3dbrew - User contributions [en]

NCCH/Extended Header

2016-06-16T07:49:42Z

Jakcron: link to sysmodules

This page documents the format of the '''NCCH Extended Header''', or '''exheader''' for short.

The exheader has two sections:

* The actual exheader data, containing System Control Info (SCI) and Access Control Info (ACI);
* A signed copy of NCCH HDR public key, and exheader ACI. This version of the ACI is used as limitation to the actual ACI.

== Main Structure ==
All values are little endian unless otherwise specified.

See also: [https://github.com/profi200/Project_CTR/blob/master/ctrtool/exheader.h]

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x200</code>
| SCI
|-
| <code>0x200</code>
| <code>0x200</code>
| ACI
|-
| <code>0x400</code>
| <code>0x100</code>
| <code>AccessDesc</code> signature (RSA-2048-SHA256)
|-
| <code>0x500</code>
| <code>0x100</code>
| NCCH HDR RSA-2048 public key
|-
| <code>0x600</code>
| <code>0x200</code>
| ACI (for limitation of first ACI)
|}

The <code>AccessDesc</code> signature covers the NCCH HDR public key and second ACI. The <code>AccessDesc</code> public key is initialised by the boot ROM.

When loading the exheader, [[FIRM|Process9]] compares the exheader data with the data in the <code>AccessDesc</code> (note that not everything is compared here). When these don't match, an error is returned. The Process9 code handling this validation was updated with [[6.0.0-11|v6.0]]; the only change in this function seems to be the check for the "Ideal processor" field.

== System Control Info ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| Application title
|-
| <code>0x8</code>
| <code>0x5</code>
| Reserved
|-
| <code>0xD</code>
| <code>0x1</code>
| Flag (bit 0: <code>CompressExefsCode</code>, bit 1: <code>SDApplication</code>)
|-
| <code>0xE</code>
| <code>0x2</code>
| Remaster version
|-
| <code>0x10</code>
| <code>0xC</code>
| Text code set info
|-
| <code>0x1C</code>
| <code>0x4</code>
| Stack size
|-
| <code>0x20</code>
| <code>0xC</code>
| Read-only code set info
|-
| <code>0x2C</code>
| <code>0x4</code>
| Reserved
|-
| <code>0x30</code>
| <code>0xC</code>
| Data code set info
|-
| <code>0x3C</code>
| <code>0x4</code>
| BSS size
|-
| <code>0x40</code>
| <code>0x180</code> (<code>48*8</code>)
| Dependency [[Title list#00040130 - System Modules|module]] (program ID) list
|-
| <code>0x1C0</code>
| <code>0x40</code>
| <code>SystemInfo</code>
|}

Most of these fields are used in [[LOADER:LoadProcess]].

=== Code Set Info ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>4</code>
| Address
|-
| <code>0x4</code>
| <code>4</code>
| Physical region size (in page-multiples)
|-
| <code>0x8</code>
| <code>4</code>
| Size (in bytes)
|}

=== System Info ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| <code>SaveData</code> Size
|-
| <code>0x8</code>
| <code>0x8</code>
| Jump ID
|-
| <code>0x10</code>
| <code>0x30</code>
| Reserved
|}

== Access Control Info ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x170</code>
| [[#ARM11 Local System Capabilities|ARM11 local system capabilities]]
|-
| <code>0x170</code>
| <code>0x80</code>
| [[#ARM11 Kernel Capabilities|ARM11 kernel capabilities]]
|-
| <code>0x1F0</code>
| <code>0x10</code>
| [[#ARM9 Access Control|ARM9 access control]]
|}

=== ARM11 Local System Capabilities ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| Program ID
|-
| <code>0x8</code>
| <code>0x4</code>
| Core version (The Title ID low of the required [[FIRM]])
|-
| <code>0xC</code>
| <code>0x2</code>
| [[#Flag1|Flag1]] and [[#Flag2|Flag2]] (both implemented starting from [[8.0.0-18]]).
|-
| <code>0xE</code>
| <code>0x1</code>
| [[#Flag0|Flag0]]
|-
| <code>0xF</code>
| <code>0x1</code>
| Priority
|-
| <code>0x10</code>
| <code>0x20</code> (<code>16*2</code>)
| Resource limit descriptors. The first byte here controls the maximum allowed [[PMApp:SetAppResourceLimit|<code>CpuTime</code>]].
|-
| <code>0x30</code>
| <code>0x20</code>
| [[#Storage Info|Storage info]]
|-
| <code>0x50</code>
| <code>0x100</code> (<code>32*8</code>)
| [[#Service Access Control|Service access control]]
|-
| <code>0x150</code>
| <code>0x10</code> (<code>2*8</code>)
| Extended service access control, support for this was implemented with [[9.3.0-21|9.3.0-X]].
|-
| <code>0x160</code>
| <code>0xF</code>
| Reserved
|-
| <code>0x16F</code>
| <code>0x1</code>
| Resource limit category. (0 = <code>APPLICATION</code>, 1 = <code>SYS_APPLET</code>, 2 = <code>LIB_APPLET</code>, 3 = <code>OTHER</code> (sysmodules running under the BASE memregion))
|}

==== Flag0 ====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| <code>0-1</code>
| Ideal processor
|-
| <code>2-3</code>
| Affinity mask
|-
| <code>4-7</code>
| Old3DS system mode
|}

===== Old3DS System Mode =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| <code>0</code>
| <code>Prod</code> (64MB of usable application memory)
|-
| <code>1</code>
| <code>Undefined</code> (unusable)
|-
| <code>2</code>
| <code>Dev1</code> (96MB of usable application memory)
|-
| <code>3</code>
| <code>Dev2</code> (80MB of usable application memory)
|-
| <code>4</code>
| <code>Dev3</code> (72MB of usable application memory)
|-
| <code>5</code>
| <code>Dev4</code> (32MB of usable application memory)
|-
| <code>6-7</code>
| <code>Undefined</code> Same as <code>Prod</code>?
|}

In the exheader data, the ideal processor field is a bit-index, while in the <code>AccessDesc</code> the ideal processor field is a bitmask. When the bit specified by the exheader field is not set in the <code>AccessDesc</code> field, an error is returned.

<pre>if((1 << exheaderval) & accessdescval == 0) return error</pre>

During a FIRM-launch when a <code>TitleInfo</code> structure was specified, the field at offset [[FIRM#FIRM_Launch_Parameters|0x400]] in the FIRM-launch parameters is set to the SystemMode of the specified title, however in some cases other values are written there. With [[8.0.0-18]] NS will now check the output of [[PTM|PTMSYSM]] command <code>0x040A0000</code>, when the output is non-zero and a certain NS state field is value-zero, the following is executed otherwise this is skipped. With that check passed on [[8.0.0-18]], NS will then check (<code>Flag2 & 0xF</code>). When that is <code>value2</code>, the output value (used for the FIRM-launcher parameter field mentioned above) is set to <code>value7</code>. Otherwise, when that value is non-zero, the output value is set to 6.

==== Flag1 ====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| <code>0</code>
| <code>EnableL2Cache</code> (Unknown what this actually does, New3DS-only presumably)
|-
| <code>1</code>
| <code>cpuspeed_804MHz</code> (Default "cpuspeed" when not set)
|-
| <code>2-7</code>
| Unused
|}

In order for the exheader to have any of the above new bits set, the <code>AccessDesc</code> must have the corresponding bit set, otherwise the invalid-exheader error is returned.

Homebrew which runs under a title which has the above <code>cpuspeed</code> flag set, runs much faster on New3DS. It's unknown how exactly the system handles these flags.

When launching titles / perhaps other things with [[APT]], [[NS]] uses [[PTMSYSM:ConfigureNew3DSCPU]] with data which originally came from these flags; NS does this regardless of what the running 3DS system is. However, due to a bug(?) in NS the value sent to that command is always either 0x0 or 0x3. When calculating that value, the code only ever uses the cpuspeed field, not the cache field: code to actually load and check the value of the cache field appears to be missing.

==== Flag2 ====
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0-3</code>
| New3DS system mode
|-
| <code>4-7</code>
| Unused
|}

===== New3DS System Mode =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| <code>0</code>
| <code>Legacy</code> (use Old3DS system mode)
|-
| <code>1</code>
| <code>Prod</code> (124MB of usable application memory)
|-
| <code>2</code>
| <code>Dev1</code> (178MB of usable application memory)
|-
| <code>3</code>
| <code>Dev2</code> Same as <code>Prod</code>?
|-
| <code>4-7</code>
| <code>Undefined</code> Same as <code>Prod</code>?
|}

When in <code>Legacy</code> mode, the actual memory layout is the same as in <code>New3DS Prod</code>, except the available application memory as reported to the application is reduced to the Old3DS size.

The exheader value for the New3DS system mode value must be ≤ to the <code>AccessDesc</code> value, otherwise the invalid-exheader error is returned.

==== Storage Info ====
Used in [[FSReg:Register]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>8</code>
| Extdata ID
|-
| <code>0x8</code>
| <code>8</code>
| System savedata IDs
|-
| <code>0x10</code>
| <code>8</code>
| Storage accessible unique IDs
|-
| <code>0x18</code>
| <code>7</code>
| Filesystem access info
|-
| <code>0x1F</code>
| <code>1</code>
| Other attributes
|}

File System Access Info:
{| class="wikitable" border="1"
|-
! Bit and bitmask
! Description
|-
| <code>0</code>, <code>0x1</code>
| Category system application
|-
| <code>1</code>, <code>0x2</code>
| Category hardware check
|-
| <code>2</code>, <code>0x4</code>
| Category filesystem tool
|-
| <code>3</code>, <code>0x8</code>
| Debug
|-
| <code>4</code>, <code>0x10</code>
| TWL card backup
|-
| <code>5</code>, <code>0x20</code>
| TWL NAND data
|-
| <code>6</code>, <code>0x40</code>
| BOSS
|-
| <code>7</code>, <code>0x80</code>
| [[FS:OpenArchive|<code>sdmc:/</code>]]
|-
| <code>8</code>, <code>0x100</code>
| Core
|-
| <code>9</code>, <code>0x200</code>
| [[Flash Filesystem|<code>nand:/ro/</code>]] (Read Only)
|-
| <code>10</code>, <code>0x400</code>
| [[Flash Filesystem|<code>nand:/rw/</code>]]
|-
| <code>11</code>, <code>0x800</code>
| [[Flash Filesystem|<code>nand:/ro/</code>]] (Write Access)
|-
| <code>12</code>, <code>0x1000</code>
| Category system settings
|-
| <code>13</code>, <code>0x2000</code>
| Cardboard
|-
| <code>14</code>, <code>0x4000</code>
| Export/Import IVS
|-
| <code>15</code>, <code>0x8000</code>
| [[FS:OpenArchive|<code>sdmc:/</code>]] (Write-only)
|-
| <code>16</code>, <code>0x10000</code>
| Switch cleanup (Introduced in [[3.0.0-5|3.0.0]]?)
|-
| <code>17</code>, <code>0x20000</code>
| Savedata move (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>18</code>, <code>0x40000</code>
| Shop (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>19</code>, <code>0x80000</code>
| Shell (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>20</code>, <code>0x100000</code>
| Category home menu (Introduced in [[6.0.0-11|6.0.0]])
|-
| <code>21</code>, <code>0x200000</code>
| Seed DB. Introduced in [[9.6.0-24|9.6.0-X]] [[FIRM]]. [[Home Menu]] has this bit set starting with [[9.6.0-24|9.6.0-X]].
|}

====Other Attributes====

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Not use ROMFS
|-
| <code>1</code>
| Use Extended savedata access.
|}

When Bit1 is set, the "Extdata ID" and "Storage Accessable Unique IDs" regions are used to store a total of 6 "Accessible Save IDs". Introduced in [[6.0.0-11|6.0.0]].

==== Service Access Control ====
This is the list of [[Services_API|services]] which the process is allowed to access, this is registered with the [[Services|services]] manager. Each service listed in the exheader must be listed in the <code>AccessDesc</code>, otherwise the invalid exheader error is returned. The order of the services for exheader/<code>AccessDesc</code> doesn't matter. The <code>AccessDesc</code> can list services which are not in the exheader, but normally the service-access-control data for exheader/<code>AccessDesc</code> are exactly the same.

This list is submitted to [[SRVPM:RegisterProcess]].

=== ARM11 Kernel Capabilities ===
The kernel capability descriptors are passed to [[SVC|svcCreateProcess]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x70</code> (<code>28*4</code>)
| Descriptors
|-
| <code>0x70</code>
| <code>0x10</code>
| Reserved
|}

There are different descriptor types, determined by the number of leading ones in the binary value representation of bits 20-31. The different types are laid out as follows:

{| class="wikitable" border="1"
|-
! Pattern of bits 20-31
! Type
! Fields
|-
| <code>0b1110xxxxxxxx</code>
| Interrupt info
|
|-
| <code>0b11110xxxxxxx</code>
| System call mask
| Bits 24-26: System call mask table index; Bits 0-23: mask
|-
| <code>0b1111110xxxxx</code>
| Kernel release version
| Bits 8-15: Major version; Bits 0-7: Minor version
|-
| <code>0b11111110xxxx</code>
| Handle table size
| Bits 0-18: size
|-
| <code>0b111111110xxx</code>
| [[#ARM11_Kernel_Flags|Kernel flags]]
| See below
|-
| <code>0b11111111100x</code>
| Mapping static address
|
|-
| <code>0b111111111110</code>
| Mapping IO address
| Bits 0-19: IO page index to map; Bit 20: Map read-only (otherwise read-write)
|}

==== ARM11 Kernel Flags ====
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Allow debug
|-
| <code>1</code>
| Force debug
|-
| <code>2</code>
| Allow non-alphanum
|-
| <code>3</code>
| Shared page writing
|-
| <code>4</code>
| Privilege priority
|-
| <code>5</code>
| Allow <code>main()</code> args
|-
| <code>6</code>
| Shared device memory
|-
| <code>7</code>
| Runnable on sleep
|-
| <code>8-11</code>
| Memory type (1: application, 2: system, 3: base)
|-
| <code>12</code>
| [[Memory_layout#NATIVE_FIRM.2FSAFE_MODE_FIRM_Userland_Memory|Special memory]]
|-
| <code>13</code>
| Process has access to CPU core 2 (New3DS only)
|}

=== ARM9 Access Control ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>15</code>
| Descriptors
|-
| <code>0xF</code>
| <code>1</code>
| ARM9 Descriptor Version. Originally this value had to be ≥ 2. Starting with [[9.3.0-21|9.3.0-X]] this value has to be either value 2 or value 3.
|}

Descriptors:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Mount [[Flash Filesystem|<code>nand:/</code>]]
|-
| <code>1</code>
| Mount [[Flash Filesystem|<code>nand:/ro/</code>]] (Write Access)
|-
| <code>2</code>
| Mount [[Flash Filesystem|<code>twln:/</code>]]
|-
| <code>3</code>
| Mount [[Flash Filesystem|<code>wnand:/</code>]]
|-
| <code>4</code>
| Mount card SPI
|-
| <code>5</code>
| Use SDIF3
|-
| <code>6</code>
| Create seed
|-
| <code>7</code>
| Use card SPI
|-
| <code>8</code>
| SD application (Not checked)
|-
| <code>9</code>
| Mount [[SD Filesystem|sdmc:/]] (Write Access)
|}

NCCH/Extended Header

2016-06-16T07:46:46Z

Jakcron: Add system modes

This page documents the format of the '''NCCH Extended Header''', or '''exheader''' for short.

The exheader has two sections:

* The actual exheader data, containing System Control Info (SCI) and Access Control Info (ACI);
* A signed copy of NCCH HDR public key, and exheader ACI. This version of the ACI is used as limitation to the actual ACI.

== Main Structure ==
All values are little endian unless otherwise specified.

See also: [https://github.com/profi200/Project_CTR/blob/master/ctrtool/exheader.h]

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x200</code>
| SCI
|-
| <code>0x200</code>
| <code>0x200</code>
| ACI
|-
| <code>0x400</code>
| <code>0x100</code>
| <code>AccessDesc</code> signature (RSA-2048-SHA256)
|-
| <code>0x500</code>
| <code>0x100</code>
| NCCH HDR RSA-2048 public key
|-
| <code>0x600</code>
| <code>0x200</code>
| ACI (for limitation of first ACI)
|}

The <code>AccessDesc</code> signature covers the NCCH HDR public key and second ACI. The <code>AccessDesc</code> public key is initialised by the boot ROM.

When loading the exheader, [[FIRM|Process9]] compares the exheader data with the data in the <code>AccessDesc</code> (note that not everything is compared here). When these don't match, an error is returned. The Process9 code handling this validation was updated with [[6.0.0-11|v6.0]]; the only change in this function seems to be the check for the "Ideal processor" field.

== System Control Info ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| Application title
|-
| <code>0x8</code>
| <code>0x5</code>
| Reserved
|-
| <code>0xD</code>
| <code>0x1</code>
| Flag (bit 0: <code>CompressExefsCode</code>, bit 1: <code>SDApplication</code>)
|-
| <code>0xE</code>
| <code>0x2</code>
| Remaster version
|-
| <code>0x10</code>
| <code>0xC</code>
| Text code set info
|-
| <code>0x1C</code>
| <code>0x4</code>
| Stack size
|-
| <code>0x20</code>
| <code>0xC</code>
| Read-only code set info
|-
| <code>0x2C</code>
| <code>0x4</code>
| Reserved
|-
| <code>0x30</code>
| <code>0xC</code>
| Data code set info
|-
| <code>0x3C</code>
| <code>0x4</code>
| BSS size
|-
| <code>0x40</code>
| <code>0x180</code> (<code>48*8</code>)
| Dependency module (program ID) list
|-
| <code>0x1C0</code>
| <code>0x40</code>
| <code>SystemInfo</code>
|}

Most of these fields are used in [[LOADER:LoadProcess]].

=== Code Set Info ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>4</code>
| Address
|-
| <code>0x4</code>
| <code>4</code>
| Physical region size (in page-multiples)
|-
| <code>0x8</code>
| <code>4</code>
| Size (in bytes)
|}

=== System Info ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| <code>SaveData</code> Size
|-
| <code>0x8</code>
| <code>0x8</code>
| Jump ID
|-
| <code>0x10</code>
| <code>0x30</code>
| Reserved
|}

== Access Control Info ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x170</code>
| [[#ARM11 Local System Capabilities|ARM11 local system capabilities]]
|-
| <code>0x170</code>
| <code>0x80</code>
| [[#ARM11 Kernel Capabilities|ARM11 kernel capabilities]]
|-
| <code>0x1F0</code>
| <code>0x10</code>
| [[#ARM9 Access Control|ARM9 access control]]
|}

=== ARM11 Local System Capabilities ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| Program ID
|-
| <code>0x8</code>
| <code>0x4</code>
| Core version (The Title ID low of the required [[FIRM]])
|-
| <code>0xC</code>
| <code>0x2</code>
| [[#Flag1|Flag1]] and [[#Flag2|Flag2]] (both implemented starting from [[8.0.0-18]]).
|-
| <code>0xE</code>
| <code>0x1</code>
| [[#Flag0|Flag0]]
|-
| <code>0xF</code>
| <code>0x1</code>
| Priority
|-
| <code>0x10</code>
| <code>0x20</code> (<code>16*2</code>)
| Resource limit descriptors. The first byte here controls the maximum allowed [[PMApp:SetAppResourceLimit|<code>CpuTime</code>]].
|-
| <code>0x30</code>
| <code>0x20</code>
| [[#Storage Info|Storage info]]
|-
| <code>0x50</code>
| <code>0x100</code> (<code>32*8</code>)
| [[#Service Access Control|Service access control]]
|-
| <code>0x150</code>
| <code>0x10</code> (<code>2*8</code>)
| Extended service access control, support for this was implemented with [[9.3.0-21|9.3.0-X]].
|-
| <code>0x160</code>
| <code>0xF</code>
| Reserved
|-
| <code>0x16F</code>
| <code>0x1</code>
| Resource limit category. (0 = <code>APPLICATION</code>, 1 = <code>SYS_APPLET</code>, 2 = <code>LIB_APPLET</code>, 3 = <code>OTHER</code> (sysmodules running under the BASE memregion))
|}

==== Flag0 ====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| <code>0-1</code>
| Ideal processor
|-
| <code>2-3</code>
| Affinity mask
|-
| <code>4-7</code>
| Old3DS system mode
|}

===== Old3DS System Mode =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| <code>0</code>
| <code>Prod</code> (64MB of usable application memory)
|-
| <code>1</code>
| <code>Undefined</code> (unusable)
|-
| <code>2</code>
| <code>Dev1</code> (96MB of usable application memory)
|-
| <code>3</code>
| <code>Dev2</code> (80MB of usable application memory)
|-
| <code>4</code>
| <code>Dev3</code> (72MB of usable application memory)
|-
| <code>5</code>
| <code>Dev4</code> (32MB of usable application memory)
|-
| <code>6-7</code>
| <code>Undefined</code> Same as <code>Prod</code>?
|}

In the exheader data, the ideal processor field is a bit-index, while in the <code>AccessDesc</code> the ideal processor field is a bitmask. When the bit specified by the exheader field is not set in the <code>AccessDesc</code> field, an error is returned.

<pre>if((1 << exheaderval) & accessdescval == 0) return error</pre>

During a FIRM-launch when a <code>TitleInfo</code> structure was specified, the field at offset [[FIRM#FIRM_Launch_Parameters|0x400]] in the FIRM-launch parameters is set to the SystemMode of the specified title, however in some cases other values are written there. With [[8.0.0-18]] NS will now check the output of [[PTM|PTMSYSM]] command <code>0x040A0000</code>, when the output is non-zero and a certain NS state field is value-zero, the following is executed otherwise this is skipped. With that check passed on [[8.0.0-18]], NS will then check (<code>Flag2 & 0xF</code>). When that is <code>value2</code>, the output value (used for the FIRM-launcher parameter field mentioned above) is set to <code>value7</code>. Otherwise, when that value is non-zero, the output value is set to 6.

==== Flag1 ====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| <code>0</code>
| <code>EnableL2Cache</code> (Unknown what this actually does, New3DS-only presumably)
|-
| <code>1</code>
| <code>cpuspeed_804MHz</code> (Default "cpuspeed" when not set)
|-
| <code>2-7</code>
| Unused
|}

In order for the exheader to have any of the above new bits set, the <code>AccessDesc</code> must have the corresponding bit set, otherwise the invalid-exheader error is returned.

Homebrew which runs under a title which has the above <code>cpuspeed</code> flag set, runs much faster on New3DS. It's unknown how exactly the system handles these flags.

When launching titles / perhaps other things with [[APT]], [[NS]] uses [[PTMSYSM:ConfigureNew3DSCPU]] with data which originally came from these flags; NS does this regardless of what the running 3DS system is. However, due to a bug(?) in NS the value sent to that command is always either 0x0 or 0x3. When calculating that value, the code only ever uses the cpuspeed field, not the cache field: code to actually load and check the value of the cache field appears to be missing.

==== Flag2 ====
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0-3</code>
| New3DS system mode
|-
| <code>4-7</code>
| Unused
|}

===== New3DS System Mode =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| <code>0</code>
| <code>Legacy</code> (use Old3DS system mode)
|-
| <code>1</code>
| <code>Prod</code> (124MB of usable application memory)
|-
| <code>2</code>
| <code>Dev1</code> (178MB of usable application memory)
|-
| <code>3</code>
| <code>Dev2</code> Same as <code>Prod</code>?
|-
| <code>4-7</code>
| <code>Undefined</code> Same as <code>Prod</code>?
|}

When in <code>Legacy</code> mode, the actual memory layout is the same as in <code>New3DS Prod</code>, except the available application memory as reported to the application is reduced to the Old3DS size.

The exheader value for the New3DS system mode value must be ≤ to the <code>AccessDesc</code> value, otherwise the invalid-exheader error is returned.

==== Storage Info ====
Used in [[FSReg:Register]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>8</code>
| Extdata ID
|-
| <code>0x8</code>
| <code>8</code>
| System savedata IDs
|-
| <code>0x10</code>
| <code>8</code>
| Storage accessible unique IDs
|-
| <code>0x18</code>
| <code>7</code>
| Filesystem access info
|-
| <code>0x1F</code>
| <code>1</code>
| Other attributes
|}

File System Access Info:
{| class="wikitable" border="1"
|-
! Bit and bitmask
! Description
|-
| <code>0</code>, <code>0x1</code>
| Category system application
|-
| <code>1</code>, <code>0x2</code>
| Category hardware check
|-
| <code>2</code>, <code>0x4</code>
| Category filesystem tool
|-
| <code>3</code>, <code>0x8</code>
| Debug
|-
| <code>4</code>, <code>0x10</code>
| TWL card backup
|-
| <code>5</code>, <code>0x20</code>
| TWL NAND data
|-
| <code>6</code>, <code>0x40</code>
| BOSS
|-
| <code>7</code>, <code>0x80</code>
| [[FS:OpenArchive|<code>sdmc:/</code>]]
|-
| <code>8</code>, <code>0x100</code>
| Core
|-
| <code>9</code>, <code>0x200</code>
| [[Flash Filesystem|<code>nand:/ro/</code>]] (Read Only)
|-
| <code>10</code>, <code>0x400</code>
| [[Flash Filesystem|<code>nand:/rw/</code>]]
|-
| <code>11</code>, <code>0x800</code>
| [[Flash Filesystem|<code>nand:/ro/</code>]] (Write Access)
|-
| <code>12</code>, <code>0x1000</code>
| Category system settings
|-
| <code>13</code>, <code>0x2000</code>
| Cardboard
|-
| <code>14</code>, <code>0x4000</code>
| Export/Import IVS
|-
| <code>15</code>, <code>0x8000</code>
| [[FS:OpenArchive|<code>sdmc:/</code>]] (Write-only)
|-
| <code>16</code>, <code>0x10000</code>
| Switch cleanup (Introduced in [[3.0.0-5|3.0.0]]?)
|-
| <code>17</code>, <code>0x20000</code>
| Savedata move (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>18</code>, <code>0x40000</code>
| Shop (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>19</code>, <code>0x80000</code>
| Shell (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>20</code>, <code>0x100000</code>
| Category home menu (Introduced in [[6.0.0-11|6.0.0]])
|-
| <code>21</code>, <code>0x200000</code>
| Seed DB. Introduced in [[9.6.0-24|9.6.0-X]] [[FIRM]]. [[Home Menu]] has this bit set starting with [[9.6.0-24|9.6.0-X]].
|}

====Other Attributes====

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Not use ROMFS
|-
| <code>1</code>
| Use Extended savedata access.
|}

When Bit1 is set, the "Extdata ID" and "Storage Accessable Unique IDs" regions are used to store a total of 6 "Accessible Save IDs". Introduced in [[6.0.0-11|6.0.0]].

==== Service Access Control ====
This is the list of [[Services_API|services]] which the process is allowed to access, this is registered with the [[Services|services]] manager. Each service listed in the exheader must be listed in the <code>AccessDesc</code>, otherwise the invalid exheader error is returned. The order of the services for exheader/<code>AccessDesc</code> doesn't matter. The <code>AccessDesc</code> can list services which are not in the exheader, but normally the service-access-control data for exheader/<code>AccessDesc</code> are exactly the same.

This list is submitted to [[SRVPM:RegisterProcess]].

=== ARM11 Kernel Capabilities ===
The kernel capability descriptors are passed to [[SVC|svcCreateProcess]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x70</code> (<code>28*4</code>)
| Descriptors
|-
| <code>0x70</code>
| <code>0x10</code>
| Reserved
|}

There are different descriptor types, determined by the number of leading ones in the binary value representation of bits 20-31. The different types are laid out as follows:

{| class="wikitable" border="1"
|-
! Pattern of bits 20-31
! Type
! Fields
|-
| <code>0b1110xxxxxxxx</code>
| Interrupt info
|
|-
| <code>0b11110xxxxxxx</code>
| System call mask
| Bits 24-26: System call mask table index; Bits 0-23: mask
|-
| <code>0b1111110xxxxx</code>
| Kernel release version
| Bits 8-15: Major version; Bits 0-7: Minor version
|-
| <code>0b11111110xxxx</code>
| Handle table size
| Bits 0-18: size
|-
| <code>0b111111110xxx</code>
| [[#ARM11_Kernel_Flags|Kernel flags]]
| See below
|-
| <code>0b11111111100x</code>
| Mapping static address
|
|-
| <code>0b111111111110</code>
| Mapping IO address
| Bits 0-19: IO page index to map; Bit 20: Map read-only (otherwise read-write)
|}

==== ARM11 Kernel Flags ====
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Allow debug
|-
| <code>1</code>
| Force debug
|-
| <code>2</code>
| Allow non-alphanum
|-
| <code>3</code>
| Shared page writing
|-
| <code>4</code>
| Privilege priority
|-
| <code>5</code>
| Allow <code>main()</code> args
|-
| <code>6</code>
| Shared device memory
|-
| <code>7</code>
| Runnable on sleep
|-
| <code>8-11</code>
| Memory type (1: application, 2: system, 3: base)
|-
| <code>12</code>
| [[Memory_layout#NATIVE_FIRM.2FSAFE_MODE_FIRM_Userland_Memory|Special memory]]
|-
| <code>13</code>
| Process has access to CPU core 2 (New3DS only)
|}

=== ARM9 Access Control ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>15</code>
| Descriptors
|-
| <code>0xF</code>
| <code>1</code>
| ARM9 Descriptor Version. Originally this value had to be ≥ 2. Starting with [[9.3.0-21|9.3.0-X]] this value has to be either value 2 or value 3.
|}

Descriptors:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Mount [[Flash Filesystem|<code>nand:/</code>]]
|-
| <code>1</code>
| Mount [[Flash Filesystem|<code>nand:/ro/</code>]] (Write Access)
|-
| <code>2</code>
| Mount [[Flash Filesystem|<code>twln:/</code>]]
|-
| <code>3</code>
| Mount [[Flash Filesystem|<code>wnand:/</code>]]
|-
| <code>4</code>
| Mount card SPI
|-
| <code>5</code>
| Use SDIF3
|-
| <code>6</code>
| Create seed
|-
| <code>7</code>
| Use card SPI
|-
| <code>8</code>
| SD application (Not checked)
|-
| <code>9</code>
| Mount [[SD Filesystem|sdmc:/]] (Write Access)
|}

NCCH/Extended Header

2016-06-16T07:15:42Z

Jakcron:

This page documents the format of the '''NCCH Extended Header''', or '''exheader''' for short.

The exheader has two sections:

* The actual exheader data, containing System Control Info (SCI) and Access Control Info (ACI);
* A signed copy of NCCH HDR public key, and exheader ACI. This version of the ACI is used as limitation to the actual ACI.

== Main Structure ==
All values are little endian unless otherwise specified.

See also: [https://github.com/profi200/Project_CTR/blob/master/ctrtool/exheader.h]

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x200</code>
| SCI
|-
| <code>0x200</code>
| <code>0x200</code>
| ACI
|-
| <code>0x400</code>
| <code>0x100</code>
| <code>AccessDesc</code> signature (RSA-2048-SHA256)
|-
| <code>0x500</code>
| <code>0x100</code>
| NCCH HDR RSA-2048 public key
|-
| <code>0x600</code>
| <code>0x200</code>
| ACI (for limitation of first ACI)
|}

The <code>AccessDesc</code> signature covers the NCCH HDR public key and second ACI. The <code>AccessDesc</code> public key is initialised by the boot ROM.

When loading the exheader, [[FIRM|Process9]] compares the exheader data with the data in the <code>AccessDesc</code> (note that not everything is compared here). When these don't match, an error is returned. The Process9 code handling this validation was updated with [[6.0.0-11|v6.0]]; the only change in this function seems to be the check for the "Ideal processor" field.

== System Control Info ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| Application title
|-
| <code>0x8</code>
| <code>0x5</code>
| Reserved
|-
| <code>0xD</code>
| <code>0x1</code>
| Flag (bit 0: <code>CompressExefsCode</code>, bit 1: <code>SDApplication</code>)
|-
| <code>0xE</code>
| <code>0x2</code>
| Remaster version
|-
| <code>0x10</code>
| <code>0xC</code>
| Text code set info
|-
| <code>0x1C</code>
| <code>0x4</code>
| Stack size
|-
| <code>0x20</code>
| <code>0xC</code>
| Read-only code set info
|-
| <code>0x2C</code>
| <code>0x4</code>
| Reserved
|-
| <code>0x30</code>
| <code>0xC</code>
| Data code set info
|-
| <code>0x3C</code>
| <code>0x4</code>
| BSS size
|-
| <code>0x40</code>
| <code>0x180</code> (<code>48*8</code>)
| Dependency module (program ID) list
|-
| <code>0x1C0</code>
| <code>0x40</code>
| <code>SystemInfo</code>
|}

Most of these fields are used in [[LOADER:LoadProcess]].

=== Code Set Info ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>4</code>
| Address
|-
| <code>0x4</code>
| <code>4</code>
| Physical region size (in page-multiples)
|-
| <code>0x8</code>
| <code>4</code>
| Size (in bytes)
|}

=== System Info ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| <code>SaveData</code> Size
|-
| <code>0x8</code>
| <code>0x8</code>
| Jump ID
|-
| <code>0x10</code>
| <code>0x30</code>
| Reserved
|}

== Access Control Info ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x170</code>
| [[#ARM11 Local System Capabilities|ARM11 local system capabilities]]
|-
| <code>0x170</code>
| <code>0x80</code>
| [[#ARM11 Kernel Capabilities|ARM11 kernel capabilities]]
|-
| <code>0x1F0</code>
| <code>0x10</code>
| [[#ARM9 Access Control|ARM9 access control]]
|}

=== ARM11 Local System Capabilities ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| Program ID
|-
| <code>0x8</code>
| <code>0x4</code>
| Core version (The Title ID low of the required [[FIRM]])
|-
| <code>0xC</code>
| <code>0x2</code>
| [[#Flag1|Flag1]] and [[#Flag2|Flag2]] (both implemented starting from [[8.0.0-18]]).
|-
| <code>0xE</code>
| <code>0x1</code>
| [[#Flag0|Flag0]]
|-
| <code>0xF</code>
| <code>0x1</code>
| Priority
|-
| <code>0x10</code>
| <code>0x20</code> (<code>16*2</code>)
| Resource limit descriptors. The first byte here controls the maximum allowed [[PMApp:SetAppResourceLimit|<code>CpuTime</code>]].
|-
| <code>0x30</code>
| <code>0x20</code>
| [[#Storage Info|Storage info]]
|-
| <code>0x50</code>
| <code>0x100</code> (<code>32*8</code>)
| [[#Service Access Control|Service access control]]
|-
| <code>0x150</code>
| <code>0x10</code> (<code>2*8</code>)
| Extended service access control, support for this was implemented with [[9.3.0-21|9.3.0-X]].
|-
| <code>0x160</code>
| <code>0xF</code>
| Reserved
|-
| <code>0x16F</code>
| <code>0x1</code>
| Resource limit category. (0 = <code>APPLICATION</code>, 1 = <code>SYS_APPLET</code>, 2 = <code>LIB_APPLET</code>, 3 = <code>OTHER</code> (sysmodules running under the BASE memregion))
|}

==== Flag0 ====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| <code>0-1</code>
| Ideal processor
|-
| <code>2-3</code>
| Affinity mask
|-
| <code>4-7</code>
| System mode
|}

In the exheader data, the ideal processor field is a bit-index, while in the <code>AccessDesc</code> the ideal processor field is a bitmask. When the bit specified by the exheader field is not set in the <code>AccessDesc</code> field, an error is returned.

<pre>if((1 << exheaderval) & accessdescval == 0) return error</pre>

During a FIRM-launch when a <code>TitleInfo</code> structure was specified, the field at offset [[FIRM#FIRM_Launch_Parameters|0x400]] in the FIRM-launch parameters is set to the SystemMode of the specified title, however in some cases other values are written there. With [[8.0.0-18]] NS will now check the output of [[PTM|PTMSYSM]] command <code>0x040A0000</code>, when the output is non-zero and a certain NS state field is value-zero, the following is executed otherwise this is skipped. With that check passed on [[8.0.0-18]], NS will then check (<code>Flag2 & 0xF</code>). When that is <code>value2</code>, the output value (used for the FIRM-launcher parameter field mentioned above) is set to <code>value7</code>. Otherwise, when that value is non-zero, the output value is set to 6.

==== Flag1 ====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| <code>0</code>
| <code>EnableL2Cache</code> (Unknown what this actually does, New3DS-only presumably)
|-
| <code>1</code>
| <code>cpuspeed_804MHz</code> (Default "cpuspeed" when not set)
|-
| <code>2-7</code>
| Unused
|}

In order for the exheader to have any of the above new bits set, the <code>AccessDesc</code> must have the corresponding bit set, otherwise the invalid-exheader error is returned.

Homebrew which runs under a title which has the above <code>cpuspeed</code> flag set, runs much faster on New3DS. It's unknown how exactly the system handles these flags.

When launching titles / perhaps other things with [[APT]], [[NS]] uses [[PTMSYSM:ConfigureNew3DSCPU]] with data which originally came from these flags; NS does this regardless of what the running 3DS system is. However, due to a bug(?) in NS the value sent to that command is always either 0x0 or 0x3. When calculating that value, the code only ever uses the cpuspeed field, not the cache field: code to actually load and check the value of the cache field appears to be missing.

==== Flag2 ====
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0-3</code>
| ''Unknown''
|-
| <code>4-7</code>
| Unused
|}

The exheader value for the above 4-bit value must be ≤ to the <code>AccessDesc</code> value, otherwise the invalid-exheader error is returned.

==== Storage Info ====
Used in [[FSReg:Register]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>8</code>
| Extdata ID
|-
| <code>0x8</code>
| <code>8</code>
| System savedata IDs
|-
| <code>0x10</code>
| <code>8</code>
| Storage accessible unique IDs
|-
| <code>0x18</code>
| <code>7</code>
| Filesystem access info
|-
| <code>0x1F</code>
| <code>1</code>
| Other attributes
|}

File System Access Info:
{| class="wikitable" border="1"
|-
! Bit and bitmask
! Description
|-
| <code>0</code>, <code>0x1</code>
| Category system application
|-
| <code>1</code>, <code>0x2</code>
| Category hardware check
|-
| <code>2</code>, <code>0x4</code>
| Category filesystem tool
|-
| <code>3</code>, <code>0x8</code>
| Debug
|-
| <code>4</code>, <code>0x10</code>
| TWL card backup
|-
| <code>5</code>, <code>0x20</code>
| TWL NAND data
|-
| <code>6</code>, <code>0x40</code>
| BOSS
|-
| <code>7</code>, <code>0x80</code>
| [[FS:OpenArchive|<code>sdmc:/</code>]]
|-
| <code>8</code>, <code>0x100</code>
| Core
|-
| <code>9</code>, <code>0x200</code>
| [[Flash Filesystem|<code>nand:/ro/</code>]] (Read Only)
|-
| <code>10</code>, <code>0x400</code>
| [[Flash Filesystem|<code>nand:/rw/</code>]]
|-
| <code>11</code>, <code>0x800</code>
| [[Flash Filesystem|<code>nand:/ro/</code>]] (Write Access)
|-
| <code>12</code>, <code>0x1000</code>
| Category system settings
|-
| <code>13</code>, <code>0x2000</code>
| Cardboard
|-
| <code>14</code>, <code>0x4000</code>
| Export/Import IVS
|-
| <code>15</code>, <code>0x8000</code>
| [[FS:OpenArchive|<code>sdmc:/</code>]] (Write-only)
|-
| <code>16</code>, <code>0x10000</code>
| Switch cleanup (Introduced in [[3.0.0-5|3.0.0]]?)
|-
| <code>17</code>, <code>0x20000</code>
| Savedata move (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>18</code>, <code>0x40000</code>
| Shop (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>19</code>, <code>0x80000</code>
| Shell (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>20</code>, <code>0x100000</code>
| Category home menu (Introduced in [[6.0.0-11|6.0.0]])
|-
| <code>21</code>, <code>0x200000</code>
| Seed DB. Introduced in [[9.6.0-24|9.6.0-X]] [[FIRM]]. [[Home Menu]] has this bit set starting with [[9.6.0-24|9.6.0-X]].
|}

====Other Attributes====

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Not use ROMFS
|-
| <code>1</code>
| Use Extended savedata access.
|}

When Bit1 is set, the "Extdata ID" and "Storage Accessable Unique IDs" regions are used to store a total of 6 "Accessible Save IDs". Introduced in [[6.0.0-11|6.0.0]].

==== Service Access Control ====
This is the list of [[Services_API|services]] which the process is allowed to access, this is registered with the [[Services|services]] manager. Each service listed in the exheader must be listed in the <code>AccessDesc</code>, otherwise the invalid exheader error is returned. The order of the services for exheader/<code>AccessDesc</code> doesn't matter. The <code>AccessDesc</code> can list services which are not in the exheader, but normally the service-access-control data for exheader/<code>AccessDesc</code> are exactly the same.

This list is submitted to [[SRVPM:RegisterProcess]].

=== ARM11 Kernel Capabilities ===
The kernel capability descriptors are passed to [[SVC|svcCreateProcess]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x70</code> (<code>28*4</code>)
| Descriptors
|-
| <code>0x70</code>
| <code>0x10</code>
| Reserved
|}

There are different descriptor types, determined by the number of leading ones in the binary value representation of bits 20-31. The different types are laid out as follows:

{| class="wikitable" border="1"
|-
! Pattern of bits 20-31
! Type
! Fields
|-
| <code>0b1110xxxxxxxx</code>
| Interrupt info
|
|-
| <code>0b11110xxxxxxx</code>
| System call mask
| Bits 24-26: System call mask table index; Bits 0-23: mask
|-
| <code>0b1111110xxxxx</code>
| Kernel release version
| Bits 8-15: Major version; Bits 0-7: Minor version
|-
| <code>0b11111110xxxx</code>
| Handle table size
| Bits 0-18: size
|-
| <code>0b111111110xxx</code>
| [[#ARM11_Kernel_Flags|Kernel flags]]
| See below
|-
| <code>0b11111111100x</code>
| Mapping static address
|
|-
| <code>0b111111111110</code>
| Mapping IO address
| Bits 0-19: IO page index to map; Bit 20: Map read-only (otherwise read-write)
|}

==== ARM11 Kernel Flags ====
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Allow debug
|-
| <code>1</code>
| Force debug
|-
| <code>2</code>
| Allow non-alphanum
|-
| <code>3</code>
| Shared page writing
|-
| <code>4</code>
| Privilege priority
|-
| <code>5</code>
| Allow <code>main()</code> args
|-
| <code>6</code>
| Shared device memory
|-
| <code>7</code>
| Runnable on sleep
|-
| <code>8-11</code>
| Memory type (1: application, 2: system, 3: base)
|-
| <code>12</code>
| [[Memory_layout#NATIVE_FIRM.2FSAFE_MODE_FIRM_Userland_Memory|Special memory]]
|-
| <code>13</code>
| Process has access to CPU core 2 (New3DS only)
|}

=== ARM9 Access Control ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>15</code>
| Descriptors
|-
| <code>0xF</code>
| <code>1</code>
| ARM9 Descriptor Version. Originally this value had to be ≥ 2. Starting with [[9.3.0-21|9.3.0-X]] this value has to be either value 2 or value 3.
|}

Descriptors:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Mount [[Flash Filesystem|<code>nand:/</code>]]
|-
| <code>1</code>
| Mount [[Flash Filesystem|<code>nand:/ro/</code>]] (Write Access)
|-
| <code>2</code>
| Mount [[Flash Filesystem|<code>twln:/</code>]]
|-
| <code>3</code>
| Mount [[Flash Filesystem|<code>wnand:/</code>]]
|-
| <code>4</code>
| Mount card SPI
|-
| <code>5</code>
| Use SDIF3
|-
| <code>6</code>
| Create seed
|-
| <code>7</code>
| Use card SPI
|-
| <code>8</code>
| SD application (Not checked)
|-
| <code>9</code>
| Mount [[SD Filesystem|sdmc:/]] (Write Access)
|}

AES Registers

2016-01-30T19:19:51Z

Jakcron: Byte reads of the FIFOs confirm the endianness

== Registers ==
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! RW
|-
| style="background: green" | Yes
| [[#AES_CNT|AES_CNT]]
| 0x10009000
| 4
| RW
|-
| style="background: green" | Yes
| [[#AES_BLKCNT|AES_BLKCNT]]
| 0x10009004
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_WRFIFO]]
| 0x10009008
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_RDFIFO]]
| 0x1000900C
| 4
| R
|-
| style="background: green" | Yes
| AES_KEYSEL
| 0x10009010
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_KEYCNT|AES_KEYCNT]]
| 0x10009011
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_CTR|AES_CTR]]
| 0x10009020
| 16
| W
|-
| style="background: green" | Yes
| [[#AES_MAC|AES_MAC]]
| 0x10009030
| 16
| W
|-
| style="background: green" | Yes
| AES_KEY0
| 0x10009040
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY1
| 0x10009070
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY2
| 0x100090A0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY3
| 0x100090D0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEYFIFO
| 0x10009100
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYXFIFO
| 0x10009104
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYYFIFO
| 0x10009108
| 4
| W
|}

== AES_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write FIFO count (0-16)
|-
| 9-5
| Read FIFO count (0-16)
|-
| 10
| Flush write FIFO (1=Clear write FIFO)
|-
| 11
| Flush read fifo (1=Clear read FIFO)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
|? (MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Big endian, 0=Little endian)
|-
| 23
| Input endianness (1=Big endian, 0=Little endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
| 26
| Update keyslot (selects the keyslot specified by AES_KEYSEL when this bit is set)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=enable, 0=disable)
|-
| 31
| Start (1=enable/busy, 0=idle)
|}

When bit31 is set, this register essentially becomes locked and doesn't change when written to. However if bit26 is "set", keyslot-selection is cued to be handled when bit31 is cleared.

Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.

Read/Write FIFO counts and the MAC status can never be set by writing to AES_CNT, they are read-only.

Changing the input word order triggers the key/keyX/keyY FIFOs to be flushed.

== AES_BLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4 (i.e. the number of blocks to process)
|}

== AES_WRFIFO/AES_RDFIFO ==
Up to 128 bytes of input data can be buffered.

The input data for the AES crypto operation is written to AES_WRFIFO, the output data is read from AES_RDFIFO.

Reading from AES_RDFIFO when there's no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.

When triggering either RDFIFO or WRFIFO to be flushed, the AES Engine does not clear either buffer.

Word order and endianness can be changed between each read/write to these FIFOs. However changing the word order when writing to WRFIFO can cause the word to be written outside the current block, leaving uninitialized data in its place. Attempts to change endianness or word order are not honored when reading from RDFIFO when no more data is available.

== AES_KEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.

== AES_CTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.
The AES engine will automatically increment the counter up to the maximum BLKCNT, after which point it must be manually incremented and set again.

== AES_MAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== AES_KEY0/1/2/3 ==
{| class="wikitable" border="1"
! Byte
! Description
|-
| 0-15
| Normalkey
|-
| 16-31
| KeyX
|-
| 32-47
| KeyY
|-}

These registers are the same as they were on TWL, and are likely preserved for compatibility reasons. The keyslot is updated immediately after *any* data(u8/u32/...) is written here, which was used on DSi to [[3DS_System_Flaws|break]] the key-generator.

== Endianness and word order ==
When writing to the AES_CTR, AES_MAC or AES_KEY0/1/2/3 register, the hardware will process the written data according to the current input endianness specified in AES_CNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslot ranges ==
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.

{| class="wikitable" border="1"
! Keyslot
! Name
! KeyX
! KeyY/Normal-key
! Console unique.
|-
| 0x00-0x03
| TWL keys.
| Probably unset.
| Probably unset.
| -
|-
| 0x04-0x07
| NAND partition keys.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x08-0x0B
| See below.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x0C-0x0F
| SSL cert key.
| Same for all.
| Same for all.
| style="background: red" | No
|-
| 0x10-0x17
| -
| Not set.
| Not set.
| -
|-
| 0x18-0x1B
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x1C-0x1F
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x20-0x23
| Never used.
| Same for all.
| Same for all.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x24
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x25-0x27
| -
| Not set.
| Not set.
| -
|-
| 0x28-0x2B
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x2C-0x2F
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x30-0x33
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x34-0x37
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x38-0x3B
| Various uniques.
| Same for all.
| Different for all.
| style="background: red" | No
|-
| 0x3C-0x3F
| Various uniques.
| Individually set.
| Individually set.
| style="background: red" | No
|}

Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX's. This suggests they were set to same normal-key by bootrom.

== Keyslots ==
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key generator instead (see [[#Hardware_key_generator|below]]). There is no way to read the contents of a keyslot.

{| class="wikitable" border="1"
! Keyslot
! Description
! KeyX set by
! KeyY set by
! Normal-key
! Old3DS
|-
| 0x00-0x03
| TWL keys.
| NATIVE_FIRM hard-boot.
| NATIVE_FIRM hard-boot.
| -
| Yes
|-
| 0x04..0x07
| [[Flash_Filesystem|NAND]] partition keys.

Keyslot is determined by [[NCSD]] partition FS type and encryption type.
The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data. Its keyX is console-unique and set by the bootloader.
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x0A
| DSiWare export key.

Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0B
| This is console-unique. This keyslot is used for the NAND [[Title_Database|dbs]] images AESMACs, and the [[Nand/private/movable.sed]] AESMAC(when used).
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0D
| SSL-certificate key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| -
| -
| Bootrom.
| Yes
|-
| 0x11
| Temporary keyslot.

Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.
| Arm9Loader.
| Arm9Loader.
| NATIVE_FIRM.
| Yes
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Bootrom.
| NATIVE_FIRM boot.
| -
| Yes
|-
| 0x15
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x16
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x18..0x1F
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.6.0-24|9.6.0-X]] keyslots 0x1C..0x1F are not yet used by Process9.
| Arm9Loader.
| NATIVE_FIRM / see previous info for these keyslots.
| See previous info for these keyslots.
| No
|-
| 0x18
| New3DS [[9.3.0-21|9.3.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0A.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x19
| New3DS gamecard [[Savegames|savedata]] AES-MAC key.

Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1A
| New3DS gamecard [[Savegames|savedata]] actual key.

Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1B
| New3DS [[9.6.0-24|9.6.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0B.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x24
| AGB_FIRM savegame AES-MAC key.
| Bootrom.
| AGB/NATIVE_FIRM.
| -
| Yes
|-
| 0x25
| [[7.0.0-13|v7.0]] [[NCCH]] key, when ncchflag[3] is 0x01.
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2C
| Original [[NCCH|NCCH]] key, when ncchflag[3] is 0x00 and always for certain NCCH sections.
| Bootrom.
| Process9.
| -
| Yes
|-
| 0x2D
| UDS local-WLAN CCMP key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x2E
| Streetpass key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2F
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x30
| SD/NAND AES-MAC key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs under SD [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x31
| APT wrap key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x32
| Unknown.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x33
| Gamecard [[Savegames|savedata]] AES-MAC.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x34
| SD key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x35
| Movable.sed key.

This is the keyslot used for movable.sed encryption + AES-MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x36
| Unknown. Used by friends module.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x37
| Gamecard [[Savegames|savedata]] actual key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x38
| BOSS key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x39
| Download Play key, and the actual NFC key for generating retail [[Amiibo]] keys.

This keyslot is used for two different keys. Both are available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3A
| DSiWare export key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs for SD [[DSiWare_Exports]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3B
| [[CTRCARD_Registers#CTRCARD_SECSEED|CTR-CARD hardware-crypto seed]] decryption key.

AES-CCM is used, the keyY, nonce and MAC are stored in the [[NCSD#Card_Info_Header|Card Info Header]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3D
| Common key.

Used to decrypt title keys in [[Ticket]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|}

=== Updating keydata ===
The contents of the keyslot specified in AES_KEYCNT can be updated by consecutively writing four words to AES_KEYXFIFO (keyX), AES_KEYYFIFO(keyY), or AES_KEYFIFO (normalkey).

After writing to a keyslot, the keyslot must be selected again(write AES_KEYSEL + set AES_CNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

The TWL keyslots 0x00-0x03 can be set directly by writing to the AES_KEY0-AES_KEY3 registers.

The key FIFOs can be written simultaneously. For example, executing the following will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);

Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by AES_KEYCNT at the time the last word was written.

=== Hardware key generator ===
A dedicated hardware key generator can be used to generate a keyslot's normal-key from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots.

The algorithm for generating the normal-key from keyX and keyY is as follows, in big-endian 128-bit unsigned wraparound arithmetic:

{| class="wikitable" border="1"
! Mode
! Formula
|-
| 3DS
| NormalKey = (((KeyX ROL 2) XOR KeyY) + C1) ROR 41
|-
| DSi
| NormalKey = ((KeyX XOR KeyY) + C2) ROL 42
|}

Unless noted otherwise, all keyslots on retail units use the hardware key generator.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.

AES Registers

2016-01-30T18:32:58Z

Jakcron: Actually little endian.

== Registers ==
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! RW
|-
| style="background: green" | Yes
| [[#AES_CNT|AES_CNT]]
| 0x10009000
| 4
| RW
|-
| style="background: green" | Yes
| [[#AES_BLKCNT|AES_BLKCNT]]
| 0x10009004
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_WRFIFO]]
| 0x10009008
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_RDFIFO]]
| 0x1000900C
| 4
| R
|-
| style="background: green" | Yes
| AES_KEYSEL
| 0x10009010
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_KEYCNT|AES_KEYCNT]]
| 0x10009011
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_CTR|AES_CTR]]
| 0x10009020
| 16
| W
|-
| style="background: green" | Yes
| [[#AES_MAC|AES_MAC]]
| 0x10009030
| 16
| W
|-
| style="background: green" | Yes
| AES_KEY0
| 0x10009040
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY1
| 0x10009070
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY2
| 0x100090A0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY3
| 0x100090D0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEYFIFO
| 0x10009100
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYXFIFO
| 0x10009104
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYYFIFO
| 0x10009108
| 4
| W
|}

== AES_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write FIFO count (0-16)
|-
| 9-5
| Read FIFO count (0-16)
|-
| 10
| Flush write FIFO (1=Clear write FIFO)
|-
| 11
| Flush read fifo (1=Clear read FIFO)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
|? (MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Little endian, 0=Big endian)
|-
| 23
| Input endianness (1=Little endian, 0=Big endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
| 26
| Update keyslot (selects the keyslot specified by AES_KEYSEL when this bit is set)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=enable, 0=disable)
|-
| 31
| Start (1=enable/busy, 0=idle)
|}

When bit31 is set, this register essentially becomes locked and doesn't change when written to. However if bit26 is "set", keyslot-selection is cued to be handled when bit31 is cleared.

Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.

Read/Write FIFO counts and the MAC status can never be set by writing to AES_CNT, they are read-only.

Changing the input word order triggers the key/keyX/keyY FIFOs to be flushed.

== AES_BLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4 (i.e. the number of blocks to process)
|}

== AES_WRFIFO/AES_RDFIFO ==
Up to 128 bytes of input data can be buffered.

The input data for the AES crypto operation is written to AES_WRFIFO, the output data is read from AES_RDFIFO.

Reading from AES_RDFIFO when there's no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.

When triggering either RDFIFO or WRFIFO to be flushed, the AES Engine does not clear either buffer.

Word order and endianness can be changed between each read/write to these FIFOs. However changing the word order when writing to WRFIFO can cause the word to be written outside the current block, leaving uninitialized data in its place. Attempts to change endianness or word order are not honored when reading from RDFIFO when no more data is available.

== AES_KEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.

== AES_CTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.
The AES engine will automatically increment the counter up to the maximum BLKCNT, after which point it must be manually incremented and set again.

== AES_MAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== AES_KEY0/1/2/3 ==
{| class="wikitable" border="1"
! Byte
! Description
|-
| 0-15
| Normalkey
|-
| 16-31
| KeyX
|-
| 32-47
| KeyY
|-}

These registers are the same as they were on TWL, and are likely preserved for compatibility reasons. The keyslot is updated immediately after *any* data(u8/u32/...) is written here, which was used on DSi to [[3DS_System_Flaws|break]] the key-generator.

== Endianness and word order ==
When writing to the AES_CTR, AES_MAC or AES_KEY0/1/2/3 register, the hardware will process the written data according to the current input endianness specified in AES_CNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslot ranges ==
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.

{| class="wikitable" border="1"
! Keyslot
! Name
! KeyX
! KeyY/Normal-key
! Console unique.
|-
| 0x00-0x03
| TWL keys.
| Probably unset.
| Probably unset.
| -
|-
| 0x04-0x07
| NAND partition keys.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x08-0x0B
| See below.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x0C-0x0F
| SSL cert key.
| Same for all.
| Same for all.
| style="background: red" | No
|-
| 0x10-0x17
| -
| Not set.
| Not set.
| -
|-
| 0x18-0x1B
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x1C-0x1F
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x20-0x23
| Never used.
| Same for all.
| Same for all.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x24
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x25-0x27
| -
| Not set.
| Not set.
| -
|-
| 0x28-0x2B
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x2C-0x2F
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x30-0x33
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x34-0x37
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x38-0x3B
| Various uniques.
| Same for all.
| Different for all.
| style="background: red" | No
|-
| 0x3C-0x3F
| Various uniques.
| Individually set.
| Individually set.
| style="background: red" | No
|}

Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX's. This suggests they were set to same normal-key by bootrom.

== Keyslots ==
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key generator instead (see [[#Hardware_key_generator|below]]). There is no way to read the contents of a keyslot.

{| class="wikitable" border="1"
! Keyslot
! Description
! KeyX set by
! KeyY set by
! Normal-key
! Old3DS
|-
| 0x00-0x03
| TWL keys.
| NATIVE_FIRM hard-boot.
| NATIVE_FIRM hard-boot.
| -
| Yes
|-
| 0x04..0x07
| [[Flash_Filesystem|NAND]] partition keys.

Keyslot is determined by [[NCSD]] partition FS type and encryption type.
The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data. Its keyX is console-unique and set by the bootloader.
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x0A
| DSiWare export key.

Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0B
| This is console-unique. This keyslot is used for the NAND [[Title_Database|dbs]] images AESMACs, and the [[Nand/private/movable.sed]] AESMAC(when used).
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0D
| SSL-certificate key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| -
| -
| Bootrom.
| Yes
|-
| 0x11
| Temporary keyslot.

Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.
| Arm9Loader.
| Arm9Loader.
| NATIVE_FIRM.
| Yes
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Bootrom.
| NATIVE_FIRM boot.
| -
| Yes
|-
| 0x15
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x16
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x18..0x1F
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.6.0-24|9.6.0-X]] keyslots 0x1C..0x1F are not yet used by Process9.
| Arm9Loader.
| NATIVE_FIRM / see previous info for these keyslots.
| See previous info for these keyslots.
| No
|-
| 0x18
| New3DS [[9.3.0-21|9.3.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0A.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x19
| New3DS gamecard [[Savegames|savedata]] AES-MAC key.

Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1A
| New3DS gamecard [[Savegames|savedata]] actual key.

Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1B
| New3DS [[9.6.0-24|9.6.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0B.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x24
| AGB_FIRM savegame AES-MAC key.
| Bootrom.
| AGB/NATIVE_FIRM.
| -
| Yes
|-
| 0x25
| [[7.0.0-13|v7.0]] [[NCCH]] key, when ncchflag[3] is 0x01.
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2C
| Original [[NCCH|NCCH]] key, when ncchflag[3] is 0x00 and always for certain NCCH sections.
| Bootrom.
| Process9.
| -
| Yes
|-
| 0x2D
| UDS local-WLAN CCMP key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x2E
| Streetpass key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2F
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x30
| SD/NAND AES-MAC key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs under SD [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x31
| APT wrap key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x32
| Unknown.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x33
| Gamecard [[Savegames|savedata]] AES-MAC.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x34
| SD key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x35
| Movable.sed key.

This is the keyslot used for movable.sed encryption + AES-MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x36
| Unknown. Used by friends module.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x37
| Gamecard [[Savegames|savedata]] actual key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x38
| BOSS key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x39
| Download Play key, and the actual NFC key for generating retail [[Amiibo]] keys.

This keyslot is used for two different keys. Both are available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3A
| DSiWare export key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs for SD [[DSiWare_Exports]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3B
| [[CTRCARD_Registers#CTRCARD_SECSEED|CTR-CARD hardware-crypto seed]] decryption key.

AES-CCM is used, the keyY, nonce and MAC are stored in the [[NCSD#Card_Info_Header|Card Info Header]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3D
| Common key.

Used to decrypt title keys in [[Ticket]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|}

=== Updating keydata ===
The contents of the keyslot specified in AES_KEYCNT can be updated by consecutively writing four words to AES_KEYXFIFO (keyX), AES_KEYYFIFO(keyY), or AES_KEYFIFO (normalkey).

After writing to a keyslot, the keyslot must be selected again(write AES_KEYSEL + set AES_CNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

The TWL keyslots 0x00-0x03 can be set directly by writing to the AES_KEY0-AES_KEY3 registers.

The key FIFOs can be written simultaneously. For example, executing the following will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);

Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by AES_KEYCNT at the time the last word was written.

=== Hardware key generator ===
A dedicated hardware key generator can be used to generate a keyslot's normal-key from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots.

The algorithm for generating the normal-key from keyX and keyY is as follows, in big-endian 128-bit unsigned wraparound arithmetic:

{| class="wikitable" border="1"
! Mode
! Formula
|-
| 3DS
| NormalKey = (((KeyX ROL 2) XOR KeyY) + C1) ROR 41
|-
| DSi
| NormalKey = ((KeyX XOR KeyY) + C2) ROL 42
|}

Unless noted otherwise, all keyslots on retail units use the hardware key generator.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.

AES Registers

2016-01-30T18:28:45Z

Jakcron:

Makerom

2016-01-23T11:50:15Z

Jakcron: link downloads to github release page, no longer has romfs issues

{{Infobox homebrew
| title = makerom
| type = pc utility
| author = [[User:3dsguy|3dsguy]]
| download = https://github.com/profi200/Project_CTR/releases
| source = https://github.com/profi200/Project_CTR/tree/master/makerom
| version = 0.15
}}

makerom is a tool which can be used to create [[NCCH]], [[NCSD|CCI]], and [[CIA]] files.

== Format Overviews ==
=== NCCH ===
The native format storing code binaries and data archives for the 3DS is [[NCCH]]. [[NCCH]] files are comprised of:
* code/exheader/plainregion (used for code execution) (plainregion just lists included SDK library add-ons)
* icon (app title text, icon, homemenu settings, see [[SMDH|here]]
* banner (cbmd + cwav, i.e. the upper screen banner/sound shown on the homemenu)
* logo (the splash screen displayed after an application is launched from the homemenu)
* romfs (read-only filesystem used to store resources)

Typical uses for NCCH files include:
* Executable image (code+exheader+icon+banner+logo+romfs)
* e-Manual archive (accessed from homemenu) (romfs)
* [[Download Play|DLP]] child CIA archive (accessed from application) (romfs)
* Update Data archive (romfs)
* Standalone data archive (romfs)
* DLC index archive (icon+romfs)
* DLC archive (romfs)

=== CCI ===
The native format for gamecard images is [[NCSD|CCI]] and is a NCCH container format. CCI files are limited to containing 8 NCCH files, and can contain NCCH files for applications titles only.
==== NCCH configuration for CCI ====
{| class="wikitable"
|-
! NCCH
! Required
! Index
|-
| Executable image
| YES
| 0
|-
| e-Manual archive
| NO
| 1
|-
| DLP child CIA archive
| NO
| 2
|-
| Update Data archive
| NO
| 7
|}

=== CIA ===
The native format for packaging NCCH files for install is [[CIA]], which is also a NCCH container format. CIA files are limited to containing 65535 NCCH files and can be used to contain NCCH files for any title type. CIA files also contain '''signed''' data used by the 3DS for general title management and DRM. Installing custom CIA files on a 3DS which also uses eShop/SysUpdates is unwise as conflicts will likely occur.

==== NCCH configurations for CIA ====
Applications (Application/DlpChild/Demo/Patch/SystemApplication):
{| class="wikitable"
|-
! NCCH
! Required
! Index
|-
| Executable image
| YES
| 0
|-
| e-Manual archive
| NO
| 1
|-
| DLP child CIA archive
| NO
| 2
|}

System Applet/Module:
{| class="wikitable"
|-
! NCCH
! Required
! Index
|-
| Executable image
| YES
| 0
|}

System Data Archives:
{| class="wikitable"
|-
! NCCH
! Required
! Index
|-
| Data archive
| YES
| 0
|}

DLC:

The number of DLC data archives in DLC varies for each DLC.
{| class="wikitable"
|-
! NCCH
! Required
! Index
|-
| DLC index archive
| YES
| 0
|-
| DLC data archive
| YES
| Varies
|}

== Using Makerom ==

=== Command line ===

makerom [general args] [rsf args] [crypto args] [ncch 0 build args] [cci args] [cia args]

'''General Arguments'''
{| class="wikitable"
|-
! Argument
! Acceptable values
! Notes
|-
| -f <format>
| 'ncch'/'cxi'/'cfa'/'cci'/'cia'
| Specify the output file format. 'ncch'/'cxi'/'cfa' has no affect, probably parsed without error for legacy support.
|-
| -o <path>
| Valid file path.
| Specify name/path for output file. Makerom will decided a name if this is not specified.
|-
| -v
| not required
| Enables verbose output.
|}

'''RSF Arguments'''
{| class="wikitable"
|-
! Argument
! Acceptable values
! Notes
|-
| -rsf <path>
| Valid file path
| Specify the path to Rom Specification File(RSF). See below for creating RSF.
|-
| -D<NAME>=<VALUE>
|
| This is used to substitute where "$(<NAME>)" exists in the RSF files with "<VALUE>". (Uppercase isn't a requirement)
|}

'''Crypto Arguments'''
{| class="wikitable"
|-
! Argument
! Acceptable values
! Notes
|-
| -target <target>
| 't'/'d'/'p'
| Specify key-chain. This affects encryption, signing and '-desc' template availability. t=test, suitable for homebrew. d=devkit(incomplete), suitable for devkits. p=retail(unusable), suitable for signing retail software?
|-
| -ckeyid <index>
| Any value between 0-255 (inclusive).
| Overrides the default common key used to encrypt CIA title keys.
|-
| -showkeys
| none
| Dumps loaded key-chain to stdout.
|}

'''NCCH Build Arguments'''
{| class="wikitable"
|-
! Argument
! Acceptable values
! Notes
|-
| -elf <file>
| Valid file path
| Specify ELF. See below for creating ELF.
|-
| -icon <file>
| Valid file path
| Specify [[SMDH|icon]].
|-
| -banner <file>
| Valid file path
| Specify banner.
|-
| -desc <apptype>:<fw>
| <apptype>='app'/'ecapp'/'demo'/'dlpchild'. <fw>='kernel version minor'.
| Use a template for [[Exheader|exheader/accessdesc]]. These are hard-coded, so not all firmwares have a template. A value from 1-7 can be used in place of 'kernel version minor'. A template shouldn't be used if the title needs "special" permissions, the RSF must be configured fully.
|-
| -exefslogo
| none
| Include logo in ExeFS. Required for usage on <5.0 systems.
|}

Arguments useful for rebuilding a NCCH file:
{| class="wikitable"
|-
! Argument
! Acceptable values
! Notes
|-
| -code <file>
| Valid file path
| Specify decompressed/plaintext exefs code binary.
|-
| -exheader <file>
| Valid file path
| Specify plaintext exheader binary.
|-
| -logo <file>
| Valid file path
| Specify logo.
|-
| -plainrgn <file>
| Valid file path
| Specify NCCH plain-region.
|-
| -romfs <file>
| Valid file path
| Specify an unencrypted RomFS binary.
|}

'''CCI Arguments'''
{| class="wikitable"
|-
! Argument
! Acceptable values
! Notes
|-
| -content <path>:<index>
| <path>=Valid file path. <index>=Any value between 0-7 (inclusive)
| Include a built NCCH file in the CCI container. "-i" can be used instead of "-content".
|-
| -devcci
| none
| Build a debug CCI?
|-
| -nomodtid
| none
| Don't modify the TitleIds of NCCH files included to match NCCH0
|-
| -alignwr
| none
| Align the offset for the Card2 writable region to the end of the last NCCH in the CCI.
|}

'''CIA Arguments'''
{| class="wikitable"
|-
! Argument
! Acceptable values
! Notes
|-
| -content <path>:<index>:<id>
| <path>=Valid file path. <index>=Any value between 0x0-0xFFFF (inclusive). <id>=Any value between 0x0-0xFFFFFFFF (inclusive)
| Include a built NCCH file in the CIA container. If <id> isn't specified, it will be generated randomly. "-i" can be used instead of "-content".
|-
| -major <version>
| Any value between 0-63 (inclusive)
| Specify the version major for the title. This cannot be used with "-dver".
|-
| -minor <version>
| Any value between 0-63 (inclusive)
| Specify the version minor for the title. This cannot be used with "-dver".
|-
| -micro <version>
| Any value between 0-15 (inclusive)
| Specify the version micro for the title.
|-
| -dver <version>
| Any value between 0-4095 (inclusive)
| Specify the data-title version for the title. This cannot be used with "-major" or "-minor".
|-
| -dlc
| none
| Specify this flag when building a DLC CIA.
|-
| -rand
| none
| Use a random title key to encrypt CIA content.
|}

==== Examples ====

General examples:

'''Create CXI'''
makerom -o sample.cxi -rsf sample.rsf -target t -elf sample.elf -icon sample.icn -banner sample.bnr -desc app:4

'''Create CFA'''
makerom -o sample.cfa -rsf sample.rsf -target t

'''Create CCI'''
makerom -f cci -o sample.cci -target t -i sample.cxi:0 -i sample.cfa:1

'''Create CIA'''
makerom -f cia -o sample.cia -target t -i sample.cxi:0:0 -i sample.cfa:1:1

Makerom supports building a NCCH file and including it automatically (as index 0) into a NCCH container:

'''Create CCI and CXI at the same time and include a CFA'''
makerom -f cci -o sample.cci -rsf sample.rsf -target t -elf sample.elf -icon sample.icn -banner sample.bnr -desc app:4 -i sample.cfa:1

'''Create CIA and CXI at the same time and include a CFA'''
makerom -f cia -o sample.cia -rsf sample.rsf -target t -elf sample.elf -icon sample.icn -banner sample.bnr -desc app:4 -i sample.cfa:1:1

Rebuilding CXI:
makerom -o rebuild.cxi -rsf rebuild.rsf -target t -code rebuild/code.bin -exheader rebuild/exheader.bin -icon rebuild/icon.bin -banner rebuild/banner.bin -romfs rebuild/romfs.bin

=== Creating RSF files ===
Inspired by Nintendo's format for their makerom, a yaml configuration file is required for creating NCCH files. CIA/CCI can be created without using a RSF file, but default settings will be used.

For CXI, RSF files can be used to specify permissions, and access control settings. Makerom can use default settings by use of the "-desc" option, which removes the requirement for specifying them in the RSF file.

Sample RSF to be used with "-desc": [https://gist.githubusercontent.com/3DSGuy/83e12e0ae3dcccb9827f/raw/sample0.rsf download] (link broken)

Sample RSF to be used without "-desc": [https://gist.githubusercontent.com/3DSGuy/83e12e0ae3dcccb9827f/raw/sample1.rsf download] (link broken)

=== Creating ELF files ===
The latest devkitARM used in conjunction with [https://github.com/smealum/ctrulib ctrulib] can create ELF files compatible with makerom.

ELF files that are created using the official SDK are also supported by makerom.

== Compiling Source ==
For Windows a MinGW-W64/MSYS build setup is required.

For Linux, gcc/g++/make must be installed.

All additional libraries used by makerom (polarssl/libyaml) are included in the source, and are linked statically.

Title list

2016-01-21T03:59:44Z

Jakcron: /* 00040030 - Applets */ added CHN/KOR/TWN applet ids

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ here]. When using SSL, the update/shop servers must be accessed via SSLv3.

The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.

Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.

The 3DS retrieves system [[CommonETicket|tickets]] with SOAP request GetSystemCommonETicket, instead of directly downloading the cetk with HTTPS. The cetk is still accessible via HTTP, however 3DS doesn't use direct HTTP for this.

'''TitleID Structure''': 0xCCCCABCDLLLLLLRR

* CCCC defines the console '''Platform''' (5=WiiU, 4=3DS, 3=DSi, 1=[http://wiibrew.org/wiki/Title_database Wii])
* ABCD defines the '''Content Category''' of the title, Demo, DLPChild, etc.
* LLLLLL For CTR titles, this is the title's '''Unique ID'''. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.
* RR This is the Title ID '''Variation''', and has various uses.

'''Content Categories''':

This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.

Specific Bitmask Flags:
{| class="wikitable" border="1"
|-
! Category
! Bitmask
|-
| Normal
| 0x0
|-
| DlpChild
| 0x1
|-
| Demo
| 0x2
|-
| Contents
| 0x3
|-
| AddOnContents
| 0x4
|-
| Patch
| 0x6
|-
| CannotExecution
| 0x8
|-
| System
| 0x10
|-
| RequireBatchUpdate
| 0x20
|-
| NotRequireUserApproval
| 0x40
|-
| NotRequireRightForMount
| 0x80
|-
| CanSkipConvertJumpId
| 0x100
|-
| TWL
| 0x8000
|}

* TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.

* System titles (TWL and CTR) are eligible to be updated during a System Update.

* Bit Mask 0x4000 appears to be reserved, as it renders the ''TWL'' and ''System'' bit masks useless.

'''Unique ID Restrictions''':

For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes.

{| class="wikitable" border="1"
|-
! TITLE TYPE
! UNIQUE ID RANGE
|-
| System
| 0x0 - 0x2FF
|-
| Application
| 0x300 - 0xF7FFF
|-
| Evaluation
| 0xF8000 -0xFFFFF
|-
| Prototype*
| 0xFF000 - 0xFF3FF
|}
<nowiki>*</nowiki>On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.

ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on [[New_3DS]](that is, programID-low 0x20000000 / uniqueID 0x200000).

'''TitleID Variation''':

This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:

* CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:
{| class="wikitable" border="1"
|-
! RR
! MEANING
|-
| 02
| System Title (Core version 0x2)
|-
| 03
| SAFE_MODE System Title (Core version 0x3)
|}
Normally on retail SAFE_MODE ARM11 [[NCCH#CXI|CXI]] titles can't be launched, since the [[Configuration_Memory|system]] core version doesn't match the CXI exheader core version.

* Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.

* [[3DS Development Unit Software|Dev Menu]] installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.

* Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:

=== Versions ===

v## = 0xHHHH = 0bBBBBBBBB...

* The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary
* 6 bits : Major
* 6 bits : Minor
* 4 bits : Micro ('Build' in some contexts)
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [http://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| [[Health and Safety Information]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| N/A
| N/A
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| N/A
| N/A
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
| 00008102
| 00008102
| 00008102
| 00008102
| 00008102
| 00008102
| [[NS#Alternate menu|Alternate menu]]
| N/A
|-
| 00008202
| 00008F02
| 00009802
| 0000a102
| 0000a902
| 0000b102
| [[Home Menu|Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]], [[10.3.0-28|v25600]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]], [[10.3.0-28|v23552]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]], [[10.3.0-28|v22528]]
|-
| 00008402
| 00009002
| 00009902
| 0000A202
| 0000AA02
| 0000B202
| Camera applet used by Home-menu (CtrApp)
| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008502
| 00009102
| 00009A02
| ?
| ?
| ?
| Not available on CDN
| ?
|
|
|-
| 00008602
| 00009202
| 00009B02
| 0000A402
| 0000AC02
| 0000B402
| Instruction Manual, applet for displaying instruction manuals
| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
|-
| 00008702
| 00009302
| 00009C02
| 0000A502
| 0000AD02
| 0000B502
| Game Notes (Cherry)
| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008802
| 00009402
| 00009D02
| 0000A602
| 0000AE02
| 0000B602
| [[Internet Browser]] (spider)
| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]]
| Same as JPN
| Same as JPN
|-
| 20008802
| 20009402
| 20009D02
| ?
| 2000AE02
| N/A
| [[New_3DS]] [[Internet Browser]] (SKATER)
| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]]
| Same as JPN
| Same as JPN
|-
| 00008A02
| 00008A02
| 00008A02
| 00008A02
| 00008A02
| 00008A02
| [[ErrDisp]]
| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008A03
| 00008A03
| 00008A03
| 00008A03
| 00008A03
| 00008A03
| SAFE_MODE [[ErrDisp]]
| v0
| Same as JPN
| Same as JPN
|-
| 20008A03
| 20008A03
| 20008A03
| ?
| 20008A03
| N/A
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
| [[8.1.0-0_New3DS|v7169]]
| Same as JPN
| Same as JPN
|-
| 00008D02
| 00009602
| 00009F02
| 0000A702
| 0000AE02
| 0000B702
| Friend List (friend)
| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
| Same as JPN
| Same as JPN
|-
| 00008E02
| 00009702
| 0000A002
| 0000A802
| 0000B002
| 0000B802
| Notifications (newslist)
| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
| Same as JPN
| Same as JPN
|-
| 0000C002
| 0000C802
| 0000D002
| 0000D802
| 0000DE02
| 0000E402
| Software Keyboard (swkbd)
| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C003
| 0000C803
| 0000D003
| 0000D803
| 0000DE03
| 0000E403
| SAFE_MODE Software Keyboard (swkbd)
| v0
| Same as JPN
| Same as JPN
|-
| 2000C003
| 2000C803
| 2000D003
| ?
| 2000DE03
| N/A
| [[New_3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v0]](for JPN this is v1024)
| Same as JPN
| Same as JPN
|-
| 0000C102
| 0000C902
| 0000D102
| 0000D902
| 0000DF02
| 0000E502
| appletEd (MiiSelector)
| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
| Same as JPN
| Same as JPN
|-
| 0000C302
| 0000CB02
| 0000D302
| 0000DB02
| 0000E102
| 0000E702
| PNOTE_AP (Photo file selector applet, for SD-card/etc?)
| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000C402
| 0000CC02
| 0000D402
| 0000DC02
| 0000E202
| 0000E802
| SNOTE_AP (Sound file selector applet, for SD-card/etc?)
| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C502
| 0000C502
| 0000C502
| 0000CF02
| 0000CF02
| 0000CF02
| error (This applet displays networking errors, etc)
| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
| Same as JPN
| Same as JPN
|-
| 0000C503
| 0000C503
| 0000C503
| 0000CF03
| 0000CF03
| 0000CF03
| SAFE_MODE error applet
| v0
| Same as JPN
| Same as JPN
|-
| 2000C503
| 2000C503
| 2000C503
| ?
| 2000CF03
| N/A
| [[New_3DS]] SAFE_MODE error applet
| [[8.1.0-0_New3DS|v1024]]
| Same as JPN
| Same as JPN
|-
| 0000CD02
| 0000CD02
| 0000CD02
| 0000D502
| 0000D502
| 0000D502
| extrapad ([[Circle Pad Pro]] calibration applet)
| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
| Same as JPN
| Same as JPN
|-
| 0000C602
| 0000CE02
| 0000D602
| N/A
| 0000E302
| 0000E902
| mint. eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself.
| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]], [[10.3.0-28|v14337]]
| Same as JPN
| Same as JPN
|-
| 0000BC02
| 0000BD02
| 0000BE02
| ?
| ?
| ?
| olv (Miiverse applet)
| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000F602
| 0000F602
| 0000F602
| ?
| ?
| ?
| memolib (Uses Miiverse, likely the "system library" for Miiverse)
| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
|-
| 00008302
| 00008B02
| 0000BA02
| ?
| ?
| ?
| solv3 (Miiverse-posting applet)
| [[9.0.0-20|v6]]
| Same as JPN
| Same as JPN
|-
| 00009502
| 00009E02
| 0000B902
| ?
| ?
| ?
| Cabinet ([[amiibo Settings]])
| [[9.3.0-21|v7]], [[9.6.0-24|v1031]]
| Same as JPN
| Same as JPN
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
| Doesn't exist on CDN?
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010502
| 00010502
| 00010502
| Doesn't exist on CDN?
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| 00011402
| ?
| ?
| v0
|-
| ?
| 00011602
| ?
| ?
| v0
|-
| ?
| 00011D02
| ?
| ?
| v0
|-
| ?
| 00011E02
| ?
| ?
| v0
|-
| ?
| ?
| 00011202
| ?
| v0
|-
| ?
| ?
| 00011302
| ?
| v0
|-
| ?
| ?
| 00011502
| ?
| v0
|-
| ?
| ?
| 00011702
| ?
| v0
|-
| ?
| ?
| 00011802
| ?
| v0
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| ?
| 00011B02
| ?
| v0
|-
| ?
| ?
| 00011C02
| ?
| v0
|-
| ?
| ?
| 00011D02
| ?
| v0
|-
| ?
| ?
| 00012102
| ?
| v0, v1026, v2051, v3074
|-
| 00012202
| 00012302
| 00012102
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]]
|-
| 00013202
| 00013302
| 00013102
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]]
|-
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| Mounted as "rate:"
| v0 (EUR: v0, v1024)
|-
| ?
| 00016302
| ?
| ?
| v80
|-
| ?
| 00017302
| ?
| ?
| v3088
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]], [[10.3.0-28|v10288]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]]
| Same as CHN
| Same as CHN
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003000
| [[FIRM|Process9]] (in SAFE_MODE and normal NATIVE_FIRM)
| N/A
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]])
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| "debugger". This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== TWL System Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|}
Bitmask 0x1 for TWL titles determines whether the title will be updated during a System Update.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DSi-mode application launched by [[System Settings]] for setting TWL wifi configuration.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== TWL Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|}

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

3DS System Flaws

2016-01-20T08:56:23Z

Jakcron: Nintendo leaked a keyY normal-key pair before 3ds was even released :P

Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of publicly known system flaws, for userland applications/applets flaws see [[3DS_Userland_Flaws|here]].

=Stale / Rejected Efforts=
* Neimod has been working on a RAM dumping setup for a little while now. He's de-soldered the 3DS's RAM chip and hooked it and the RAM pinouts on the 3DS' PCB up to a custom RAM dumping setup. A while ago he published photos showing his setup to be working quite well, with the 3DS successfully booting up. However, his flickr stream is now private along with most of his work.

* Someone (who will remain unnamed) has released CFW and CIA installers, all of which is copied from the work of others, or copyrighted material.

==Tips and info==
The 3DS uses the XN feature of the ARM11 processor. There's no official way from applications to enable executable permission for memory containing arbitrary unsigned code(there's a [[SVC]] for this, but only [[RO_Services|RO-module]] has access to it). An usable userland exploit would still be useful: you could only do return-oriented-programming with it initially. From ROP one could then exploit system flaw(s), see below.

SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped(accessing SD data is far easier by running code on the target 3DS however).

=System flaws=
== Hardware ==
{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| ARM9/ARM11 bootrom vectors point at unitialized RAM
| ARM9's and ARM11's exception vectors are hardcoded to point at the CPU's internal memory (0x08000000 region for ARM9, AXIWRAM for ARM11). While the bootrom does set them up to point to an endless loop at some point during boot, it does not do so immediately. As such, a carefully-timed fault injection (via hardware) to trigger an exception (such as an invalid instruction) will cause execution to fall into ARM9 RAM.
Since RAM isn't cleared on boot (see below), one can immediately start execution of their own code here to dump bootrom, OTP, etc.
The ARM9 bootrom does the following at reset: reset vector branches to another instruction, then branches to bootrom+0x8000. Hence, there's no way to know for certain when exactly the ARM9 exception-vector data stored in memory gets initialized.

This requires *very* *precise* timing for triggering the hardware fault: it's unknown if anyone actually exploited this successfully at the time of writing(the one who attempted+discovered it *originally* as listed in this wiki section hasn't).
| None: all available 3DS models at the time of writing have the exact same ARM9/ARM11 bootrom for the unprotected areas.
| New3DS
| End of February 2014
| [[User:Derrek|derrek]], WulfyStylez (May 2015) independently
|-
| Missing AES key clearing
| The hardware AES engine does not clear keys when doing a hard reset/reboot.
| None
| New3DS
| August 2014
| Mathieulh/Others
|-
| No RAM clearing on reboots
| On an MCU-triggered reboot all RAM including FCRAM/ARM9 memory/AXIWRAM/VRAM keeps its contents.
| None
| New3DS
| March 2014
| [[User:Derrek|derrek]]
|-
| 32bits of actual console-unique TWLNAND keydata
| On retail the 8-bytes at ARM9 address [[Memory_layout|0x01FFB808]] are XORed with hard-coded data, to generate the TWL console-unique keys, including TWLNAND. On Old3DS the high u32 is always 0x0, while on New3DS that u32 is always 0x2. On top of this, the lower u32's highest bit is always ORed. only 31 bits of the TWL console-unique keydata / TWL consoleID are actually console-unique.
This allows one to easily bruteforce the TWL console-unique keydata with *just* data from TWLNAND. On DSi the actual console-unique data for key generation is 8-bytes(all bytes actually set).
| None
| New3DS
| 2012?
| [[User:Yellows8|Yellows8]]
|-
| DSi / 3DS-TWL key-generator
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the TWL key-generator function.
This applies to the keyX/keyY too.

This attack does not work for the 3DS key-generator because keyslots 0-3 are only for TWL keys.
| None
| New3DS
| 2011
| [[User:Yellows8|Yellows8]]
|-
| 3DS key-generator
| The algorithm for generating the normal-keys for keyslots is cryptographically weak. As a result, it is easily susceptible to differential cryptanalysis if the normal-key corresponding to any scrambler-generated keyslot is discovered.

Several such pairs of matching normal-keys and KeyY values were found, leading to deducing the key-generator function.
| None
| New3DS
| February 2015
| [[User:Yellows8|Yellows8]], [[User:Plutooo|plutoo]]
|-
| FIRM partitions known-plaintext
| The [[Flash_Filesystem|FIRM partitions]] are encrypted with AES-CTR. Since this works by XOR'ing data with a static (per-console in this case) keystream, one can deduce the keystream of a portion of each FIRM partition if they have the actual FIRM binary stored in it.

This can be paired with many exploits. For example, it allows minor FIRM downgrades (i.e. 10.4 to 9.6 or 9.5 to 9.4, but not 9.6 to 9.5).

This can be somewhat addressed by having a FIRM header skip over previously used section offsets, but this would just air-gap newer FIRMs without fixing the core bug. This can also only be done a limited number of times due to the size of FIRM versus the size of the partitions.
| None
| New3DS
|
| Everyone
|}

== ARM9 software ==
=== arm9loader ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Uncleared OTP hash keydata in console-unique 0x11 key-generation
| Kernel9Loader does not clear the [[SHA_Registers#SHA_HASH|SHA_HASH register]] after use. As a result, the data stored here as K9L hands over to Kernel9 is the hash of [[OTP_Registers|OTP data]] used to seed the [[FIRM#New_3DS_FIRM|console-unique NAND keystore decryption key]] set on keyslot 0x11.

Retrieving this keydata and the [[Flash_Filesystem#0x12C00|NAND keystore]] of the same device allows calculating the decrypted New3DS NAND keystore (non-unique, common to all New3DS units), which contains AES normal keys, also set on keyslot 0x11, which are then used to derive all current [[AES_Registers#Keyslots|New3DS-only AES keyXs]] including the newer batch introduced in [[9.6.0-24#arm9loader|9.6.0-X]]. From there, it is trivial to perform the same key derivation in order to initialize those keys on any system version, and even on Old3DS.

This can be performed by exploiting the "arm9loaderhax" vulnerability to obtain post-K9L code execution after an MCU reboot (the bootrom section-loading fail is not relevant here, this attack was performed without OTP data by brute-forcing keys), and using this to dump the SHA_HASH register. This attack works on any FIRM version shipping a vulnerable version of K9L, whereas OTP dumping required a boot of <[[3.0.0-6|3.0.0-X]].

This attack results in obtaining the entire (0x200-bytes) NAND keystore - it was confirmed at a later date that this keystore is encrypted with the same key (by comparing the decrypted data from multiple units), and therefore using another key in this store will not remedy the issue as all keys are known (i.e. later, unused keys decrypt to the same 0x200-bytes constant with the same OTP hash). Later keys could have been encrypted differently but this is not the case. As a result of this, it is not possible for Nintendo to use K9L again in its current format for its intended purpose, though this was not news from the moment people dumped a New3DS OTP.
| Derivation of all New3DS keys generated via the NAND keystore (0x1B "Secure4" etc.)
| None
| [[10.4.0-29|10.4.0-X]]
| ~April 2015, implemented in May 2015
| 13 January 2016
| [[User:WulfyStylez|WulfyStylez]], [[User:Dazzozo|Dazzozo]], [[User:Shinyquagsire23|shinyquagsire23]] (complimentary + implemented), [[User:Plutooo|plutoo]], Normmatt (discovered independently)
|-
| enhanced-arm9loaderhax
| See the 32c3 3ds talk.
Since this is a combination of a trick with the arm9-bootrom + arm9loaderhax, and since you have to manually write FIRM to the firm0/firm1 NAND partitions, this can't be completely fixed. Any system with existing ARM9 code execution and an OTP/OTP hash dump can exploit this. Additionally, by using the FIRM partition known-plaintext bug and bruteforcing the second entry in the keystore, this can currently be exploited on all New3DS systems without any other prerequisite hacks.
| arm9loaderhax which automatically occurs at hard-boot.
| See arm9loaderhax / description.
| See arm9loaderhax / description.
| Theorized around mid July, 2015. Later implemented+tested by [[User:Plutooo|plutoo]] and derrek.
| 32c3 3ds talk (December 27, 2015)
| [[User:Yellows8|Yellows8]]
|-
| Missing verification-block for the 9.6 keys (arm9loaderhax)
| Starting with [[9.6.0-24|9.6.0-X]] a new set of NAND-based keys were introduced. However, no verification block was added to verify that the new key read from NAND is correct. This was technically an issue from [[9.5.0-22|9.5.0-X]] with the original sector+0 keydata, however the below is only possible with [[9.6.0-24|9.6.0-X]] since keyslots 0x15 and 0x16 are generated from different 0x11 keyXs.

Writing an incorrect key to NAND will cause arm9loader to decrypt the ARM9 kernel as garbage and then jump to it.

This allows an hardware-based attack where you can boot into an older exploited firmware, fill all memory with NOP sleds/jump-instructions, and then reboot into executing garbage. By automating this process with various input keydata, eventually you'll find some garbage that jumps to your code.

This gives very early ARM9 code execution (pre-ARM9 kernel). As such, it is possible to dump RSA keyslots with this and calculate the 6.x [[Savegames#6.0.0-11_Savegame_keyY|save]], and 7.x [[NCCH]] keys. This cannot be used to recover keys initialized by arm9loader itself. This is due to it wiping the area used for its stack during NAND sector decryption and keyslot init.

Due to FIRMs on both Old and New 3DS using the same RSA data, this can be exploited on Old3DS as well, but only if one already has the actual plaintext normalkey from New3DS NAND sector 0x96 offset-0 and has dumped the OTP area of the Old3DS.
| Recovery of 6.x [[Savegames#6.0.0-11_Savegame_keyY|save key]]/7.x [[NCCH]] key
| None
| [[10.4.0-29|10.4.0-X]]
| March, 2015
|
| [[User:Plutooo|plutoo]]
|-
| Uncleared New3DS keyslot 0x11
| Originally the New3DS [[FIRM]] arm9bin loader only cleared keyslot 0x11 when it gets executed at firmlaunch. This was fixed with [[9.5.0-22|9.5.0-X]] by completely clearing keyslot 0x11 immediately after the loader finishes using keyslot 0x11.
This means that any ARM9 code that can execute before the loader clears the keyslot at firmlaunch(including firmlaunch-hax) can get access to the uncleared keyslot 0x11, which then allows one to generate all <=v9.5 New3DS keyXs which are generated by keyslot 0x11.

Therefore, to completely fix this the loader would have to generate more keys using different keyslot 0x11 keydata. This was done with [[9.6.0-24|9.6.0-X]].
| New3DS keyXs generation
| Mostly fixed with [[9.5.0-22|9.5.0-X]], completely fixed with new keys with [[9.6.0-24|9.6.0-X]].
|
| February 3, 2015 (one day after [[9.5.0-22|9.5.0-X]] release)
|
| [[User:Yellows8|Yellows8]]
|}

=== Process9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Leak of normal-key matching a key-scrambler key
| New 3DS firmware versions [[8.1.0-0 New3DS|8.1.0]] through [[9.2.0-20|9.2.0]] set the encryption key for [[Amiibo]] data using a hardcoded normal-key in Process9. In firmware [[9.3.0-21|9.3.0]], Nintendo "fixed" this by using the key scrambler instead, by calculating the keyY value for keyslot 0x39 that results in the same normal-key, then hardcoding that keyY into Process9.

Nintendo's fix is actually the problem: Nintendo revealed the normal-key matching an unknown keyX and a known keyY. Combined with the key scrambler using an insecure scrambling algorithm (see "Hardware" above), the key scrambler function could be deduced.
| Deducing the keyX for keyslot 0x39 and the key scrambler algorithm
| New 3DS [[9.3.0-21|9.3.0-X]], sort of
| [[10.0.0-27|10.0.0-X]]
| Sometime in 2015 after the hardware key-generator was broken.
| 32c3 3ds talk (December 27, 2015)
| [[User:Yellows8|Yellows8]]
|-
| Leak of normal-key matching a key-generator key
| During the 3DS' development (June/July 2010) Nintendo added support installing encrypted content ([[CIA]]). Common-key index1 was intended to be a [[AES|hardware generated key]]. However while they added code to generate the key in hardware, they forgot to remove the normal-key for index1 (used elsewhere, likely old debug code). Nintendo later removed the normal key sometime before the first non-prototype firmware release.

Knowing the keyY and the normal-key for common-key index1, the devkit key-generator algorithm can be deduced (see "Hardware" above). Additionally the remaining devkit common-keys can be generated once the common-key keyX is recovered.

Note the devkit key-generator was discovered to be the same as the retail key-generator.
| Deducing the keyX for keyslot 0x3D and hardware key-generator algorithm. Generate remaining devkit common-keys.
| pre-[[1.0.0-0|1.0.0-X]]
|
| Shortly after the key-generator was revealed to be flawed at the 32c3 3ds talk
| January 20, 2016
| [[User:Jakcron|jakcron]]
|-
| ntrcardhax
|
| ARM9 code execution
| None
| [[10.3.0-28|10.3.0-X]]
| March 2015
| 32c3 3ds talk (December 27, 2015)
| [[User:Plutooo|plutoo]]
|-
| Title downgrading via [[Application_Manager_Services|AM]]([[Application_Manager_Services_PXI|PXI]])
| When a title is *already* installed, Process9 will compare the installed title-version with the title-version being installed. When the one being installed is older, Process9 would return an error.

However, this can be bypassed by just deleting the title first via the service command(s) for that: with the title removed from the [[Title_Database]], Process9 can't compare the input title-version with anything. Hence, titles can be downgraded this way.
| Bypassing title version check at installation, which then allows downgrading any title.
| None
| NATIVE_FIRM / AM-sysmodule [[10.0.0-27|10.0.0-X]]
| ?
|
| ?
|-
| FAT FS code null-deref
| When FSFile:Read is used with a file which is corrupted on a FAT filesystem(in particular SD), Process9 can crash. This particular crash is caused by a function returning NULL instead of an actual ptr due to an error. The caller of that function doesn't check for NULL which then triggers a read based at NULL.

Sample "fsck.vfat -n -v -V <fat image backup>" output for the above crash:

<pre>...
Starting check/repair pass.
<FilePath0> and
<FilePath1>
share clusters.
Truncating second to 3375104 bytes.
<FilePath1>
File size is 2787392 bytes, cluster chain length is 16384 bytes.
Truncating file to 16384 bytes.
Checking for unused clusters.
Reclaimed 1 unused cluster (16384 bytes).
Checking free cluster summary.
Free cluster summary wrong (1404490 vs. really 1404491)
Auto-correcting.
Starting verification pass.
Checking for unused clusters.
Leaving filesystem unchanged.</pre>
| Useless null-based-read
| None
| [[9.6.0-24|9.6.0-X]]
| July 8-9, 2015
|
| [[User:Yellows8|Yellows8]]
|-
| RSA signature padding checks
| The TWL_FIRM RSA sig padding check code used for all TWL RSA sig-checks has issues, see [[FIRM|here]].
The main 3DS RSA padding check code(non-certificate, including NATIVE_FIRM) uses the function used with the above to extract more padding + the actual hash from the additional padding. This isn't really a problem here because there's proper padding check code which is executed prior to this.
|
| None
| [[9.5.0-22|9.5.0-X]]
| March 2015
|
| [[User:Yellows8|Yellows8]]
|-
| [[AMPXI:ValidateDSiWareSectionMAC]] [[AES_Registers|AES]] keyslot reuse
| When the input DSiWare section index is higher than <max number of DSiWare sections supported by this FIRM>, Process9 uses keyid 0x40 for calculating the AESMAC, which translates to keyslot 0x40. The result is that the keyslot is left at whatever was already selected before, since the AES selectkeyslot code will immediately return when keyslot is >=0x40. However, actually exploiting this is difficult: the calculated AESMAC is never returned, this command just compares the calculated AESMAC with the input AESMAC(result-code depends on whether the AESMACs match). It's unknown whether a timing attack would work with this.
This is basically a different form of the pxips9 keyslot vuln, except with AESMAC etc.
| See description.
| None
| [[10.2.0-28|10.2.0-X]]
| March 15, 2015
| December 29, 2015
| [[User:Yellows8|Yellows8]]
|-
| pxips9 [[AES_Registers|AES]] keyslot reuse
| This requires access to the [[Process_Services|ps:ps]]/pxi:ps9 services. One way to get access to this would be snshax on system-version <=10.1.0-X(see 32c3 3ds talk).
When an invalid key-type value is passed to any of the PS commands, Process9 will try to select keyslot 0x40. That aesengine_setkeyslot() code will then immediately return due to the invalid keyslot value. Since that function doesn't return any errors, Process9 will just continue to do crypto with whatever AES keyslot was selected before the PS command was sent.
| Reusing the previously used keyslot, for crypto with PS.
| None
| [[10.2.0-28|10.2.0-X]]
| Roughly the same time(same day?) as firmlaunch-hax.
| December 29, 2015
| [[User:Yellows8|Yellows8]]
|-
| firmlaunch-hax: FIRM header ToCToU
| This can't be exploited from ARM11 userland.
During [[FIRM]] launch, the only FIRM header the ARM9 uses at all is stored in FCRAM, this is 0x200-bytes(the actual used FIRM RSA signature is read to the Process9 stack however). The ARM9 doesn't expect "anything" besides the ARM9 to access this data.
With [[9.5.0-22]] the address of this FIRM header was changed from a FCRAM address, to ARM9-only address 0x01fffc00.
| ARM9 code execution
| [[9.5.0-22]]
|
| 2012, 3 days after [[User:Yellows8|Yellows8]] started Process9 code RE.
|
| [[User:Yellows8|Yellows8]]
|-
| Uninitialized data output for (PXI) command replies
| PXI commands for various services(including some [[Filesystem_services_PXI|here]] and many others) can write uninitialized data (like from ARM registers) to the command reply. This happens with stubbed commands, but this can also occur with certain commands when returning an error.
Certain ARM11 service commands have this same issue as well.
|
| None
| [[9.3.0-21|9.3.0-X]]
| ?
|
| [[User:Yellows8|Yellows8]]
|-
| [[Filesystem_services_PXI|FSPXI]] OpenArchive SD permissions
| Process9 does not use the exheader ARM9 access-mount permission flag for SD at all.
This would mean ARM11-kernelmode code / fs-module itself could directly use FSPXI to access SD card without ARM9 checking for SD access, but this is rather useless since a process is usually running with SD access(Home Menu for example) anyway.
|
| None
| [[9.3.0-21|9.3.0-X]]
| 2012
|
| [[User:Yellows8|Yellows8]]
|-
| [[AMPXI:ExportDSiWare]] export path
| Process9 allocates memory on Process9 heap for the export path then verifies that the actual allocated size matches the input size. Then Process9 copies the input path from FCRAM to this buffer, and uses it with the Process9 FS openfile code, which use paths in the form of "<mountpoint>:/<path>".
Process9 does not check the contents of this path at all before passing it to the FS code, besides writing a NUL-terminator to the end of the buffer.
| Exporting of DSiWare to arbitrary Process9 file-paths, such as "nand:/<path>" etc. This isn't really useful since the data which gets written can't be controlled.
| None
| [[9.5.0-22]]
| April 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[DSiWare_Exports]] [[CTCert]] verification
| Just like DSi originally did, 3DS verifies the APCert for DSiWare on SD with the CTCert also in the DSiWare .bin. On DSi this was fixed with with system-version 1.4.2 by verifying with the actual console-unique cert instead(stored in NAND), while on 3DS it's still not(?) fixed.
On 3DS however this is rather useless, due to the entire DSiWare .bin being encrypted with the console-unique movable.sed keyY.
| When the movable.sed keyY for the target 3DS is known and the target 3DS CTCert private-key is unknown, importing of modified DSiWare SD .bin files.
| Unknown, probably none.
| ?
| April 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[Gamecard_Services_PXI]] unchecked REG_CTRCARDCNT transfer-size
| The u8 REG_CTRCARDCNT transfer-size parameter for the [[Gamecard_Services_PXI]] read/write CTRCARD commands is used as an index for an array of u16 values. Before [[5.0.0-11|5.0.0-X]] this u8 value wasn't checked, thus out-of-bounds reads could be triggered(which is rather useless in this case).
| Out-of-bounds read for a value which gets written to a register.
| [[5.0.0-11|5.0.0-X]]
|
| 2013?
|
| [[User:Yellows8|Yellows8]]
|-
| [[PXI_Registers|PXI]] cmdbuf buffer overrun
| The Process9 code responsible [[PXI_Registers|PXI]] communications didn't verify the size of the incoming command before writing it to a C++ member variable.
| Probably ARM9 code execution
| [[5.0.0-11|5.0.0-11]]
|
| March 2015, original timeframe if any unknown
|
| [[User:Plutooo|plutoo]]/[[User:Yellows8|Yellows8]]/maybe others(?)
|-
| [[Application_Manager_Services_PXI|PXIAM]] command 0x003D0108(See also [[Application_Manager_Services|this]])
| When handling this command, Process9 allocates a 0x2800-byte heap buffer, then copies the 4 FCRAM input buffers to this heap buffer without checking the sizes at all(only the buffers with non-zero sizes are copied). Starting with [[5.0.0-11|5.0.0-X]], the total combined size of the input data must be <=0x2800.
| ARM9 code execution
| [[5.0.0-11|5.0.0-X]]
|
| May 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[Process_Services_PXI|PS RSA]] commands buffer overflows
| pxips9 cmd1(not accessible via ps:ps) and VerifyRsaSha256: unchecked copy to a buffer in Process9's .bss, from the input FCRAM buffer. The buffer is located before the pxi cmdhandler threads' stacks. SignRsaSha256 also has a buf overflow, but this isn't exploitable.
The buffer for this is the buffer for the signature data. With v5.0, the signature buffer was moved to stack, with a check for the signature data size. When the signature data size is too large, Process9 uses [[SVC|svcBreak]].
| ARM9 code execution
| [[5.0.0-11|5.0.0-X]]
|
| 2012
|
| [[User:Yellows8|Yellows8]]
|-
| [[PXI_Registers|PXI]] pxi_id bad check
| The Process9 code responsible for [[PXI_Registers|PXI]] communications read pxi_id as a signed char. There were two flaws:
* They used it as index to a lookup-table without checking the value at all.
* Another function verified that pxi_id < 7, allowing negative values to pass the check. This would also cause an out-of-range table-lookup.
| Maybe ARM9 code execution
| [[3.0.0-5|3.0.0-5]]
|
| March 2015, originally 2012 for the first issue at least
|
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]], maybe others(?)
|}

=== Kernel9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]] bit1 not set by Kernel9
| Old versions of Kernel9 never set bit1 of [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]]. This leaves the [[OTP Registers|0x10012000]]-region unprotected (this region should be locked early during boot!). Since it's never locked, you can dump it once you get ARM9 code execution. See [[OTP Registers|here]] regarding the data stored there.

From [[3.0.0-5|3.0.0-X]] this was fixed by setting the bit in Kernel9 after poking some registers in that region. On New3DS arm9loader sets this bit instead of Kernel9.

This flaw resurged when it gained a new practical use: retrieving the OTP data for a New3DS console in order to decrypt the key data used in arm9loader. This was performed by downgrading to a vulnerable system version. By accounting for differences in CTR-NAND crypto (see partition encryption types [[Flash_Filesystem#NAND_structure|here]]), it is possible to boot a New3DS using Old3DS firmware 1.0-2.x, and retrieve the required OTP data using this flaw.
| Dumping of the [[OTP Registers|OTP]] area
| [[3.0.0-5|3.0.0-X]]
|
| February 2015
| [[User:Plutooo|plutoo]], Normmatt independently
|}

== ARM11 software ==
=== Kernel11 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[SVC]] table too small
| The table of function pointers for SVC's only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing SVC7E or SVC7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.

However, this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn't mapped as executable.
|
| None
| [[10.2.0-28|10.2.0-X]]
| 2012
| Everyone
|-
| [[SVC|svcBackdoor (0x7B)]]
| This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.
| See description
| None
| [[10.2.0-28|10.2.0-X]]
|
| Everyone
|-
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup for loading the FIRM-modules from the FIRM section located in DSP-mem, this never seems to be used after that, however. This is never unmapped either.
|
| None
| [[10.2.0-28|10.2.0-X]]
|
|
|-
| Memchunkhax2
|
| ARM11 kernel code execution
| [[10.4.0-29|10.4.0-X]]
| [[10.4.0-29|10.4.0-X]]
|
| derrek
|-
| AffinityMask/processorid validation
| With [[10.0.0-27|10.0.0-X]] the following functions were updated: svcGetThreadAffinityMask, svcGetProcessAffinityMask, svcSetProcessAffinityMask, and svcCreateThread. The code changes for all but svcCreateThread are identical.
The original code with the first 3 did the following:
* if(u32_processorcount > ~0x80000001)return 0xe0e01bfd;
* if(s32_processorcount > <total_cores>)return 0xd8e007fd;
The following code replaced the above:
* if(u32_processorcount >= <total_cores+1>)return 0xd8e007fd;
In theory the latter should catch everything that the former did, so it's unknown if this was really a security issue.

The svcCreateThread changes with [[10.0.0-27|10.0.0-X]] definitely did fix a security issue.
* Original code: "if(s32_processorid > <total_cores>)return 0xd8e007fd;"
* New code: "if(s32_processorid >= <total_cores> || s32_processorid <= -4)return 0xd8e007fd;"
This fixed an off-by-one issue: if one would use processorid=total_cores, which isn't actually a valid value, svcCreateThread would accept that value on <[[10.0.0-27|10.0.0-X]]. This results in data being written out-of-bounds(baseaddr = arrayaddr + entrysize*processorid), which has the following result:
* Old3DS: Useless kernel-mode crash due to accessing unmapped memory.
* New3DS: uncontrolled data write into a kernel-mode L1 MMU-table. This isn't really useful: the data can't be controlled, and the data which gets overwritten is all-zero anyway(this isn't anywhere near MMU L1 entries for actually mapped memory).
The previous version also allowed large negative s32_processorid values(negative processorid values are special values not actual procids), but it appears using values like that won't actually do anything(meaning no crash) besides the thread not running / thread not running for a while(besides triggering a kernelpanic with certain s32_processorid value(s)).
| Nothing useful
| [[10.0.0-27|10.0.0-X]]
| [[10.0.0-27|10.0.0-X]]
| svcCreateThread issue: May 31, 2015. The rest: September 8, 2015, via v9.6->v10.0 ARM11-kernel code-diff.
| [[User:Yellows8|Yellows8]]
|-
| memchunkhax
| The kernel originally did not validate the data stored in the FCRAM kernel heap [[Memchunkhdr|memchunk-headers]] for free-memory at all. Exploiting this requires raw R/W access to these memchunk-headers, like physical-memory access with gspwn.

There are ''multiple'' ways to exploit this, but the end-result for most of these is the same: overwrite code in AXIWRAM via the 0xEFF00000/0xDFF00000 kernel virtual-memory mapping.

This was fixed in [[9.3.0-21|9.3.0-X]] by checking that the memchunk(including size, next, and prev ptrs) is located within the currently used heap memory. The kernel may also check that the next/prev ptrs are valid compared to other memchunk-headers basically. When any of these checks fail, kernelpanic() is called.
| When combined with other flaws: ARM11-kernelmode code execution
| [[9.3.0-21|9.3.0-21]]
|
| February 2014
| [[User:Yellows8|Yellows8]]
|-
| Multiple [[KLinkedListNode|KLinkedListNode]] SlabHeap use after free bugs
| The ARM11-kernel did access the 'key' field of [[KLinkedListNode|KLinkedListNode]] objects, which are located on the SlabHeap, after freeing them. Thus, triggering an allocation of a new [[KLinkedListNode|KLinkedListNode]] object at the right time could result in a type-confusion. Pseudo-code:
SlabHeap_free(KLinkedListNode);
KObject *obj = KLinkedListNode->key; // the object there might have changed!
This bug appeared all over the place.
| ARM11-kernelmode code exec maybe
| [[8.0.0-18|8.0.0-18]]
|
| April 2015
| [[User:Derrek|derrek]]
|-
| PXI [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11-kernel didn't check permissions for PXI input/output buffers for commands. Starting with [[6.0.0-11|6.0.0]] PXI input/output buffers must have RW permissions, otherwise kernelpanic is triggered.
|
| [[6.0.0-11|6.0.0-11]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|svcStartInterProcessDma]]
| For svcStartInterProcessDma, the kernel code had the following flaws:

* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.

* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.

* The kernel now also checks whether the srcaddr/dstaddr (+size) is within userland memory (0x20000000), the kernel now (with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address >=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr->physaddr conversion).
|
| [[6.0.0-11]]
|
| DmaConfig issue: unknown. The rest: 2014
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] independently
|-
| [[SVC|svcControlMemory]] Parameter checks
| For svcControlMemory the parameter check had these two flaws:

* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn't actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn't actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.

* Integer overflows on (addr0+size) are now checked that previously weren't (this also applies to most other address checks elsewhere in the kernel).

|
| [[5.0.0-11]]
|
|
| [[User:Plutooo|plutoo]]
|-
| [[RPC_Command_Structure|Command]] request/response buffer overflow
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words (0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread. However, since the data written there would be translate parameters (such as header-words + buffer addresses), exploiting this would likely be very difficult, if possible at all.

If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of <nowiki>((size<<14) | 2)</nowiki> to write arbitrary memory to any RW userland memory in the destination process.
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|SVC stack allocation overflows]]
|
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun.
* The alignment (size+7)&~7 calculation before allocation was not checked for integer overflow.

This might allow for ARM11 kernel code-execution.

(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] complementary
|-
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn't check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.
|
| [[4.1.0-8]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11 kernel didn't check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don't have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.
|
| [[4.0.0-7]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.
|
| [[4.0.0-7]]
|
| 2012?
| [[User:Yellows8|Yellows8]]
|}

=== [[FIRM]] Sysmodules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[Services|"srv:pm"]] process registration
| Originally any process had access to the port "srv:pm". The PID's used for the (un)registration commands are not checked either. This allowed any process to re-register itself with "srv:pm", and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.

This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] "srv:pm" is now a service instead of a globally accessible port. Only processes with PID's less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for "srv:pm" open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.

This flaw was needed for exploiting the <=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don't have access to those service(s).
| Access to arbitrary services
| [[7.0.0-13]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| FSDIR null-deref
| [[Filesystem_services|FS]]-module may crash in some cases when handling directory reading. The trigger seems to be due to using [[FSDir:Close]] without closing the dir-handle afterwards?(Perhaps this is caused by out-of-memory?) This seems to be useless since it's just a null-deref.
|
| None
| [[9.6.0-24|9.6.0-X]]
| May 19(?)-20, 2015
| [[User:Yellows8|Yellows8]]
|}

=== Standalone Sysmodules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system-module system-version
! Last system-module system-version this flaw was checked for
! Timeframe this was discovered
! Timeframe this was added to wiki
! Discovered by
|-
| [[NIM_Services|NIM]]: Downloading old title-versions from eShop
| Multiple NIM service commands(such as [[NIMS:StartDownload]]) use a title-version value specified by the user-process, NIM does not validate that this input version matches the latest version available via SOAP. Therefore, when combined with AM(PXI) [[#Process9|title-downgrading]] via deleting the target eShop title with System Settings Data Management(if the title was already installed), this allows downloading+installing any title-version from eShop ''if'' it's still available from CDN.
The easiest way to exploit this is to just patch the eShop system-application code using these NIM commands(ideally the code which loads the title-version).

Originally this was tested with a debugging-system via modded-FIRM, eventually smea implemented it in HANS for the 32c3 release.
| Downloading old title-versions from eShop
| None
| [[10.0.0-27|10.0.0-X]]
| October 24, 2015 (Unknown when exactly the first eShop title downgrade was actually tested, maybe November)
| January 7, 2016 (Same day Ironfall v1.0 was removed from CDN via the main-CXI files)
| [[User:Yellows8|Yellows8]]
|-
| [[SPI_Services|SPI]] service out-of-bounds write
| cmd1 has out-of-bounds write allowing overwrite of some static variables in .data.
|
| None
| [[9.5.0-22]]
| March 2015
|
| [[User:Plutooo|plutoo]]
|-
| [[NFC_Services|NFC]] module service command buf-overflows
| NFC module copies data with certain commands, from command input buffers to stack without checking the size. These commands include the following, it's unknown if there's more commands with similar issues: "nfc:dev" <0x000C....> and "nfc:s" <0x0037....>.
Since both of these commands are stubbed in the Old3DS NFC module from the very first version(those just return an error), these issues only affect the New3DS NFC module.

There's no known retail titles which have access to either of these services.
| ROP under NFC module.
| New3DS: None
| New3DS: [[9.5.0-22]]
| December 2014?
|
| [[User:Yellows8|Yellows8]]
|-
| [[News_Services|NEWSS]] service command notificationID validation failure
| This module does not validate the input notificationID for <nowiki>"news:s"</nowiki> service commands. This is an out-of-bounds array index bug. For example, [[NEWSS:SetNotificationHeader]] could be used to exploit news module: this copies the input data(size is properly checked) to: out = newsdb_savedata+0x10 + (someu32array[notificationID]*0x70).
| ROP under news module.
| None
| [[9.7.0-25|9.7.0-X]]
| December 2014
|
| [[User:Yellows8|Yellows8]]
|-
| [[NWMUDS:DecryptBeaconData]] heap buffer overflow
| input_size = 0x1E * <value the u8 from input_[[NWM_Services|networkstruct]]+0x1D>. Then input_tag0 is copied to a heap buffer. When input_size is larger than 0xFA-bytes, it will then copy input_tag1 to <end_address_of_previous_outbuf>, with size=input_size-0xFA.

This can be triggered by either using this command directly, or by boadcasting a wifi beacon which triggers it while a 3DS system running the target process is in range, when the process is scanning for hosts to connect to. Processes will only pass tag data to this command when the wlancommID and other thing(s) match the values for the process.

There's no known way to actually exploit this for getting ROP under NWM-module, at the time of originally adding this to the wiki. This is because the data which gets copied out-of-bounds *and* actually causes crash(es), can't be controlled it seems(with just broadcasting a beacon at least). It's unknown whether this could be exploited from just using NWMUDS service-cmd(s) directly.
| Without any actual way to exploit this: NWM-module DoS, resulting in process termination(process crash). This breaks *everything* involving wifi comms, a reboot is required to recover from this.
| None
| [[9.0.0-20]]
| ~September 23, 2014(see the [[NWMUDS:DecryptBeaconData]] page history)
| August 3, 2015
| [[User:Yellows8|Yellows8]]
|-
| [[HID_Services|HID]] module shared-mem
| HID module does not validate the index values in [[HID_Shared_Memory|sharedmem]](just changes index to 0 when index == maxval when updating), therefore large values will result in HID module writing HID data to arbitrary addresses.
| ROP under HID module, but this is *very* unlikely to be exploitable since the data written is HID data.
| None
| [[9.3.0-21]]
| 2014?
|
| [[User:Yellows8|Yellows8]]
|-
| gspwn
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).

FCRAM is gpu-accessible up to physaddr 0x26800000 on Old3DS, and 0x2DC00000 on New3DS. This is BASE_memregion_start(aka SYSTEM_memregion_end)-0x400000 with the default memory-layout on Old3DS/New3DS.
| User-mode code execution.
| None
| [[9.6.0-24|9.6.0-X]]
| Early 2014
|
| smea, [[User:Yellows8|Yellows8]]/others before then
|-
| rohax
| Using gspwn, it is possible to overwrite a loaded [[CRO0]]/[[CRR0]] after its RSA-signature has been validated. Badly validated [[CRO0]] header leads to arbitrary read/write of memory in the ro-process. This gives code-execution in the ro module, who has access to [[SVC|syscalls]] 0x70-0x72, 0x7D.

This was fixed after [[ninjhax]] release by adding checks on [[CRO0]]-based pointers before writing to them.
| Memory-mapping syscalls.
| [[9.3.0-21]]
| [[9.4.0-21]]
|
|
| smea, [[User:Plutooo|plutoo]] joint effort
|-
| Region free
| Only [[Home Menu]] itself checks gamecards' region when launching them. Therefore, any application launch that is done directly with [[NS]] without signaling Home Menu to launch the app, will result in region checks being bypassed.
This essentially means launching the gamecard with the [[NS_and_APT_Services|"ns:s"]] service. The main way to exploit this is to trigger a FIRM launch with an application specified, either with a normal FIRM launch or a hardware [[NSS:RebootSystem|reboot]].
| Launching gamecards from any region + bypassing Home Menu gamecard-sysupdate installation
| None
| Last tested with [[10.1.0-27|10.1.0-X]].
| June(?) 2014
|
| [[User:Yellows8|Yellows8]]
|-
| [[NWM_Services|NWM]] service-cmd state null-ptr deref
| The NWMUDS service command code loads a ptr from .data, adds an offset to that, then passes that as the state address for the actual command-handler function. The value of the ptr loaded from .data is not checked, therefore this will cause crashes due to that being 0x0 when NWMUDS was not properly initialized.
It's unknown whether any NWM services besides NWMUDS have this issue.
| This is rather useless since it's only a crash caused by a state ptr based at 0x0.
| None
| [[9.0.0-20]]
| 2013?
|
| [[User:Yellows8|Yellows8]]
|}

=== General/CTRSDK ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in version
! Last version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[NWM_Services|UDS]] beacon additional-data buffer overflow
| Originally CTRSDK did not validate the UDS additional-data size before using that size to copy the additional-data to a [[NWM_Services|networkstruct]]. This was eventually fixed.
This was discovered while doing code RE with an old dlp-module version. It's unknown in what specific CTRSDK version this was fixed, or even what system-version updated titles with a fixed version.

It's unknown if there's any titles using a vulnerable CTRSDK version which are also exploitable with this(dlp module can't be exploited with this).

The maximum number of bytes that can be written beyond the end of the outbuf is 0x37-bytes, with additionaldata_size=0xFF.
| Perhaps ROP, very difficult if possible with anything at all
| ?
|
| September(?) 2014
| [[User:Yellows8|Yellows8]]
|}

Error codes

2015-11-28T03:06:48Z

Jakcron: Added more modules

All system error codes follow a shared format.

{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-9
| Description
|-
| 10-17
| Module
|-
| 21-26
| Summary
|-
| 27-31
| Level
|}

Description ranges:

{| class="wikitable" border="1"
|-
! Num
! Description
|-
| 100-179
| Not found
|-
| 180-199
| Exists already
|-
| 200-219
| Not enough space
|-
| 220-229
| Invalidated archive
|-
| 230-339
| Unacceptable
|-
| 390-399
| Verification failure
|-
| 760-779
| Not supported
|}

Description values:

{| class="wikitable" border="1"
|-
! Num
! Description
|-
| 0
| Success
|-
| 2
| Invalid memory permissions (kernel)
|-
| 4
| Invalid ticket version (AM)
|-
| 5
| Invalid string length. This error is returned when service name length is greater than 8 or zero. (srv)
|-
| 6
| Access denied. This error is returned when you request a service that you don't have access to. (srv)
|-
| 7
| String size does not match string contents. This error is returned when service name contains an unexpected null byte. (srv)
|-
| 8
| Camera already in use/busy (qtm).
|-
| 10
| Not enough memory (os)
|-
| 26
| Session closed by remote (os)
|-
| 37
| Invalid NCCH? (AM)
|-
| 39
| Invalid title version (AM)
|-
| 43
| Database doesn't exist/failed to open (AM)
|-
| 44
| Trying to uninstall system-app (AM)
|-
| 101
| Archive not mounted/mount-point not found (fs)
|-
| 105
| Request timed out (http)
|-
| 106
| Invalid signature/CIA? (AM)
|-
| 120
| Title/object not found? (fs)
|-
| 141
| Gamecard not inserted? (fs)
|-
| 230
| Invalid open-flags / permissions? (fs)
|-
| 271
| Invalid configuration (mvd).
|-
| 391
| NCCH hash-check failed? (fs)
|-
| 392
| RSA/AES-MAC verification failed? (fs)
|-
| 393
| Invalid database? (AM)
|-
| 395
| RomFS/Savedata hash-check failed? (fs)
|-
| 630
| Command not allowed / missing permissions? (fs)
|-
| 702
| Invalid path? (fs)
|-
| 761
| Incorrect read-size for ExeFS? (fs)
|-
| 1000
| Invalid selection
|-
| 1001
| Too large
|-
| 1002
| Not authorized
|-
| 1003
| Already done
|-
| 1004
| Invalid size
|-
| 1005
| Invalid enum value
|-
| 1006
| Invalid combination
|-
| 1007
| No data
|-
| 1008
| Busy
|-
| 1009
| Misaligned address
|-
| 1010
| Misaligned size
|-
| 1011
| Out of memory
|-
| 1012
| Not implemented
|-
| 1013
| Invalid address
|-
| 1014
| Invalid pointer
|-
| 1015
| Invalid handle
|-
| 1016
| Not initialized
|-
| 1017
| Already initialized
|-
| 1018
| Not found
|-
| 1019
| Cancel requested
|-
| 1020
| Already exists
|-
| 1021
| Out of range
|-
| 1022
| Timeout
|-
| 1023
| Invalid result value
|}

Summary values:
{| class="wikitable" border="1"
|-
! Num
! Description
|-
| 0
| Success
|-
| 1
| Nothing happened
|-
| 2
| Would block
|-
| 3
| Out of resource
|-
| 4
| Not found
|-
| 5
| Invalid state
|-
| 6
| Not supported
|-
| 7
| Invalid argument
|-
| 8
| Wrong argument
|-
| 9
| Canceled
|-
| 10
| Status changed
|-
| 11
| Internal
|-
| 63
| Invalid result value
|}

Module values:
{| class="wikitable" border="1"
|-
! Num
! Description
|-
| 0
| Common
|-
| 1
| Kernel
|-
| 2
| Util
|-
| 3
| File server
|-
| 4
| Loader server
|-
| 5
| TCB
|-
| 6
| OS
|-
| 7
| DBG
|-
| 8
| DMNT
|-
| 9
| PDN
|-
| 10
| GX
|-
| 11
| I2C
|-
| 12
| GPIO
|-
| 13
| DD
|-
| 14
| CODEC
|-
| 15
| SPI
|-
| 16
| PXI
|-
| 17
| FS
|-
| 18
| DI
|-
| 19
| HID
|-
| 20
| CAM
|-
| 21
| PI
|-
| 22
| PM
|-
| 23
| PM_LOW
|-
| 24
| FSI
|-
| 25
| SRV
|-
| 26
| NDM
|-
| 27
| NWM
|-
| 28
| SOC
|-
| 29
| LDR
|-
| 30
| ACC
|-
| 31
| RomFS
|-
| 32
| AM
|-
| 33
| HIO
|-
| 34
| Updater
|-
| 35
| MIC
|-
| 36
| FND
|-
| 37
| MP
|-
| 38
| MPWL
|-
| 39
| AC
|-
| 40
| HTTP
|-
| 41
| DSP
|-
| 42
| SND
|-
| 43
| DLP
|-
| 44
| HIO_LOW
|-
| 45
| CSND
|-
| 46
| SSL
|-
| 47
| AM_LOW
|-
| 48
| NEX
|-
| 49
| Friends
|-
| 50
| RDT
|-
| 51
| Applet
|-
| 52
| NIM
|-
| 53
| PTM
|-
| 54
| MIDI
|-
| 55
| MC
|-
| 56
| SWC
|-
| 57
| FatFS
|-
| 58
| NGC
|-
| 59
| CARD
|-
| 60
| CARDNOR
|-
| 61
| SDMC
|-
| 62
| BOSS
|-
| 63
| DBM
|-
| 64
| Config
|-
| 65
| PS
|-
| 66
| CEC
|-
| 67
| IR
|-
| 68
| UDS
|-
| 69
| PL
|-
| 70
| CUP
|-
| 71
| Gyroscope
|-
| 72
| MCU
|-
| 73
| NS
|-
| 74
| News
|-
| 75
| RO
|-
| 76
| GD
|-
| 77
| Card SPI
|-
| 78
| EC
|-
| 79
| Web Browser
|-
| 80
| Test
|-
| 81
| ENC
|-
| 82
| PIA
|-
| 83
| ACT
|-
| 84
| VCTL
|-
| 85
| OLV
|-
| 86
| NEIA
|-
| 87
| NPNS
|-
| 90
| AVD
|-
| 91
| L2B
|-
| 92
| MVD
|-
| 93
| NFC
|-
| 94
| UART
|-
| 95
| SPM
|-
| 96
| QTM
|-
| 97
| NFP (amiibo)
|-
| 254
| Application
|-
| 255
| Invalid result value
|}

Level values:
{| class="wikitable" border="1"
|-
! Num
! Description
|-
| 0
| Success
|-
| 1
| Info
|-
| 25
| Status
|-
| 26
| Temporary
|-
| 27
| Permanent
|-
| 28
| Usage
|-
| 29
| Reinitialize
|-
| 30
| Reset
|-
| 31
| Fatal
|}

Title list

2015-11-20T13:39:36Z

Jakcron:

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ here]. When using SSL, the update/shop servers must be accessed via SSLv3.

The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.

Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.

The 3DS retrieves system [[CommonETicket|tickets]] with SOAP request GetSystemCommonETicket, instead of directly downloading the cetk with HTTPS. The cetk is still accessible via HTTP, however 3DS doesn't use direct HTTP for this.

'''TitleID Structure''': 0xCCCCABCDLLLLLLRR

* CCCC defines the console '''Platform''' (5=WiiU, 4=3DS, 3=DSi, 1=[http://wiibrew.org/wiki/Title_database Wii])
* ABCD defines the '''Content Category''' of the title, Demo, DLPChild, etc.
* LLLLLL For CTR titles, this is the title's '''Unique ID'''. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.
* RR This is the Title ID '''Variation''', and has various uses.

'''Content Categories''':

This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.

Specific Bitmask Flags:
{| class="wikitable" border="1"
|-
! Category
! Bitmask
|-
| Normal
| 0x0
|-
| DlpChild
| 0x1
|-
| Demo
| 0x2
|-
| Contents
| 0x3
|-
| AddOnContents
| 0x4
|-
| Patch
| 0x6
|-
| CannotExecution
| 0x8
|-
| System
| 0x10
|-
| RequireBatchUpdate
| 0x20
|-
| NotRequireUserApproval
| 0x40
|-
| NotRequireRightForMount
| 0x80
|-
| CanSkipConvertJumpId
| 0x100
|-
| TWL
| 0x8000
|}

* TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.

* System titles (TWL and CTR) are eligible to be updated during a System Update.

* Bit Mask 0x4000 appears to be reserved, as it renders the ''TWL'' and ''System'' bit masks useless.

'''Unique ID Restrictions''':

For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes.

{| class="wikitable" border="1"
|-
! TITLE TYPE
! UNIQUE ID RANGE
|-
| System
| 0x0 - 0x2FF
|-
| Application
| 0x300 - 0xF7FFF
|-
| Evaluation
| 0xF8000 -0xFFFFF
|-
| Prototype*
| 0xFF000 - 0xFF3FF
|}
<nowiki>*</nowiki>On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.

ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on [[New_3DS]](that is, programID-low 0x20000000 / uniqueID 0x200000).

'''TitleID Variation''':

This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:

* CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:
{| class="wikitable" border="1"
|-
! RR
! MEANING
|-
| 02
| System Title (Core version 0x2)
|-
| 03
| SAFE_MODE System Title (Core version 0x3)
|}
Normally on retail SAFE_MODE ARM11 [[NCCH#CXI|CXI]] titles can't be launched, since the [[Configuration_Memory|system]] core version doesn't match the CXI exheader core version.

* Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.

* [[3DS Development Unit Software|Dev Menu]] installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.

* Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:

=== Versions ===

v## = 0xHHHH = 0bBBBBBBBB...

* The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary
* 6 bits : Major
* 6 bits : Minor
* 4 bits : Micro ('Build' in some contexts)
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [http://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| [[Health and Safety Information]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| N/A
| N/A
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| N/A
| N/A
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
| 00008102
| 00008102
| 00008102
| [[NS#Alternate menu|Alternate menu]]
| N/A
|-
| 00008202
| 00008F02
| 00009802
| [[Home Menu|Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]], [[10.3.0-28|v25600]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]], [[10.3.0-28|v23552]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]], [[10.3.0-28|v22528]]
|-
| 00008402
| 00009002
| 00009902
| Camera applet used by Home-menu (CtrApp)
| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008502
| 00009102
| 00009A02
| Not available on CDN
| ?
|
|
|-
| 00008602
| 00009202
| 00009B02
| Instruction Manual, applet for displaying instruction manuals
| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
|-
| 00008702
| 00009302
| 00009C02
| Game Notes (Cherry)
| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008802
| 00009402
| 00009D02
| [[Internet Browser]] (spider)
| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]]
| Same as JPN
| Same as JPN
|-
| 20008802
| 20009402
| 20009D02
| [[New_3DS]] [[Internet Browser]] (SKATER)
| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]]
| Same as JPN
| Same as JPN
|-
| 00008A02
| 00008A02
| 00008A02
| [[ErrDisp]]
| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008A03
| 00008A03
| 00008A03
| SAFE_MODE [[ErrDisp]]
| v0
| Same as JPN
| Same as JPN
|-
| 20008A03
| 20008A03
| 20008A03
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
| [[8.1.0-0_New3DS|v7169]]
| Same as JPN
| Same as JPN
|-
| 00008D02
| 00009602
| 00009F02
| Friend List (friend)
| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
| Same as JPN
| Same as JPN
|-
| 00008E02
| 00009702
| 0000A002
| Notifications (newslist)
| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
| Same as JPN
| Same as JPN
|-
| 0000C002
| 0000C802
| 0000D002
| Software Keyboard (swkbd)
| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C003
| 0000C803
| 0000D003
| SAFE_MODE Software Keyboard (swkbd)
| v0
| Same as JPN
| Same as JPN
|-
| 2000C003
| 2000C803
| 2000D003
| [[New_3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v0]](for JPN this is v1024)
| Same as JPN
| Same as JPN
|-
| 0000C102
| 0000C902
| 0000D102
| appletEd
| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
| Same as JPN
| Same as JPN
|-
| 0000C302
| 0000CB02
| 0000D302
| PNOTE_AP (Photo file selector applet, for SD-card/etc?)
| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000C402
| 0000CC02
| 0000D402
| SNOTE_AP (Sound file selector applet, for SD-card/etc?)
| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C502
| 0000C502
| 0000C502
| error (This applet displays networking errors, etc)
| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
| Same as JPN
| Same as JPN
|-
| 0000C503
| 0000C503
| 0000C503
| SAFE_MODE error applet
| v0
| Same as JPN
| Same as JPN
|-
| 2000C503
| 2000C503
| 2000C503
| [[New_3DS]] SAFE_MODE error applet
| [[8.1.0-0_New3DS|v1024]]
| Same as JPN
| Same as JPN
|-
| 0000CD02
| 0000CD02
| 0000CD02
| extrapad ([[Circle Pad Pro]] calibration applet)
| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
| Same as JPN
| Same as JPN
|-
| 0000C602
| 0000CE02
| 0000D602
| mint. eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself.
| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]], [[10.3.0-28|v14337]]
| Same as JPN
| Same as JPN
|-
| 0000BC02
| 0000BD02
| 0000BE02
| olv (Miiverse applet)
| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000F602
| 0000F602
| 0000F602
| memolib (Uses Miiverse, likely the "system library" for Miiverse)
| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
|-
| 00008302
| 00008B02
| 0000BA02
| solv3 (Miiverse-posting applet)
| [[9.0.0-20|v6]]
| Same as JPN
| Same as JPN
|-
| 00009502
| 00009E02
| 0000B902
| Cabinet ([[amiibo Settings]])
| [[9.3.0-21|v7]], [[9.6.0-24|v1031]]
| Same as JPN
| Same as JPN
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
| Doesn't exist on CDN?
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010502
| 00010502
| 00010502
| Doesn't exist on CDN?
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| 00011402
| ?
| ?
| v0
|-
| ?
| 00011602
| ?
| ?
| v0
|-
| ?
| 00011D02
| ?
| ?
| v0
|-
| ?
| 00011E02
| ?
| ?
| v0
|-
| ?
| ?
| 00011202
| ?
| v0
|-
| ?
| ?
| 00011302
| ?
| v0
|-
| ?
| ?
| 00011502
| ?
| v0
|-
| ?
| ?
| 00011702
| ?
| v0
|-
| ?
| ?
| 00011802
| ?
| v0
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| ?
| 00011B02
| ?
| v0
|-
| ?
| ?
| 00011C02
| ?
| v0
|-
| ?
| ?
| 00011D02
| ?
| v0
|-
| ?
| ?
| 00012102
| ?
| v0, v1026, v2051, v3074
|-
| 00012202
| 00012302
| 00012102
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]]
|-
| 00013202
| 00013302
| 00013102
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]]
|-
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| Mounted as "rate:"
| v0 (EUR: v0, v1024)
|-
| ?
| 00016302
| ?
| ?
| v80
|-
| ?
| 00017302
| ?
| ?
| v3088
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]], [[10.3.0-28|v10288]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]]
| Same as CHN
| Same as CHN
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003000
| [[FIRM|Process9]] (in SAFE_MODE and normal NATIVE_FIRM)
| N/A
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]])
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| "debugger". This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== TWL System Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|}
Bitmask 0x1 for TWL titles determines whether the title will be updated during a System Update.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DSi-mode application launched by [[System Settings]] for setting TWL wifi configuration.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== TWL Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|}

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}