3dbrew - User contributions [en]

Services API

2016-12-31T13:25:32Z

Infinicore: Try guessing the naming of some ports. Sometimes 3dbrew already knew on the individual pages.

Nintendo provides application developers with an API, which communicate with certain services. Services, in this sense, are [[Title_list#00040130_-_System_Modules|system processes running in the background]] which wait for incoming requests. When a process wants to communicate with a service, it first needs to get a handle to the named service, and then it can communicate with the service via interprocess communication. Each service has a name up to 8 characters, for example "nim:u".

Handles for services are retrieved from the [[Services|service manager port]], "srv:". Services are an abstraction of ports, they operate the same way except regular ports can have their handles retrieved directly from a SVC.

For a description of how commands and arguments are passed to services, see [[IPC Command Structure]].

List of services (grouped by the process which provides them):
{| class="wikitable" border="1"
|-
! Old3ds
! Services
! Service names
! scope="col" width="200" | Notes
|-
| style="background: green" | Yes
| [[Filesystem services‎]]
| fs:USER, fs:LDR, fs:REG
| USER: normal applications and system modules, LDR: loader, REG: ?
|-
| style="background: green" | Yes
| [[Process Services‎]]
| ps:ps
|
|-
| style="background: green" | Yes
| [[PXI Services‎]]
| PxiFS0, PxiFS1, PxiFSB, PxiFSR, PxiPM, pxi:am9, pxi:dev, pxi:mc, pxi:ps9
|
|-
| style="background: green" | Yes
| [[Application Manager Services]]
| am:app, am:net, am:u, am:sys, am:pipe
| app: am for applications, net: network installation ([[NIM_Services|nim]]), u: local installation, sys: am for system titles, pipe: not an actual port (internally used to represent the [[Application_Manager_Services#File_service|FSFile-like interface]])
|-
| style="background: green" | Yes
| [[Process Manager Services]]
| pm:app, pm:dbg
| app: launching titles, dbg: launching titles with debugging enabled
|-
| style="background: green" | Yes
| [[NIM Services]]
| nim:aoc, nim:ndm, nim:s, nim:u
| aoc: DLC, ndm: for [[NDM Services|ndm]], s: for eShop, u: for updater
|-
| style="background: green" | Yes
| [[Config Services]]
| cfg:u, cfg:s, cfg:i, cfg:nor
| u: for user, s: for system, i: for initialization/formatting, nor: accesses wifi SPI flash
|-
| style="background: green" | Yes
| [[NS|NS and APT Services]]
| ns:s, ns:p, ns:c, APT:A, APT:S, APT:U
| ns:s: for system, ns:p: power (shutdown/reboot), ns:c: ?, APT:A: application, APT:S: system, APT:U: user
|-
| style="background: green" | Yes
| [[RO Services]]
| ldr:ro
|
|-
| style="background: green" | Yes
| [[NDM Services]]
| ndm:u
|
|-
| style="background: green" | Yes
| [[CSND Services]]
| csnd:SND
|
|-
| style="background: green" | Yes
| [[Camera Services]]
| cam:u, y2r:u, cam:s, cam:c, cam:q (New3DS only)
|
|-
| style="background: green" | Yes
| [[Codec Services]]
| cdc:HID, cdc:MIC, cdc:CSN, cdc:DSP, cdc:LGY, cdc:CHK
| HID: human interface device, MIC: microphone, CSN: for [[CSND_Services|csnd]]?, DSP: for [[DSP_Services|dsp]]?, LGY: legacy (some kind of backwards compat?), CHK: ?
|-
| style="background: green" | Yes
| [[DLP Services]]
| dlp:CLNT, dlp:FKCL, dlp:SRVR
| CLNT: client, FKCL: fake client, SRVR: server
|-
| style="background: green" | Yes
| [[DSP Services]]
| dsp::DSP
|
|-
| style="background: green" | Yes
| [[GSP Services]]
| gsp::Lcd, gsp::Gpu
| Lcd: LCD control, Gpu: GPU control
|-
| style="background: green" | Yes
| [[BOSS Services]]
| boss:U, boss:P, boss:M
| U: user, P: privileged, M: for [[NDM Services|ndm]]
|-
| style="background: green" | Yes
| [[CECD Services]]
| cecd:u, cecd:s, cecd:ndm
| u: user, s: system, ndm: for [[NDM Services|ndm]]
|-
| style="background: green" | Yes
| [[IR Services]]
| ir:u, ir:USER, ir:rst
|
|-
| style="background: green" | Yes
| [[I2C Services]]
| i2c::MCU, i2c::CAM, i2c::LCD, i2c::DEB, i2c::HID, i2c::IR, i2c::EEP, i2c::NFC, i2c::QTM
|
|-
| style="background: green" | Yes
| [[GPIO Services]]
| gpio:CDC, gpio:MCU, gpio:HID, gpio:NWM, gpio:IR, gpio:NFC, gpio:QTM
|
|-
| style="background: green" | Yes
| [[HID Services]]
| hid:NFC, hid:QTM, hid:SPVR, hid:USER
| NFC: near-field communication (amiibo), QTM: head tracking device (related to [[QTM_Services|QTM Services]])?, SPVR: system privileged?
|-
| style="background: green" | Yes
| [[PTM Services]]
| ptm:gets, ptm:play, ptm:s, ptm:sets, ptm:sysm, ptm:u
| gets: get system time, play: play history, s: system, sets: set system time, sysm: system menu (homemenu/testmenu), u: user
|-
| style="background: green" | Yes
| [[NWM Services]]
| nwm::CEC, nwm::EXT, nwm::INF, nwm::SAP, nwm::SOC, nwm::TST, nwm::UDS
| CEC: streetpass, EXT: ?, INF: infrastructure, SAP: ?, SOC: socket, UDS: local WLAN, TST: ?
|-
| style="background: green" | Yes
| [[HTTP Services]]
| http:C
| C: connection
|-
| style="background: green" | Yes
| [[SSL Services]]
| ssl:C
| C: connection
|-
| style="background: green" | Yes
| [[Socket Services]]
| soc:P, soc:U
| P: privileged, U: user
|-
| style="background: green" | Yes
| [[AC Services]]
| ac:i, ac:u
| i: internal, u: user
|-
| style="background: green" | Yes
| [[Friend Services]]
| frd:a, frd:n, frd:u
| a: admin, n: for [[NDM Services|ndm]], u: user
|-
| style="background: green" | Yes
| [[News Services]]
| news:s, news:u
| s: system, u:user
|-
| style="background: green" | Yes
| [[PDN Services]]
| pdn:s, pdn:d, pdn:i, pdn:g, pdn:c
|
|-
| style="background: green" | Yes
| [[SPI Services]]
| SPI::NOR, SPI::CD2, SPI::CS2, SPI::CS3, SPI::DEF
|
|-
| style="background: green" | Yes
| [[Loader Services]]
| Loader
|
|-
| style="background: green" | Yes
| [[MCU Services]]
| mcu::CAM, mcu::GPU, mcu::HID, mcu::RTC, mcu::SND, mcu::NWM, mcu::HWC, mcu::PLS, mcu::CDC
|
|-
| style="background: green" | Yes
| [[MIC Services]]
| mic:u
|
|-
| style="background: green" | Yes
| [[ACT Services]]
| act:a, act:u
| a: admin, u: user
|-
| style="background: green" | Yes
| [[NFC Services]]
| nfc:dev, nfc:m, nfc:p, nfc:r, nfc:s, nfc:u
| dev: developer, m: ? p: passthrough?, r: raw?, s: system, u: user
|-
| style="background: red" | No
| [[MVD Services]]
|
|
|-
| style="background: red" | No
| [[QTM Services]]
|
|
|}

List of PXI services:
* [[Filesystem services PXI]]
* [[Process Services PXI]]
* [[Application Manager Services PXI]]
* [[Process Manager Services PXI]]
* [[Development Services PXI]]
* [[Gamecard Services PXI]]
* [[Legacy FIRM PXI]] (TWL_FIRM/AGB_FIRM)

List of ports:
* [[ErrDisp]]
* [[Services]]

See [[Error codes]].

Bootloader

2016-09-05T12:38:14Z

Infinicore: NTR cart read

The bootloader is the binary code stored in the ARM9 and ARM11 boot ROMs and hence is ran when the 3DS is powered on. It's purpose is initializing hardware and loading the [[FIRM|system firmware]] from the internal [[Flash_Filesystem|NAND memory]].

Besides NATIVE_FIRM, the bootloader is also capable of booting other firmwares (such as TWL_FIRM and AGB_FIRM). However, this will result either in a japanese error-screen or a system shutdown, directly after FIRM-Launching.

== Boot ROM ==
Upon boot, parts of the ARM9 and ARM11 boot ROMs are protected by writing to [[CONFIG#CFG_SYSPROT9|CFG_SYSPROT9]] and [[CONFIG#CFG_SYSPROT11|CFG_SYSPROT11]], respectively. The non-protected areas of the ARM9 and ARM11 boot ROMs are identical for launch-day regular Old3DS, 2DS, and regular New3DS.

== Boot Procedure ==

* 0 seconds - unit is powered on. The ARM9 and ARM11 [[Memory_layout|bootroms]] begin execution.

* 2 seconds - ARM9 bootrom attempts to initialize the NAND.
**If the NAND is successfully initialized:
***the ARM9 bootrom loads the [[FIRM|firmware]] stored in the NAND [[FIRM]] partition which handles booting the rest of the system (if verification for NAND firm0 fails, the ARM9 bootrom will attempt to use firm1 instead). If the NCSD header is missing, an attempt to read a certain NTR cartridge is made.
***The ARM11 kernel loaded from FIRM then launches the [[NCCH#CXI|CXI]] ARM11 system modules loaded from FIRM (i.e. sm, fs, pm, loader, and pxi). (Note that the ARM11 kernel does not handle any encryption/RSA verification, this is handled by the [[FIRM|ARM9]].)
**If the NAND cannot be initialized (i.e. the NAND chip is not connected/damaged/etc), a [[Bootloader#Error_Codes|blue error screen]] appears.

* 3 seconds - all essential hardware is active.
**The [[Process_Manager_Services|PM]] module launches [[NS]]
**If [[Home_Menu#Auto-Boot_Function|auto-booting]] is needed, NS will [[NS#Auto-boot|auto-boot]] titles.
**Otherwise, NS will instead launch [[ErrDisp]] and the [[Configuration Memory#ACTIVEMENUTID|current active menu]] via the PM module. For retail units, this menu is usually the [[Home Menu]]. Note that the PM module first launches the module dependencies when launching a process, prior to actually launching the process.
**The further Home Menu startup process is described [[Home_Menu#Home_Menu_startup|here]].

* 4 seconds - the LCD screens are initialized.

* 7 seconds - [[Home Menu]] is fully initialized/loaded.

== NAND Reads during Boot ==
During a successful boot on 6.x, the bootloader (and firm) reads the following sectors from NAND (in this order):
00000000 (NCSD Partition Table)

Only verify 'FIRM' magic? (A second Header-read will be attempted even if everything except the magic is 0xFF...)
0B130000 (FIRM Partition)
0B530000 (Secondary FIRM Partition)

Verify RSA signature and parse Header:
0B130000 (FIRM: Header)
0B130200 (FIRM: Section 1)
0B163E00 (FIRM: Section 2)
0B193E00 (FIRM: Section 3)

00013000 .. Below is probably NATIVE_FIRM booting ..
00014000
00015000
00016000
00017000

09011A00
09011C00
09012000
09012400
...

== Error Codes ==
When the 3DS does not find the NAND chip, the following error is displayed:

[[Image:CTR_Bootrom_Error.jpg|240px]]

{| class="wikitable" border="1"
|-
! Error
! Description
|-
| <tt>00F800FE 00000000 00000000 00000200 00000000</tt>
| Error when having SD-card reader connected to NAND during boot.
|-
| <tt>00F800FE 00000000 00000000 00000400 00000000</tt>
| NAND not found error (?)
|-
| <tt>00F800FE FFFFFFFF FFFFFFFF 00000080 00800000</tt>
| NAND error when DAT1 was used as DAT0.
|-
| <tt>00F800FE FFFFFFFF FFFFFFFF 00000005 00800000</tt>
| NAND error when DAT2 was used as DAT0.
|-
| <tt>00F800FE FFFFFFFF FFFFFFFF 00000005 00000000</tt>
| NAND error when DAT3 was used as DAT0.
|-
| <tt>00F800FF F8F8FFFF FFFFFFFF 00000000 00000000</tt>
| Both the firm0 and firm1 partitions are corrupt (failed signature checks).
|-
| <tt>00F800EE FFFFFFFF FFFFFFFF 00000000 00000000</tt>
| [[NCSD]] header in sector 0 is corrupt (failed signature check).
|}

Bootroms

2016-09-05T12:36:15Z

Infinicore: Redirected page to Bootloader

#REDIRECT [[Bootloader]]

Bootrom

2016-09-05T12:36:00Z

Infinicore: Redirected page to Bootloader

#REDIRECT [[Bootloader]]

Hardware

2016-07-26T15:08:52Z

Infinicore: ''Dazzozo confirmed.'' Undo revision 17816 by Neobrain (talk)

This page lists and describes the hardware found inside the Nintendo 3DS. Many of these parts are custom made and are expanded upon here or in other pages.

== Common hardware ==
{| class="wikitable"
! Type !! Description
|-
| ARM11 Processor Core || Old3DS: [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0360f/index.html ARM11 2x MPCore & 2x VFPv2 Co-Processor] 268MHz(~268123480 Hz).

New3DS: 4x MPCore, 4x VFPv2, able to run up to 804MHz (see below). It also has an optional 2MB L2 cache.
|-
| ARM9 Processor Core || [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0201d/index.html ARM946] 134MHz(~134058675 Hz),
|-
| GPU || [http://en.wikipedia.org/wiki/PICA200 DMP PICA] 268MHz,
|-
| VRAM || 6 MB within SoC.
|-
| Top screen || 800x240, with only 400 usable pixels per eye per line.
|-
| Bottom screen || 320x240, with resistive touch overlay.
|-
| DSP || [https://twitter.com/CEVADSP/status/177172880918986752 CEVA TeakLite]. 134Mhz. 24ch 32728Hz sampling rates.
|}

The above clock-rates were calculated by calling svcGetSystemTick in sets of 5(call it, execute svcSleepThread for 1s, then call it again), then the average of those were calculated. The clock-rate listed above applies for *all* 4 New3DS MPCores. This is referring to the "~268123480 Hz" clock-rate.

New3DS exclusives are able to clock the CPU at 804MHz, but this appears to be limited to the currently running application/app cores. Timed by running svcGetSystemTick on either side of a long idle loop to stay in the current process context. svcSleepThread + svcGetSystemTick implies a tick counter running at 268MHz in this mode.

On New3DS: when Home Menu is active, the system runs at 804MHz. For everything else, it's 268MHz, except when the app(let) has the required flag set. See [[NCCH/Extended_Header|here]] and [[PDN_Registers|here]] for details, regarding clock-rate and cache.

For New3DS-only there are multiple clock-rate multiplier values available in [[PDN_Registers|hardware]], but since the relevant code is only implemented in the New3DS ARM11-kernel, the only non-normal clock-rate available with official kernel code is 3x.

== Specifications ==
{| class="wikitable"
! Type !! 3DS !! 3DSXL !! 2DS !! N3DS !! N3DSXL
|-
| SoC || CPU CTR (1048 0H)
CPU CTR (1214 32)
|| CPU CTR A (1226 60)
CPU CTR (1037 21)
|| CPU CTR B (??) || CPU LGR A (1444 86) || CPU LGR A (1446 17)
|-
| FCRAM || [http://www.fujitsu.com/downloads/MICRO/fma/pdf/MB81EDS516545_e511463.pdf 2x64MB Fujitsu MB82M8080-07L] || Fujitsu MB82DBS16641 || Fujitsu MB82DBS1664 || ?? || Fujitsu MB82MK9A9A
|-
| Top Screen || 3.53 in, 3D || 4.88 in, 3D || 3.53 in(?) cropped from a single panel || 3.88 in, 3D || 4.88 in, 3D
|-
| Bottom Screen || 3.00 in || 4.18 in || 3.00 in(?) cropped from a single panel || 3.33 in || 4.18 in
|-
| Storage ||colspan="3"| Toshiba THGBM2G3P1FBAI8 1GB ||colspan="2"| Samsung KLM4G1YEQC 4GB (in 1.3GiB SLC mode)
Toshiba THGBMBG4P1KBAIT 2GB (MLC, approx. 1.8GiB usable)
|-
| Audio Codec || TI PAIC3010B 0AA37DW || ?? || ?? || TI AIC3010B 39C4ETW || TI AIC3010D 48C01JW
|-
| Gyroscope || [http://dl-web.dropbox.com/u/20520664/references/PS-ITG-3200-00-01.4.pdf Invensense ITG-3270 MEMS Gyroscope] || ?? || ?? || ?? || ??
|-
| Accelerometer || ST Micro 2048 33DH X1MAQ Accelerometer Model LIS331DH || ?? || ?? || ?? || ??
|-
| Wifi || Atheros AR6014 || ?? || ?? || ?? || Atheros AR6014G-AL1C
|-
| Infrared IC || NXP S750 0803 TSD031C || ?? || ?? || ?? || NXP S750 1603 TSD438C
|-
| Custom Microcontroller || Renesas UC CTR || ?? || Renesas UC CTR 324KM47 KG10 || Renesas UC KTR || Renesas UC KTR 442KM13 TK14
|-
| PMIC? || TI 93045A4 OAAH86W || ?? || ?? || TI 93045A4 38A6TYW G2 || TI 93045A4 49AF3NW G2
|}

* [11] Official Documentation

* [5],[10] According to iFixit.com ([http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/1#s22696 source]):

* Datasheet for memory is for a chip in the same series, it has less memory than the one inside the 3DS (128mbits vs 512mbits).

* There is a trove of data on the FCC website at [https://fjallfoss.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=462292&fcc_id=%27EW4DWMW028%27].

* [12] This IC is somewhat similar to [http://www.alldatasheet.net/datasheet-pdf/pdf/347838/NXP/SC16IS750IBS.html this].

== FCRAM ==

There is one FCRAM (Fast Cycle RAM) IC in the 3DS, produced by Fujitsu and branded as MB82M8080-07L. The Fujitsu MB82M8080-07L chip internally contains 2 dies, where each die is branded MB81EDS516545 and MB82DBS08645.

The MB81EDS516545 die is a CMOS Fast Cycle Random Access Memory (FCRAM) with Low Power Double Data Rate (LPDDR) SDRAM Interface containing 512MBit storage accessible in a 64-bit format. The MB81EDS516545 is suited for consumer applications requiring high data bandwidth with low power consumption.

== SoC ==

The 3DS has much of it's internals housed in a SoC (System on Chip) just like it's predecessors. This is done to reduce build costs, cut down on power consumption, as well as make the PCB layout less complex and make the system harder to tamper with. The SoC, branded as the Nintendo 1048 0H, contains the CPU, GPU, DSP and VRAM.

According to official documents, the CPU used is a dual-core ARM11 CPU, clocked at 268MHz. One core is dedicated to system software, while the other is used for application programming, each known as the syscore and appcore, respectively.

== GPU ==

Designed by Digital Media Professionals Inc. (DMP) and codenamed PICA200, 268Mhz.

Block diagram of an ULTRAY2000 based architecture PICA200:

[[File:Pica200BlockDiagram.png]]

PICA200 is compatible with OpenGL ES 1.1. It furthermore provides unique functionality for:
* Per-fragment lighting ("Lighting Maestro")
* Hard- and soft-shadowing ("Shadow Maestro")
* Polygon subdivision ("Figure Maestro")
* Bump mapping and procedural textures ("Mapping Maestro")
* Rendering of gaseous objects ("Particle Maestro")

Some parts of the extended functionality are provided in hardware by an extended geometry pipeline. Most importantly, PICA200 has three programmable vertex processors. There is furthermore a unit called [[GPU/Primitive_Engine|Primitive Engine]], which is a geometry shader unit (using the same instruction set as vertex shaders) with support for variable-size primitives. The Primitive Engine functionality may be disabled, and the geometry shader unit then acts as a fourth vertex processor. See [[Shader_Instruction_Set]] for more information on the shader instruction set.

[[GPU/Fragment Lighting|Fragment lighting]] is implemented as an optional pipeline step during pixel processing. It's implemented by having the vertex shader output an additional attribute describing the transformation (represented by a quaternion) to surface-local space. This per-vertex quaternion can then be interpolated across screen space to calculate dot products relevant for lighting (e.g. light vector dot normal vector). To provide support for advanced lighting models, these dot products are used as indices into programmable lookup tables. With this setup, PICA200 in particular supports the shading models Blinn-Phong, Cook-Terrance, Ward, and microfacet-based BRDF-models.

PICA200 supports four texture units, the fourth of which is used exclusively for [[GPU/Procedural Texture Generation|procedural texture generation]].

== SDIO controller ==

Nintendo recommends SD cards up to 32 GB however the internal SDIO controller seems to support SD cards up to 2.19 Terabyte (32-bit sector number). It's unknown if it really can handle that much. 128 GB was tested and works fine however it causes a major slowdown of the system especially at boot.

== MCU ==

The MCU uses the RL78 ISA.

== Images ==

=== Front ===

[[Image:CTR_Front.jpg|600px]]

[http://guide-images.ifixit.net/igi/ishJaSCOwLkvbLYK High Resolution]

=== Back ===

[[Image:CTR_Back.jpg]]

[http://guide-images.ifixit.net/igi/n1CKAdbPrHyNPNuW High Resolution]

=== NAND pinout ===

NAND dumping has been successful, but the image is encrypted.

==== Normal model ====

[[Image:CTR_NAND_pinout.png]]

==== XL model ====

[[Image:CTR_NAND_pinout_XL.jpg|500px]]

==== 2DS ====

[[Image:2DSeMMC.jpg|500px]]

==== New 3DS ====

[[Image:N3DSeMMC.jpg]]

==== New 3DS XL ====

[[Image:N3DSXLeMMC.jpg]]

=== WiFi dongle pinout ===
[[Image:CTR_WiFiDongle_pinout.png|600px]]

SDIO interface is colored red:
* CLK
* CMD
* D0, D1, D2, D3

This is the interface for the 'NEW' WiFi module (based on Atheros AR6002) first included in DSi.

The proprietary and by now ancient DS-mode WiFi is colored yellow, pins are unknown.

I2C eeprom is colored blue:
* SCL
* SDA

SPI Flash is colored purple:
* CLK
* CS#
* SI
* SO
* WP#
* NC

=== Auxiliary Microcontroller ===
[[Image:CTR_UC.png|600px]]

Monitors HOME button, WiFi switch, 3D slider, volume control slider.
Controls LEDs, various power supplies.

Devices attached to I2C bus:
* UC (master?)
* Accelerometer (slave address 0x18)
* SoC (master? slave?)

Hardware

2016-07-26T15:00:41Z

Infinicore: Add MCU ISA.

NS and APT Services

2016-07-13T12:06:17Z

Infinicore: /* APT Services */ Link to APT:SetScreencapPostPermission

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| ?
|-
| 0x00020100
| ?
|}

This was added with [[5.0.0-11]], it's unknown what this is used for.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Description
|-
| 0x00010040
|
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| [[APT:SetScreencapPostPermission|SetScreencapPostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| [[APT:GetScreencapPostPermission|GetScreencapPostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DSApp|CheckNew3DSApp]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| This writes an output u8 to cmdreply[2], the value is determined by checking various NS internal state + whether this is a New3DS.
The normal output seems to be value 0x2. Forcing this value to 0x1 causes New3DS HID usage(via ir:USER) in Smash Bros to be disabled.
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| ?
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORAMT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| Home Menu (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet (CtrApp)
|-
| 0x112
| Friends List applet (friend)
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| Notifications applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| Miiverse posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| Mii Selector (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display (error) (?)
|-
| 0x207
| eShop applet (mint) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

APT:GetScreenCapturePostPermission

2016-07-13T12:05:28Z

Infinicore: /* Description */ fix values

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00560000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| The screenshot posting permission
|}

=Description=
This returns whether or not screenshots may be posted on Miiverse.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 1
| the user has no explicit setting
|-
| 2
| screenshot posting to Miiverse is enabled
|-
| 3
| screenshot posting to Miiverse is disabled
|}

APT:SetScreenCapturePostPermission

2016-07-13T12:05:04Z

Infinicore: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x00550040] |- | 1 | Permission to post screenshots to Miiverse |} =Response=..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00550040]
|-
| 1
| Permission to post screenshots to Miiverse
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This sets whether or not screenshots may be posted on Miiverse.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 1
| the user has no explicit setting
|-
| 2
| screenshot posting to Miiverse is enabled
|-
| 3
| screenshot posting to Miiverse is disabled
|}

APT:GetScreenCapturePostPermission

2016-07-13T12:02:59Z

Infinicore: actually fill this in

Process Services

2016-07-09T11:29:16Z

Infinicore: Link to PS:GetCTRCardAutoStartupBit

[[Category:Services]]
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010244
| [[1.0.0-0]]
| SignRsaSha256
|-
| 0x00020244
| [[1.0.0-0]]
| VerifyRsaSha256
|-
| Not implemented
|
| SetAesKey (just returns error 0xD8C107F4)
|-
| 0x00040204
| [[1.0.0-0]]
| [[PS:EncryptDecryptAes|EncryptDecryptAes]]
|-
| 0x00050284
| [[1.0.0-0]]
| [[PS:EncryptSignDecryptVerifyAesCcm|EncryptSignDecryptVerifyAesCcm]]
|-
| 0x00060040
| [[1.0.0-0]]
| GetRomId (u32 processID)
|-
| 0x00070040
| [[1.0.0-0]]
| GetRomId2 (u32 processID)
|-
| 0x00080040
| [[1.0.0-0]]
| GetRomMakerCode (u32 processID)
|-
| 0x00090000
| [[1.0.0-0]]
| [[PS:GetCTRCardAutoStartupBit|GetCTRCardAutoStartupBit]]
|-
| 0x000A0000
| [[1.0.0-0]]
| GetLocalFriendCodeSeed
|-
| 0x000B0000
| [[1.0.0-0]]
| GetDeviceId
|-
| 0x000C0000
| [[1.0.0-0]]
| [[PS:SeedRNG|SeedRNG]]
|-
| 0x000D0042
| [[1.0.0-0]]
| GenerateRandomBytes
|-
| 0x000E0082
| New3DS = [[8.1.0-0_New3DS]], Old3DS = [[9.0.0-20]]
| Interface for [[Process_Services_PXI]] New3DS command 0x04010084.
|-
| 0x000F0082
| New3DS = [[8.1.0-0_New3DS]], Old3DS = [[9.0.0-20]]
| Interface for [[Process_Services_PXI]] New3DS command 0x04020082.
|-
| 0x00100042
| New3DS = [[8.1.0-0_New3DS]], Old3DS = [[9.0.0-20]]
| Interface for [[Process_Services_PXI]] New3DS command 0x04030044.
|-
| 0x00110042
| New3DS = [[8.1.0-0_New3DS]], Old3DS = [[9.0.0-20]]
| Interface for [[Process_Services_PXI]] New3DS command 0x04040044.
|}

These commands are an interface for [[Process_Services_PXI]].

For GetRomId, GetRomId2, and GetRomMakerCode, PS-module uses [[FS:GetProgramLaunchInfo]] with the processID which was sent to PS-module via the command input. If GetProgramLaunchInfo fails, PS-module returns error 0xC90107FA. When the mediatype is value2 for gamecard, the PSPXI command is used, otherwise PS-module just clears the output data for the command response.

PS module does not use any CheckNew3DS commands: commands 0x000E0082..0x00110042 are handled by PS module regardless of whether this is running on Old3DS/New3DS. Using these commands on Old3DS will result in Process9 returning an invalid command header error. [[NFC_Services|NFC]] module uses all of these new commands for New3DS.

Process Services PXI

2016-07-09T11:28:17Z

Infinicore: /* Process Services PXI "pxi:ps9" */ Add link to PSPXI:GetCTRCardAutoStartupBit

=Process Services PXI "pxi:ps9"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C6
| [[1.0.0-0]]
| This crypts a raw message with RSA.
|-
| 0x00020284
| [[1.0.0-0]]
| SignRsaSha256
|-
| 0x00030284
| [[1.0.0-0]]
| VerifyRsaSha256
|-
| 0x000401C4
| [[1.0.0-0]]
| [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]
|-
| 0x00050284
| [[1.0.0-0]]
| [[PSPXI:EncryptSignDecryptVerifyAesCcm|EncryptSignDecryptVerifyAesCcm]]
|-
| 0x00060000
| [[1.0.0-0]]
| GetRomId. This reads 0x40-bytes from [[Gamecards|gamecard]] command 0xC6 (gamecard-uniqueID), and returns the first 0x10-bytes from that since the rest of the command reply is all 0xFF-bytes.
|-
| 0x00070000
| [[1.0.0-0]]
| GetRomId2. The first u8 this returns is from GetRomMakerCode, the following 0x10-bytes are from [[AES|encrypting]] the 0x10-bytes which GetRomId also returns. This is encrypted with AES-CBC, the regular normal-key and IV set by [[FIRM|Process9]] for this are loaded from the Process9 .rodata section.
|-
| 0x00080000
| [[1.0.0-0]]
| [[PSPXI:GetCTRCardAutoStartupBit|GetCTRCardAutoStartupBit]]
|-
| 0x00090000
| [[1.0.0-0]]
| GetRomMakerCode
|-
| 0x000A0000
| [[1.0.0-0]]
| [[PSPXI:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x000B0000
| [[1.0.0-0]]
| [[PSPXI:GetDeviceId|GetDeviceId]]
|-
| 0x000C0042
| [[1.0.0-0]]
| SeedRNG
|-
| 0x000D0042
| [[1.0.0-0]]
| [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x000E0042
| [[1.0.0-0]], removed with [[2.0.0-2]]
| With [[2.0.0-2]] the system no longer handles this command at all. This was mostly the same as GenerateRandomBytes.
|-
| 0x04010084
| [[8.1.0-0_New3DS]]
| [[New_3DS]]-only. cmd[1] = insize, cmd[2] = outsize, cmd[3] = (insize<<8) <nowiki>|</nowiki> 0x4, cmd[4] = inbufptr, cmd[5] = (outsize<<8) <nowiki>|</nowiki> 0x14, and cmd[6] = outbufptr.
|-
| 0x04020082
| [[8.1.0-0_New3DS]]
| [[New_3DS]]-only. cmd[1] = insize, cmd[2] = u8 flag, cmd[3] = (insize<<8) <nowiki>|</nowiki> 0x4, cmd[4] = inbufptr.
|-
| 0x04030044
| [[8.1.0-0_New3DS]]
| [[New_3DS]]-only.
|-
| 0x04040044
| [[8.1.0-0_New3DS]]
| [[New_3DS]]-only.
|}

These RSA commands are an interface for using the [[RSA]] engine. The system will hang when it attempts to use a >RSA-2048 RSA bit-size with the RSA engine, since the [[RSA]] engine does not support >RSA-2048. These RSA commands have an input field specifying what RSA bit-size to use, but the RSA padding code is hard-coded to use RSA-2048.

The New3DS 0x040X commands(used for [[Amiibo]] crypto) were removed with [[9.3.0-21]], the code for that was moved into [[NFC_Services|NFC]]-module.

=Command 0x04010084=
The input buffer size must be <=0x1E0-bytes, and the out buffer size must be >0 and <=0x20-bytes. This calculates a SHA256-HMAC over the input buffer using the current already-generated [[Amiibo]] HMAC key(generated_amiibodata+0x20), the output hash is then written to the out buffer.

=Command 0x04020082=
This is used for [[Amiibo]] key generation. 0x30-bytes are generated. The input buffer size must be 0x40-bytes.

The input u8 must be either zero or non-zero, the used value varies depending on what crypto(AES/HMAC) operation is done after the crypto init.

Structure of the input buffer:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| This is the raw [[Amiibo]]-write counter u16 from page[4] byte1.
|-
| 0x2
| 0xE
| All-zero.
|-
| 0x10
| 0x8
| This is the first 8-bytes of the NFC tag serial-number(page0-1).
|-
| 0x18
| 0x8
| Same 8-bytes as above.
|-
| 0x20
| 0x20
| This is the plaintext hash from NFC tag page[0x18], which is the hash listed under the page 0x15 section [[Amiibo|here]].
|}

=Command 0x04030044=
This is used for the actual [[Amiibo]] AES crypto, max input buffer size is same as command 0x04010084. AES-CTR is used here. Normal-key = generated_amiibodata+0x0, CTR = generated_amiibodata+0x10(see command 0x04010084 regarding generated_amiibodata).

=Command 0x04040044=
Similar to 0x04030044, except this is devunit-only with dev-only keys.

PSPXI:GetCTRCardAutoStartupBit

2016-07-09T11:27:18Z

Infinicore: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x00080000] |} =Response= {| class="wikitable" border="1" |- ! Index Word !..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00080000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| 1 if the auto startup bit is set, 0 otherwise.
|}

=Description=
This command returns whether the cartridge's auto start bit is set.

PS:GetCTRCardAutoStartupBit

2016-07-09T11:26:14Z

Infinicore: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x00090000] |} =Response= {| class="wikitable" border="1" |- ! Index Word !..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00090000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| 1 if the auto startup bit is set, 0 otherwise.
|}

=Description=
This is a wrapper for [[PSPXI:GetCTRCardAutoStartupBit]].

Factory Setup

2016-07-03T10:07:50Z

Infinicore: /* CTRAging */ add PabloMK7's video

== Setup Process ==

[[Nandrw/sys/updater.log]], [[Twln/sys/log/inspect.log]] and [[Twln/sys/log/product.log]] get written during Factory Setup. CTRAging appears to do the product.log writing.

It is currently unknown how CTRAging is launched.

== Titles ==

=== Overview ===

Factory firmware is effectively a firmware that consists of NATIVE_FIRM, TWL_FIRM and AGB_FIRM, all system modules, TestMenu and CTRAging.

On O3DS, all system titles have TID high 00040001. This may just be convention of a very old firmware since [[FIRM#NATIVE_FIRM|NATIVE_FIRM in the factory]] is extremely old, being over 20 versions behind 1.0. TestMenu also has this TID high.

For N3DS, the title IDs match the [[Title_list|normal]] TID-highs. The entire N3DS factory firmware appears to be based on some firmware around 8.1. The TestMenu TID high was adjusted to match the TestMenu in the Nintendo CTR SDK as well.

Most, but apparently not all, units ship with tickets for all factory titles in ticket.db, signed with retail keys. All factory titles for retail units use the retail [[NCCH]] secure crypto; the [[NCCH/Extended_Header#Access_Control_Info|NCCH access desc]] uses the retail keys for signatures, too. This suggests that at the point the factory firmware is booted for the first time, the [[OTP_Registers|one-time programmable (OTP) region]] has already been programmed or that the bootroms set the keys for retail by default.

=== Title List ===

It is currently unknown whether these are all factory titles known or if there may be more.

{| class="wikitable" border="1"
|-
! TID-high
! TID-low
! Description
|-
| 00040000
| 0F980000
| CTRAging ("Test Program")
|-
| 00040001
| 00000002
| NATIVE_FIRM
|-
| 00040001
| 00000102
| TWL_FIRM
|-
| 00040001
| 00000202
| AGB_FIRM
|-
| 00040001
| 00001802
| codec sysmodule
|-
| 00040001
| 00001902
| dmnt sysmodule (Debugger sysmodule, see [[Title_list|here]])
|-
| 00040001
| 00001A02
| dsp sysmodule
|-
| 00040001
| 00001B02
| gpio sysmodule
|-
| 00040001
| 00001D02
| hid sysmodule
|-
| 00040001
| 00001E02
| i2c sysmodule
|-
| 00040001
| 00001F02
| mcu sysmodule
|-
| 00040001
| 00002102
| pdn sysmodule
|-
| 00040001
| 00002302
| spi sysmodule
|-
| 00040001
| 00002702
| csnd sysmodule
|-
| 00040001
| 00002802
| dlp sysmodule
|-
| 00040001
| 00002A02
| mp sysmodule
|-
| 00040001
| 00002B02
| ndm sysmodule
|-
| 00040001
| 00002C02
| nim sysmodule
|-
| 00040001
| 00002D02
| nwm sysmodule
|-
| 00040001
| 00002E02
| socket sysmodule
|-
| 00040001
| 00003102
| ps module
|-
| 00040001
| 00003202
| friends sysmodule
|-
| 00040001
| 00003302
| ir sysmodule
|-
| 00040001
| 00003402
| boss sysmodule
|-
| 00040001
| 00008002
| [[NS]]
|-
| 00040001
| 00008102
| TestMenu (O3DS)
|-
| 00040001
| 00008A02
| [[ErrDisp|DevErrDi]]
|-
| 00040030
| 00008102
| TestMenu (some O3DS (?), all N3DS)
|-
|}

== TestMenu ==

TestMenu is similar to its [[3DS_Development_Unit_GUI#Test_Menu|Nintendo CTR SDK equivalent]].

On O3DS factory TestMenu, there are two strings that do not appear to be part of the standard Nintendo CTR SDK TestMenu: "run TWL test app" and "run AGB test app."

On N3DS, TestMenu appears to be identical to the Nintendo CTR SDK TestMenu revision.

No TestMenu version is capable of launching CTRAging directly: O3DS factory TestMenu can only launch [[3DS_Development_Unit_Software#Dev_Menu|DevMenu]] installed on [[Flash_Filesystem|NAND]], the inserted cartridge and the TWL/AGB test apps; N3DS factory TestMenu can only launch [[3DS_Development_Unit_Software#Dev_Menu|DevMenu]] installed on [[Flash_Filesystem|NAND]], the inserted cartridge and [[System_Settings|System Settings]].

== CTRAging ==

CTRAging appears to be a title used for hardware testing at the factory. This app also displays images, Chinese/Asian-language and text, both of which appear to be for system assembly/testing. CTRAging includes images for each 3DS model (which ones are included depends on the CTRAging version): original Old3DS, Old3DS XL, 2DS, regular New3DS, and New3DS XL. Some of the New3DS JPEG images have an EXIF last-modified timestamp of 2013, July-September.

Full dumps of CTRAging have only been possible on the N3DS. A menu can be pulled up by holding START. A video of the main testing routine is available at: https://www.youtube.com/watch?v=JsOhYqnW9Ww

On O3DS, [[ExeFS]]:/.code is consistently corrupted. It is unknown whether this is coincidential or whether CTRAging is destroyed intentionally during any part of the factory setup.

The O3DS version has ''vastly'' more services access compared to the N3DS version.

Factory Setup

2016-07-03T10:06:32Z

Infinicore: revamp page

== Setup Process ==

[[Nandrw/sys/updater.log]], [[Twln/sys/log/inspect.log]] and [[Twln/sys/log/product.log]] get written during Factory Setup. CTRAging appears to do the product.log writing.

It is currently unknown how CTRAging is launched.

== Titles ==

=== Overview ===

Factory firmware is effectively a firmware that consists of NATIVE_FIRM, TWL_FIRM and AGB_FIRM, all system modules, TestMenu and CTRAging.

On O3DS, all system titles have TID high 00040001. This may just be convention of a very old firmware since [[FIRM#NATIVE_FIRM|NATIVE_FIRM in the factory]] is extremely old, being over 20 versions behind 1.0. TestMenu also has this TID high.

For N3DS, the title IDs match the [[Title_list|normal]] TID-highs. The entire N3DS factory firmware appears to be based on some firmware around 8.1. The TestMenu TID high was adjusted to match the TestMenu in the Nintendo CTR SDK as well.

Most, but apparently not all, units ship with tickets for all factory titles in ticket.db, signed with retail keys. All factory titles for retail units use the retail [[NCCH]] secure crypto; the [[NCCH/Extended_Header#Access_Control_Info|NCCH access desc]] uses the retail keys for signatures, too. This suggests that at the point the factory firmware is booted for the first time, the [[OTP_Registers|one-time programmable (OTP) region]] has already been programmed or that the bootroms set the keys for retail by default.

=== Title List ===

It is currently unknown whether these are all factory titles known or if there may be more.

{| class="wikitable" border="1"
|-
! TID-high
! TID-low
! Description
|-
| 00040000
| 0F980000
| CTRAging ("Test Program")
|-
| 00040001
| 00000002
| NATIVE_FIRM
|-
| 00040001
| 00000102
| TWL_FIRM
|-
| 00040001
| 00000202
| AGB_FIRM
|-
| 00040001
| 00001802
| codec sysmodule
|-
| 00040001
| 00001902
| dmnt sysmodule (Debugger sysmodule, see [[Title_list|here]])
|-
| 00040001
| 00001A02
| dsp sysmodule
|-
| 00040001
| 00001B02
| gpio sysmodule
|-
| 00040001
| 00001D02
| hid sysmodule
|-
| 00040001
| 00001E02
| i2c sysmodule
|-
| 00040001
| 00001F02
| mcu sysmodule
|-
| 00040001
| 00002102
| pdn sysmodule
|-
| 00040001
| 00002302
| spi sysmodule
|-
| 00040001
| 00002702
| csnd sysmodule
|-
| 00040001
| 00002802
| dlp sysmodule
|-
| 00040001
| 00002A02
| mp sysmodule
|-
| 00040001
| 00002B02
| ndm sysmodule
|-
| 00040001
| 00002C02
| nim sysmodule
|-
| 00040001
| 00002D02
| nwm sysmodule
|-
| 00040001
| 00002E02
| socket sysmodule
|-
| 00040001
| 00003102
| ps module
|-
| 00040001
| 00003202
| friends sysmodule
|-
| 00040001
| 00003302
| ir sysmodule
|-
| 00040001
| 00003402
| boss sysmodule
|-
| 00040001
| 00008002
| [[NS]]
|-
| 00040001
| 00008102
| TestMenu (O3DS)
|-
| 00040001
| 00008A02
| [[ErrDisp|DevErrDi]]
|-
| 00040030
| 00008102
| TestMenu (some O3DS (?), all N3DS)
|-
|}

== TestMenu ==

TestMenu is similar to its [[3DS_Development_Unit_GUI#Test_Menu|Nintendo CTR SDK equivalent]].

On O3DS factory TestMenu, there are two strings that do not appear to be part of the standard Nintendo CTR SDK TestMenu: "run TWL test app" and "run AGB test app."

On N3DS, TestMenu appears to be identical to the Nintendo CTR SDK TestMenu revision.

No TestMenu version is capable of launching CTRAging directly: O3DS factory TestMenu can only launch [[3DS_Development_Unit_Software#Dev_Menu|DevMenu]] installed on [[Flash_Filesystem|NAND]], the inserted cartridge and the TWL/AGB test apps; N3DS factory TestMenu can only launch [[3DS_Development_Unit_Software#Dev_Menu|DevMenu]] installed on [[Flash_Filesystem|NAND]], the inserted cartridge and [[System_Settings|System Settings]].

== CTRAging ==

CTRAging appears to be a title used for hardware testing at the factory. This app also displays images, Chinese/Asian-language and text, both of which appear to be for system assembly/testing. CTRAging includes images for each 3DS model (which ones are included depends on the CTRAging version): original Old3DS, Old3DS XL, 2DS, regular New3DS, and New3DS XL. Some of the New3DS JPEG images have an EXIF last-modified timestamp of 2013, July-September.

Full dumps of CTRAging have only been possible on the N3DS.

On O3DS, [[ExeFS]]:/.code is consistently corrupted. It is unknown whether this is coincidential or whether CTRAging is destroyed intentionally during any part of the factory setup.

The O3DS version has ''vastly'' more services access compared to the N3DS version.

Talk:Services

2016-01-02T07:15:47Z

Infinicore: /* Service Command Notation */ Forgot my signature

= Service Command Notation =

There seems to be some disagreement on how to notate commands on services. Some people do this: AMNet:OpenTicket (as done by the wiki for page naming), others do am:net::OpenTicket.

I'd like to propose that the wiki page naming continues with all-uppercase service names followed by initial uppercase port name (i.e., am:net -> AMNet, act:u -> ACTU, and so on), but that they are used in text to be more precise: am:net#OpenTicket, act:u#GetAccountDataBlock. This is loosely modeled after Ruby and Javadoc method notation. [[User:Infinicore|Infinicore]] ([[User talk:Infinicore|talk]]) 09:15, 2 January 2016 (CET)

Talk:Services

2016-01-02T07:15:22Z

Infinicore: Service notation suggestion

NIM Services

2015-10-31T08:23:25Z

Infinicore: /* kagiya server */ typo

[[Category:Services]]
= NIM user service "nim:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| Related to starting a sysupdate?
|-
| 0x00020000
| [[NIMU:GetUpdateDownloadProgress|GetUpdateDownloadProgress]]
|-
| 0x0003....
| ?
|-
| 0x00040000
| [[NIMU:FinishTitlesInstall|FinishTitlesInstall]]
|-
| 0x00050000
| This obtains an event handle. Home Menu will check whether a system update is available when this event is triggered.
|-
| 0x0006....
| ?
|-
| 0x0007....
| ?
|-
| 0x0008....
| ?
|-
| 0x00090000
| [[NIMU:CheckSysupdateAvailable|CheckSysupdateAvailable]]
|-
| 0x000A0000
| GetState
|-
| 0x000B....
| GetSystemTitleHash (unique hash for each sysupdate titlelist)
|}

= NIM server service "nim:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00060080
| The input at cmdreq[1-2] is an u64 titleID. This writes an u8 to cmdreply[2]. It's unknown what exactly the [[eShop]] application uses this for, it only uses this command for apps which are installed(checked via [[Application_Manager_Services|AM]] probably). In those cases, it seems the outval for this command(with result-code=0) is normally 0?
|-
| 0x000A0000
| [[NIMS:CheckSysupdateAvailableSOAP|CheckSysupdateAvailableSOAP]]
|-
| 0x0016020A
| [[NIMS:ListTitles|ListTitles]]
|-
| 0x002D0042
| [[NIMS:DownloadTickets|DownloadTickets]]
|-
| 0x00420240
| [[NIMS:StartDownload|StartDownload]]
|}

= NIM server service "nim:aoc" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00030042
| SetApplicationId
|-
| 0x00040042
| SetTin
|-
| 0x000902D0
| ListContentSetsEx
|-
| 0x00180000
| GetBalance
|-
| 0x001D0000
| GetCustomerSupportCode
|-
| 0x00210000
| Initialize
|-
| 0x00240282
| CalculateContentsRequiredSize
|-
| 0x00250000
| RefreshServerTime
|}

= NIM service "nim:ndm" =

= kagiya server =

The nim system module communicates with a server called kagiya (kagiya-ctr.cdn.nintendo.net or kagiya-dev-ctr.cdn.nintendo.net for development units). It provides the seed in binary form for any given title ID under (HTTPS) kagiya-ctr.cdn.nintendo.net/title/0x%16llx/ext_key?country=%s, where %16llx is the title ID and %s is a country code as used in the [[EShop|eShop]].

NIM Services

2015-10-31T08:22:59Z

Infinicore:

[[Category:Services]]
= NIM user service "nim:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| Related to starting a sysupdate?
|-
| 0x00020000
| [[NIMU:GetUpdateDownloadProgress|GetUpdateDownloadProgress]]
|-
| 0x0003....
| ?
|-
| 0x00040000
| [[NIMU:FinishTitlesInstall|FinishTitlesInstall]]
|-
| 0x00050000
| This obtains an event handle. Home Menu will check whether a system update is available when this event is triggered.
|-
| 0x0006....
| ?
|-
| 0x0007....
| ?
|-
| 0x0008....
| ?
|-
| 0x00090000
| [[NIMU:CheckSysupdateAvailable|CheckSysupdateAvailable]]
|-
| 0x000A0000
| GetState
|-
| 0x000B....
| GetSystemTitleHash (unique hash for each sysupdate titlelist)
|}

= NIM server service "nim:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00060080
| The input at cmdreq[1-2] is an u64 titleID. This writes an u8 to cmdreply[2]. It's unknown what exactly the [[eShop]] application uses this for, it only uses this command for apps which are installed(checked via [[Application_Manager_Services|AM]] probably). In those cases, it seems the outval for this command(with result-code=0) is normally 0?
|-
| 0x000A0000
| [[NIMS:CheckSysupdateAvailableSOAP|CheckSysupdateAvailableSOAP]]
|-
| 0x0016020A
| [[NIMS:ListTitles|ListTitles]]
|-
| 0x002D0042
| [[NIMS:DownloadTickets|DownloadTickets]]
|-
| 0x00420240
| [[NIMS:StartDownload|StartDownload]]
|}

= NIM server service "nim:aoc" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00030042
| SetApplicationId
|-
| 0x00040042
| SetTin
|-
| 0x000902D0
| ListContentSetsEx
|-
| 0x00180000
| GetBalance
|-
| 0x001D0000
| GetCustomerSupportCode
|-
| 0x00210000
| Initialize
|-
| 0x00240282
| CalculateContentsRequiredSize
|-
| 0x00250000
| RefreshServerTime
|}

= NIM service "nim:ndm" =

= kagiya server =

The nim system module communicates with a server called kagiya (kagiya-ctr.cdn.nintendo.net or kagiya-dev-ctr.cdn.nintendo.net for development units). It provides the seed in binary form for any given title ID unde (HTTPS) kagiya-ctr.cdn.nintendo.net/title/0x%16llx/ext_key?country=%s, where %16llx is the title ID and %s is a country code as used in the [[EShop|eShop]]

Factory Setup

2015-06-28T15:08:44Z

Infinicore: Going by the pattern of the other titles, 0004000100002302 is very likely spi

With certain 3DS nandimages, the following NCCH can be recovered from NAND(in some cases these are somewhat corrupted). In some cases, only 000400000F980000 is left, in other cases the NCCH headers for all of these are overwritten. ''All'' of these use the retail NCCH secure-crypto mode, the NCCH accessdesc uses the retail pubk too.

Note that [[Nandrw/sys/updater.log]], [[Twln/sys/log/inspect.log]], and [[Twln/sys/log/product.log]] gets written during Factory Setup. CTRAging appears to do the product.log writing.

CTRAging appears to be an app which is used for hardware testing at the factory. This app also displays images(including Chinese/Asian-language text) which appear to be for system assembly/testing. CTRAging includes images for each 3DS model(which ones are included depends on the CTRAging version): original Old3DS, Old3DS XL, 2DS, regular New3DS, and New3DS XL. Some of the New3DS JPEG images have an EXIF last-modified timestamp of 2013, July-September.

Originally these titles(except for CTRAging) and the exheader dependency lists had TID-high 00040001, later that was changed to the [[Title_list|normal]] TID-highs.

{| class="wikitable" border="1"
|-
! TID-high
! TID-low
! Description
|-
| 00040000
| 0F980000
| CTRAging ("Test Program")
|-
| 00040001
| 00000002
| NATIVE_FIRM
|-
| 00040001
| 00000102
| TWL_FIRM
|-
| 00040001
| 00000202
| AGB_FIRM
|-
| 00040001
| 00001902
| dmnt (Debugger sysmodule, see [[Title_list|here]])
|-
| 00040001
| 00001B02
| gpio sysmodule
|-
| 00040001
| 00001D02
| hid sysmodule
|-
| 00040001
| 00001E02
| i2c sysmodule
|-
| 00040001
| 00001F02
| mcu sysmodule
|-
| 00040001
| 00002102
| pdn sysmodule
|-
| 00040001
| 00002302
| (unknown, likely spi sysmodule)
|-
| 00040001
| 00002702
| csnd sysmodule
|-
| 00040001
| 00002802
| dlp sysmodule
|-
| 00040001
| 00002A02
| mp sysmodule
|-
| 00040001
| 00002B02
| ndm sysmodule
|-
| 00040001
| 00002C02
| nim sysmodule
|-
| 00040001
| 00002D02
| nwm sysmodule
|-
| 00040001
| 00003102
| ps module
|-
| 00040001
| 00003202
| friends sysmodule
|-
| 00040001
| 00003302
| ir sysmodule
|-
| 00040001
| 00003402
| boss sysmodule
|-
| 00040001
| 00008002
| [[NS]]
|-
| 00040001
| 00008102
| TestMenu
|-
| 00040001
| 00008A02
| [[ErrDisp|DevErrDi]]
|-
| 00040030
| 00008102
| TestMenu
|-
|}

Factory Setup

2015-06-28T14:49:10Z

Infinicore: nwm found

With certain 3DS nandimages, the following NCCH can be recovered from NAND(in some cases these are somewhat corrupted). In some cases, only 000400000F980000 is left, in other cases the NCCH headers for all of these are overwritten. ''All'' of these use the retail NCCH secure-crypto mode, the NCCH accessdesc uses the retail pubk too.

Note that [[Nandrw/sys/updater.log]], [[Twln/sys/log/inspect.log]], and [[Twln/sys/log/product.log]] gets written during Factory Setup. CTRAging appears to do the product.log writing.

CTRAging appears to be an app which is used for hardware testing at the factory. This app also displays images(including Chinese/Asian-language text) which appear to be for system assembly/testing. CTRAging includes images for each 3DS model(which ones are included depends on the CTRAging version): original Old3DS, Old3DS XL, 2DS, regular New3DS, and New3DS XL. Some of the New3DS JPEG images have an EXIF last-modified timestamp of 2013, July-September.

Originally these titles(except for CTRAging) and the exheader dependency lists had TID-high 00040001, later that was changed to the [[Title_list|normal]] TID-highs.

{| class="wikitable" border="1"
|-
! TID-high
! TID-low
! Description
|-
| 00040000
| 0F980000
| CTRAging ("Test Program")
|-
| 00040001
| 00000002
| NATIVE_FIRM
|-
| 00040001
| 00000102
| TWL_FIRM
|-
| 00040001
| 00000202
| AGB_FIRM
|-
| 00040001
| 00001902
| dmnt (Debugger sysmodule, see [[Title_list|here]])
|-
| 00040001
| 00001B02
| gpio sysmodule
|-
| 00040001
| 00001D02
| hid sysmodule
|-
| 00040001
| 00001E02
| i2c sysmodule
|-
| 00040001
| 00001F02
| mcu sysmodule
|-
| 00040001
| 00002102
| pdn sysmodule
|-
| 00040001
| 00002302
|
|-
| 00040001
| 00002702
| csnd sysmodule
|-
| 00040001
| 00002802
| dlp sysmodule
|-
| 00040001
| 00002A02
| mp sysmodule
|-
| 00040001
| 00002B02
| ndm sysmodule
|-
| 00040001
| 00002C02
| nim sysmodule
|-
| 00040001
| 00002D02
| nwm sysmodule
|-
| 00040001
| 00003102
| ps module
|-
| 00040001
| 00003202
| friends sysmodule
|-
| 00040001
| 00003302
| ir sysmodule
|-
| 00040001
| 00003402
| boss sysmodule
|-
| 00040001
| 00008002
| [[NS]]
|-
| 00040001
| 00008102
| TestMenu
|-
| 00040001
| 00008A02
| [[ErrDisp|DevErrDi]]
|-
| 00040030
| 00008102
| TestMenu
|-
|}

Configuration Memory

2015-06-23T17:08:15Z

Infinicore: /* Shared Memory Page For ARM11 Processes */ Research 0x1FF81066: wifi signal strength

= ARM11 Kernel Configuration Memory =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| KERNEL_?
| 0x1FF80000
| 1
|-
| KERNEL_VERSIONREVISION
| 0x1FF80001
| 1
|-
| KERNEL_VERSIONMINOR
| 0x1FF80002
| 1
|-
| KERNEL_VERSIONMAJOR
| 0x1FF80003
| 1
|-
| UPDATEFLAG
| 0x1FF80004
| 4
|-
| NSTID
| 0x1FF80008
| 8
|-
| SYSCOREVER
| 0x1FF80010
| 4
|-
| UNITINFO
| 0x1FF80014
| 1
|-
| BOOT_FIRM
| 0x1FF80015
| 1
|-
| PREV_FIRM
| 0x1FF80016
| 1
|-
| KERNEL_CTRSDKVERSION
| 0x1FF80018
| 4
|-
| APPMEMTYPE
| 0x1FF80030
| 4
|-
| APPMEMALLOC
| 0x1FF80040
| 4
|-
| SYSMEMALLOC
| 0x1FF80044
| 4
|-
| BASEMEMALLOC
| 0x1FF80048
| 4
|-
| FIRM_?
| 0x1FF80060
| 1
|-
| FIRM_VERSIONREVISION
| 0x1FF80061
| 1
|-
| FIRM_VERSIONMINOR
| 0x1FF80062
| 1
|-
| FIRM_VERSIONMAJOR
| 0x1FF80063
| 1
|-
| FIRM_SYSCOREVER
| 0x1FF80064
| 4
|-
| FIRM_CTRSDKVERSION
| 0x1FF80068
| 4
|}

This memory page is [[Memory_layout|read-only]] for ARM11 processes. This memory and the kernel code for it only exists under NATIVE_FIRM/SAFE_MODE_FIRM.

The FIRM_* fields are by default identical to the KERNEL_* fields. However, the FIRM_* fields can be overridden via FIRM-launch parameters, see [[FIRM|here]].

Besides mem-region related fields, the data written here by the old 3DS/new 3DS kernels is identical.

= Shared Memory Page For ARM11 Processes =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| bit0 selects DATETIME_0 or DATETIME_1.
| 0x1FF81000
| 4
|-
| RUNNING_HW (1=product, 2=devboard, 3=debugger, 4=capture)
| 0x1FF81004
| 1
|-
| MCU_HW_INFO
| 0x1FF81005
| 1
|-
| DATETIME_0 {(u64)MillisecondsSinceFirstJan1900,(u64)SystemTickLastTimeThisWasUpdated,(u32)unk,(u32)unk,(u32)unk,(u32)unk}
| 0x1FF81020
| 32
|-
| DATETIME_1
| 0x1FF81040
| 32
|-
| WIFI_MACADDR
| 0x1FF81060
| 6
|-
| WIFI_LINKLEVEL Ranges from 0-3; 0 stands for no or a poor network connection; 3 stands for a good connection. This corresponds with the number of wifi bars displayed by [[Home Menu]].
| 0x1FF81066
| 1
|-
| WIFI_? Likely wifi hardware related, NWM module initializes this. Regular Old3DS value = 0x00, regular New3DS value = 0x02.
| 0x1FF81067
| 1
|-
| 3D_SLIDERSTATE
| 0x1FF81080
| 4
|-
| 3D_LEDSTATE
| 0x1FF81084
| 1
|-
| BATTERY_LEDSTATE
| 0x1FF81085
| 1
|-
| MENUTID
| 0x1FF810A0
| 8
|-
| ACTIVEMENUTID
| 0x1FF810A8
| 8
|-
| Signed? Headsets connected?
| 0x1FF810C0
| 1
|}

This memory page is normally read-only for ARM11 processes, write-access is [[Memory_layout|determined]] by the process exheader kernel "shared page writing" flag. This memory only exists under NATIVE_FIRM/SAFE_MODE_FIRM.

= ARM11 Kernel Config Fields =

== 0x1FF80000 / 0x1FF80060 ==
Unknown, this is normally value 0.

== KERNEL_VERSIONREVISION / FIRM_VERSIONREVISION ==
This is the version-revision for the currently running [[FIRM]].

== KERNEL_VERSIONMINOR ==
This is the version-minor from ((title-version & 0x3FF) >> 4), for the currently running [[FIRM]]. The values from KERNEL_VERSIONMINOR and KERNEL_VERSIONMAJOR can be stored in applications' [[NCCH#CXI|CXI]] exheader.

== FIRM_VERSIONMINOR ==
This is the same as KERNEL_VERSIONMINOR. After [[AM:InstallNATIVEFIRM]] checks FIRM_SYSCOREVER, [[AM:InstallNATIVEFIRM]] then compares FIRM_VERSIONMINOR with the NATIVE_FIRM ((title-version & 0x3FF) >> 4), when the latter is larger than FIRM_VERSIONMINOR [[AM:InstallNATIVEFIRM]] will trigger a [[FIRM]] install.

== KERNEL_VERSIONMAJOR / FIRM_VERSIONMAJOR ==
This is the version-major for the currently running [[FIRM]].

== UPDATEFLAG ==
Normally this flag is zero. When the ARM11 kernel is booting on non-factory FIRM it will set this flag to 1, when bit0 from the data which field 0x1FF80016 is loaded from is clear, if the following [[PAD]] buttons are pressed: L, R, A, Up. When this flag is set, [[NS]] will launch the [[System_Settings#System_Updater|System Updater]] title instead of [[Home Menu]].

== NSTID ==
This field contains the titleID of the first title to launch from CTR-NAND after the [[FIRM]] system processes are loaded. The [[Process_Manager_Services|PM]] module launches this title. If this field titleID is all-zero, the system will not attempt to launch the title. The regular ARM11 kernel sets this to the regular [[NS]] titleID, while the SAFE_MODE ARM11 kernel sets this to the SAFE_MODE NS titleID. The factory FIRM ARM11-kernel sets this to the NS TID from [[Factory_Setup|here]].

== SYSCOREVER ==
This field is initialized by the ARM11 kernel, this is the programID-low of the running FIRM. When launching [[NCCH#CXI|CXIs]], the value stored here must match the core version field stored in the CXI exheader. If they do not match, the [[Process_Manager_Services|PM]] module will refuse to launch the ARM11 process.

With [[Factory_Setup|factory]] NATIVE_FIRM, this is set to 0x0, even though the FIRM programID-low is 0x2. However, the factory system-titles have core-version set to 0x2. Hence, this config-mem SYSCOREVER field might not be used by factory system processes?

== FIRM_SYSCOREVER ==
Normally this is the same as SYSCOREVER. This used by [[AM:InstallNATIVEFIRM]] for comparing with the NATIVE_FIRM titleID-low. When the low u8 from the NATIVE_FIRM titleID-low is larger than FIRMSYSCOREVER, [[AM:InstallNATIVEFIRM]] will trigger FIRM installing. When that u8 is not larger than FIRM_SYSCOREVER, and these two values don't match, [[AM:InstallNATIVEFIRM]] will return an error.

== UNITINFO ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Clear for developer unit, set for retail.(See 0x1FF80015)
|-
| 1
| Set for debug units
|-
| 2-7
|?
|}

Bit1 in this field is set by the ARM11 kernel when ARM debug CP14 DSCR bit14 is set. [[NS]] loads the menu TID from MENUTID when bits 1-7 of this field are clear. [[ErrDisp]] will display development error info when bit0 is clear.

== 0x1FF80015 ==
The ARM11 loads this value from 0x1FFFFFF0+1 during startup, which is written by the ARM9 during ARM9<>ARM11 kernel sync.

When this field is zero, bit0 for UNITINFO is set for retail. When this field is non-zero, bit0 for UNITINFO is clear for dev/debug units, and an ARM11 kernel state flag which enables debugging is set. Bit1 means JTAG connected.

== 0x1FF80016 ==
The ARM11 loads this value from 0x1FFFFFF0+2 during startup, which is written by the ARM9 during ARM9<>ARM11 kernel sync.

This originates from the low 8-bits of register [[CONFIG|0x10010000]]. When bit0 is set, the ARM11 kernel will not set the UPDATEFLAG to value 1.

== KERNEL_CTRSDKVERSION / FIRM_CTRSDKVERSION ==
This is the CTR-SDK version which was used to build the currently running [[FIRM]].

== APPMEMTYPE ==
The value of this field determines the size for APPMEMALLOC. The retail type(value0) is used when the type is not values 2-5. See [[Memory_layout]] for the table of values for this and the mem-region sizes.

== APPMEMALLOC ==
This contains the total size of the memory that can be allocated with the APPLICATION [[SVC|memory-region]], see [[Memory_layout|here]].

== SYSMEMALLOC ==
Same as APPMEMALLOC except for the SYSTEM mem-region, see [[Memory_layout|here]].

== BASEMEMALLOC ==
Same as APPMEMALLOC except for the BASE mem-region, see [[Memory_layout|here]].

= Shared Memory Page Fields =

== WIFI_MACADDR ==
This is the WiFi MAC address for the 3DS. This is initialized by the [[NWM_Services|NWM]] module, it's unknown where the MAC address written here was originally loaded from.

== 3D_SLIDERSTATE ==
This float contains the state of the 3D slider. The range of this float is value 0.0f for "off", and 1.0f for max.

This is written/updated by [[HID_Services|HID]] module.

== 3D_LEDSTATE ==
When non-zero, the 3D LED is disabled. See [[GSPGPU:SetLedForceOff]].

== MENUTID ==
Unknown, contains the menu TID (used by [[NS]])

== ACTIVEMENUTID ==
This contains the titleID of the currently running menu launched by [[NS]].

= NATIVE_FIRM Versions =
{| class="wikitable" border="1"
! System version
! old 3DS title version
! old 3DS hex title contentID
! Kernel/FIRM version (old 3DS/new 3DS)
|-
| [[Factory_Setup|Factory]] FIRM (titleID 00040001-00000002)
| v0
| 00
| 2.3-0
|-
| [[1.0.0-0|1.0.0]]
| v432
| 00
| 2.27-0
|-
| [[1.1.0-1|1.1.0]]
| v1472
| 02
| 2.28-0
|-
| [[2.0.0-2|2.0.0]]
| v2516
| 09
| 2.29-7
|-
| [[2.1.0-3|2.1.0]]
| v3553
| 0B
| 2.30-18
|-
| [[2.2.0-X|2.2.0]]
| v4595
| 0F
| 2.31-40
|-
| [[3.0.0-5|3.0.0]]
| v5647
| 18
| 2.32-15
|-
| [[4.0.0-7|4.0.0]]
| v6677
| 1D
| 2.33-4
|-
| [[4.1.0-8|4.1.0]]
| v7712
| 1F
| 2.34-0
|-
| [[5.0.0-11|5.0.0]]
| v8758
| 25
| 2.35-6
|-
| [[5.1.0-11|5.1.0]]
| v9792
| 26
| 2.36-0
|-
| [[6.0.0-11|6.0.0]]
| v10833
| 29
| 2.37-0
|-
| [[6.1.0-11|6.1.0]]
| v11872
| 2A
| 2.38-0
|-
| [[7.0.0-13|7.0.0]]
| v12916
| 2E
| 2.39-4
|-
| [[7.2.0-17|7.2.0]]
| v13956
| 30
| 2.40-0
|-
| [[8.0.0-18|8.0.0]]
| v15047
| 37
| 2.44-6
|-
| [[8.1.0-0_New3DS]]
|N/A
|N/A
| 2.45-5
|-
| [[9.0.0-20|9.0.0]]
| v17120
| 38
| 2.46-0
|-
| [[9.3.0-21|9.3.0]]
| v18182
| 3F
| 2.48-3
|-
| [[9.5.0-22|9.5.0]]
| v19216
| 40
| 2.49-0
|-
| [[9.6.0-24|9.6.0]]
| v20262
| 49
| 2.50-1
|}

The above kernel/FIRM versions are in the format: <KERNEL_VERSIONMAJOR>.<KERNEL_VERSIONMINOR>-<KERNEL_VERSIONREVISION>.