cert instead(stored in NAND), while on 3DS it&#039;s still not(?) fixed.&lt;br /&gt;
On 3DS however this is rather useless, due to the entire DSiWare .bin being encrypted with the console-unique movable.sed keyY.&lt;br /&gt;
| When the movable.sed keyY for the target 3DS is known and the target 3DS CTCert private-key is unknown, importing of modified DSiWare SD .bin files.&lt;br /&gt;
| Unknown, probably none.&lt;br /&gt;
| ?&lt;br /&gt;
| April 2013&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[Gamecard_Services_PXI]] unchecked REG_CTRCARDCNT transfer-size&lt;br /&gt;
| The u8 REG_CTRCARDCNT transfer-size parameter for the [[Gamecard_Services_PXI]] read/write CTRCARD commands is used as an index for an array of u16 values. Before [[5.0.0-11|5.0.0-X]] this u8 value wasn&#039;t checked, thus out-of-bounds reads could be triggered(which is rather useless in this case).&lt;br /&gt;
| Out-of-bounds read for a value which gets written to a register.&lt;br /&gt;
| [[5.0.0-11|5.0.0-X]]&lt;br /&gt;
| &lt;br /&gt;
| 2013?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[PXI_Registers|PXI]] cmdbuf buffer overrun&lt;br /&gt;
| The Process9 code responsible [[PXI_Registers|PXI]] communications didn&#039;t verify the size of the incoming command before writing it to a C++ member variable. &lt;br /&gt;
| Probably ARM9 code execution&lt;br /&gt;
| [[5.0.0-11|5.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| March 2015, original timeframe if any unknown&lt;br /&gt;
| &lt;br /&gt;
| [[User:Plutooo|plutoo]]/[[User:Yellows8|Yellows8]]/maybe others(?)&lt;br /&gt;
|-&lt;br /&gt;
| [[Application_Manager_Services_PXI|PXIAM]] command 0x003D0108(See also [[Application_Manager_Services|this]])&lt;br /&gt;
| When handling this command, Process9 allocates a 0x2800-byte heap buffer, then copies the 4 FCRAM input buffers to this heap buffer without checking the sizes at all(only the buffers with non-zero sizes are copied). Starting with [[5.0.0-11|5.0.0-X]], the total combined size of the input data must be &amp;lt;=0x2800.&lt;br /&gt;
| ARM9 code execution&lt;br /&gt;
| [[5.0.0-11|5.0.0-X]]&lt;br /&gt;
| &lt;br /&gt;
| May 2013&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[Process_Services_PXI|PS RSA]] commands buffer overflows&lt;br /&gt;
| pxips9 cmd1(not accessible via ps:ps) and VerifyRsaSha256: unchecked copy to a buffer in Process9&#039;s .bss, from the input FCRAM buffer. The buffer is located before the pxi cmdhandler threads&#039; stacks. SignRsaSha256 also has a buf overflow, but this isn&#039;t exploitable.&lt;br /&gt;
The buffer for this is the buffer for the signature data. With v5.0, the signature buffer was moved to stack, with a check for the signature data size. When the signature data size is too large, Process9 uses [[SVC|svcBreak]].&lt;br /&gt;
| ARM9 code execution&lt;br /&gt;
| [[5.0.0-11|5.0.0-X]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[PXI_Registers|PXI]] pxi_id bad check&lt;br /&gt;
| The Process9 code responsible for [[PXI_Registers|PXI]] communications read pxi_id as a signed char. There were two flaws:&lt;br /&gt;
* They used it as index to a lookup-table without checking the value at all.&lt;br /&gt;
* Another function verified that pxi_id &amp;lt; 7, allowing negative values to pass the check. This would also cause an out-of-range table-lookup.&lt;br /&gt;
| Maybe ARM9 code execution&lt;br /&gt;
| [[3.0.0-5|3.0.0-5]]&lt;br /&gt;
|&lt;br /&gt;
| March 2015, originally 2012 for the first issue at least&lt;br /&gt;
| &lt;br /&gt;
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]], maybe others(?)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel9 ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]] bit1 not set by Kernel9&lt;br /&gt;
| Old versions of Kernel9 never set bit1 of [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]]. This leaves the [[OTP Registers|0x10012000]]-region unprotected (this region should be locked early during boot!). Since it&#039;s never locked, you can dump it once you get ARM9 code execution. See [[OTP Registers|here]] regarding the data stored there.&lt;br /&gt;
&lt;br /&gt;
From [[3.0.0-5|3.0.0-X]] this was fixed by setting the bit in Kernel9 after poking some registers in that region. On New3DS arm9loader sets this bit instead of Kernel9.&lt;br /&gt;
| Dumping of the [[OTP Registers|OTP]] area&lt;br /&gt;
| [[3.0.0-5|3.0.0-X]]&lt;br /&gt;
|&lt;br /&gt;
| February 2015&lt;br /&gt;
| [[User:Plutooo|plutoo]], Normmatt independently&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== ARM11 software ==&lt;br /&gt;
=== Kernel11 ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
|  [[SVC]] table too small&lt;br /&gt;
|  The table of function pointers for SVC&#039;s only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing SVC7E or SVC7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.&lt;br /&gt;
&lt;br /&gt;
However, this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn&#039;t mapped as executable.&lt;br /&gt;
| &lt;br /&gt;
|  None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
| 2012&lt;br /&gt;
| Everyone&lt;br /&gt;
|-&lt;br /&gt;
|  [[SVC|svcBackdoor (0x7B)]]&lt;br /&gt;
|  This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.&lt;br /&gt;
| See description&lt;br /&gt;
|  None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
|&lt;br /&gt;
| Everyone&lt;br /&gt;
|-&lt;br /&gt;
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory&lt;br /&gt;
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup for loading the FIRM-modules from the FIRM section located in DSP-mem, this never seems to be used after that, however. This is never unmapped either.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
|  AffinityMask/processorid validation&lt;br /&gt;
|  With [[10.0.0-27|10.0.0-X]] the following functions were updated: svcGetThreadAffinityMask, svcGetProcessAffinityMask, svcSetProcessAffinityMask, and svcCreateThread. The code changes for all but svcCreateThread are identical.&lt;br /&gt;
The original code with the first 3 did the following: &lt;br /&gt;
* if(u32_processorcount &amp;gt; ~0x80000001)return 0xe0e01bfd;&lt;br /&gt;
* if(s32_processorcount &amp;gt; &amp;lt;total_cores&amp;gt;)return 0xd8e007fd;&lt;br /&gt;
The following code replaced the above:&lt;br /&gt;
* if(u32_processorcount &amp;gt;= &amp;lt;total_cores+1&amp;gt;)return 0xd8e007fd;&lt;br /&gt;
In theory the latter should catch everything that the former did, so it&#039;s unknown if this was really a security issue.&lt;br /&gt;
&lt;br /&gt;
The svcCreateThread changes with [[10.0.0-27|10.0.0-X]] definitely did fix a security issue.&lt;br /&gt;
* Original code: &amp;quot;if(s32_processorid &amp;gt; &amp;lt;total_cores&amp;gt;)return 0xd8e007fd;&amp;quot;&lt;br /&gt;
* New code: &amp;quot;if(s32_processorid &amp;gt;= &amp;lt;total_cores&amp;gt; || s32_processorid &amp;lt;= -4)return 0xd8e007fd;&amp;quot;&lt;br /&gt;
This fixed an off-by-one issue: if one would use processorid=total_cores, which isn&#039;t actually a valid value, svcCreateThread would accept that value on &amp;lt;[[10.0.0-27|10.0.0-X]]. This results in data being written out-of-bounds(baseaddr = arrayaddr + entrysize*processorid), which has the following result:&lt;br /&gt;
* Old3DS: Useless kernel-mode crash due to accessing unmapped memory.&lt;br /&gt;
* New3DS: uncontrolled data write into a kernel-mode L1 MMU-table. This isn&#039;t really useful: the data can&#039;t be controlled, and the data which gets overwritten is all-zero anyway(this isn&#039;t anywhere near MMU L1 entries for actually mapped memory).&lt;br /&gt;
The previous version also allowed large negative s32_processorid values(negative processorid values are special values not actual procids), but it appears using values like that won&#039;t actually do anything(meaning no crash) besides the thread not running / thread not running for a while(besides triggering a kernelpanic with certain s32_processorid value(s)).&lt;br /&gt;
| Nothing useful&lt;br /&gt;
|  [[10.0.0-27|10.0.0-X]]&lt;br /&gt;
| [[10.0.0-27|10.0.0-X]]&lt;br /&gt;
| svcCreateThread issue: May 31, 2015. The rest: September 8, 2015, via v9.6-&amp;gt;v10.0 ARM11-kernel code-diff.&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| memchunkhax&lt;br /&gt;
| The kernel originally did not validate the data stored in the FCRAM kernel heap [[Memchunkhdr|memchunk-headers]] for free-memory at all. Exploiting this requires raw R/W access to these memchunk-headers, like physical-memory access with gspwn.&lt;br /&gt;
&lt;br /&gt;
There are &#039;&#039;multiple&#039;&#039; ways to exploit this, but the end-result for most of these is the same: overwrite code in AXIWRAM via the 0xEFF00000/0xDFF00000 kernel virtual-memory mapping.&lt;br /&gt;
&lt;br /&gt;
This was fixed in [[9.3.0-21|9.3.0-X]] by checking that the memchunk(including size, next, and prev ptrs) is located within the currently used heap memory. The kernel may also check that the next/prev ptrs are valid compared to other memchunk-headers basically. When any of these checks fail, kernelpanic() is called.&lt;br /&gt;
| When combined with other flaws: ARM11-kernelmode code execution&lt;br /&gt;
| [[9.3.0-21|9.3.0-21]]&lt;br /&gt;
| &lt;br /&gt;
| February 2014&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| Multiple [[KLinkedListNode|KLinkedListNode]] SlabHeap use after free bugs&lt;br /&gt;
| The ARM11-kernel did access the &#039;key&#039; field of [[KLinkedListNode|KLinkedListNode]] objects, which are located on the SlabHeap, after freeing them. Thus, triggering an allocation of a new [[KLinkedListNode|KLinkedListNode]] object at the right time could result in a type-confusion. Pseudo-code:&lt;br /&gt;
SlabHeap_free(KLinkedListNode);&lt;br /&gt;
KObject *obj = KLinkedListNode-&amp;gt;key;  // the object there might have changed!&lt;br /&gt;
This bug appeared all over the place.&lt;br /&gt;
| ARM11-kernelmode code exec maybe&lt;br /&gt;
| [[8.0.0-18|8.0.0-18]]&lt;br /&gt;
| &lt;br /&gt;
| April 2015&lt;br /&gt;
| [[User:Derrek|derrek]]&lt;br /&gt;
|-&lt;br /&gt;
| PXI [[RPC_Command_Structure|Command]] input/output buffer permissions&lt;br /&gt;
| Originally the ARM11-kernel didn&#039;t check permissions for PXI input/output buffers for commands. Starting with [[6.0.0-11|6.0.0]] PXI input/output buffers must have RW permissions, otherwise kernelpanic is triggered.&lt;br /&gt;
| &lt;br /&gt;
| [[6.0.0-11|6.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|svcStartInterProcessDma]]&lt;br /&gt;
| For svcStartInterProcessDma, the kernel code had the following flaws:&lt;br /&gt;
&lt;br /&gt;
* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.&lt;br /&gt;
&lt;br /&gt;
* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.&lt;br /&gt;
&lt;br /&gt;
* The kernel now also checks whether the srcaddr/dstaddr (+size) is within userland memory (0x20000000), the kernel now (with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address &amp;gt;=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr-&amp;gt;physaddr conversion). &lt;br /&gt;
| &lt;br /&gt;
| [[6.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| DmaConfig issue: unknown. The rest: 2014&lt;br /&gt;
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] independently&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|svcControlMemory]] Parameter checks&lt;br /&gt;
| For svcControlMemory the parameter check had these two flaws:&lt;br /&gt;
&lt;br /&gt;
* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn&#039;t actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn&#039;t actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.&lt;br /&gt;
&lt;br /&gt;
* Integer overflows on (addr0+size) are now checked that previously weren&#039;t (this also applies to most other address checks elsewhere in the kernel).&lt;br /&gt;
&lt;br /&gt;
| &lt;br /&gt;
| [[5.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
|&lt;br /&gt;
| [[User:Plutooo|plutoo]]&lt;br /&gt;
|-&lt;br /&gt;
| [[RPC_Command_Structure|Command]] request/response buffer overflow&lt;br /&gt;
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words (0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread. However, since the data written there would be translate parameters (such as header-words + buffer addresses), exploiting this would likely be very difficult, if possible at all.&lt;br /&gt;
&lt;br /&gt;
If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of &amp;lt;nowiki&amp;gt;((size&amp;lt;&amp;lt;14) | 2)&amp;lt;/nowiki&amp;gt; to write arbitrary memory to any RW userland memory in the destination process.&lt;br /&gt;
| &lt;br /&gt;
| [[5.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| v4.1 FIRM -&amp;gt; v5.0 code diff&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|SVC stack allocation overflows]]&lt;br /&gt;
| &lt;br /&gt;
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun. &lt;br /&gt;
* The alignment (size+7)&amp;amp;~7 calculation before allocation was not checked for integer overflow.&lt;br /&gt;
&lt;br /&gt;
This might allow for ARM11 kernel code-execution.&lt;br /&gt;
&lt;br /&gt;
(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)&lt;br /&gt;
| &lt;br /&gt;
| [[5.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| v4.1 FIRM -&amp;gt; v5.0 code diff&lt;br /&gt;
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] complementary&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions&lt;br /&gt;
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn&#039;t check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.&lt;br /&gt;
| &lt;br /&gt;
| [[4.1.0-8]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[RPC_Command_Structure|Command]] input/output buffer permissions&lt;br /&gt;
| Originally the ARM11 kernel didn&#039;t check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don&#039;t have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.&lt;br /&gt;
| &lt;br /&gt;
| [[4.0.0-7]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions&lt;br /&gt;
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.&lt;br /&gt;
| &lt;br /&gt;
| [[4.0.0-7]]&lt;br /&gt;
| &lt;br /&gt;
| 2012?&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== [[FIRM]] Sysmodules ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| [[Services|&amp;quot;srv:pm&amp;quot;]] process registration&lt;br /&gt;
| Originally any process had access to the port &amp;quot;srv:pm&amp;quot;. The PID&#039;s used for the (un)registration commands are not checked either. This allowed any process to re-register itself with &amp;quot;srv:pm&amp;quot;, and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.&lt;br /&gt;
&lt;br /&gt;
This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] &amp;quot;srv:pm&amp;quot; is now a service instead of a globally accessible port. Only processes with PID&#039;s less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for &amp;quot;srv:pm&amp;quot; open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.&lt;br /&gt;
&lt;br /&gt;
This flaw was needed for exploiting the &amp;lt;=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don&#039;t have access to those service(s).&lt;br /&gt;
| Access to arbitrary services&lt;br /&gt;
| [[7.0.0-13]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| FSDIR null-deref&lt;br /&gt;
| [[Filesystem_services|FS]]-module may crash in some cases when handling directory reading. The trigger seems to be due to using [[FSDir:Close]] without closing the dir-handle afterwards?(Perhaps this is caused by out-of-memory?) This seems to be useless since it&#039;s just a null-deref.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.6.0-24|9.6.0-X]]&lt;br /&gt;
| May 19(?)-20, 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Standalone Sysmodules ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in system-module system-version&lt;br /&gt;
!  Last system-module system-version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Timeframe this was added to wiki&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| [[SPI_Services|SPI]] service out-of-bounds write&lt;br /&gt;
| cmd1 has out-of-bounds write allowing overwrite of some static variables in .data.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.5.0-22]]&lt;br /&gt;
| March 2015&lt;br /&gt;
| &lt;br /&gt;
| [[User:Plutooo|plutoo]]&lt;br /&gt;
|-&lt;br /&gt;
| [[NFC_Services|NFC]] module service command buf-overflows&lt;br /&gt;
| NFC module copies data with certain commands, from command input buffers to stack without checking the size. These commands include the following, it&#039;s unknown if there&#039;s more commands with similar issues: &amp;quot;nfc:dev&amp;quot; &amp;lt;0x000C....&amp;gt; and &amp;quot;nfc:s&amp;quot; &amp;lt;0x0037....&amp;gt;.&lt;br /&gt;
Since both of these commands are stubbed in the Old3DS NFC module from the very first version(those just return an error), these issues only affect the New3DS NFC module.&lt;br /&gt;
&lt;br /&gt;
There&#039;s no known retail titles which have access to either of these services.&lt;br /&gt;
| ROP under NFC module.&lt;br /&gt;
| New3DS: None&lt;br /&gt;
| New3DS: [[9.5.0-22]]&lt;br /&gt;
| December 2014?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[News_Services|NEWSS]] service command notificationID validation failure&lt;br /&gt;
| This module does not validate the input notificationID for &amp;lt;nowiki&amp;gt;&amp;quot;news:s&amp;quot;&amp;lt;/nowiki&amp;gt; service commands. This is an out-of-bounds array index bug. For example, [[NEWSS:SetNotificationHeader]] could be used to exploit news module: this copies the input data(size is properly checked) to: out = newsdb_savedata+0x10 + (someu32array[notificationID]*0x70).&lt;br /&gt;
| ROP under news module.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.7.0-25|9.7.0-X]]&lt;br /&gt;
| December 2014&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[NWMUDS:DecryptBeaconData]] heap buffer overflow&lt;br /&gt;
| input_size = 0x1E * &amp;lt;value the u8 from input_[[NWM_Services|networkstruct]]+0x1D&amp;gt;. Then input_tag0 is copied to a heap buffer. When input_size is larger than 0xFA-bytes, it will then copy input_tag1 to &amp;lt;end_address_of_previous_outbuf&amp;gt;, with size=input_size-0xFA.&lt;br /&gt;
&lt;br /&gt;
This can be triggered by either using this command directly, or by boadcasting a wifi beacon which triggers it while a 3DS system running the target process is in range, when the process is scanning for hosts to connect to. Processes will only pass tag data to this command when the wlancommID and other thing(s) match the values for the process.&lt;br /&gt;
&lt;br /&gt;
There&#039;s no known way to actually exploit this for getting ROP under NWM-module, at the time of originally adding this to the wiki. This is because the data which gets copied out-of-bounds *and* actually causes crash(es), can&#039;t be controlled it seems(with just broadcasting a beacon at least). It&#039;s unknown whether this could be exploited from just using NWMUDS service-cmd(s) directly.&lt;br /&gt;
| Without any actual way to exploit this: NWM-module DoS, resulting in process termination(process crash). This breaks *everything* involving wifi comms, a reboot is required to recover from this.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.0.0-20]]&lt;br /&gt;
| ~September 23, 2014(see the [[NWMUDS:DecryptBeaconData]] page history)&lt;br /&gt;
| August 3, 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[HID_Services|HID]] module shared-mem&lt;br /&gt;
| HID module does not validate the index values in [[HID_Shared_Memory|sharedmem]](just changes index to 0 when index == maxval when updating), therefore large values will result in HID module writing HID data to arbitrary addresses.&lt;br /&gt;
| ROP under HID module, but this is *very* unlikely to be exploitable since the data written is HID data.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.3.0-21]]&lt;br /&gt;
| 2014?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| gspwn&lt;br /&gt;
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you&#039;re running under, and gain real code-execution from a ROP-chain. Normally applets&#039; .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).&lt;br /&gt;
&lt;br /&gt;
FCRAM is gpu-accessible up to physaddr 0x26800000 on Old3DS, and 0x2DC00000 on New3DS. This is BASE_memregion_start(aka SYSTEM_memregion_end)-0x400000 with the default memory-layout on Old3DS/New3DS.&lt;br /&gt;
| User-mode code execution.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.6.0-24|9.6.0-X]]&lt;br /&gt;
| Early 2014&lt;br /&gt;
| &lt;br /&gt;
| smea, [[User:Yellows8|Yellows8]]/others before then&lt;br /&gt;
|-&lt;br /&gt;
| rohax&lt;br /&gt;
| Using gspwn, it is possible to overwrite a loaded [[CRO0]]/[[CRR0]] after its RSA-signature has been validated. Badly validated [[CRO0]] header leads to arbitrary read/write of memory in the ro-process. This gives code-execution in the ro module, who has access to [[SVC|syscalls]] 0x70-0x72, 0x7D.&lt;br /&gt;
&lt;br /&gt;
This was fixed after [[ninjhax]] release by adding checks on [[CRO0]]-based pointers before writing to them.&lt;br /&gt;
| Memory-mapping syscalls.&lt;br /&gt;
| [[9.3.0-21]]&lt;br /&gt;
| [[9.4.0-21]]&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
| smea, [[User:Plutooo|plutoo]] joint effort&lt;br /&gt;
|-&lt;br /&gt;
| Region free&lt;br /&gt;
| Only [[Home Menu]] itself checks gamecards&#039; region when launching them. Therefore, any application launch that is done directly with [[NS]] without signaling Home Menu to launch the app, will result in region checks being bypassed.&lt;br /&gt;
This essentially means launching the gamecard with the [[NS_and_APT_Services|&amp;quot;ns:s&amp;quot;]] service. The main way to exploit this is to trigger a FIRM launch with an application specified, either with a normal FIRM launch or a hardware [[NSS:RebootSystem|reboot]].&lt;br /&gt;
| Launching gamecards from any region + bypassing Home Menu gamecard-sysupdate installation&lt;br /&gt;
| None&lt;br /&gt;
| Last tested with [[10.1.0-27|10.1.0-X]].&lt;br /&gt;
| June(?) 2014&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[NWM_Services|NWM]] service-cmd state null-ptr deref&lt;br /&gt;
| The NWMUDS service command code loads a ptr from .data, adds an offset to that, then passes that as the state address for the actual command-handler function. The value of the ptr loaded from .data is not checked, therefore this will cause crashes due to that being 0x0 when NWMUDS was not properly initialized.&lt;br /&gt;
It&#039;s unknown whether any NWM services besides NWMUDS have this issue.&lt;br /&gt;
| This is rather useless since it&#039;s only a crash caused by a state ptr based at 0x0.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.0.0-20]]&lt;br /&gt;
| 2013?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== General/CTRSDK ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in version&lt;br /&gt;
!  Last version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| [[NWM_Services|UDS]] beacon additional-data buffer overflow&lt;br /&gt;
| Originally CTRSDK did not validate the UDS additional-data size before using that size to copy the additional-data to a [[NWM_Services|networkstruct]]. This was eventually fixed.&lt;br /&gt;
This was discovered while doing code RE with an old dlp-module version. It&#039;s unknown in what specific CTRSDK version this was fixed, or even what system-version updated titles with a fixed version.&lt;br /&gt;
&lt;br /&gt;
It&#039;s unknown if there&#039;s any titles using a vulnerable CTRSDK version which are also exploitable with this(dlp module can&#039;t be exploited with this).&lt;br /&gt;
&lt;br /&gt;
The maximum number of bytes that can be written beyond the end of the outbuf is 0x37-bytes, with additionaldata_size=0xFF.&lt;br /&gt;
| Perhaps ROP, very difficult if possible with anything at all&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
| September(?) 2014&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=3DS_System_Flaws&amp;diff=15127</id>
		<title>3DS System Flaws</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=3DS_System_Flaws&amp;diff=15127"/>
		<updated>2016-01-02T03:28:12Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Only on N3DS&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of publicly known system flaws, for userland applications/applets flaws see [[3DS_Userland_Flaws|here]].&lt;br /&gt;
&lt;br /&gt;
=Stale / Rejected Efforts=&lt;br /&gt;
* Neimod has been working on a RAM dumping setup for a little while now. He&#039;s de-soldered the 3DS&#039;s RAM chip and hooked it and the RAM pinouts on the 3DS&#039; PCB up to a custom RAM dumping setup. A while ago he published photos showing his setup to be working quite well, with the 3DS successfully booting up. However, his flickr stream is now private along with most of his work.&lt;br /&gt;
&lt;br /&gt;
* Someone (who will remain unnamed) has released CFW and CIA installers, all of which is copied from the work of others, or copyrighted material.&lt;br /&gt;
&lt;br /&gt;
==Tips and info==&lt;br /&gt;
The 3DS uses the XN feature of the ARM11 processor. There&#039;s no official way from applications to enable executable permission for memory containing arbitrary unsigned code(there&#039;s a [[SVC]] for this, but only [[RO_Services|RO-module]] has access to it). An usable userland exploit would still be useful: you could only do return-oriented-programming with it initially. From ROP one could then exploit system flaw(s), see below.&lt;br /&gt;
&lt;br /&gt;
SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped(accessing SD data is far easier by running code on the target 3DS however).&lt;br /&gt;
&lt;br /&gt;
=System flaws=&lt;br /&gt;
== Hardware ==&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Fixed with hardware model/revision&lt;br /&gt;
!  Newest hardware model/revision this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| ARM9/ARM11 bootrom vectors point at unitialized RAM&lt;br /&gt;
| ARM9&#039;s and ARM11&#039;s exception vectors are hardcoded to point at the CPU&#039;s internal memory (0x08000000 region for ARM9, AXIWRAM for ARM11). While the bootrom does set them up to point to an endless loop at some point during boot, it does not do so immediately. As such, a carefully-timed fault injection (via hardware) to trigger an exception (such as an invalid instruction) will cause execution to fall into ARM9 RAM. &lt;br /&gt;
Since RAM isn&#039;t cleared on boot (see below), one can immediately start execution of their own code here to dump bootrom, OTP, etc.&lt;br /&gt;
The ARM9 bootrom does the following at reset:  reset vector branches to another instruction, then branches to bootrom+0x8000. Hence, there&#039;s no way to know for certain when exactly the ARM9 exception-vector data stored in memory gets initialized.&lt;br /&gt;
&lt;br /&gt;
This requires *very* *precise* timing for triggering the hardware fault: it&#039;s unknown if anyone actually exploited this successfully at the time of writing(the one who attempted+discovered it *originally* as listed in this wiki section hasn&#039;t).&lt;br /&gt;
| None: all available 3DS models at the time of writing have the exact same ARM9/ARM11 bootrom for the unprotected areas.&lt;br /&gt;
| New3DS&lt;br /&gt;
| End of February 2014&lt;br /&gt;
| [[User:Derrek|derrek]], WulfyStylez (May 2015) independently&lt;br /&gt;
|-&lt;br /&gt;
| Missing AES key clearing&lt;br /&gt;
| The hardware AES engine does not clear keys when doing a hard reset/reboot.&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| August 2014&lt;br /&gt;
| Mathieulh/Others&lt;br /&gt;
|-&lt;br /&gt;
| No RAM clearing on reboots&lt;br /&gt;
| On an MCU-triggered reboot all RAM including FCRAM/ARM9 memory/AXIWRAM/VRAM keeps its contents.&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| March 2014&lt;br /&gt;
| [[User:Derrek|derrek]]&lt;br /&gt;
|-&lt;br /&gt;
| 32bits of actual console-unique TWLNAND keydata&lt;br /&gt;
| On retail the 8-bytes at ARM9 address [[Memory_layout|0x01FFB808]] are XORed with hard-coded data, to generate the TWL console-unique keys, including TWLNAND. On Old3DS the high u32 is always 0x0, while on New3DS that u32 is always 0x2. On top of this, the lower u32&#039;s highest bit is always ORed. only 31 bits of the TWL console-unique keydata / TWL consoleID are actually console-unique.&lt;br /&gt;
This allows one to easily bruteforce the TWL console-unique keydata with *just* data from TWLNAND. On DSi the actual console-unique data for key generation is 8-bytes(all bytes actually set).&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| 2012?&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| DSi / 3DS-TWL key-generator&lt;br /&gt;
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the TWL key-generator function.&lt;br /&gt;
This applies to the keyX/keyY too.&lt;br /&gt;
&lt;br /&gt;
This attack does not work for the 3DS key-generator because keyslots 0-3 are only for TWL keys.&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| 2011&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| 3DS key-generator&lt;br /&gt;
| The algorithm for generating the normal-keys for keyslots is cryptographically weak.  As a result, it is easily susceptible to differential cryptanalysis if the normal-key corresponding to any scrambler-generated keyslot is discovered.&lt;br /&gt;
&lt;br /&gt;
Several such pairs of matching normal-keys and KeyY values were found, leading to deducing the key-generator function.&lt;br /&gt;
| None&lt;br /&gt;
| New3DS&lt;br /&gt;
| February 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]], [[User:Plutooo|plutoo]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== ARM9 software ==&lt;br /&gt;
=== arm9loader ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| Missing verification-block for the 9.6 keys&lt;br /&gt;
| Starting with [[9.6.0-24|9.6.0-X]] a new set of NAND-based keys were introduced. However, no verification block was added to verify that the new key read from NAND is correct. This was technically an issue from [[9.5.0-22|9.5.0-X]] with the original sector+0 keydata, however the below is only possible with [[9.6.0-24|9.6.0-X]] since keyslots 0x15 and 0x16 are generated from different 0x11 keyXs.&lt;br /&gt;
&lt;br /&gt;
Writing an incorrect key to NAND will cause arm9loader to decrypt the ARM9 kernel as garbage and then jump to it.&lt;br /&gt;
&lt;br /&gt;
This allows an hardware-based attack where you can boot into an older exploited firmware, fill all memory with NOP sleds/jump-instructions, and then reboot into executing garbage. By automating this process with various input keydata, eventually you&#039;ll find some garbage that jumps to your code.&lt;br /&gt;
&lt;br /&gt;
This should give very early ARM9 code execution (pre-ARM9 kernel). As such, it is possible to dump RSA keyslots with this and calculate the 6.x [[Savegames#6.0.0-11_Savegame_keyY|save]], and 7.x [[NCCH]] keys. This cannot be used to recover keys initialized by arm9loader itself. This is due to it wiping the area used for its stack during NAND sector decryption and keyslot init. &lt;br /&gt;
&lt;br /&gt;
Due to FIRMs on both Old and New 3DS using the same RSA data, this can be exploited on Old3DS as well, but only if one already has the actual plaintext normalkey from New3DS NAND sector 0x96 offset-0 and has dumped the OTP area of the Old3DS.&lt;br /&gt;
| Recovery of 6.x [[Savegames#6.0.0-11_Savegame_keyY|save key]]/7.x [[NCCH]] key&lt;br /&gt;
| None&lt;br /&gt;
| [[9.6.0-24|9.6.0-X]]&lt;br /&gt;
| March, 2015&lt;br /&gt;
| [[User:Plutooo|plutoo]]&lt;br /&gt;
|-&lt;br /&gt;
| Uncleared New3DS keyslot 0x11&lt;br /&gt;
| Originally the New3DS [[FIRM]] arm9bin loader only cleared keyslot 0x11 when it gets executed at firmlaunch. This was fixed with [[9.5.0-22|9.5.0-X]] by completely clearing keyslot 0x11 immediately after the loader finishes using keyslot 0x11.&lt;br /&gt;
This means that any ARM9 code that can execute before the loader clears the keyslot at firmlaunch(including firmlaunch-hax) can get access to the uncleared keyslot 0x11, which then allows one to generate all &amp;lt;=v9.5 New3DS keyXs which are generated by keyslot 0x11.&lt;br /&gt;
&lt;br /&gt;
Therefore, to completely fix this the loader would have to generate more keys using different keyslot 0x11 keydata. This was done with [[9.6.0-24|9.6.0-X]].&lt;br /&gt;
| New3DS keyXs generation&lt;br /&gt;
| Mostly fixed with [[9.5.0-22|9.5.0-X]], completely fixed with new keys with [[9.6.0-24|9.6.0-X]].&lt;br /&gt;
| &lt;br /&gt;
| February 3, 2015 (one day after [[9.5.0-22|9.5.0-X]] release)&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Process9 ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Public disclosure timeframe&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| Leak of normal-key matching a key-scrambler key&lt;br /&gt;
| New 3DS firmware versions [[8.1.0-0|8.1.0]] through [[9.2.0-20|9.2.0]] set the encryption key for [[Amiibo]] data using a hardcoded normal-key in Process9.  In firmware [[9.3.0-21|9.3.0]], Nintendo &amp;quot;fixed&amp;quot; this by using the key scrambler instead, by calculating the keyY value for keyslot 0x39 that results in the same normal-key, then hardcoding that keyY into Process9.&lt;br /&gt;
&lt;br /&gt;
Nintendo&#039;s fix is actually the problem: Nintendo revealed the normal-key matching an unknown keyX and a known keyY.  Combined with the key scrambler using an insecure scrambling algorithm (see &amp;quot;Hardware&amp;quot; above), the key scrambler function could be deduced.&lt;br /&gt;
| Deducing the keyX for keyslot 0x39 and the key scrambler algorithm&lt;br /&gt;
| New 3DS [[9.3.0-21|9.3.0-X]], sort of&lt;br /&gt;
| [[10.0.0-27|10.0.0-X]]&lt;br /&gt;
| Sometime in 2015 after the hardware key-generator was broken.&lt;br /&gt;
| 32c3 3ds talk (December 27, 2015)&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| Title downgrading via [[Application_Manager_Services|AM]]([[Application_Manager_Services_PXI|PXI]])&lt;br /&gt;
| When a title is *already* installed, Process9 will compare the installed title-version with the title-version being installed. When the one being installed is older, Process9 would return an error.&lt;br /&gt;
&lt;br /&gt;
However, this can be bypassed by just deleting the title first via the service command(s) for that: with the title removed from the [[Title_Database]], Process9 can&#039;t compare the input title-version with anything. Hence, titles can be downgraded this way.&lt;br /&gt;
| Bypassing title version check at installation, which then allows downgrading any title.&lt;br /&gt;
| None&lt;br /&gt;
| NATIVE_FIRM / AM-sysmodule [[10.0.0-27|10.0.0-X]]&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| FAT FS code null-deref&lt;br /&gt;
| When FSFile:Read is used with a file which is corrupted on a FAT filesystem(in particular SD), Process9 can crash. This particular crash is caused by a function returning NULL instead of an actual ptr due to an error. The caller of that function doesn&#039;t check for NULL which then triggers a read based at NULL.&lt;br /&gt;
&lt;br /&gt;
Sample &amp;quot;fsck.vfat -n -v -V &amp;lt;fat image backup&amp;gt;&amp;quot; output for the above crash:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;...&lt;br /&gt;
Starting check/repair pass.&lt;br /&gt;
&amp;lt;FilePath0&amp;gt; and&lt;br /&gt;
&amp;lt;FilePath1&amp;gt;&lt;br /&gt;
 share clusters.&lt;br /&gt;
 Truncating second to 3375104 bytes.&lt;br /&gt;
&amp;lt;FilePath1&amp;gt;&lt;br /&gt;
 File size is 2787392 bytes, cluster chain length is 16384 bytes.&lt;br /&gt;
 Truncating file to 16384 bytes.&lt;br /&gt;
Checking for unused clusters.&lt;br /&gt;
Reclaimed 1 unused cluster (16384 bytes).&lt;br /&gt;
Checking free cluster summary.&lt;br /&gt;
Free cluster summary wrong (1404490 vs. really 1404491)&lt;br /&gt;
 Auto-correcting.&lt;br /&gt;
Starting verification pass.&lt;br /&gt;
Checking for unused clusters.&lt;br /&gt;
Leaving filesystem unchanged.&amp;lt;/pre&amp;gt;&lt;br /&gt;
| Useless null-based-read&lt;br /&gt;
| None&lt;br /&gt;
| [[9.6.0-24|9.6.0-X]]&lt;br /&gt;
| July 8-9, 2015&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| RSA signature padding checks&lt;br /&gt;
| The TWL_FIRM RSA sig padding check code used for all TWL RSA sig-checks has issues, see [[FIRM|here]].&lt;br /&gt;
The main 3DS RSA padding check code(non-certificate, including NATIVE_FIRM) uses the function used with the above to extract more padding + the actual hash from the additional padding. This isn&#039;t really a problem here because there&#039;s proper padding check code which is executed prior to this.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.5.0-22|9.5.0-X]]&lt;br /&gt;
| March 2015&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[AMPXI:ValidateDSiWareSectionMAC]] [[AES_Registers|AES]] keyslot reuse&lt;br /&gt;
| When the input DSiWare section index is higher than &amp;lt;max number of DSiWare sections supported by this FIRM&amp;gt;, Process9 uses keyid 0x40 for calculating the AESMAC, which translates to keyslot 0x40. The result is that the keyslot is left at whatever was already selected before, since the AES selectkeyslot code will immediately  return when keyslot is &amp;gt;=0x40. However, actually exploiting this is difficult: the calculated AESMAC is never returned, this command just compares the calculated AESMAC with the input AESMAC(result-code depends on whether the AESMACs match). It&#039;s unknown whether a timing attack would work with this.&lt;br /&gt;
This is basically a different form of the pxips9 keyslot vuln, except with AESMAC etc.&lt;br /&gt;
| See description.&lt;br /&gt;
| None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
| March 15, 2015&lt;br /&gt;
| December 29, 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| pxips9 [[AES_Registers|AES]] keyslot reuse&lt;br /&gt;
| This requires access to the [[Process_Services|ps:ps]]/pxi:ps9 services. One way to get access to this would be snshax on system-version &amp;lt;=10.1.0-X(see 32c3 3ds talk).&lt;br /&gt;
When an invalid key-type value is passed to any of the PS commands, Process9 will try to select keyslot 0x40. That aesengine_setkeyslot() code will then immediately return due to the invalid keyslot value. Since that function doesn&#039;t return any errors, Process9 will just continue to do crypto with whatever AES keyslot was selected before the PS command was sent.&lt;br /&gt;
| Reusing the previously used keyslot, for crypto with PS.&lt;br /&gt;
| None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
| Roughly the same time(same day?) as firmlaunch-hax.&lt;br /&gt;
| December 29, 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| firmlaunch-hax: FIRM header ToCToU&lt;br /&gt;
| This can&#039;t be exploited from ARM11 userland.&lt;br /&gt;
During [[FIRM]] launch, the only FIRM header the ARM9 uses at all is stored in FCRAM, this is 0x200-bytes(the actual used FIRM RSA signature is read to the Process9 stack however). The ARM9 doesn&#039;t expect &amp;quot;anything&amp;quot; besides the ARM9 to access this data.&lt;br /&gt;
With [[9.5.0-22]] the address of this FIRM header was changed from a FCRAM address, to ARM9-only address 0x01fffc00.&lt;br /&gt;
| ARM9 code execution&lt;br /&gt;
| [[9.5.0-22]]&lt;br /&gt;
| &lt;br /&gt;
| 2012, 3 days after [[User:Yellows8|Yellows8]] started Process9 code RE.&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| Uninitialized data output for (PXI) command replies&lt;br /&gt;
| PXI commands for various services(including some [[Filesystem_services_PXI|here]] and many others) can write uninitialized data (like from ARM registers) to the command reply. This happens with stubbed commands, but this can also occur with certain commands when returning an error.&lt;br /&gt;
Certain ARM11 service commands have this same issue as well.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.3.0-21|9.3.0-X]]&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[Filesystem_services_PXI|FSPXI]] OpenArchive SD permissions&lt;br /&gt;
| Process9 does not use the exheader ARM9 access-mount permission flag for SD at all.&lt;br /&gt;
This would mean ARM11-kernelmode code / fs-module itself could directly use FSPXI to access SD card without ARM9 checking for SD access, but this is rather useless since a process is usually running with SD access(Home Menu for example) anyway.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.3.0-21|9.3.0-X]]&lt;br /&gt;
| 2012&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[AMPXI:ExportDSiWare]] export path&lt;br /&gt;
| Process9 allocates memory on Process9 heap for the export path then verifies that the actual allocated size matches the input size. Then Process9 copies the input path from FCRAM to this buffer, and uses it with the Process9 FS openfile code, which use paths in the form of &amp;quot;&amp;lt;mountpoint&amp;gt;:/&amp;lt;path&amp;gt;&amp;quot;.&lt;br /&gt;
Process9 does not check the contents of this path at all before passing it to the FS code, besides writing a NUL-terminator to the end of the buffer.&lt;br /&gt;
| Exporting of DSiWare to arbitrary Process9 file-paths, such as &amp;quot;nand:/&amp;lt;path&amp;gt;&amp;quot; etc. This isn&#039;t really useful since the data which gets written can&#039;t be controlled.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.5.0-22]]&lt;br /&gt;
| April 2013&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[DSiWare_Exports]] [[CTCert]] verification&lt;br /&gt;
| Just like DSi originally did, 3DS verifies the APCert for DSiWare on SD with the CTCert also in the DSiWare .bin. On DSi this was fixed with with system-version 1.4.2 by verifying with the actual console-unique cert instead(stored in NAND), while on 3DS it&#039;s still not(?) fixed.&lt;br /&gt;
On 3DS however this is rather useless, due to the entire DSiWare .bin being encrypted with the console-unique movable.sed keyY.&lt;br /&gt;
| When the movable.sed keyY for the target 3DS is known and the target 3DS CTCert private-key is unknown, importing of modified DSiWare SD .bin files.&lt;br /&gt;
| Unknown, probably none.&lt;br /&gt;
| ?&lt;br /&gt;
| April 2013&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[Gamecard_Services_PXI]] unchecked REG_CTRCARDCNT transfer-size&lt;br /&gt;
| The u8 REG_CTRCARDCNT transfer-size parameter for the [[Gamecard_Services_PXI]] read/write CTRCARD commands is used as an index for an array of u16 values. Before [[5.0.0-11|5.0.0-X]] this u8 value wasn&#039;t checked, thus out-of-bounds reads could be triggered(which is rather useless in this case).&lt;br /&gt;
| Out-of-bounds read for a value which gets written to a register.&lt;br /&gt;
| [[5.0.0-11|5.0.0-X]]&lt;br /&gt;
| &lt;br /&gt;
| 2013?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[PXI_Registers|PXI]] cmdbuf buffer overrun&lt;br /&gt;
| The Process9 code responsible [[PXI_Registers|PXI]] communications didn&#039;t verify the size of the incoming command before writing it to a C++ member variable. &lt;br /&gt;
| Probably ARM9 code execution&lt;br /&gt;
| [[5.0.0-11|5.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| March 2015, original timeframe if any unknown&lt;br /&gt;
| &lt;br /&gt;
| [[User:Plutooo|plutoo]]/[[User:Yellows8|Yellows8]]/maybe others(?)&lt;br /&gt;
|-&lt;br /&gt;
| [[Application_Manager_Services_PXI|PXIAM]] command 0x003D0108(See also [[Application_Manager_Services|this]])&lt;br /&gt;
| When handling this command, Process9 allocates a 0x2800-byte heap buffer, then copies the 4 FCRAM input buffers to this heap buffer without checking the sizes at all(only the buffers with non-zero sizes are copied). Starting with [[5.0.0-11|5.0.0-X]], the total combined size of the input data must be &amp;lt;=0x2800.&lt;br /&gt;
| ARM9 code execution&lt;br /&gt;
| [[5.0.0-11|5.0.0-X]]&lt;br /&gt;
| &lt;br /&gt;
| May 2013&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[Process_Services_PXI|PS RSA]] commands buffer overflows&lt;br /&gt;
| pxips9 cmd1(not accessible via ps:ps) and VerifyRsaSha256: unchecked copy to a buffer in Process9&#039;s .bss, from the input FCRAM buffer. The buffer is located before the pxi cmdhandler threads&#039; stacks. SignRsaSha256 also has a buf overflow, but this isn&#039;t exploitable.&lt;br /&gt;
The buffer for this is the buffer for the signature data. With v5.0, the signature buffer was moved to stack, with a check for the signature data size. When the signature data size is too large, Process9 uses [[SVC|svcBreak]].&lt;br /&gt;
| ARM9 code execution&lt;br /&gt;
| [[5.0.0-11|5.0.0-X]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[PXI_Registers|PXI]] pxi_id bad check&lt;br /&gt;
| The Process9 code responsible for [[PXI_Registers|PXI]] communications read pxi_id as a signed char. There were two flaws:&lt;br /&gt;
* They used it as index to a lookup-table without checking the value at all.&lt;br /&gt;
* Another function verified that pxi_id &amp;lt; 7, allowing negative values to pass the check. This would also cause an out-of-range table-lookup.&lt;br /&gt;
| Maybe ARM9 code execution&lt;br /&gt;
| [[3.0.0-5|3.0.0-5]]&lt;br /&gt;
|&lt;br /&gt;
| March 2015, originally 2012 for the first issue at least&lt;br /&gt;
| &lt;br /&gt;
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]], maybe others(?)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel9 ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]] bit1 not set by Kernel9&lt;br /&gt;
| Old versions of Kernel9 never set bit1 of [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]]. This leaves the [[OTP Registers|0x10012000]]-region unprotected (this region should be locked early during boot!). Since it&#039;s never locked, you can dump it once you get ARM9 code execution. See [[OTP Registers|here]] regarding the data stored there.&lt;br /&gt;
&lt;br /&gt;
From [[3.0.0-5|3.0.0-X]] this was fixed by setting the bit in Kernel9 after poking some registers in that region. On New3DS arm9loader sets this bit instead of Kernel9.&lt;br /&gt;
| Dumping of the [[OTP Registers|OTP]] area&lt;br /&gt;
| [[3.0.0-5|3.0.0-X]]&lt;br /&gt;
|&lt;br /&gt;
| February 2015&lt;br /&gt;
| [[User:Plutooo|plutoo]], Normmatt independently&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== ARM11 software ==&lt;br /&gt;
=== Kernel11 ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
|  [[SVC]] table too small&lt;br /&gt;
|  The table of function pointers for SVC&#039;s only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing SVC7E or SVC7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.&lt;br /&gt;
&lt;br /&gt;
However, this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn&#039;t mapped as executable.&lt;br /&gt;
| &lt;br /&gt;
|  None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
| 2012&lt;br /&gt;
| Everyone&lt;br /&gt;
|-&lt;br /&gt;
|  [[SVC|svcBackdoor (0x7B)]]&lt;br /&gt;
|  This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.&lt;br /&gt;
| See description&lt;br /&gt;
|  None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
|&lt;br /&gt;
| Everyone&lt;br /&gt;
|-&lt;br /&gt;
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory&lt;br /&gt;
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup for loading the FIRM-modules from the FIRM section located in DSP-mem, this never seems to be used after that, however. This is never unmapped either.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[10.2.0-28|10.2.0-X]]&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
|  AffinityMask/processorid validation&lt;br /&gt;
|  With [[10.0.0-27|10.0.0-X]] the following functions were updated: svcGetThreadAffinityMask, svcGetProcessAffinityMask, svcSetProcessAffinityMask, and svcCreateThread. The code changes for all but svcCreateThread are identical.&lt;br /&gt;
The original code with the first 3 did the following: &lt;br /&gt;
* if(u32_processorcount &amp;gt; ~0x80000001)return 0xe0e01bfd;&lt;br /&gt;
* if(s32_processorcount &amp;gt; &amp;lt;total_cores&amp;gt;)return 0xd8e007fd;&lt;br /&gt;
The following code replaced the above:&lt;br /&gt;
* if(u32_processorcount &amp;gt;= &amp;lt;total_cores+1&amp;gt;)return 0xd8e007fd;&lt;br /&gt;
In theory the latter should catch everything that the former did, so it&#039;s unknown if this was really a security issue.&lt;br /&gt;
&lt;br /&gt;
The svcCreateThread changes with [[10.0.0-27|10.0.0-X]] definitely did fix a security issue.&lt;br /&gt;
* Original code: &amp;quot;if(s32_processorid &amp;gt; &amp;lt;total_cores&amp;gt;)return 0xd8e007fd;&amp;quot;&lt;br /&gt;
* New code: &amp;quot;if(s32_processorid &amp;gt;= &amp;lt;total_cores&amp;gt; || s32_processorid &amp;lt;= -4)return 0xd8e007fd;&amp;quot;&lt;br /&gt;
This fixed an off-by-one issue: if one would use processorid=total_cores, which isn&#039;t actually a valid value, svcCreateThread would accept that value on &amp;lt;[[10.0.0-27|10.0.0-X]]. This results in data being written out-of-bounds(baseaddr = arrayaddr + entrysize*processorid), which has the following result:&lt;br /&gt;
* Old3DS: Useless kernel-mode crash due to accessing unmapped memory.&lt;br /&gt;
* New3DS: uncontrolled data write into a kernel-mode L1 MMU-table. This isn&#039;t really useful: the data can&#039;t be controlled, and the data which gets overwritten is all-zero anyway(this isn&#039;t anywhere near MMU L1 entries for actually mapped memory).&lt;br /&gt;
The previous version also allowed large negative s32_processorid values(negative processorid values are special values not actual procids), but it appears using values like that won&#039;t actually do anything(meaning no crash) besides the thread not running / thread not running for a while(besides triggering a kernelpanic with certain s32_processorid value(s)).&lt;br /&gt;
| Nothing useful&lt;br /&gt;
|  [[10.0.0-27|10.0.0-X]]&lt;br /&gt;
| [[10.0.0-27|10.0.0-X]]&lt;br /&gt;
| svcCreateThread issue: May 31, 2015. The rest: September 8, 2015, via v9.6-&amp;gt;v10.0 ARM11-kernel code-diff.&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| memchunkhax&lt;br /&gt;
| The kernel originally did not validate the data stored in the FCRAM kernel heap [[Memchunkhdr|memchunk-headers]] for free-memory at all. Exploiting this requires raw R/W access to these memchunk-headers, like physical-memory access with gspwn.&lt;br /&gt;
&lt;br /&gt;
There are &#039;&#039;multiple&#039;&#039; ways to exploit this, but the end-result for most of these is the same: overwrite code in AXIWRAM via the 0xEFF00000/0xDFF00000 kernel virtual-memory mapping.&lt;br /&gt;
&lt;br /&gt;
This was fixed in [[9.3.0-21|9.3.0-X]] by checking that the memchunk(including size, next, and prev ptrs) is located within the currently used heap memory. The kernel may also check that the next/prev ptrs are valid compared to other memchunk-headers basically. When any of these checks fail, kernelpanic() is called.&lt;br /&gt;
| When combined with other flaws: ARM11-kernelmode code execution&lt;br /&gt;
| [[9.3.0-21|9.3.0-21]]&lt;br /&gt;
| &lt;br /&gt;
| February 2014&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| Multiple [[KLinkedListNode|KLinkedListNode]] SlabHeap use after free bugs&lt;br /&gt;
| The ARM11-kernel did access the &#039;key&#039; field of [[KLinkedListNode|KLinkedListNode]] objects, which are located on the SlabHeap, after freeing them. Thus, triggering an allocation of a new [[KLinkedListNode|KLinkedListNode]] object at the right time could result in a type-confusion. Pseudo-code:&lt;br /&gt;
SlabHeap_free(KLinkedListNode);&lt;br /&gt;
KObject *obj = KLinkedListNode-&amp;gt;key;  // the object there might have changed!&lt;br /&gt;
This bug appeared all over the place.&lt;br /&gt;
| ARM11-kernelmode code exec maybe&lt;br /&gt;
| [[8.0.0-18|8.0.0-18]]&lt;br /&gt;
| &lt;br /&gt;
| April 2015&lt;br /&gt;
| [[User:Derrek|derrek]]&lt;br /&gt;
|-&lt;br /&gt;
| PXI [[RPC_Command_Structure|Command]] input/output buffer permissions&lt;br /&gt;
| Originally the ARM11-kernel didn&#039;t check permissions for PXI input/output buffers for commands. Starting with [[6.0.0-11|6.0.0]] PXI input/output buffers must have RW permissions, otherwise kernelpanic is triggered.&lt;br /&gt;
| &lt;br /&gt;
| [[6.0.0-11|6.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|svcStartInterProcessDma]]&lt;br /&gt;
| For svcStartInterProcessDma, the kernel code had the following flaws:&lt;br /&gt;
&lt;br /&gt;
* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.&lt;br /&gt;
&lt;br /&gt;
* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.&lt;br /&gt;
&lt;br /&gt;
* The kernel now also checks whether the srcaddr/dstaddr (+size) is within userland memory (0x20000000), the kernel now (with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address &amp;gt;=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr-&amp;gt;physaddr conversion). &lt;br /&gt;
| &lt;br /&gt;
| [[6.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| DmaConfig issue: unknown. The rest: 2014&lt;br /&gt;
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] independently&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|svcControlMemory]] Parameter checks&lt;br /&gt;
| For svcControlMemory the parameter check had these two flaws:&lt;br /&gt;
&lt;br /&gt;
* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn&#039;t actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn&#039;t actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.&lt;br /&gt;
&lt;br /&gt;
* Integer overflows on (addr0+size) are now checked that previously weren&#039;t (this also applies to most other address checks elsewhere in the kernel).&lt;br /&gt;
&lt;br /&gt;
| &lt;br /&gt;
| [[5.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
|&lt;br /&gt;
| [[User:Plutooo|plutoo]]&lt;br /&gt;
|-&lt;br /&gt;
| [[RPC_Command_Structure|Command]] request/response buffer overflow&lt;br /&gt;
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words (0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread. However, since the data written there would be translate parameters (such as header-words + buffer addresses), exploiting this would likely be very difficult, if possible at all.&lt;br /&gt;
&lt;br /&gt;
If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of &amp;lt;nowiki&amp;gt;((size&amp;lt;&amp;lt;14) | 2)&amp;lt;/nowiki&amp;gt; to write arbitrary memory to any RW userland memory in the destination process.&lt;br /&gt;
| &lt;br /&gt;
| [[5.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| v4.1 FIRM -&amp;gt; v5.0 code diff&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|SVC stack allocation overflows]]&lt;br /&gt;
| &lt;br /&gt;
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun. &lt;br /&gt;
* The alignment (size+7)&amp;amp;~7 calculation before allocation was not checked for integer overflow.&lt;br /&gt;
&lt;br /&gt;
This might allow for ARM11 kernel code-execution.&lt;br /&gt;
&lt;br /&gt;
(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)&lt;br /&gt;
| &lt;br /&gt;
| [[5.0.0-11]]&lt;br /&gt;
| &lt;br /&gt;
| v4.1 FIRM -&amp;gt; v5.0 code diff&lt;br /&gt;
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] complementary&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions&lt;br /&gt;
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn&#039;t check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.&lt;br /&gt;
| &lt;br /&gt;
| [[4.1.0-8]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[RPC_Command_Structure|Command]] input/output buffer permissions&lt;br /&gt;
| Originally the ARM11 kernel didn&#039;t check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don&#039;t have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.&lt;br /&gt;
| &lt;br /&gt;
| [[4.0.0-7]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions&lt;br /&gt;
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.&lt;br /&gt;
| &lt;br /&gt;
| [[4.0.0-7]]&lt;br /&gt;
| &lt;br /&gt;
| 2012?&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== [[FIRM]] Sysmodules ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in [[FIRM]] system version&lt;br /&gt;
!  Last [[FIRM]] system version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| [[Services|&amp;quot;srv:pm&amp;quot;]] process registration&lt;br /&gt;
| Originally any process had access to the port &amp;quot;srv:pm&amp;quot;. The PID&#039;s used for the (un)registration commands are not checked either. This allowed any process to re-register itself with &amp;quot;srv:pm&amp;quot;, and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.&lt;br /&gt;
&lt;br /&gt;
This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] &amp;quot;srv:pm&amp;quot; is now a service instead of a globally accessible port. Only processes with PID&#039;s less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for &amp;quot;srv:pm&amp;quot; open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.&lt;br /&gt;
&lt;br /&gt;
This flaw was needed for exploiting the &amp;lt;=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don&#039;t have access to those service(s).&lt;br /&gt;
| Access to arbitrary services&lt;br /&gt;
| [[7.0.0-13]]&lt;br /&gt;
| &lt;br /&gt;
| 2012&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| FSDIR null-deref&lt;br /&gt;
| [[Filesystem_services|FS]]-module may crash in some cases when handling directory reading. The trigger seems to be due to using [[FSDir:Close]] without closing the dir-handle afterwards?(Perhaps this is caused by out-of-memory?) This seems to be useless since it&#039;s just a null-deref.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.6.0-24|9.6.0-X]]&lt;br /&gt;
| May 19(?)-20, 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Standalone Sysmodules ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in system-module system-version&lt;br /&gt;
!  Last system-module system-version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Timeframe this was added to wiki&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| [[SPI_Services|SPI]] service out-of-bounds write&lt;br /&gt;
| cmd1 has out-of-bounds write allowing overwrite of some static variables in .data.&lt;br /&gt;
| &lt;br /&gt;
| None&lt;br /&gt;
| [[9.5.0-22]]&lt;br /&gt;
| March 2015&lt;br /&gt;
| &lt;br /&gt;
| [[User:Plutooo|plutoo]]&lt;br /&gt;
|-&lt;br /&gt;
| [[NFC_Services|NFC]] module service command buf-overflows&lt;br /&gt;
| NFC module copies data with certain commands, from command input buffers to stack without checking the size. These commands include the following, it&#039;s unknown if there&#039;s more commands with similar issues: &amp;quot;nfc:dev&amp;quot; &amp;lt;0x000C....&amp;gt; and &amp;quot;nfc:s&amp;quot; &amp;lt;0x0037....&amp;gt;.&lt;br /&gt;
Since both of these commands are stubbed in the Old3DS NFC module from the very first version(those just return an error), these issues only affect the New3DS NFC module.&lt;br /&gt;
&lt;br /&gt;
There&#039;s no known retail titles which have access to either of these services.&lt;br /&gt;
| ROP under NFC module.&lt;br /&gt;
| New3DS: None&lt;br /&gt;
| New3DS: [[9.5.0-22]]&lt;br /&gt;
| December 2014?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[News_Services|NEWSS]] service command notificationID validation failure&lt;br /&gt;
| This module does not validate the input notificationID for &amp;lt;nowiki&amp;gt;&amp;quot;news:s&amp;quot;&amp;lt;/nowiki&amp;gt; service commands. This is an out-of-bounds array index bug. For example, [[NEWSS:SetNotificationHeader]] could be used to exploit news module: this copies the input data(size is properly checked) to: out = newsdb_savedata+0x10 + (someu32array[notificationID]*0x70).&lt;br /&gt;
| ROP under news module.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.7.0-25|9.7.0-X]]&lt;br /&gt;
| December 2014&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[NWMUDS:DecryptBeaconData]] heap buffer overflow&lt;br /&gt;
| input_size = 0x1E * &amp;lt;value the u8 from input_[[NWM_Services|networkstruct]]+0x1D&amp;gt;. Then input_tag0 is copied to a heap buffer. When input_size is larger than 0xFA-bytes, it will then copy input_tag1 to &amp;lt;end_address_of_previous_outbuf&amp;gt;, with size=input_size-0xFA.&lt;br /&gt;
&lt;br /&gt;
This can be triggered by either using this command directly, or by boadcasting a wifi beacon which triggers it while a 3DS system running the target process is in range, when the process is scanning for hosts to connect to. Processes will only pass tag data to this command when the wlancommID and other thing(s) match the values for the process.&lt;br /&gt;
&lt;br /&gt;
There&#039;s no known way to actually exploit this for getting ROP under NWM-module, at the time of originally adding this to the wiki. This is because the data which gets copied out-of-bounds *and* actually causes crash(es), can&#039;t be controlled it seems(with just broadcasting a beacon at least). It&#039;s unknown whether this could be exploited from just using NWMUDS service-cmd(s) directly.&lt;br /&gt;
| Without any actual way to exploit this: NWM-module DoS, resulting in process termination(process crash). This breaks *everything* involving wifi comms, a reboot is required to recover from this.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.0.0-20]]&lt;br /&gt;
| ~September 23, 2014(see the [[NWMUDS:DecryptBeaconData]] page history)&lt;br /&gt;
| August 3, 2015&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[HID_Services|HID]] module shared-mem&lt;br /&gt;
| HID module does not validate the index values in [[HID_Shared_Memory|sharedmem]](just changes index to 0 when index == maxval when updating), therefore large values will result in HID module writing HID data to arbitrary addresses.&lt;br /&gt;
| ROP under HID module, but this is *very* unlikely to be exploitable since the data written is HID data.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.3.0-21]]&lt;br /&gt;
| 2014?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| gspwn&lt;br /&gt;
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you&#039;re running under, and gain real code-execution from a ROP-chain. Normally applets&#039; .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).&lt;br /&gt;
&lt;br /&gt;
FCRAM is gpu-accessible up to physaddr 0x26800000 on Old3DS, and 0x2DC00000 on New3DS. This is BASE_memregion_start(aka SYSTEM_memregion_end)-0x400000 with the default memory-layout on Old3DS/New3DS.&lt;br /&gt;
| User-mode code execution.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.6.0-24|9.6.0-X]]&lt;br /&gt;
| Early 2014&lt;br /&gt;
| &lt;br /&gt;
| smea, [[User:Yellows8|Yellows8]]/others before then&lt;br /&gt;
|-&lt;br /&gt;
| rohax&lt;br /&gt;
| Using gspwn, it is possible to overwrite a loaded [[CRO0]]/[[CRR0]] after its RSA-signature has been validated. Badly validated [[CRO0]] header leads to arbitrary read/write of memory in the ro-process. This gives code-execution in the ro module, who has access to [[SVC|syscalls]] 0x70-0x72, 0x7D.&lt;br /&gt;
&lt;br /&gt;
This was fixed after [[ninjhax]] release by adding checks on [[CRO0]]-based pointers before writing to them.&lt;br /&gt;
| Memory-mapping syscalls.&lt;br /&gt;
| [[9.3.0-21]]&lt;br /&gt;
| [[9.4.0-21]]&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
| smea, [[User:Plutooo|plutoo]] joint effort&lt;br /&gt;
|-&lt;br /&gt;
| Region free&lt;br /&gt;
| Only [[Home Menu]] itself checks gamecards&#039; region when launching them. Therefore, any application launch that is done directly with [[NS]] without signaling Home Menu to launch the app, will result in region checks being bypassed.&lt;br /&gt;
This essentially means launching the gamecard with the [[NS_and_APT_Services|&amp;quot;ns:s&amp;quot;]] service. The main way to exploit this is to trigger a FIRM launch with an application specified, either with a normal FIRM launch or a hardware [[NSS:RebootSystem|reboot]].&lt;br /&gt;
| Launching gamecards from any region + bypassing Home Menu gamecard-sysupdate installation&lt;br /&gt;
| None&lt;br /&gt;
| Last tested with [[10.1.0-27|10.1.0-X]].&lt;br /&gt;
| June(?) 2014&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|-&lt;br /&gt;
| [[NWM_Services|NWM]] service-cmd state null-ptr deref&lt;br /&gt;
| The NWMUDS service command code loads a ptr from .data, adds an offset to that, then passes that as the state address for the actual command-handler function. The value of the ptr loaded from .data is not checked, therefore this will cause crashes due to that being 0x0 when NWMUDS was not properly initialized.&lt;br /&gt;
It&#039;s unknown whether any NWM services besides NWMUDS have this issue.&lt;br /&gt;
| This is rather useless since it&#039;s only a crash caused by a state ptr based at 0x0.&lt;br /&gt;
| None&lt;br /&gt;
| [[9.0.0-20]]&lt;br /&gt;
| 2013?&lt;br /&gt;
| &lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== General/CTRSDK ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Summary&lt;br /&gt;
!  Description&lt;br /&gt;
!  Successful exploitation result&lt;br /&gt;
!  Fixed in version&lt;br /&gt;
!  Last version this flaw was checked for&lt;br /&gt;
!  Timeframe this was discovered&lt;br /&gt;
!  Discovered by&lt;br /&gt;
|-&lt;br /&gt;
| [[NWM_Services|UDS]] beacon additional-data buffer overflow&lt;br /&gt;
| Originally CTRSDK did not validate the UDS additional-data size before using that size to copy the additional-data to a [[NWM_Services|networkstruct]]. This was eventually fixed.&lt;br /&gt;
This was discovered while doing code RE with an old dlp-module version. It&#039;s unknown in what specific CTRSDK version this was fixed, or even what system-version updated titles with a fixed version.&lt;br /&gt;
&lt;br /&gt;
It&#039;s unknown if there&#039;s any titles using a vulnerable CTRSDK version which are also exploitable with this(dlp module can&#039;t be exploited with this).&lt;br /&gt;
&lt;br /&gt;
The maximum number of bytes that can be written beyond the end of the outbuf is 0x37-bytes, with additionaldata_size=0xFF.&lt;br /&gt;
| Perhaps ROP, very difficult if possible with anything at all&lt;br /&gt;
| ?&lt;br /&gt;
| &lt;br /&gt;
| September(?) 2014&lt;br /&gt;
| [[User:Yellows8|Yellows8]]&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=HTTP_Services&amp;diff=14448</id>
		<title>HTTP Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=HTTP_Services&amp;diff=14448"/>
		<updated>2015-11-03T04:55:00Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* HTTP service &amp;quot;http:C&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= HTTP service &amp;quot;http:C&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010044&lt;br /&gt;
| [[HTTPC:Initialize|Initialize]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020082&lt;br /&gt;
| [[HTTPC:CreateContext|CreateContext]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| [[HTTPC:CloseContext|CloseContext]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040040&lt;br /&gt;
| [[HTTPC:CancelConnection|CancelConnection]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050040&lt;br /&gt;
| [[HTTPC:GetRequestState|GetRequestState]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00060040&lt;br /&gt;
| [[HTTPC:GetDownloadSizeState|GetDownloadSizeState]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070040&lt;br /&gt;
| [[HTTPC:GetRequestError|GetRequestError]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080042&lt;br /&gt;
| [[HTTPC:InitializeConnectionSession|InitializeConnectionSession]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090040&lt;br /&gt;
| [[HTTPC:BeginRequest|BeginRequest]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A0040&lt;br /&gt;
| [[HTTPC:BeginRequestAsync|BeginRequestAsync]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0082&lt;br /&gt;
| [[HTTPC:ReceiveData|ReceiveData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0102&lt;br /&gt;
| [[HTTPC:ReceiveDataTimeout|ReceiveDataTimeout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0146&lt;br /&gt;
| [[HTTPC:SetProxy|SetProxy]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0040&lt;br /&gt;
| [[HTTPC:SetProxyDefault|SetProxyDefault]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F00C4&lt;br /&gt;
| [[HTTPC:SetBasicAuthorization|SetBasicAuthorization]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100080&lt;br /&gt;
| SetSocketBufferSize&lt;br /&gt;
|-&lt;br /&gt;
| 0x001100C4&lt;br /&gt;
| [[HTTPC:AddRequestHeader|AddRequestHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001200C4&lt;br /&gt;
| [[HTTPC:AddPostDataAscii|AddPostDataAscii]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001300C4&lt;br /&gt;
| AddPostDataBinary&lt;br /&gt;
|-&lt;br /&gt;
| 0x00140082&lt;br /&gt;
| AddPostDataRaw&lt;br /&gt;
|-&lt;br /&gt;
| 0x00150080&lt;br /&gt;
| SetPostDataType(u8 enum)&lt;br /&gt;
|-&lt;br /&gt;
| 0x001600C4&lt;br /&gt;
| SendPostDataAscii&lt;br /&gt;
|-&lt;br /&gt;
| 0x00170144&lt;br /&gt;
| SendPostDataAsciiTimeout&lt;br /&gt;
|-&lt;br /&gt;
| 0x001800C4&lt;br /&gt;
| SendPostDataBinary&lt;br /&gt;
|-&lt;br /&gt;
| 0x00190144&lt;br /&gt;
| SendPostDataBinaryTimeout&lt;br /&gt;
|-&lt;br /&gt;
| 0x001A0082&lt;br /&gt;
| SendPostDataRaw&lt;br /&gt;
|-&lt;br /&gt;
| 0x001B0102&lt;br /&gt;
| [[HTTPC:SendPOSTDataTimeout|SendPOSTDataRawTimeout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001C0080&lt;br /&gt;
| SetPostDataEncoding&lt;br /&gt;
|-&lt;br /&gt;
| 0x001D0040&lt;br /&gt;
| NotifyFinishSendPostData&lt;br /&gt;
|-&lt;br /&gt;
| 0x001E00C4&lt;br /&gt;
| [[HTTPC:GetResponseHeader|GetResponseHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001F0144&lt;br /&gt;
| [[HTTPC:GetResponseHeaderTimeout|GetResponseHeaderTimeout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00200082&lt;br /&gt;
| [[HTTPC:GetResponseData|GetResponseData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00210102&lt;br /&gt;
| GetResponseDataTimeout&lt;br /&gt;
|-&lt;br /&gt;
| 0x00220040&lt;br /&gt;
| [[HTTPC:GetResponseStatusCode|GetResponseStatusCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002300C0&lt;br /&gt;
| [[HTTPC:GetResponseStatusCodeTimeout|GetResponseStatusCodeTimeout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00240082&lt;br /&gt;
| [[HTTPC:AddTrustedRootCA|AddTrustedRootCA]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00250080&lt;br /&gt;
| cmd[1]=httpcontext, cmd[2]=val. This is a wrapper for [[SSL_Services|SSLC]] command 0x00060080. The output value from that SSLC command is not returned by this HTTP command. Somehow related to [[HTTPC:AddTrustedRootCA|AddTrustedRootCA]].&lt;br /&gt;
|-&lt;br /&gt;
| 0x00260080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002700C4&lt;br /&gt;
| [[HTTPC:SetClientCert|SetClientCert]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00280080&lt;br /&gt;
| Somehow related to [[HTTPC:SetClientCert|SetClientCert]].&lt;br /&gt;
|-&lt;br /&gt;
| 0x00290080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002A0040&lt;br /&gt;
| GetSSLError?&lt;br /&gt;
|-&lt;br /&gt;
| 0x002B0080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002C0080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002D0000&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002E0040&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002F0082&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00300080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00310080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00320084&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00330040&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00340040&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00350186&lt;br /&gt;
| SetDefaultProxy&lt;br /&gt;
|-&lt;br /&gt;
| 0x00360000&lt;br /&gt;
| ClearDNSCache&lt;br /&gt;
|-&lt;br /&gt;
| 0x00370080&lt;br /&gt;
| SetKeepAlive (bool)&lt;br /&gt;
|-&lt;br /&gt;
| 0x003800C0&lt;br /&gt;
| SetPostDataTypeSize (u8 enum, u32 size) (similar to SetPostDataType)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00390000&lt;br /&gt;
| Finalize&lt;br /&gt;
|-&lt;br /&gt;
| 0x003A....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003B0082&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003C....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003D....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003E....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003F....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x00400082&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x0041....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x0042....&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= Error codes =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Error code&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0xd8a0a046&lt;br /&gt;
| This is returned by [[HTTPC:Initialize]] when no network connection is available(or at least when wifi is disabled via Home Menu on New3DS).&lt;br /&gt;
|-&lt;br /&gt;
| 0xd8a0a066&lt;br /&gt;
| This indicates that the context handle is wrong.&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=HTTPC:SetClientCert&amp;diff=14442</id>
		<title>HTTPC:SetClientCert</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=HTTPC:SetClientCert&amp;diff=14442"/>
		<updated>2015-11-03T04:35:26Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Created page with &amp;quot;=Request= {| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot; |- !  Index Word !  Description |- | 0 | Header code [0x002700C4] |- | 1 | HTTP context handle |- | 2 | Client cert buffer size |- | 3 |...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Request=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code [0x002700C4]&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| HTTP context handle&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Client cert buffer size&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| Cert private key buffer size&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| (Client cert buffer size&amp;lt;&amp;lt;4)  &amp;lt;nowiki&amp;gt;|&amp;lt;/nowiki&amp;gt; 10&lt;br /&gt;
|-&lt;br /&gt;
| 5&lt;br /&gt;
| Client cert buffer&lt;br /&gt;
|-&lt;br /&gt;
| 6&lt;br /&gt;
| (Cert private key buffer size&amp;lt;&amp;lt;4)  &amp;lt;nowiki&amp;gt;|&amp;lt;/nowiki&amp;gt; 10&lt;br /&gt;
|-&lt;br /&gt;
| 7&lt;br /&gt;
| Cert private key buffer&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Response=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Result code&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=HTTP_Services&amp;diff=14441</id>
		<title>HTTP Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=HTTP_Services&amp;diff=14441"/>
		<updated>2015-11-03T04:28:59Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* HTTP service &amp;quot;http:C&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= HTTP service &amp;quot;http:C&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x00010044&lt;br /&gt;
| [[HTTPC:Initialize|Initialize]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00020082&lt;br /&gt;
| [[HTTPC:CreateContext|CreateContext]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030040&lt;br /&gt;
| [[HTTPC:CloseContext|CloseContext]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00040040&lt;br /&gt;
| [[HTTPC:CancelConnection|CancelConnection]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00050040&lt;br /&gt;
| [[HTTPC:GetRequestState|GetRequestState]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00060040&lt;br /&gt;
| [[HTTPC:GetDownloadSizeState|GetDownloadSizeState]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070040&lt;br /&gt;
| [[HTTPC:GetRequestError|GetRequestError]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080042&lt;br /&gt;
| [[HTTPC:InitializeConnectionSession|InitializeConnectionSession]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00090040&lt;br /&gt;
| [[HTTPC:BeginRequest|BeginRequest]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A0040&lt;br /&gt;
| [[HTTPC:BeginRequestAsync|BeginRequestAsync]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0082&lt;br /&gt;
| [[HTTPC:ReceiveData|ReceiveData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0102&lt;br /&gt;
| [[HTTPC:ReceiveDataTimeout|ReceiveDataTimeout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0146&lt;br /&gt;
| [[HTTPC:SetProxy|SetProxy]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0040&lt;br /&gt;
| [[HTTPC:SetProxyDefault|SetProxyDefault]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F00C4&lt;br /&gt;
| [[HTTPC:SetBasicAuthorization|SetBasicAuthorization]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100080&lt;br /&gt;
| SetSocketBufferSize&lt;br /&gt;
|-&lt;br /&gt;
| 0x001100C4&lt;br /&gt;
| [[HTTPC:AddRequestHeader|AddRequestHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001200C4&lt;br /&gt;
| [[HTTPC:AddPostDataAscii|AddPostDataAscii]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001300C4&lt;br /&gt;
| AddPostDataBinary&lt;br /&gt;
|-&lt;br /&gt;
| 0x00140082&lt;br /&gt;
| AddPostDataRaw&lt;br /&gt;
|-&lt;br /&gt;
| 0x00150080&lt;br /&gt;
| SetPostDataType(u8 enum)&lt;br /&gt;
|-&lt;br /&gt;
| 0x001600C4&lt;br /&gt;
| SendPostDataAscii&lt;br /&gt;
|-&lt;br /&gt;
| 0x00170144&lt;br /&gt;
| SendPostDataAsciiTimeout&lt;br /&gt;
|-&lt;br /&gt;
| 0x001800C4&lt;br /&gt;
| SendPostDataBinary&lt;br /&gt;
|-&lt;br /&gt;
| 0x00190144&lt;br /&gt;
| SendPostDataBinaryTimeout&lt;br /&gt;
|-&lt;br /&gt;
| 0x001A0082&lt;br /&gt;
| SendPostDataRaw&lt;br /&gt;
|-&lt;br /&gt;
| 0x001B0102&lt;br /&gt;
| [[HTTPC:SendPOSTDataTimeout|SendPOSTDataRawTimeout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001C0080&lt;br /&gt;
| SetPostDataEncoding&lt;br /&gt;
|-&lt;br /&gt;
| 0x001D0040&lt;br /&gt;
| NotifyFinishSendPostData&lt;br /&gt;
|-&lt;br /&gt;
| 0x001E00C4&lt;br /&gt;
| [[HTTPC:GetResponseHeader|GetResponseHeader]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x001F0144&lt;br /&gt;
| [[HTTPC:GetResponseHeaderTimeout|GetResponseHeaderTimeout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00200082&lt;br /&gt;
| [[HTTPC:GetResponseData|GetResponseData]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00210102&lt;br /&gt;
| GetResponseDataTimeout&lt;br /&gt;
|-&lt;br /&gt;
| 0x00220040&lt;br /&gt;
| [[HTTPC:GetResponseStatusCode|GetResponseStatusCode]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x002300C0&lt;br /&gt;
| [[HTTPC:GetResponseStatusCodeTimeout|GetResponseStatusCodeTimeout]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00240082&lt;br /&gt;
| [[HTTPC:AddTrustedRootCA|AddTrustedRootCA]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00250080&lt;br /&gt;
| cmd[1]=httpcontext, cmd[2]=val. This is a wrapper for [[SSL_Services|SSLC]] command 0x00060080. The output value from that SSLC command is not returned by this HTTP command. Somehow related to [[HTTPC:AddTrustedRootCA|AddTrustedRootCA]].&lt;br /&gt;
|-&lt;br /&gt;
| 0x00260080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002700C4&lt;br /&gt;
| [[HTTPC:SetClientCert|SetClientCert]]&lt;br /&gt;
|-&lt;br /&gt;
| 0x00280080&lt;br /&gt;
| Somehow related to [[HTTPC:SetClientCert|SetClientCert]].&lt;br /&gt;
|-&lt;br /&gt;
| 0x00290080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002A0040&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002B0080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002C0080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002D0000&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002E0040&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x002F0082&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00300080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00310080&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00320084&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00330040&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00340040&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| 0x00350186&lt;br /&gt;
| SetDefaultProxy&lt;br /&gt;
|-&lt;br /&gt;
| 0x00360000&lt;br /&gt;
| ClearDNSCache&lt;br /&gt;
|-&lt;br /&gt;
| 0x00370080&lt;br /&gt;
| SetKeepAlive (bool)&lt;br /&gt;
|-&lt;br /&gt;
| 0x003800C0&lt;br /&gt;
| SetPostDataTypeSize (u8 enum, u32 size) (similar to SetPostDataType)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00390000&lt;br /&gt;
| Finalize&lt;br /&gt;
|-&lt;br /&gt;
| 0x003A....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003B0082&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003C....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003D....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003E....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x003F....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x00400082&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x0041....&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
| 0x0042....&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= Error codes =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Error code&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0xd8a0a046&lt;br /&gt;
| This is returned by [[HTTPC:Initialize]] when no network connection is available(or at least when wifi is disabled via Home Menu on New3DS).&lt;br /&gt;
|-&lt;br /&gt;
| 0xd8a0a066&lt;br /&gt;
| This indicates that the context handle is wrong.&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=HTTPC:GetResponseData&amp;diff=14440</id>
		<title>HTTPC:GetResponseData</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=HTTPC:GetResponseData&amp;diff=14440"/>
		<updated>2015-11-03T04:23:14Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Add note with Ninty&amp;#039;s name, taken from Dragon Quest VII debug strings&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Request=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code [0x00200082]&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| HTTP context handle&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Max buffer size&lt;br /&gt;
|-&lt;br /&gt;
| 3&lt;br /&gt;
| (OutSize&amp;lt;&amp;lt;4)  &amp;lt;nowiki&amp;gt;|&amp;lt;/nowiki&amp;gt; 12&lt;br /&gt;
|-&lt;br /&gt;
| 4&lt;br /&gt;
| Output data pointer&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Response=&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Index Word&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0&lt;br /&gt;
| Header code&lt;br /&gt;
|-&lt;br /&gt;
| 1&lt;br /&gt;
| Result code&lt;br /&gt;
|-&lt;br /&gt;
| 2&lt;br /&gt;
| Output total response size&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Description=&lt;br /&gt;
This obtains the raw HTTP response data, prior to the received content.&lt;br /&gt;
&lt;br /&gt;
NOTE: Named GetHeaderAll by Nintendo&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14428</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14428"/>
		<updated>2015-11-02T04:21:04Z</updated>

		<summary type="html">&lt;p&gt;Guiand: Remove redundant information, game-side CecMessageData&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14427</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14427"/>
		<updated>2015-11-02T04:19:59Z</updated>

		<summary type="html">&lt;p&gt;Guiand: /* CECD Service &amp;quot;cecd:u&amp;quot; */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageData ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Type&lt;br /&gt;
! Field&lt;br /&gt;
|-&lt;br /&gt;
| CecMessage&lt;br /&gt;
| message&lt;br /&gt;
|-&lt;br /&gt;
| char[3200]&lt;br /&gt;
| icon&lt;br /&gt;
|-&lt;br /&gt;
| uchar16_t[64]&lt;br /&gt;
| title&lt;br /&gt;
|-&lt;br /&gt;
| char?[256]&lt;br /&gt;
| body&lt;br /&gt;
|-&lt;br /&gt;
| u32&lt;br /&gt;
| unknown?&lt;br /&gt;
|-&lt;br /&gt;
| u32&lt;br /&gt;
| padding/unknown?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageType ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Name&lt;br /&gt;
! Value&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
| ?&lt;br /&gt;
| 0x2&lt;br /&gt;
| Corresponds to some 0x60-byte data&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_ICON&lt;br /&gt;
| 0x65&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; icon&lt;br /&gt;
|-&lt;br /&gt;
| CECMESSAGE_BOX_TITLE&lt;br /&gt;
| 0x6E&lt;br /&gt;
| Corresponds to the StreetPass &amp;quot;box&amp;quot; title&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14424</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14424"/>
		<updated>2015-11-01T21:17:46Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessageData ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
! Type&lt;br /&gt;
! Field&lt;br /&gt;
|-&lt;br /&gt;
| CecMessage&lt;br /&gt;
| message&lt;br /&gt;
|-&lt;br /&gt;
| char[3200]&lt;br /&gt;
| icon&lt;br /&gt;
|-&lt;br /&gt;
| uchar16_t[64]&lt;br /&gt;
| title&lt;br /&gt;
|-&lt;br /&gt;
| char?[256]&lt;br /&gt;
| body&lt;br /&gt;
|-&lt;br /&gt;
| u32&lt;br /&gt;
| unknown?&lt;br /&gt;
|-&lt;br /&gt;
| u32&lt;br /&gt;
| padding/unknown?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14422</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14422"/>
		<updated>2015-11-01T20:24:10Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14421</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14421"/>
		<updated>2015-11-01T20:22:12Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14419</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14419"/>
		<updated>2015-11-01T19:55:16Z</updated>

		<summary type="html">&lt;p&gt;Guiand: fix typo&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (length of CecMessage buffer in cmdbuff[9] (always 8), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
	<entry>
		<id>https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14418</id>
		<title>CECD Services</title>
		<link rel="alternate" type="text/html" href="https://www.3dbrew.org/w/index.php?title=CECD_Services&amp;diff=14418"/>
		<updated>2015-11-01T19:54:28Z</updated>

		<summary type="html">&lt;p&gt;Guiand: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Services]]&lt;br /&gt;
= CECD Service &amp;quot;cecd:u&amp;quot; =&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Command Header&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
| 0x000100C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00030104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00070106&lt;br /&gt;
| ? (length of CecMessage buffer in cmdbuff[9] (always 8), CecMessage* in cmdbuf[10])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00080102&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000900C2&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000A00C4&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000B0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000C0040&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000D0082&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x000E0000&lt;br /&gt;
| ? (returns some kind of enum value in cmdbuf[2])&lt;br /&gt;
|-&lt;br /&gt;
| 0x000F0000&lt;br /&gt;
| ? (returns some kind of synchronizable handle in cmdbuf[3])&lt;br /&gt;
|-&lt;br /&gt;
| 0x00100000&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00110104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x00120104&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== CecMessage ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot;&lt;br /&gt;
!  Type&lt;br /&gt;
!  Field&lt;br /&gt;
|-&lt;br /&gt;
| char[8]&lt;br /&gt;
| data&lt;br /&gt;
|-&lt;br /&gt;
}&lt;/div&gt;</summary>
		<author><name>Guiand</name></author>
	</entry>
</feed>