3dbrew - User contributions [en]

NIM Services

2023-03-08T01:11:04Z

Luigoalma: Some nim:s

[[Category:Services]]
= NIM updater service "nim:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[NIMU:StartNetworkUpdate|StartNetworkUpdate]]
|-
| 0x00020000
| [[NIMU:GetProgress|GetProgress]]
|-
| 0x00030000
| [[NIMU:Cancel|Cancel]]
|-
| 0x00040000
| [[NIMU:CommitSystemTitles|CommitSystemTitles]]
|-
| 0x00050000
| [[NIMU:GetBackgroundEventForMenu|GetBackgroundEventForMenu]]
|-
| 0x00060000
| [[NIMU:GetBackgroundEventForNews|GetBackgroundEventForNews]]
|-
| 0x00070000
| [[NIMU:FormatSaveData|FormatSaveData]]
|-
| 0x00080000
| [[NIMU:GetCustomerSupportCode|GetCustomerSupportCode]]
|-
| 0x00090000
| [[NIMU:IsCommittableAllSystemTitles|IsCommittableAllSystemTitles]]
|-
| 0x000A0000
| [[NIMU:GetBackgroundProgress|GetBackgroundProgress]]
|-
| 0x000B0000
| [[NIMU:GetSavedHash|GetSavedHash]]
|-
| 0x000C0082
| [[NIMU:UnregisterTask|UnregisterTask]]
|-
| 0x000D0080
| [[NIMU:IsRegistered|IsRegistered]]
|-
| 0x000E0080
| [[NIMU:FindTaskInfo|FindTaskInfo]]
|-
| 0x000F0042
| [[NIMU:GetTaskInfos|GetTaskInfos]]
|-
| 0x00100000
| [[NIMU:DeleteUnmanagedContexts|DeleteUnmanagedContexts]]
|-
| 0x00110000
| [[NIMU:UpdateAutoTitleDownloadTasksAsync|UpdateAutoTitleDownloadTasksAsync]]
|-
| 0x00120000
| [[NIMU:StartPendingAutoTitleDownloadTasksAsync|StartPendingAutoTitleDownloadTasksAsync]]
|-
| 0x00130000
| [[NIMU:GetAsyncResult|GetAsyncResult]]
|-
| 0x00140000
| [[NIMU:CancelAsyncCall|CancelAsyncCall]]
|-
| 0x00150000
| [[NIMU:IsPendingAutoTitleDownloadTasks|IsPendingAutoTitleDownloadTasks]]
|-
| 0x00160000
| [[NIMU:GetNumAutoTitleDownloadTasks|GetNumAutoTitleDownloadTasks]]
|-
| 0x00170042
| [[NIMU:GetAutoTitleDownloadTaskInfos|GetAutoTitleDownloadTaskInfos]]
|-
| 0x00180080
| [[NIMU:CancelAutoTitleDownloadTask|CancelAutoTitleDownloadTask]]
|-
| 0x00190002
| [[NIMU:SetAutoDbgDat|SetAutoDbgDat]]
|-
| 0x001A0002
| [[NIMU:GetAutoDbgDat|GetAutoDbgDat]]
|-
| 0x001B0042
| [[NIMU:SetDbgTasks|SetDbgTasks]]
|-
| 0x001C0042
| [[NIMU:GetDbgTasks|GetDbgTasks]]
|-
| 0x001D0000
| [[NIMU:DeleteDbgData|DeleteDbgData]]
|-
| 0x001E0042
| [[NIMU:SetTslXml|SetTslXml]]
|-
| 0x001F0000
| [[NIMU:GetTslXmlSize|GetTslXmlSize]]
|-
| 0x00200042
| [[NIMU:GetTslXml|GetTslXml]]
|-
| 0x00210000
| [[NIMU:DeleteTslXml|DeleteTslXml]]
|-
| 0x00220042
| [[NIMU:SetDtlXml|SetDtlXml]]
|-
| 0x00230000
| [[NIMU:GetDtlXmlSize|GetDtlXmlSize]]
|-
| 0x00240042
| [[NIMU:GetDtlXml|GetDtlXml]]
|-
| 0x00250000
| [[NIMU:UpdateAccountStatus|UpdateAccountStatus]]
|-
| 0x00260180
| [[NIMU:StartTitleDownload|StartTitleDownload]]
|-
| 0x00270000
| [[NIMU:StopTitleDownload|StopTitleDownload]]
|-
| 0x00280000
| [[NIMU:GetTitleDownloadProgress|GetTitleDownloadProgress]]
|-
| 0x00290246
| [[NIMU:RegisterTask|RegisterTask]]
|-
| 0x002A0000
| [[NIMU:IsSystemUpdateAvailable|IsSystemUpdateAvailable]]
|-
| 0x002B0000
| ? (Response: 0 = 0x002B0040, 1 = Result Code)
|-
| 0x002C0000
| [[NIMU:UpdateTickets|UpdateTickets]]
|-
| 0x002D00C0
| [[NIMU:DownloadTitleSeedAsync|DownloadTitleSeedAsync]]
|-
| 0x002E0000
| [[NIMU:DownloadMissingTitleSeedsAsync|DownloadMissingTitleSeedsAsync]]
|-
|}

= NIM server service "nim:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010200
| [[NIMS:StartDownloadSimple|StartDownloadSimple]]
|-
| 0x00020000
| [[NIMS:CancelDownload|CancelDownload]]
|-
| 0x00030000
| [[NIMS:GetProgress|GetProgress]]
|-
| 0x00050082
| [[NIMS:UnregisterTask|UnregisterTask]]
|-
| 0x00060080
| [[NIMS:IsTaskRegistered|IsTaskRegistered]]
|-
| 0x00070080
| GetTaskInfoFromTitleId
|-
| 0x00080042
| GetTaskList
|-
| 0x0009xxxx
| Returns 0xE0C0D3F4, not implemented.
|-
| 0x000A0000
| [[NIMS:CheckSysupdateAvailableSOAP|CheckSysupdateAvailableSOAP]]
|-
| 0x000B0084
| [[NIMS:SetAttribute|SetAttribute]]
|-
| 0x000C0082
| SetAttributeInt32
|-
| 0x000D0082
| Connect
|-
| 0x000E0000
| UnregisterSOAP, aka soap account delete
|-
| 0x000F0042
| SetCountrySOAP, change effective country registry
|-
| 0x00100080
| Returns 0xE0C0D3F4, not implemented, reads for an int64 in IPC.
|-
| 0x001100C4
| Returns 0xE0C0D3F4, not implemented, reads for IPC parameters.
|-
| 0x00120084
| SetExternalAccountSOAP
|-
| 0x00130042
| DeleteExternalAccountSOAP
|-
| 0x00140000
| DeleteSavedCardSOAP
|-
| 0x00150082
| ListCashReplenishAmountsSOAP
|-
| 0x0016020A
| [[NIMS:ListTitles|ListTitles]]
|-
| 0x0017020A
| ListContentSetsExSOAP
|-
| 0x0018020A
| ListItemsSOAP
|-
| 0x0019028C
| ListContentSetGroupsSOAP
|-
| 0x001E0104
| GetTaxesSOAP
|-
| 0x001F0106
| GetTaxLocationSOAP
|-
| 0x00220080
| AccountDeleteTitleETicketsSOAP. The SOAP request is sent only after the ticket for the specified titleID has been successfully deleted.
|-
| 0x00290000
| [[NIMS:AccountCheckBalanceSOAP|AccountCheckBalanceSOAP]]
|-
| 0x002D0042
| [[NIMS:DownloadTickets|DownloadTickets]]
|-
| 0x0036xxxx
| Returns 0xE0C0D3F4, not implemented.
|-
| 0x003C0002
| [[NIMS:RegisterSelf|RegisterSelf]]
|-
| 0x003F0000
| GetInitializeResult. Checks whether nim is properly initialized or not. If it is not, the result code returned is non-zero.
|-
| 0x00420240
| [[NIMS:StartDownload|StartDownload]]
|-
| 0x00550246
| [[NIMS:RegisterTask|RegisterTask]]
|-
| 0x00570082
| [[NIMS:ConnectNoTicketDownload|ConnectNoTicketDownload]]
|-
| 0x005B0000
| DeleteInitAccSavedData
|-
| 0x005C0000
| DeleteAccountSavedData
|-
| 0x005F00C0
| DownloadTitleSeed
|}

= NIM server service "nim:aoc" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00030042
| SetApplicationId
|-
| 0x00040042
| SetTin
|-
| 0x000902D0
| ListContentSetsEx
|-
| 0x00180000
| GetBalance
|-
| 0x001D0000
| GetCustomerSupportCode
|-
| 0x00210000
| Initialize
|-
| 0x00240282
| CalculateContentsRequiredSize
|-
| 0x00250000
| RefreshServerTime
|}

= NIM service "nim:ndm" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| GetDaemonEventHandle
|-
| 0x00020000
| Does nothing, always returns 0
|-
| 0x00030000
| SetDaemonToWorkingState
|-
| 0x00040040
| SetDaemonToSuspendedState
|-
| 0x00050000
| GetDaemonState
|-
|}

= kagiya server =
The nim system module communicates with a server called kagiya (kagiya-ctr.cdn.nintendo.net or kagiya-dev-ctr.cdn.nintendo.net for development units). It provides the 9.6 crypto seed in binary form for any given title ID under (HTTPS) kagiya-ctr.cdn.nintendo.net/title/0x%16llx/ext_key?country=%s, where %16llx is the title ID and %s is a country code as used in the [[EShop|eShop]].

=New3DS=
NIM module only uses [[PTMSYSM:CheckNew3DS|CheckNew3DS]] for determining what heap sizes to use, in two functions. One is for the size of the 0x08000000 vmem heap, the other is probably for some buffer allocated on that heap. The New3DS version of these sizes are 0x1C000-bytes larger than the Old3DS sizes here.

=HTTPS requests=

==Trusted RootCAs==
During startup NIM-module creates two RootCertChains with [[HTTP_Services|HTTPC]]. Both of these only contain the same [[HTTPC:RootCertChainAddDefaultCert|default]] cert with ID 0x3. The first RootCertChain is used with NetUpdateSOAP. Requests such as the "notifications.json" page don't use these RootCertChains(in this case just [[HTTPC:AddDefaultCert|default]] certID 0xB is used).

==SOAP==

===NetUpdateSOAP===
There are exactly 3 types of network SOAP requests used with [https://nus.c.shop.nintendowifi.net/nus/services/NetUpdateSOAP NetUpdateSOAP] by NIM module, described below. This URL contained in NIM module itself is only used with GetSystemTitleHash. The other requests use an identical URL loaded from an ECommerceSOAP response instead.

See also [https://github.com/yellows8/ninupdates here].

====GetSystemUpdate====
Returns the current sysupdate title-listing. This also contains the SystemTitleHash returned by GetSystemTitleHash.

====GetSystemTitleHash====
Returns the current SystemTitleHash for the current sysupdate title-listing.

====GetSystemCommonETicket====
Returns the Base64-encoded cetk for each specified TitleId entry.

This is only used when installing new titles. This means with CDN system-updates, tickets are never installed except when a title is being installed for the first time. For example, a system on the latest system-version that was only ever updated via CDN has the same NATIVE_FIRM ticket installed from the factory.

=Sysupdate checking process=
This section describes the process used when checking whether a sysupdate is required.

First the GetSystemTitleHash SOAP request is done. Then the SystemTitleHash in savedata hash.dat is compared with the received one. If they match and the SystemTitleHash flag is set to value 0x03, it will immediately return that no sysupdate is required. Otherwise it will start the GetSystemUpdate SOAP request handling.

The GetSystemUpdate SOAP request contains a titlelist of all NAND system-titles. For GetSystemUpdate response parsing, it compares each SOAP title_entry with the NAND system titlelist. If a SOAP titleID isn't found in the NAND titlelist, this means NAND is missing a new title and hence a sysupdate is required for installing that title. If a NAND title_entry-version is less than the SOAP title_entry-version, this means the title needs updated and hence a sysupdate is required.

At least one <TitleVersion> entry with valid data in the GetSystemUpdate response is required.

The titleIDs sent in the GetSystemUpdate SOAP request are decimal, while the titleIDs in the response are hex.

=NIM [[System_SaveData]]=
==hash.dat==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x60
| 0x1
| u8 flag used with the SystemTitleHash. 0x01 = latest sysupdate isn't installed as of last SOAP requests, 0x03 = latest sysupdate is installed as of last SOAP requests.
|-
| 0x61
| 0x21
| ASCII hex SystemTitleHash, including NUL-terminator. This is the latest SystemTitleHash which NIM module received from SOAP.
|}

=Types=

==SystemUpdateProgress==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x01
| [[#SystemUpdateState|System Update State]]
|-
| 0x01
| 0x03
| Padding
|-
| 0x04
| 0x04
| Last Operation Result Code
|-
| 0x08
| 0x08
| Current Title Downloaded Bytes
|-
| 0x10
| 0x08
| Current Title Total Bytes
|-
| 0x18
| 0x08
| Titles Downloaded
|-
| 0x20
| 0x08
| Titles Total
|}

==SystemUpdateState==

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Not Initialized
|-
| 1
| Starting System Update
|-
| 2
| Fetching System Hash and Account Status
|-
| 3
| Installing New Tickets
|-
| 4
| Installing Titles
|-
| 5
| Update Complete
|-
| 6
| Failed - System Updates Disabled (Dev Units Only)
|-
| 7
| ? (Only for background updates)
|-
| 8
| ? (Only for background updates)
|}

==TitleDownloadProgress==
{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x01
| [[#TitleDownloadState|Title Download State]]
|-
| 0x01
| 0x03
| Padding
|-
| 0x04
| 0x04
| Last Operation Result Code
|-
| 0x08
| 0x08
| Downloaded Bytes
|-
| 0x10
| 0x08
| Total Bytes
|}

==TitleDownloadState==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Not Initialized
|-
| 1
| Starting Title Download
|-
| 2
| Downloading and Installing TMD
|-
| 3
| Committing TMD
|-
| 4
| Downloading and Installing Contents
|-
| 5
| Contents Installed
|-
| 6
| [[AM:CommitImportPrograms|Committing Titles]]
|-
| 7
| Finished
|-
| 8
| ? (Unknown error regarding title version?)
|-
| 9
| ? (Creating the .ctx file (or error doing so)?)
|-
| 10
| Background Download Failed
|}

==TitleDownloadConfig==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x08
| Title ID
|-
| 0x08
| 0x04
| Title version
|-
| 0x0C
| 0x04
| Unknown (always 0?)
|-
| 0x10
| 0x01
| Age Rating (for HOME Menu parental controls)
|-
| 0x11
| 0x01
| [[Filesystem_services#MediaType|Media Type]]
|-
| 0x12
| 0x02
| Padding
|-
| 0x14
| 0x04
| Unknown (always 0?)
|}

==BackgroundTitleDownloadConfig==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x018
| [[#TitleDownloadConfig|Title Download Config]]
|-
| 0x018
| 0x001
| Unknown
|-
| 0x019
| 0x001
| Unknown
|-
| 0x01A
| 0x006
| Padding
|-
| 0x020
| 0x008
| Requester Title ID
|-
| 0x028
| 0x090
| Title Name (UTF-16)
|-
| 0x0B8
| 0x002
| Title Name Forced NUL Terminator (always 0)
|-
| 0x0BA
| 0x048
| Developer Name (UTF-16)
|-
| 0x102
| 0x002
| Developer Name Forced NUL Terminator (always 0)
|}

==BackgroundTitleDownloadTaskInfo==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x104
| [[#BackgroundTitleDownloadConfig|Background Title Download Config]]
|-
| 0x104
| 0x004
| Padding
|-
| 0x108
| 0x018
| [[#TitleDownloadProgress|Title Download Progress]]
|}

==AutoTitleDownloadTaskInfo==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x008
| Task ID
|-
| 0x008
| 0x008
| Title ID
|-
| 0x010
| 0x004
| Title Version
|-
| 0x014
| 0x014
| Unknown
|-
| 0x028
| 0x008
| Required Storage Space
|-
| 0x030
| 0x004
| Last Operation Result code
|-
| 0x034
| 0x004
| Last Operation Customer Support Code
|-
| 0x038
| 0x090
| Title Name (UTF-16)
|-
| 0x0C8
| 0x002
| Title Name Forced NUL Terminator (always 0)
|-
| 0x0CA
| 0x048
| Developer Name (UTF-16)
|-
| 0x112
| 0x002
| Developer Name Forced NUL Terminator (always 0)
|-
| 0x114
| 0x024
| Unknown
|}

==InstallationMode==

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Initial Installation
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Re-installation
|}

==Autodbg==

Despite this being for debug purposes, it's used in retail if present.

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x004
| Debug flags
|-
| 0x004
| 0x004
| Number of debug tasks in dbgtasks.dat
|-
| 0x008
| 0x100
| Debug URL dst.xml override
|}

===Autodbg flag bits===

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| Use the tasks stored in dbgtasks.dat
|-
| 1
| Use provided debug dtl.xml URL override
|-
| 2
| Disable the download of dtl.xml
|-
| 3
| Skip connecting to SOAP EC and download ETickets with a false success result during TSL processing
|-
| 4
| Fake assume always ticket is present during TSL task condition processing
|-
| 5
| Skip NPNS notification fetch for auto title downloads with a false success result
|}

=Error Results=

==NIM Results==

{| class="wikitable" border="1"
|-
! Result
! Description
|-
| 0xE0E0D001
| Non-null terminated string on IPC parameter for given length.
|-
| 0xD960D003
| SOAP EC/NUP manager internal error number translation of unhandled values or -4199.
|-
| 0xD960D004
| Unexpected/invalid state enums. (generic)
|-
| 0xC820D005
| Invalid state under one title install manager.
|-
| 0xD8A0D006
| Error state enum value. (generic)
|-
| 0xC920D008
| When content downloading, HTTP Status was not 200 or 206 when connecting, and when status is 206, the Content-Range values failed sanity check.
|-
| 0xC920D009
| Mismatch system title hash with server system title hash.
|-
| 0xC960D00C
| Failed to convert country enum value in CFG save block 0xB0000 to country ISO 3166-1 Alpha-2 code.
|-
| 0xC960D00D
| CFG didn't reply any serial number or dummy serial number "000000000000000" was given.
|-
| 0xC860D00E
| Max total size exceeded for system update pending titles. (128 MiB)
|-
| 0xC880D00F
| *to be filled*
|-
| 0xC8E0D011
| Bad condition, title id for purpose or size under one title install manager.
|-
| 0xC960D012
| Invalid .dat or less than expected size of buffer length read from .dat save files during raw data load.
|-
| 0xC960D013
| Daemon service is suspended.
|-
| 0xC8A0D014
| *to be filled*
|-
| 0xC960D015
| Version mismatch for reinstall condition.
|-
| 0xC960D016
| Used in a few contexts where length does not match expected or the limit. Example, seed data size from HTTP is not 16 bytes.
|-
| 0xC920D017
| SetIVSData will not perform, conditions are not adequate to set IVS. In Service Standby mode or not registered successfully in IAS.
|-
| 0xC920D019
| Certain EC connect flows disallowed to continue while IVS is waiting to be synced from servers. System Transfer has previously occurred and IVS is pending.
|-
| 0xC920D01A
| For nim:s IPC cmd id 0x40, IVS not flagged for synchronization on target console on EC connect after system transfer.
|-
| 0xC960D01B
| Failed to convert language enum value in CFG save block 0xA0002 to language ISO 639-1 code.
|-
| 0xE0E0D01C
| Invalid installation mode for some IPC contexts.
|-
| 0xE0C0D01E
| May be either:
* Trying to set autodbg or dbgtasks with too many tasks on nim:u IPC cmd ids 0x19 and 0x1B, respectively.
* Non debug ENVINFO when calling debug version of get balance nim:s IPC cmd id 0x56.
* A boolean parameter for nim:s IPC cmd id 0x58 was set false.
|-
| 0xD860D020
| May be either:
* Result translation of 0xC860D06E if returned by the early attributes filter handler.
* If the internal Work-only heap fails to initialize with buffer length lesser than 32 bytes. This buffer is given over IPC.
|-
| 0xC860D021
| Task manager has run out of task slots.
|-
| 0xC920D022
| Buffer size too small for ticket length on nim:aoc IPC cmd id 0x1B.
|-
| 0xD880D023
| When Account Id missing for nim:aoc IPC cmd id 0x1B and 0x20 or when Account Id or Token are missing for nim:s IPC cmd id 0x53.
|-
| 0xD860D024
| Failed to initialize Data Heap using buffer given over IPC.
|-
| 0xD920D025
| SOAP reply implied that Service Standby mode is enabled. Certain EC flows cancelled.
|-
| 0xC8A0D026
| May be either:
* Result translation, NIM ran into NPNS result 0xD8A15C06 or NIM result 0xD960D02B.
* System updates pending while trying to SOAP EC connect with ETicket download while processing auto downloads.
|-
| 0xC8A0D027
| This occurs under certain code paths.
<ol>
<li>Result translation of result error from:</li>
<ul><li>HTTP module</li></ul>
<ul><li>SSL module</li></ul>
<ul><li>NIM module if description is between 100 to 299 (inclusive), 200 descriptions to fit the reserved range of the SOAP manager internal error range of -4000 to -4199 </li></ul>
<li>Unexpected HTTP status, followed up also by generating error integer with 54400 + http status, result value used as a 005-xxxx error</li>
</ol>
|-
| 0xD960D028
| Generic XML parsing error. Not related to SOAP XML.
|-
| 0xD960D029
| XML processor stub function called. Not related to SOAP XML.
|-
| 0xD960D02A
| Generic XML data processing error: bad length or insufficient memory. Not related to SOAP XML.
|-
| 0xD960D02B
| Result translation of 0xD960D028.
|-
| 0xD960D02C
| Auto download programmed max task count exceeded trying to add more to list. (64)
|-
| 0xD960D02D
| tsl.xml or tsl.xml.tmp couldn't be opened. FS result translation of description between 100 and 179, inclusive.
|-
| 0xD960D02E
| During tsl.xml task condition check. Still unclear, type of task check
|-
| 0xD960D030
| During tsl.xml task condition check. Ticket missing for title when expected. Will not occur with autodbg flag bit 4 set.
|-
| 0xD960D031
| During tsl.xml task condition check. Title already installed when not overwrite mode.
|-
| 0xD960D032
| During tsl.xml task condition check. Task for title already exists with same or higher version in task.dat.
|-
| 0xD960D033
| During tsl.xml task condition check. Task for title already exists in task.dat.
|-
| 0xD8E0D034
| During tsl.xml task condition check. Unexpected task title type.
|-
| 0xD960D035
| During tsl.xml task condition check. Tsl.xml task will not be processed while max programmed maximum for tasks pending in task.dat is equal or exceeded. (10)
|-
| 0xD960D037
| Failed to load saved dtl.xml with result error of FS with description between 100 and 179, inclusive.
|-
| 0xD960D038
| During tsl.xml task condition check. Not enough space for target SDMC user title.
|-
| 0xD8A0D03A
| No valid NPNS X-Device-Token was available while trying to fetch it from CFG save block 0xF0006.
|-
| 0xD940D03B
| Selected tsl.xml task was cancelled with nim:u IPC cmd id 0x18.
|-
| 0xD960D03C
| Result translation for 0xD960D028 while trying to read XML. Not related to SOAP XML.
|-
| 0xD8A0D03D
| During tsl.xml task condition check. SDMC not inserted or non-writable for SDMC title. (bad media status)
|-
| 0xD960D03E
| During tsl.xml task condition check. Not enough space for target TWL user title.
|-
| 0xD940D03F
| NPNS notification url is not HTTPS.
|-
| 0xD940D040
| NIM ran into NPNS result 0xD8A15C07. Result translation.
|-
| 0xD860D041
| During tsl.xml task condition check. Pending task count of task.dat and installed SDMC user title count exceed programmed max. (300)
|-
| 0xD860D042
| During tsl.xml task condition check. Pending task count of task.dat and installed TWL user title count exceed programmed max. (40)
|-
| 0xD880D043
| HTTP 404 while fetching title crypto seed from kagiya.
|-
| 0xD880D044
| HTTP 503 while fetching title crypto seed from kagiya.
|-
| 0xC960D065
| SOAP EC/NUP manager internal error number translation of value -4001
|-
| 0xE0C0D066
| SOAP EC/NUP manager internal error number translation of value -4002
|-
| 0xE0E0D068
| SOAP EC/NUP manager internal error number translation of value -4004
|-
| 0xC860D069
| SOAP EC/NUP manager internal error number translation of value -4005
|-
| 0xC880D06A
| SOAP EC/NUP manager internal error number translation of value -4006
|-
| 0xC8A0D06B
| SOAP EC/NUP manager internal error number translation of value -4007
|-
| 0xC8A0D06C
| SOAP EC/NUP manager internal error number translation of value -4008
|-
| 0xC860D06E
| SOAP EC/NUP manager internal error number translation of value -4010
|-
| 0xC920D073
| SOAP EC/NUP manager internal error number translation of value -4015
|-
| 0xC900D075
| SOAP EC/NUP manager internal error number translation of value -4017
|-
| 0xC860D076
| SOAP EC/NUP manager internal error number translation of value -4018
|-
| 0xC920D077
| SOAP EC/NUP manager internal error number translation of value -4019
|-
| 0xC900D084
| SOAP EC/NUP manager internal error number translation of value -4032
|-
| 0xC900D085
| SOAP EC/NUP manager internal error number translation of value -4033
|-
| 0xC920D086
| SOAP EC/NUP manager internal error number translation of value -4034
|-
| 0xC920D08A
| SOAP EC/NUP manager internal error number translation of value -4038
|-
| 0xC900D08B
| SOAP EC/NUP manager internal error number translation of value -4039
|-
| 0xC920D08C
| SOAP EC/NUP manager internal error number translation of value -4040
|-
| 0xE0A0D08D
| SOAP EC/NUP manager internal error number translation of value -4041
|-
| 0xC920D08F
| SOAP EC/NUP manager internal error number translation of value -4043
|-
| 0xC920D095
| SOAP EC/NUP manager internal error number translation of value -4049
|-
| 0xE0E0D099
| SOAP EC/NUP manager internal error number translation of value -4053
|-
| 0xC900D09F
| SOAP EC/NUP manager internal error number translation of value -4059
|-
| 0xE100D0A0
| SOAP EC/NUP manager internal error number translation of value -4060
|-
| 0xE100D0A1
| SOAP EC/NUP manager internal error number translation of value -4061
|-
| 0xC920D0A4
| SOAP EC/NUP manager internal error number translation of value -4064
|-
| 0xC920D0A7
| SOAP EC/NUP manager internal error number translation of value -4067
|-
| 0xC920D0A8
| SOAP EC/NUP manager internal error number translation of value -4068
|-
| 0xE0A0D0A9
| SOAP EC/NUP manager internal error number translation of value -4069
|-
| 0xC920D0AD
| SOAP EC/NUP manager internal error number translation of value -4073
|-
| 0xC920D0B1
| SOAP EC/NUP manager internal error number translation of value -4077
|-
| 0xC920D0B3
| SOAP EC/NUP manager internal error number translation of value -4079
|-
| 0xC920D0B5
| SOAP EC/NUP manager internal error number translation of value -4081
|}

==NPNS Results==

NPNS has a module number for results, but no module exists, but can be at least in part found inside NIM.

{| class="wikitable" border="1"
|-
! Result
! Description
|-
| 0xC9215C00
| Result translation, HTTP result 0xD8A0A018.
|-
| 0xD8615C01
| Allocation error, insufficient memory.
|-
| 0xD8A15C02
| HTTP non 2xx, json message processing, default error code switch result error.
|-
| 0xD8A15C03
| JSON processing errors.
|-
| 0xD8A15C04
| Notifications array bigger than expected.
|-
| 0xD8A15C05
| HTTP Empty body response.
|-
| 0xD8A15C06
| HTTP non 2xx, json message processing, error code 1003 given in json body.
|-
| 0xD8A15C07
| HTTP non 2xx, json message processing, error code 1000 given in json body.
|-
| 0xD8A15C08
| HTTP non 2xx, json message processing, error code 1004 given in json body.
|}

==Other Results==

Any other result that is not given by other modules as a response, but found internally in NIM.

{| class="wikitable" border="1"
|-
! Result
! Module value
! Description
|-
| 0xD8600801
| Util (2)
| Encoding errors. In NIM, if error while encoding base64 for X-Authentication-Key or X-Authentication-Data HTTP parameters.
|}

NIM Services

2023-03-05T21:47:07Z

Luigoalma: This should be all NIM specific results codes, that are not using the common descriptions numbers

[[Category:Services]]
= NIM updater service "nim:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[NIMU:StartNetworkUpdate|StartNetworkUpdate]]
|-
| 0x00020000
| [[NIMU:GetProgress|GetProgress]]
|-
| 0x00030000
| [[NIMU:Cancel|Cancel]]
|-
| 0x00040000
| [[NIMU:CommitSystemTitles|CommitSystemTitles]]
|-
| 0x00050000
| [[NIMU:GetBackgroundEventForMenu|GetBackgroundEventForMenu]]
|-
| 0x00060000
| [[NIMU:GetBackgroundEventForNews|GetBackgroundEventForNews]]
|-
| 0x00070000
| [[NIMU:FormatSaveData|FormatSaveData]]
|-
| 0x00080000
| [[NIMU:GetCustomerSupportCode|GetCustomerSupportCode]]
|-
| 0x00090000
| [[NIMU:IsCommittableAllSystemTitles|IsCommittableAllSystemTitles]]
|-
| 0x000A0000
| [[NIMU:GetBackgroundProgress|GetBackgroundProgress]]
|-
| 0x000B0000
| [[NIMU:GetSavedHash|GetSavedHash]]
|-
| 0x000C0082
| [[NIMU:UnregisterTask|UnregisterTask]]
|-
| 0x000D0080
| [[NIMU:IsRegistered|IsRegistered]]
|-
| 0x000E0080
| [[NIMU:FindTaskInfo|FindTaskInfo]]
|-
| 0x000F0042
| [[NIMU:GetTaskInfos|GetTaskInfos]]
|-
| 0x00100000
| [[NIMU:DeleteUnmanagedContexts|DeleteUnmanagedContexts]]
|-
| 0x00110000
| [[NIMU:UpdateAutoTitleDownloadTasksAsync|UpdateAutoTitleDownloadTasksAsync]]
|-
| 0x00120000
| [[NIMU:StartPendingAutoTitleDownloadTasksAsync|StartPendingAutoTitleDownloadTasksAsync]]
|-
| 0x00130000
| [[NIMU:GetAsyncResult|GetAsyncResult]]
|-
| 0x00140000
| [[NIMU:CancelAsyncCall|CancelAsyncCall]]
|-
| 0x00150000
| [[NIMU:IsPendingAutoTitleDownloadTasks|IsPendingAutoTitleDownloadTasks]]
|-
| 0x00160000
| [[NIMU:GetNumAutoTitleDownloadTasks|GetNumAutoTitleDownloadTasks]]
|-
| 0x00170042
| [[NIMU:GetAutoTitleDownloadTaskInfos|GetAutoTitleDownloadTaskInfos]]
|-
| 0x00180080
| [[NIMU:CancelAutoTitleDownloadTask|CancelAutoTitleDownloadTask]]
|-
| 0x00190002
| [[NIMU:SetAutoDbgDat|SetAutoDbgDat]]
|-
| 0x001A0002
| [[NIMU:GetAutoDbgDat|GetAutoDbgDat]]
|-
| 0x001B0042
| [[NIMU:SetDbgTasks|SetDbgTasks]]
|-
| 0x001C0042
| [[NIMU:GetDbgTasks|GetDbgTasks]]
|-
| 0x001D0000
| [[NIMU:DeleteDbgData|DeleteDbgData]]
|-
| 0x001E0042
| [[NIMU:SetTslXml|SetTslXml]]
|-
| 0x001F0000
| [[NIMU:GetTslXmlSize|GetTslXmlSize]]
|-
| 0x00200042
| [[NIMU:GetTslXml|GetTslXml]]
|-
| 0x00210000
| [[NIMU:DeleteTslXml|DeleteTslXml]]
|-
| 0x00220042
| [[NIMU:SetDtlXml|SetDtlXml]]
|-
| 0x00230000
| [[NIMU:GetDtlXmlSize|GetDtlXmlSize]]
|-
| 0x00240042
| [[NIMU:GetDtlXml|GetDtlXml]]
|-
| 0x00250000
| [[NIMU:UpdateAccountStatus|UpdateAccountStatus]]
|-
| 0x00260180
| [[NIMU:StartTitleDownload|StartTitleDownload]]
|-
| 0x00270000
| [[NIMU:StopTitleDownload|StopTitleDownload]]
|-
| 0x00280000
| [[NIMU:GetTitleDownloadProgress|GetTitleDownloadProgress]]
|-
| 0x00290246
| [[NIMU:RegisterTask|RegisterTask]]
|-
| 0x002A0000
| [[NIMU:IsSystemUpdateAvailable|IsSystemUpdateAvailable]]
|-
| 0x002B0000
| ? (Response: 0 = 0x002B0040, 1 = Result Code)
|-
| 0x002C0000
| [[NIMU:UpdateTickets|UpdateTickets]]
|-
| 0x002D00C0
| [[NIMU:DownloadTitleSeedAsync|DownloadTitleSeedAsync]]
|-
| 0x002E0000
| [[NIMU:DownloadMissingTitleSeedsAsync|DownloadMissingTitleSeedsAsync]]
|-
|}

= NIM server service "nim:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010200
| [[NIMS:StartDownloadSimple|StartDownloadSimple]]
|-
| 0x00020000
| [[NIMS:CancelDownload|CancelDownload]]
|-
| 0x00030000
| [[NIMS:GetProgress|GetProgress]]
|-
| 0x00050082
| [[NIMS:UnregisterTask|UnregisterTask]]
|-
| 0x00060080
| [[NIMS:IsTaskRegistered|IsTaskRegistered]]
|-
| 0x000A0000
| [[NIMS:CheckSysupdateAvailableSOAP|CheckSysupdateAvailableSOAP]]
|-
| 0x000B0084
| [[NIMS:SetAttribute|SetAttribute]]
|-
| 0x0016020A
| [[NIMS:ListTitles|ListTitles]]
|-
| 0x00220080
| AccountDeleteTitleETicketsSOAP. The SOAP request is sent only after the ticket for the specified titleID has been successfully deleted.
|-
| 0x00290000
| [[NIMS:AccountCheckBalanceSOAP|AccountCheckBalanceSOAP]]
|-
| 0x002D0042
| [[NIMS:DownloadTickets|DownloadTickets]]
|-
| 0x003C0002
| [[NIMS:RegisterSelf|RegisterSelf]]
|-
| 0x003F0000
| GetInitializeResult. Checks whether nim is properly initialized or not. If it is not, the result code returned is non-zero.
|-
| 0x00420240
| [[NIMS:StartDownload|StartDownload]]
|-
| 0x00550246
| [[NIMS:RegisterTask|RegisterTask]]
|-
| 0x00570082
| [[NIMS:ConnectNoTicketDownload|ConnectNoTicketDownload]]
|}

= NIM server service "nim:aoc" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00030042
| SetApplicationId
|-
| 0x00040042
| SetTin
|-
| 0x000902D0
| ListContentSetsEx
|-
| 0x00180000
| GetBalance
|-
| 0x001D0000
| GetCustomerSupportCode
|-
| 0x00210000
| Initialize
|-
| 0x00240282
| CalculateContentsRequiredSize
|-
| 0x00250000
| RefreshServerTime
|}

= NIM service "nim:ndm" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| GetDaemonEventHandle
|-
| 0x00020000
| Does nothing, always returns 0
|-
| 0x00030000
| SetDaemonToWorkingState
|-
| 0x00040040
| SetDaemonToSuspendedState
|-
| 0x00050000
| GetDaemonState
|-
|}

= kagiya server =
The nim system module communicates with a server called kagiya (kagiya-ctr.cdn.nintendo.net or kagiya-dev-ctr.cdn.nintendo.net for development units). It provides the 9.6 crypto seed in binary form for any given title ID under (HTTPS) kagiya-ctr.cdn.nintendo.net/title/0x%16llx/ext_key?country=%s, where %16llx is the title ID and %s is a country code as used in the [[EShop|eShop]].

=New3DS=
NIM module only uses [[PTMSYSM:CheckNew3DS|CheckNew3DS]] for determining what heap sizes to use, in two functions. One is for the size of the 0x08000000 vmem heap, the other is probably for some buffer allocated on that heap. The New3DS version of these sizes are 0x1C000-bytes larger than the Old3DS sizes here.

=HTTPS requests=

==Trusted RootCAs==
During startup NIM-module creates two RootCertChains with [[HTTP_Services|HTTPC]]. Both of these only contain the same [[HTTPC:RootCertChainAddDefaultCert|default]] cert with ID 0x3. The first RootCertChain is used with NetUpdateSOAP. Requests such as the "notifications.json" page don't use these RootCertChains(in this case just [[HTTPC:AddDefaultCert|default]] certID 0xB is used).

==SOAP==

===NetUpdateSOAP===
There are exactly 3 types of network SOAP requests used with [https://nus.c.shop.nintendowifi.net/nus/services/NetUpdateSOAP NetUpdateSOAP] by NIM module, described below. This URL contained in NIM module itself is only used with GetSystemTitleHash. The other requests use an identical URL loaded from an ECommerceSOAP response instead.

See also [https://github.com/yellows8/ninupdates here].

====GetSystemUpdate====
Returns the current sysupdate title-listing. This also contains the SystemTitleHash returned by GetSystemTitleHash.

====GetSystemTitleHash====
Returns the current SystemTitleHash for the current sysupdate title-listing.

====GetSystemCommonETicket====
Returns the Base64-encoded cetk for each specified TitleId entry.

This is only used when installing new titles. This means with CDN system-updates, tickets are never installed except when a title is being installed for the first time. For example, a system on the latest system-version that was only ever updated via CDN has the same NATIVE_FIRM ticket installed from the factory.

=Sysupdate checking process=
This section describes the process used when checking whether a sysupdate is required.

First the GetSystemTitleHash SOAP request is done. Then the SystemTitleHash in savedata hash.dat is compared with the received one. If they match and the SystemTitleHash flag is set to value 0x03, it will immediately return that no sysupdate is required. Otherwise it will start the GetSystemUpdate SOAP request handling.

The GetSystemUpdate SOAP request contains a titlelist of all NAND system-titles. For GetSystemUpdate response parsing, it compares each SOAP title_entry with the NAND system titlelist. If a SOAP titleID isn't found in the NAND titlelist, this means NAND is missing a new title and hence a sysupdate is required for installing that title. If a NAND title_entry-version is less than the SOAP title_entry-version, this means the title needs updated and hence a sysupdate is required.

At least one <TitleVersion> entry with valid data in the GetSystemUpdate response is required.

The titleIDs sent in the GetSystemUpdate SOAP request are decimal, while the titleIDs in the response are hex.

=NIM [[System_SaveData]]=
==hash.dat==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x60
| 0x1
| u8 flag used with the SystemTitleHash. 0x01 = latest sysupdate isn't installed as of last SOAP requests, 0x03 = latest sysupdate is installed as of last SOAP requests.
|-
| 0x61
| 0x21
| ASCII hex SystemTitleHash, including NUL-terminator. This is the latest SystemTitleHash which NIM module received from SOAP.
|}

=Types=

==SystemUpdateProgress==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x01
| [[#SystemUpdateState|System Update State]]
|-
| 0x01
| 0x03
| Padding
|-
| 0x04
| 0x04
| Last Operation Result Code
|-
| 0x08
| 0x08
| Current Title Downloaded Bytes
|-
| 0x10
| 0x08
| Current Title Total Bytes
|-
| 0x18
| 0x08
| Titles Downloaded
|-
| 0x20
| 0x08
| Titles Total
|}

==SystemUpdateState==

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Not Initialized
|-
| 1
| Starting System Update
|-
| 2
| Fetching System Hash and Account Status
|-
| 3
| Installing New Tickets
|-
| 4
| Installing Titles
|-
| 5
| Update Complete
|-
| 6
| Failed - System Updates Disabled (Dev Units Only)
|-
| 7
| ? (Only for background updates)
|-
| 8
| ? (Only for background updates)
|}

==TitleDownloadProgress==
{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x01
| [[#TitleDownloadState|Title Download State]]
|-
| 0x01
| 0x03
| Padding
|-
| 0x04
| 0x04
| Last Operation Result Code
|-
| 0x08
| 0x08
| Downloaded Bytes
|-
| 0x10
| 0x08
| Total Bytes
|}

==TitleDownloadState==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Not Initialized
|-
| 1
| Starting Title Download
|-
| 2
| Downloading and Installing TMD
|-
| 3
| Committing TMD
|-
| 4
| Downloading and Installing Contents
|-
| 5
| Contents Installed
|-
| 6
| [[AM:CommitImportPrograms|Committing Titles]]
|-
| 7
| Finished
|-
| 8
| ? (Unknown error regarding title version?)
|-
| 9
| ? (Creating the .ctx file (or error doing so)?)
|-
| 10
| Background Download Failed
|}

==TitleDownloadConfig==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x08
| Title ID
|-
| 0x08
| 0x04
| Title version
|-
| 0x0C
| 0x04
| Unknown (always 0?)
|-
| 0x10
| 0x01
| Age Rating (for HOME Menu parental controls)
|-
| 0x11
| 0x01
| [[Filesystem_services#MediaType|Media Type]]
|-
| 0x12
| 0x02
| Padding
|-
| 0x14
| 0x04
| Unknown (always 0?)
|}

==BackgroundTitleDownloadConfig==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x018
| [[#TitleDownloadConfig|Title Download Config]]
|-
| 0x018
| 0x001
| Unknown
|-
| 0x019
| 0x001
| Unknown
|-
| 0x01A
| 0x006
| Padding
|-
| 0x020
| 0x008
| Requester Title ID
|-
| 0x028
| 0x090
| Title Name (UTF-16)
|-
| 0x0B8
| 0x002
| Title Name Forced NUL Terminator (always 0)
|-
| 0x0BA
| 0x048
| Developer Name (UTF-16)
|-
| 0x102
| 0x002
| Developer Name Forced NUL Terminator (always 0)
|}

==BackgroundTitleDownloadTaskInfo==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x104
| [[#BackgroundTitleDownloadConfig|Background Title Download Config]]
|-
| 0x104
| 0x004
| Padding
|-
| 0x108
| 0x018
| [[#TitleDownloadProgress|Title Download Progress]]
|}

==AutoTitleDownloadTaskInfo==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x008
| Task ID
|-
| 0x008
| 0x008
| Title ID
|-
| 0x010
| 0x004
| Title Version
|-
| 0x014
| 0x014
| Unknown
|-
| 0x028
| 0x008
| Required Storage Space
|-
| 0x030
| 0x004
| Last Operation Result code
|-
| 0x034
| 0x004
| Last Operation Customer Support Code
|-
| 0x038
| 0x090
| Title Name (UTF-16)
|-
| 0x0C8
| 0x002
| Title Name Forced NUL Terminator (always 0)
|-
| 0x0CA
| 0x048
| Developer Name (UTF-16)
|-
| 0x112
| 0x002
| Developer Name Forced NUL Terminator (always 0)
|-
| 0x114
| 0x024
| Unknown
|}

==InstallationMode==

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Initial Installation
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Re-installation
|}

==Autodbg==

Despite this being for debug purposes, it's used in retail if present.

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x004
| Debug flags
|-
| 0x004
| 0x004
| Number of debug tasks in dbgtasks.dat
|-
| 0x008
| 0x100
| Debug URL dst.xml override
|}

===Autodbg flag bits===

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| Use the tasks stored in dbgtasks.dat
|-
| 1
| Use provided debug dtl.xml URL override
|-
| 2
| Disable the download of dtl.xml
|-
| 3
| Skip connecting to SOAP EC and download ETickets with a false success result during TSL processing
|-
| 4
| Fake assume always ticket is present during TSL task condition processing
|-
| 5
| Skip NPNS notification fetch for auto title downloads with a false success result
|}

=Error Results=

==NIM Results==

{| class="wikitable" border="1"
|-
! Result
! Description
|-
| 0xE0E0D001
| Non-null terminated string on IPC parameter for given length.
|-
| 0xD960D003
| SOAP EC/NUP manager internal error number translation of unhandled values or -4199.
|-
| 0xD960D004
| Unexpected/invalid state enums. (generic)
|-
| 0xC820D005
| Invalid state under one title install manager.
|-
| 0xD8A0D006
| Error state enum value. (generic)
|-
| 0xC920D008
| When content downloading, HTTP Status was not 200 or 206 when connecting, and when status is 206, the Content-Range values failed sanity check.
|-
| 0xC920D009
| Mismatch system title hash with server system title hash.
|-
| 0xC960D00C
| Failed to convert country enum value in CFG save block 0xB0000 to country ISO 3166-1 Alpha-2 code.
|-
| 0xC960D00D
| CFG didn't reply any serial number or dummy serial number "000000000000000" was given.
|-
| 0xC860D00E
| Max total size exceeded for system update pending titles. (128 MiB)
|-
| 0xC880D00F
| *to be filled*
|-
| 0xC8E0D011
| Bad condition, title id for purpose or size under one title install manager.
|-
| 0xC960D012
| Invalid .dat or less than expected size of buffer length read from .dat save files during raw data load.
|-
| 0xC960D013
| Daemon service is suspended.
|-
| 0xC8A0D014
| *to be filled*
|-
| 0xC960D015
| Version mismatch for reinstall condition.
|-
| 0xC960D016
| Used in a few contexts where length does not match expected or the limit. Example, seed data size from HTTP is not 16 bytes.
|-
| 0xC920D017
| SetIVSData will not perform, conditions are not adequate to set IVS. In Service Standby mode or not registered successfully in IAS.
|-
| 0xC920D019
| Certain EC connect flows disallowed to continue while IVS is waiting to be synced from servers. System Transfer has previously occurred and IVS is pending.
|-
| 0xC920D01A
| For nim:s IPC cmd id 0x40, IVS not flagged for synchronization on target console on EC connect after system transfer.
|-
| 0xC960D01B
| Failed to convert language enum value in CFG save block 0xA0002 to language ISO 639-1 code.
|-
| 0xE0E0D01C
| Invalid installation mode for some IPC contexts.
|-
| 0xE0C0D01E
| May be either:
* Trying to set autodbg or dbgtasks with too many tasks on nim:u IPC cmd ids 0x19 and 0x1B, respectively.
* Non debug ENVINFO when calling debug version of get balance nim:s IPC cmd id 0x56.
* A boolean parameter for nim:s IPC cmd id 0x58 was set false.
|-
| 0xD860D020
| May be either:
* Result translation of 0xC860D06E if returned by the early attributes filter handler.
* If the internal Work-only heap fails to initialize with buffer length lesser than 32 bytes. This buffer is given over IPC.
|-
| 0xC860D021
| Task manager has run out of task slots.
|-
| 0xC920D022
| Buffer size too small for ticket length on nim:aoc IPC cmd id 0x1B.
|-
| 0xD880D023
| When Account Id missing for nim:aoc IPC cmd id 0x1B and 0x20 or when Account Id or Token are missing for nim:s IPC cmd id 0x53.
|-
| 0xD860D024
| Failed to initialize Data Heap using buffer given over IPC.
|-
| 0xD920D025
| SOAP reply implied that Service Standby mode is enabled. Certain EC flows cancelled.
|-
| 0xC8A0D026
| May be either:
* Result translation, NIM ran into NPNS result 0xD8A15C06 or NIM result 0xD960D02B.
* System updates pending while trying to SOAP EC connect with ETicket download while processing auto downloads.
|-
| 0xC8A0D027
| This occurs under certain code paths.
<ol>
<li>Result translation of result error from:</li>
<ul><li>HTTP module</li></ul>
<ul><li>SSL module</li></ul>
<ul><li>NIM module if description is between 100 to 299 (inclusive), 200 descriptions to fit the reserved range of the SOAP manager internal error range of -4000 to -4199 </li></ul>
<li>Unexpected HTTP status, followed up also by generating error integer with 54400 + http status, result value used as a 005-xxxx error</li>
</ol>
|-
| 0xD960D028
| Generic XML parsing error. Not related to SOAP XML.
|-
| 0xD960D029
| XML processor stub function called. Not related to SOAP XML.
|-
| 0xD960D02A
| Generic XML data processing error: bad length or insufficient memory. Not related to SOAP XML.
|-
| 0xD960D02B
| Result translation of 0xD960D028.
|-
| 0xD960D02C
| Auto download programmed max task count exceeded trying to add more to list. (64)
|-
| 0xD960D02D
| tsl.xml or tsl.xml.tmp couldn't be opened. FS result translation of description between 100 and 179, inclusive.
|-
| 0xD960D02E
| During tsl.xml task condition check. Still unclear, type of task check
|-
| 0xD960D030
| During tsl.xml task condition check. Ticket missing for title when expected. Will not occur with autodbg flag bit 4 set.
|-
| 0xD960D031
| During tsl.xml task condition check. Title already installed when not overwrite mode.
|-
| 0xD960D032
| During tsl.xml task condition check. Task for title already exists with same or higher version in task.dat.
|-
| 0xD960D033
| During tsl.xml task condition check. Task for title already exists in task.dat.
|-
| 0xD8E0D034
| During tsl.xml task condition check. Unexpected task title type.
|-
| 0xD960D035
| During tsl.xml task condition check. Tsl.xml task will not be processed while max programmed maximum for tasks pending in task.dat is equal or exceeded. (10)
|-
| 0xD960D037
| Failed to load saved dtl.xml with result error of FS with description between 100 and 179, inclusive.
|-
| 0xD960D038
| During tsl.xml task condition check. Not enough space for target SDMC user title.
|-
| 0xD8A0D03A
| No valid NPNS X-Device-Token was available while trying to fetch it from CFG save block 0xF0006.
|-
| 0xD940D03B
| Selected tsl.xml task was cancelled with nim:u IPC cmd id 0x18.
|-
| 0xD960D03C
| Result translation for 0xD960D028 while trying to read XML. Not related to SOAP XML.
|-
| 0xD8A0D03D
| During tsl.xml task condition check. SDMC not inserted or non-writable for SDMC title. (bad media status)
|-
| 0xD960D03E
| During tsl.xml task condition check. Not enough space for target TWL user title.
|-
| 0xD940D03F
| NPNS notification url is not HTTPS.
|-
| 0xD940D040
| NIM ran into NPNS result 0xD8A15C07. Result translation.
|-
| 0xD860D041
| During tsl.xml task condition check. Pending task count of task.dat and installed SDMC user title count exceed programmed max. (300)
|-
| 0xD860D042
| During tsl.xml task condition check. Pending task count of task.dat and installed TWL user title count exceed programmed max. (40)
|-
| 0xD880D043
| HTTP 404 while fetching title crypto seed from kagiya.
|-
| 0xD880D044
| HTTP 503 while fetching title crypto seed from kagiya.
|-
| 0xC960D065
| SOAP EC/NUP manager internal error number translation of value -4001
|-
| 0xE0C0D066
| SOAP EC/NUP manager internal error number translation of value -4002
|-
| 0xE0E0D068
| SOAP EC/NUP manager internal error number translation of value -4004
|-
| 0xC860D069
| SOAP EC/NUP manager internal error number translation of value -4005
|-
| 0xC880D06A
| SOAP EC/NUP manager internal error number translation of value -4006
|-
| 0xC8A0D06B
| SOAP EC/NUP manager internal error number translation of value -4007
|-
| 0xC8A0D06C
| SOAP EC/NUP manager internal error number translation of value -4008
|-
| 0xC860D06E
| SOAP EC/NUP manager internal error number translation of value -4010
|-
| 0xC920D073
| SOAP EC/NUP manager internal error number translation of value -4015
|-
| 0xC900D075
| SOAP EC/NUP manager internal error number translation of value -4017
|-
| 0xC860D076
| SOAP EC/NUP manager internal error number translation of value -4018
|-
| 0xC920D077
| SOAP EC/NUP manager internal error number translation of value -4019
|-
| 0xC900D084
| SOAP EC/NUP manager internal error number translation of value -4032
|-
| 0xC900D085
| SOAP EC/NUP manager internal error number translation of value -4033
|-
| 0xC920D086
| SOAP EC/NUP manager internal error number translation of value -4034
|-
| 0xC920D08A
| SOAP EC/NUP manager internal error number translation of value -4038
|-
| 0xC900D08B
| SOAP EC/NUP manager internal error number translation of value -4039
|-
| 0xC920D08C
| SOAP EC/NUP manager internal error number translation of value -4040
|-
| 0xE0A0D08D
| SOAP EC/NUP manager internal error number translation of value -4041
|-
| 0xC920D08F
| SOAP EC/NUP manager internal error number translation of value -4043
|-
| 0xC920D095
| SOAP EC/NUP manager internal error number translation of value -4049
|-
| 0xE0E0D099
| SOAP EC/NUP manager internal error number translation of value -4053
|-
| 0xC900D09F
| SOAP EC/NUP manager internal error number translation of value -4059
|-
| 0xE100D0A0
| SOAP EC/NUP manager internal error number translation of value -4060
|-
| 0xE100D0A1
| SOAP EC/NUP manager internal error number translation of value -4061
|-
| 0xC920D0A4
| SOAP EC/NUP manager internal error number translation of value -4064
|-
| 0xC920D0A7
| SOAP EC/NUP manager internal error number translation of value -4067
|-
| 0xC920D0A8
| SOAP EC/NUP manager internal error number translation of value -4068
|-
| 0xE0A0D0A9
| SOAP EC/NUP manager internal error number translation of value -4069
|-
| 0xC920D0AD
| SOAP EC/NUP manager internal error number translation of value -4073
|-
| 0xC920D0B1
| SOAP EC/NUP manager internal error number translation of value -4077
|-
| 0xC920D0B3
| SOAP EC/NUP manager internal error number translation of value -4079
|-
| 0xC920D0B5
| SOAP EC/NUP manager internal error number translation of value -4081
|}

==NPNS Results==

NPNS has a module number for results, but no module exists, but can be at least in part found inside NIM.

{| class="wikitable" border="1"
|-
! Result
! Description
|-
| 0xC9215C00
| Result translation, HTTP result 0xD8A0A018.
|-
| 0xD8615C01
| Allocation error, insufficient memory.
|-
| 0xD8A15C02
| HTTP non 2xx, json message processing, default error code switch result error.
|-
| 0xD8A15C03
| JSON processing errors.
|-
| 0xD8A15C04
| Notifications array bigger than expected.
|-
| 0xD8A15C05
| HTTP Empty body response.
|-
| 0xD8A15C06
| HTTP non 2xx, json message processing, error code 1003 given in json body.
|-
| 0xD8A15C07
| HTTP non 2xx, json message processing, error code 1000 given in json body.
|-
| 0xD8A15C08
| HTTP non 2xx, json message processing, error code 1004 given in json body.
|}

==Other Results==

Any other result that is not given by other modules as a response, but found internally in NIM.

{| class="wikitable" border="1"
|-
! Result
! Module value
! Description
|-
| 0xD8600801
| Util (2)
| Encoding errors. In NIM, if error while encoding base64 for X-Authentication-Key or X-Authentication-Data HTTP parameters.
|}

NIM Services

2023-03-04T19:35:21Z

Luigoalma: More result errors

[[Category:Services]]
= NIM updater service "nim:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[NIMU:StartNetworkUpdate|StartNetworkUpdate]]
|-
| 0x00020000
| [[NIMU:GetProgress|GetProgress]]
|-
| 0x00030000
| [[NIMU:Cancel|Cancel]]
|-
| 0x00040000
| [[NIMU:CommitSystemTitles|CommitSystemTitles]]
|-
| 0x00050000
| [[NIMU:GetBackgroundEventForMenu|GetBackgroundEventForMenu]]
|-
| 0x00060000
| [[NIMU:GetBackgroundEventForNews|GetBackgroundEventForNews]]
|-
| 0x00070000
| [[NIMU:FormatSaveData|FormatSaveData]]
|-
| 0x00080000
| [[NIMU:GetCustomerSupportCode|GetCustomerSupportCode]]
|-
| 0x00090000
| [[NIMU:IsCommittableAllSystemTitles|IsCommittableAllSystemTitles]]
|-
| 0x000A0000
| [[NIMU:GetBackgroundProgress|GetBackgroundProgress]]
|-
| 0x000B0000
| [[NIMU:GetSavedHash|GetSavedHash]]
|-
| 0x000C0082
| [[NIMU:UnregisterTask|UnregisterTask]]
|-
| 0x000D0080
| [[NIMU:IsRegistered|IsRegistered]]
|-
| 0x000E0080
| [[NIMU:FindTaskInfo|FindTaskInfo]]
|-
| 0x000F0042
| [[NIMU:GetTaskInfos|GetTaskInfos]]
|-
| 0x00100000
| [[NIMU:DeleteUnmanagedContexts|DeleteUnmanagedContexts]]
|-
| 0x00110000
| [[NIMU:UpdateAutoTitleDownloadTasksAsync|UpdateAutoTitleDownloadTasksAsync]]
|-
| 0x00120000
| [[NIMU:StartPendingAutoTitleDownloadTasksAsync|StartPendingAutoTitleDownloadTasksAsync]]
|-
| 0x00130000
| [[NIMU:GetAsyncResult|GetAsyncResult]]
|-
| 0x00140000
| [[NIMU:CancelAsyncCall|CancelAsyncCall]]
|-
| 0x00150000
| [[NIMU:IsPendingAutoTitleDownloadTasks|IsPendingAutoTitleDownloadTasks]]
|-
| 0x00160000
| [[NIMU:GetNumAutoTitleDownloadTasks|GetNumAutoTitleDownloadTasks]]
|-
| 0x00170042
| [[NIMU:GetAutoTitleDownloadTaskInfos|GetAutoTitleDownloadTaskInfos]]
|-
| 0x00180080
| [[NIMU:CancelAutoTitleDownloadTask|CancelAutoTitleDownloadTask]]
|-
| 0x00190002
| [[NIMU:SetAutoDbgDat|SetAutoDbgDat]]
|-
| 0x001A0002
| [[NIMU:GetAutoDbgDat|GetAutoDbgDat]]
|-
| 0x001B0042
| [[NIMU:SetDbgTasks|SetDbgTasks]]
|-
| 0x001C0042
| [[NIMU:GetDbgTasks|GetDbgTasks]]
|-
| 0x001D0000
| [[NIMU:DeleteDbgData|DeleteDbgData]]
|-
| 0x001E0042
| [[NIMU:SetTslXml|SetTslXml]]
|-
| 0x001F0000
| [[NIMU:GetTslXmlSize|GetTslXmlSize]]
|-
| 0x00200042
| [[NIMU:GetTslXml|GetTslXml]]
|-
| 0x00210000
| [[NIMU:DeleteTslXml|DeleteTslXml]]
|-
| 0x00220042
| [[NIMU:SetDtlXml|SetDtlXml]]
|-
| 0x00230000
| [[NIMU:GetDtlXmlSize|GetDtlXmlSize]]
|-
| 0x00240042
| [[NIMU:GetDtlXml|GetDtlXml]]
|-
| 0x00250000
| [[NIMU:UpdateAccountStatus|UpdateAccountStatus]]
|-
| 0x00260180
| [[NIMU:StartTitleDownload|StartTitleDownload]]
|-
| 0x00270000
| [[NIMU:StopTitleDownload|StopTitleDownload]]
|-
| 0x00280000
| [[NIMU:GetTitleDownloadProgress|GetTitleDownloadProgress]]
|-
| 0x00290246
| [[NIMU:RegisterTask|RegisterTask]]
|-
| 0x002A0000
| [[NIMU:IsSystemUpdateAvailable|IsSystemUpdateAvailable]]
|-
| 0x002B0000
| ? (Response: 0 = 0x002B0040, 1 = Result Code)
|-
| 0x002C0000
| [[NIMU:UpdateTickets|UpdateTickets]]
|-
| 0x002D00C0
| [[NIMU:DownloadTitleSeedAsync|DownloadTitleSeedAsync]]
|-
| 0x002E0000
| [[NIMU:DownloadMissingTitleSeedsAsync|DownloadMissingTitleSeedsAsync]]
|-
|}

= NIM server service "nim:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010200
| [[NIMS:StartDownloadSimple|StartDownloadSimple]]
|-
| 0x00020000
| [[NIMS:CancelDownload|CancelDownload]]
|-
| 0x00030000
| [[NIMS:GetProgress|GetProgress]]
|-
| 0x00050082
| [[NIMS:UnregisterTask|UnregisterTask]]
|-
| 0x00060080
| [[NIMS:IsTaskRegistered|IsTaskRegistered]]
|-
| 0x000A0000
| [[NIMS:CheckSysupdateAvailableSOAP|CheckSysupdateAvailableSOAP]]
|-
| 0x000B0084
| [[NIMS:SetAttribute|SetAttribute]]
|-
| 0x0016020A
| [[NIMS:ListTitles|ListTitles]]
|-
| 0x00220080
| AccountDeleteTitleETicketsSOAP. The SOAP request is sent only after the ticket for the specified titleID has been successfully deleted.
|-
| 0x00290000
| [[NIMS:AccountCheckBalanceSOAP|AccountCheckBalanceSOAP]]
|-
| 0x002D0042
| [[NIMS:DownloadTickets|DownloadTickets]]
|-
| 0x003C0002
| [[NIMS:RegisterSelf|RegisterSelf]]
|-
| 0x003F0000
| GetInitializeResult. Checks whether nim is properly initialized or not. If it is not, the result code returned is non-zero.
|-
| 0x00420240
| [[NIMS:StartDownload|StartDownload]]
|-
| 0x00550246
| [[NIMS:RegisterTask|RegisterTask]]
|-
| 0x00570082
| [[NIMS:ConnectNoTicketDownload|ConnectNoTicketDownload]]
|}

= NIM server service "nim:aoc" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00030042
| SetApplicationId
|-
| 0x00040042
| SetTin
|-
| 0x000902D0
| ListContentSetsEx
|-
| 0x00180000
| GetBalance
|-
| 0x001D0000
| GetCustomerSupportCode
|-
| 0x00210000
| Initialize
|-
| 0x00240282
| CalculateContentsRequiredSize
|-
| 0x00250000
| RefreshServerTime
|}

= NIM service "nim:ndm" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| GetDaemonEventHandle
|-
| 0x00020000
| Does nothing, always returns 0
|-
| 0x00030000
| SetDaemonToWorkingState
|-
| 0x00040040
| SetDaemonToSuspendedState
|-
| 0x00050000
| GetDaemonState
|-
|}

= kagiya server =
The nim system module communicates with a server called kagiya (kagiya-ctr.cdn.nintendo.net or kagiya-dev-ctr.cdn.nintendo.net for development units). It provides the 9.6 crypto seed in binary form for any given title ID under (HTTPS) kagiya-ctr.cdn.nintendo.net/title/0x%16llx/ext_key?country=%s, where %16llx is the title ID and %s is a country code as used in the [[EShop|eShop]].

=New3DS=
NIM module only uses [[PTMSYSM:CheckNew3DS|CheckNew3DS]] for determining what heap sizes to use, in two functions. One is for the size of the 0x08000000 vmem heap, the other is probably for some buffer allocated on that heap. The New3DS version of these sizes are 0x1C000-bytes larger than the Old3DS sizes here.

=HTTPS requests=

==Trusted RootCAs==
During startup NIM-module creates two RootCertChains with [[HTTP_Services|HTTPC]]. Both of these only contain the same [[HTTPC:RootCertChainAddDefaultCert|default]] cert with ID 0x3. The first RootCertChain is used with NetUpdateSOAP. Requests such as the "notifications.json" page don't use these RootCertChains(in this case just [[HTTPC:AddDefaultCert|default]] certID 0xB is used).

==SOAP==

===NetUpdateSOAP===
There are exactly 3 types of network SOAP requests used with [https://nus.c.shop.nintendowifi.net/nus/services/NetUpdateSOAP NetUpdateSOAP] by NIM module, described below. This URL contained in NIM module itself is only used with GetSystemTitleHash. The other requests use an identical URL loaded from an ECommerceSOAP response instead.

See also [https://github.com/yellows8/ninupdates here].

====GetSystemUpdate====
Returns the current sysupdate title-listing. This also contains the SystemTitleHash returned by GetSystemTitleHash.

====GetSystemTitleHash====
Returns the current SystemTitleHash for the current sysupdate title-listing.

====GetSystemCommonETicket====
Returns the Base64-encoded cetk for each specified TitleId entry.

This is only used when installing new titles. This means with CDN system-updates, tickets are never installed except when a title is being installed for the first time. For example, a system on the latest system-version that was only ever updated via CDN has the same NATIVE_FIRM ticket installed from the factory.

=Sysupdate checking process=
This section describes the process used when checking whether a sysupdate is required.

First the GetSystemTitleHash SOAP request is done. Then the SystemTitleHash in savedata hash.dat is compared with the received one. If they match and the SystemTitleHash flag is set to value 0x03, it will immediately return that no sysupdate is required. Otherwise it will start the GetSystemUpdate SOAP request handling.

The GetSystemUpdate SOAP request contains a titlelist of all NAND system-titles. For GetSystemUpdate response parsing, it compares each SOAP title_entry with the NAND system titlelist. If a SOAP titleID isn't found in the NAND titlelist, this means NAND is missing a new title and hence a sysupdate is required for installing that title. If a NAND title_entry-version is less than the SOAP title_entry-version, this means the title needs updated and hence a sysupdate is required.

At least one <TitleVersion> entry with valid data in the GetSystemUpdate response is required.

The titleIDs sent in the GetSystemUpdate SOAP request are decimal, while the titleIDs in the response are hex.

=NIM [[System_SaveData]]=
==hash.dat==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x60
| 0x1
| u8 flag used with the SystemTitleHash. 0x01 = latest sysupdate isn't installed as of last SOAP requests, 0x03 = latest sysupdate is installed as of last SOAP requests.
|-
| 0x61
| 0x21
| ASCII hex SystemTitleHash, including NUL-terminator. This is the latest SystemTitleHash which NIM module received from SOAP.
|}

=Types=

==SystemUpdateProgress==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x01
| [[#SystemUpdateState|System Update State]]
|-
| 0x01
| 0x03
| Padding
|-
| 0x04
| 0x04
| Last Operation Result Code
|-
| 0x08
| 0x08
| Current Title Downloaded Bytes
|-
| 0x10
| 0x08
| Current Title Total Bytes
|-
| 0x18
| 0x08
| Titles Downloaded
|-
| 0x20
| 0x08
| Titles Total
|}

==SystemUpdateState==

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Not Initialized
|-
| 1
| Starting System Update
|-
| 2
| Fetching System Hash and Account Status
|-
| 3
| Installing New Tickets
|-
| 4
| Installing Titles
|-
| 5
| Update Complete
|-
| 6
| Failed - System Updates Disabled (Dev Units Only)
|-
| 7
| ? (Only for background updates)
|-
| 8
| ? (Only for background updates)
|}

==TitleDownloadProgress==
{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x01
| [[#TitleDownloadState|Title Download State]]
|-
| 0x01
| 0x03
| Padding
|-
| 0x04
| 0x04
| Last Operation Result Code
|-
| 0x08
| 0x08
| Downloaded Bytes
|-
| 0x10
| 0x08
| Total Bytes
|}

==TitleDownloadState==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Not Initialized
|-
| 1
| Starting Title Download
|-
| 2
| Downloading and Installing TMD
|-
| 3
| Committing TMD
|-
| 4
| Downloading and Installing Contents
|-
| 5
| Contents Installed
|-
| 6
| [[AM:CommitImportPrograms|Committing Titles]]
|-
| 7
| Finished
|-
| 8
| ? (Unknown error regarding title version?)
|-
| 9
| ? (Creating the .ctx file (or error doing so)?)
|-
| 10
| Background Download Failed
|}

==TitleDownloadConfig==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x00
| 0x08
| Title ID
|-
| 0x08
| 0x04
| Title version
|-
| 0x0C
| 0x04
| Unknown (always 0?)
|-
| 0x10
| 0x01
| Age Rating (for HOME Menu parental controls)
|-
| 0x11
| 0x01
| [[Filesystem_services#MediaType|Media Type]]
|-
| 0x12
| 0x02
| Padding
|-
| 0x14
| 0x04
| Unknown (always 0?)
|}

==BackgroundTitleDownloadConfig==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x018
| [[#TitleDownloadConfig|Title Download Config]]
|-
| 0x018
| 0x001
| Unknown
|-
| 0x019
| 0x001
| Unknown
|-
| 0x01A
| 0x006
| Padding
|-
| 0x020
| 0x008
| Requester Title ID
|-
| 0x028
| 0x090
| Title Name (UTF-16)
|-
| 0x0B8
| 0x002
| Title Name Forced NUL Terminator (always 0)
|-
| 0x0BA
| 0x048
| Developer Name (UTF-16)
|-
| 0x102
| 0x002
| Developer Name Forced NUL Terminator (always 0)
|}

==BackgroundTitleDownloadTaskInfo==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x104
| [[#BackgroundTitleDownloadConfig|Background Title Download Config]]
|-
| 0x104
| 0x004
| Padding
|-
| 0x108
| 0x018
| [[#TitleDownloadProgress|Title Download Progress]]
|}

==AutoTitleDownloadTaskInfo==

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x008
| Task ID
|-
| 0x008
| 0x008
| Title ID
|-
| 0x010
| 0x004
| Title Version
|-
| 0x014
| 0x014
| Unknown
|-
| 0x028
| 0x008
| Required Storage Space
|-
| 0x030
| 0x004
| Last Operation Result code
|-
| 0x034
| 0x004
| Last Operation Customer Support Code
|-
| 0x038
| 0x090
| Title Name (UTF-16)
|-
| 0x0C8
| 0x002
| Title Name Forced NUL Terminator (always 0)
|-
| 0x0CA
| 0x048
| Developer Name (UTF-16)
|-
| 0x112
| 0x002
| Developer Name Forced NUL Terminator (always 0)
|-
| 0x114
| 0x024
| Unknown
|}

==InstallationMode==

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Initial Installation
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Re-installation
|}

==Autodbg==

Despite this being for debug purposes, it's used in retail if present.

{| class="wikitable" border="1"
|-
! Offset
! Length
! Description
|-
| 0x000
| 0x004
| Debug flags
|-
| 0x004
| 0x004
| Number of debug tasks in dbgtasks.dat
|-
| 0x008
| 0x100
| Debug URL dst.xml override
|}

===Autodbg flag bits===

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| Use the tasks stored in dbgtasks.dat
|-
| 1
| Use provided debug dtl.xml URL override
|-
| 2
| Disable the download of dtl.xml
|-
| 3
| Skip connecting to SOAP EC and download ETickets with a false success result during TSL processing
|-
| 4
| Fake assume always ticket is present during TSL task condition processing
|-
| 5
| Skip NPNS notification fetch for auto title downloads with a false success result
|}

=Error Results=

==NIM Results==

{| class="wikitable" border="1"
|-
! Result
! Description
|-
| 0xE0E0D001
| Non-null terminated string on IPC parameter for given length.
|-
| 0xD960D003
| SOAP EC/NUP manager internal error number translation of unhandled values or -4199.
|-
| 0xD960D004
| Unexpected/invalid state enums. (generic)
|-
| 0xC820D005
| Invalid state under one title install manager.
|-
| 0xD8A0D006
| Error state enum value. (generic)
|-
| 0xC920D009
| Mismatch system title hash with server system title hash.
|-
| 0xC860D00E
| Max total size exceeded for system update pending titles. (128 MiB)
|-
| 0xC8E0D011
| Bad condition, title id for purpose or size under one title install manager.
|-
| 0xC960D012
| Invalid .dat or less than expected size of buffer length read from .dat save files during raw data load.
|-
| 0xC960D013
| Daemon service is suspended.
|-
| 0xC960D015
| Version mismatch for reinstall condition.
|-
| 0xC920D019
| Certain EC connect flows disallowed to continue while IVS is waiting to be synced from servers. System Transfer has previously occurred and IVS is pending.
|-
| 0xC860D021
| Task manager has run out of task slots.
|-
| 0xD920D025
| SOAP reply implied that Service Standby mode is enabled. Certain EC flows cancelled.
|-
| 0xC8A0D026
| May be either:
* Result translation, NIM ran into NPNS result 0xD8A15C06 or NIM result 0xD960D02B.
* System updates pending while trying to SOAP EC connect with ETicket download while processing auto downloads.
|-
| 0xC8A0D027
| This occurs under certain code paths.
<ol>
<li>Result translation of result error from:</li>
<ul><li>HTTP module</li></ul>
<ul><li>SSL module</li></ul>
<ul><li>NIM module if description is between 100 to 299 (inclusive), 200 descriptions to fit the reserved range of the SOAP manager internal error range of -4000 to -4199 </li></ul>
<li>Unexpected HTTP status, followed up also by generating error integer with 54400 + http status, result value used as a 005-xxxx error</li>
</ol>
|-
| 0xD960D028
| Generic XML parsing error. Not related to SOAP XML.
|-
| 0xD960D029
| XML processor stub function called. Not related to SOAP XML.
|-
| 0xD960D02A
| Generic XML data processing error: bad length or insufficient memory. Not related to SOAP XML.
|-
| 0xD960D02B
| Result translation of 0xD960D028.
|-
| 0xD960D02D
| tsl.xml or tsl.xml.tmp couldn't be opened. FS result translation of description between 100 and 179, inclusive.
|-
| 0xD960D02E
| During tsl.xml task condition check. Still unclear, type of task check
|-
| 0xD960D030
| During tsl.xml task condition check. Ticket missing for title when expected. Will not occur with autodbg flag bit 4 set.
|-
| 0xD960D031
| During tsl.xml task condition check. Title already installed when not overwrite mode.
|-
| 0xD960D032
| During tsl.xml task condition check. Task for title already exists with same or higher version in task.dat.
|-
| 0xD960D033
| During tsl.xml task condition check. Task for title already exists in task.dat.
|-
| 0xD8E0D034
| During tsl.xml task condition check. Unexpected task title type.
|-
| 0xD960D035
| During tsl.xml task condition check. Tsl.xml task will not be processed while max programmed maximum for tasks pending in task.dat is equal or exceeded. (10)
|-
| 0xD960D037
| Failed to load saved dtl.xml with result error of FS with description between 100 and 179, inclusive.
|-
| 0xD960D038
| During tsl.xml task condition check. Not enough space for target SDMC user title.
|-
| 0xD8A0D03D
| During tsl.xml task condition check. SDMC not inserted or non-writable for SDMC title. (bad media status)
|-
| 0xD960D03E
| During tsl.xml task condition check. Not enough space for target TWL user title.
|-
| 0xD940D040
| NIM ran into NPNS result 0xD8A15C07. Result translation.
|-
| 0xD860D041
| During tsl.xml task condition check. Pending task count of task.dat and installed SDMC user title count exceed programmed max. (300)
|-
| 0xD860D042
| During tsl.xml task condition check. Pending task count of task.dat and installed TWL user title count exceed programmed max. (40)
|-
| 0xD880D043
| HTTP 404 while fetching title crypto seed from kagiya.
|-
| 0xD880D044
| HTTP 503 while fetching title crypto seed from kagiya.
|-
| 0xC960D065
| SOAP EC/NUP manager internal error number translation of value -4001
|-
| 0xE0C0D066
| SOAP EC/NUP manager internal error number translation of value -4002
|-
| 0xE0E0D068
| SOAP EC/NUP manager internal error number translation of value -4004
|-
| 0xC860D069
| SOAP EC/NUP manager internal error number translation of value -4005
|-
| 0xC880D06A
| SOAP EC/NUP manager internal error number translation of value -4006
|-
| 0xC8A0D06B
| SOAP EC/NUP manager internal error number translation of value -4007
|-
| 0xC8A0D06C
| SOAP EC/NUP manager internal error number translation of value -4008
|-
| 0xC860D06E
| SOAP EC/NUP manager internal error number translation of value -4010
|-
| 0xC920D073
| SOAP EC/NUP manager internal error number translation of value -4015
|-
| 0xC900D075
| SOAP EC/NUP manager internal error number translation of value -4017
|-
| 0xC860D076
| SOAP EC/NUP manager internal error number translation of value -4018
|-
| 0xC920D077
| SOAP EC/NUP manager internal error number translation of value -4019
|-
| 0xC900D084
| SOAP EC/NUP manager internal error number translation of value -4032
|-
| 0xC900D085
| SOAP EC/NUP manager internal error number translation of value -4033
|-
| 0xC920D086
| SOAP EC/NUP manager internal error number translation of value -4034
|-
| 0xC920D08A
| SOAP EC/NUP manager internal error number translation of value -4038
|-
| 0xC900D08B
| SOAP EC/NUP manager internal error number translation of value -4039
|-
| 0xC920D08C
| SOAP EC/NUP manager internal error number translation of value -4040
|-
| 0xE0A0D08D
| SOAP EC/NUP manager internal error number translation of value -4041
|-
| 0xC920D08F
| SOAP EC/NUP manager internal error number translation of value -4043
|-
| 0xC920D095
| SOAP EC/NUP manager internal error number translation of value -4049
|-
| 0xE0E0D099
| SOAP EC/NUP manager internal error number translation of value -4053
|-
| 0xC900D09F
| SOAP EC/NUP manager internal error number translation of value -4059
|-
| 0xE100D0A0
| SOAP EC/NUP manager internal error number translation of value -4060
|-
| 0xE100D0A1
| SOAP EC/NUP manager internal error number translation of value -4061
|-
| 0xC920D0A4
| SOAP EC/NUP manager internal error number translation of value -4064
|-
| 0xC920D0A7
| SOAP EC/NUP manager internal error number translation of value -4067
|-
| 0xC920D0A8
| SOAP EC/NUP manager internal error number translation of value -4068
|-
| 0xE0A0D0A9
| SOAP EC/NUP manager internal error number translation of value -4069
|-
| 0xC920D0AD
| SOAP EC/NUP manager internal error number translation of value -4073
|-
| 0xC920D0B1
| SOAP EC/NUP manager internal error number translation of value -4077
|-
| 0xC920D0B3
| SOAP EC/NUP manager internal error number translation of value -4079
|-
| 0xC920D0B5
| SOAP EC/NUP manager internal error number translation of value -4081
|}

==NPNS Results==

NPNS has a module number for results, but no module exists, but can be at least in part found inside NIM.

{| class="wikitable" border="1"
|-
! Result
! Description
|-
| 0xC9215C00
| Result translation, HTTP result 0xD8A0A018.
|-
| 0xD8615C01
| Allocation error, insufficient memory.
|-
| 0xD8A15C02
| HTTP non 2xx, json message processing, default error code switch result error.
|-
| 0xD8A15C03
| JSON processing errors.
|-
| 0xD8A15C04
| Notifications array bigger than expected.
|-
| 0xD8A15C05
| HTTP Empty body response.
|-
| 0xD8A15C06
| HTTP non 2xx, json message processing, error code 1003 given in json body.
|-
| 0xD8A15C07
| HTTP non 2xx, json message processing, error code 1000 given in json body.
|-
| 0xD8A15C08
| HTTP non 2xx, json message processing, error code 1004 given in json body.
|}

==Other Results==

Any other result that is not given by other modules as a response, but found internally in NIM.

{| class="wikitable" border="1"
|-
! Result
! Module value
! Description
|-
| 0xD8600801
| Util (2)
| Encoding errors. In NIM, if error while encoding base64 for X-Authentication-Key or X-Authentication-Data HTTP parameters.
|}

NIM Services

2023-03-04T18:51:17Z

Luigoalma: nim:ndm service

NIM Services

2023-03-04T15:56:38Z

Luigoalma: Correction of result error values, swapped myself accidentally while taking note of results

NIM Services

2023-03-04T00:58:07Z

Luigoalma: Add some extent of error codes. More to add later from reversal work.

NIM Services

2023-03-03T23:19:31Z

Luigoalma: Autodbg information

CTCert

2022-04-27T20:44:35Z

Luigoalma: Saying 01 is incorrect, its not always 1 that's loaded off dev OTP

=Summary=
The console-unique CTCert is used for signing [[Title Data Structure|CTX]] files, the DeviceCert used by [[eShop]], and for [[DSiWare_Exports|DSiWare]] exports. This ECDSA signature, the ECDSA private key for this cert, and the IssuerID is loaded from memory initialized by bootrom instead of NAND. This is the 3DS equivalent of the DSi TWCert.

The CTCert is signed with ECDSA by Nintendo. CTCerts can be verified via a DER stored in NATIVE_FIRM, separate DERs are used for retail and dev/debug.

=Structure=
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[Certificates|Signature]] Type, 0x010005.
|-
| 0x04
| 0x3C
| ECDSA Signature using Nintendo's private key, in big-endian. The first 0x1E bytes are "r"; the second 0x1E bytes are "s". The hash is SHA-256 computed over this certificate, starting at byte 0x80 ("Cert Issue ID") to the end.
|-
| 0x40
| 0x40
| Padding
|-
| 0x80
| 0x40
| Cert Issuer ID, for retail this is "Nintendo CA - G3_NintendoCTR2prod", for dev "Nintendo CA - G3_NintendoCTR2dev"
|-
| 0xC0
| 0x04
| Key Type
|-
| 0xC4
| 0x40
| Key ID: "CT<DeviceId>-<ConsoleType>", where DeviceId is the hex [[PSPXI:GetDeviceId|DeviceId]], and ConsoleType is 00 for retail, any other single byte hex value for dev
|-
| 0x104
| 0x04
| Expiration time as UNIX Timestamp in big endian.
|-
| 0x108
| 0x3C
| ECDSA Public Key of this console as a curve point in big-endian. The first 0x1E bytes are "x" of this point; the second 0x1E bytes are "y".
|-
| 0x144
| 0x3C
| Padding
|}

Boot ROM decrypts [[OTP Registers]] and writes the private key and Nintendo's signature of CTCert to [[Memory_layout#ARM9_ITCM|ARM9 ITCM]]; the public key is computed from the private key.

The curve used for ECDSA is sect233r1.

Process Services PXI

2022-04-15T14:20:12Z

Luigoalma: More clear information about exponents on RSA context

=Process Services PXI "pxi:ps9"=
{| class="wikitable" border="1"
|-
! Command Header (Pre 2.0)
! Command Header (Post 2.0)
! Available since system version
! Description
|-
| 0x000100C6
| 0x000100C6
| [[1.0.0-0]]
| This crypts a raw message with RSA.
|-
| 0x00020284
| 0x00020284
| [[1.0.0-0]]
| SignRsaSha256
|-
| 0x00030284
| 0x00030284
| [[1.0.0-0]]
| VerifyRsaSha256
|-
| 0x00040140
| Removed
| [[1.0.0-0]], removed with [[2.0.0-2]]
| SetAesKey
|-
| 0x000501C4
| 0x000401C4
| [[1.0.0-0]]
| [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]
|-
| 0x00060284
| 0x00050284
| [[1.0.0-0]]
| [[PSPXI:EncryptSignDecryptVerifyAesCcm|EncryptSignDecryptVerifyAesCcm]]
|-
| 0x00070000
| 0x00060000
| [[1.0.0-0]]
| GetRomId. This reads 0x40-bytes from [[Gamecards|gamecard]] command 0xC6 (gamecard-uniqueID), and returns the first 0x10-bytes from that since the rest of the command reply is all 0xFF-bytes.
|-
| 0x00080000
| 0x00070000
| [[1.0.0-0]]
| GetRomId2. The first u8 this returns is from GetRomMakerCode, the following 0x10-bytes are from [[AES|encrypting]] the 0x10-bytes which GetRomId also returns. This is encrypted with AES-CBC, the regular normal-key and IV set by [[FIRM|Process9]] for this are loaded from the Process9 .rodata section.
|-
| 0x00090000
| 0x00080000
| [[1.0.0-0]]
| [[PSPXI:GetCTRCardAutoStartupBit|GetCTRCardAutoStartupBit]]
|-
| 0x000A0000
| 0x00090000
| [[1.0.0-0]]
| GetRomMakerCode
|-
| 0x000B0000
| 0x000A0000
| [[1.0.0-0]]
| [[PSPXI:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x000C0000
| 0x000B0000
| [[1.0.0-0]]
| [[PSPXI:GetDeviceId|GetDeviceId]]
|-
| 0x000D0042
| 0x000C0042
| [[1.0.0-0]]
| SeedRNG
|-
| 0x000E0042
| 0x000D0042
| [[1.0.0-0]]
| [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x04010084
| 0x04010084
| [[8.1.0-0_New3DS]]
| GenerateAmiiboHMAC. [[New_3DS]]-only. cmd[1] = insize, cmd[2] = outsize, cmd[3] = (insize<<8) <nowiki>|</nowiki> 0x4, cmd[4] = inbufptr, cmd[5] = (outsize<<8) <nowiki>|</nowiki> 0x14, and cmd[6] = outbufptr.
|-
| 0x04020082
| 0x04020082
| [[8.1.0-0_New3DS]]
| GenerateAmiiboKeyData. [[New_3DS]]-only. cmd[1] = insize, cmd[2] = u8 flag, cmd[3] = (insize<<8) <nowiki>|</nowiki> 0x4, cmd[4] = inbufptr.
|-
| 0x04030044
| 0x04030044
| [[8.1.0-0_New3DS]]
| AmiiboEncryptDecrypt. [[New_3DS]]-only.
|-
| 0x04040044
| 0x04040044
| [[8.1.0-0_New3DS]]
| AmiiboEncryptDecryptDev. [[New_3DS]]-only.
|}

These RSA commands are an interface for using the [[RSA]] engine. The system will hang when it attempts to use a >RSA-2048 RSA bit-size with the RSA engine, since the [[RSA]] engine does not support >RSA-2048. These RSA commands have an input field specifying what RSA bit-size to use, but the RSA padding code is hard-coded to use RSA-2048.

The New3DS 0x040X commands(used for [[Amiibo]] crypto) were removed with [[9.3.0-21]], the code for that was moved into [[NFC_Services|NFC]]-module.

=Command 0x04010084=
The input buffer size must be <=0x1E0-bytes, and the out buffer size must be >0 and <=0x20-bytes. This calculates a SHA256-HMAC over the input buffer using the current already-generated [[Amiibo]] HMAC key(generated_amiibodata+0x20), the output hash is then written to the out buffer.

=Command 0x04020082=
This is used for [[Amiibo]] key generation. 0x30-bytes are generated. The input buffer size must be 0x40-bytes.

The input u8 must be either zero or non-zero, the used value varies depending on what crypto(AES/HMAC) operation is done after the crypto init.

Structure of the input buffer:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| This is the raw [[Amiibo]]-write counter u16 from page[4] byte1.
|-
| 0x2
| 0xE
| All-zero.
|-
| 0x10
| 0x8
| This is the first 8-bytes of the NFC tag serial-number(page0-1).
|-
| 0x18
| 0x8
| Same 8-bytes as above.
|-
| 0x20
| 0x20
| This is the plaintext hash from NFC tag page[0x18], which is the hash listed under the page 0x15 section [[Amiibo|here]].
|}

=Command 0x04030044=
This is used for the actual [[Amiibo]] AES crypto, max input buffer size is same as command 0x04010084. AES-CTR is used here. Normal-key = generated_amiibodata+0x0, CTR = generated_amiibodata+0x10(see command 0x04010084 regarding generated_amiibodata).

=Command 0x04040044=
Similar to 0x04030044, except this is devunit-only with dev-only keys.

=RSA Context=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Modulo
|-
| 0x100
| 0x100
| Exponent
|-
| 0x200
| 0x4
| RSA bit-size.
|-
| 0x204
| 0x1
| Exponent Type. 0 = Short Exponent, 1 = Long Exponent. See notes below.
|-
| 0x205
| 0x3
| Padding
|}

This context structure is fixed to 0x208-bytes.

Notes on exponents:
* When the type is a short exponent, the exponent field is used as an u32 field with little endianness.
** An example use of this type is to load the common public exponent, 0x10001.
* When a long exponent is set, the exponent field is a buffer of a big endian number instead.

Application Manager Services PXI

2022-04-15T09:58:47Z

Luigoalma: Update links and names to new command information

=Application Manager Services PXI "pxi:am9"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010040
| [[1.0.0-0]]
| [[AMPXI:GetTitleCount|GetTitleCount]]
|-
| 0x00020082
| [[1.0.0-0]]
| [[AMPXI:GetTitleList|GetTitleList]]
|-
| 0x00030084
| [[1.0.0-0]]
| [[AMPXI:GetTitleInfo|GetTitleInfo]]
|-
| 0x000400C0
| [[1.0.0-0]]
| [[AMPXI:DeleteTitle|DeleteTitle]]
|-
| 0x000500C0
| [[1.0.0-0]]
| [[AMPXI:GetTitleProductCode|GetTitleProductCode]]
|-
| 0x000600C0
| [[1.0.0-0]]
| [[AMPXI:GetTitleExtDataId|GetTitleExtDataId]]
|-
| 0x00070080
| [[1.0.0-0]]
| [[AMPXI:DeletePendingTitles|DeletePendingTitles]]
|-
| 0x00080080
| [[1.0.0-0]]
| [[AMPXI:InstallFIRM|InstallFIRM]]
|-
| 0x00090000
| [[1.0.0-0]]
| [[AMPXI:InstallTikBegin|InstallTikBegin]]
|-
| 0x000A0042
| [[1.0.0-0]]
| [[AMPXI:InstallTikWrite|InstallTikWrite]]
|-
| 0x000B0000
| [[1.0.0-0]]
| [[AMPXI:InstallTikAbort|InstallTikAbort]]
|-
| 0x000C0000
| [[1.0.0-0]]
| [[AMPXI:InstallTikFinish|InstallTikFinish]]
|-
| 0x000D0080
| [[1.0.0-0]]
| [[AMPXI:DeleteTicket|DeleteTicket]]
|-
| 0x000E0000
| [[1.0.0-0]]
| [[AMPXI:GetTicketCount|GetTicketCount]]
|-
| 0x000F0082
| [[1.0.0-0]]
| [[AMPXI:GetTicketList|GetTicketList]]
|-
| 0x00100100
| [[1.0.0-0]]
| [[AMPXI:InstallTitleBegin|InstallTitleBegin]]
|-
| 0x00110000
| [[1.0.0-0]]
| [[AMPXI:InstallTitleStop|InstallTitleStop]]
|-
| 0x001200C0
| [[1.0.0-0]]
| [[AMPXI:InstallTitleResume|InstallTitleResume]]
|-
| 0x00130000
| [[1.0.0-0]]
| [[AMPXI:InstallTmdBegin|InstallTmdBegin]]
|-
| 0x00140042
| [[1.0.0-0]]
| [[AMPXI:InstallTmdWrite|InstallTmdWrite]]
|-
| 0x00150000
| [[1.0.0-0]]
| [[AMPXI:InstallTmdAbort|InstallTmdAbort]]
|-
| 0x00160040
| [[1.0.0-0]]
| [[AMPXI:InstallTmdFinish|InstallTmdFinish]]
|-
| 0x00170040
| [[1.0.0-0]]
| [[AMPXI:InstallContentBegin|InstallContentBegin]]
|-
| 0x00180042
| [[1.0.0-0]]
| [[AMPXI:InstallContentWrite|InstallContentWrite]]
|-
| 0x00190000
| [[1.0.0-0]]
| [[AMPXI:InstallContentStop|InstallContentStop]]
|-
| 0x001A0000
| [[1.0.0-0]]
| [[AMPXI:InstallContentAbort|InstallContentAbort]]
|-
| 0x001B0040
| [[1.0.0-0]]
| [[AMPXI:InstallContentResume|InstallContentResume]]
|-
| 0x001C0000
| [[1.0.0-0]]
| [[AMPXI:InstallContentFinish|InstallContentFinish]]
|-
| 0x001D0080
| [[1.0.0-0]]
| [[AMPXI:GetPendingTitleCount|GetPendingTitleCount]]
|-
| 0x001E00C2
| [[1.0.0-0]]
| [[AMPXI:GetPendingTitleList|GetPendingTitleList]]
|-
| 0x001F0084
| [[1.0.0-0]]
| [[AMPXI:GetPendingTitleInfo|GetPendingTitleInfo]]
|-
| 0x002000C0
| [[1.0.0-0]]
| [[AMPXI:DeletePendingTitle|DeletePendingTitle]]
|-
| 0x002100C0
| [[1.0.0-0]]
| [[AMPXI:GetNumImportContentContexts|GetNumImportContentContexts]]
|-
| 0x00220102
| [[1.0.0-0]]
| [[AMPXI:GetImportContentContextList|GetImportContentContextList]]
|-
| 0x00230104
| [[1.0.0-0]]
| [[AMPXI:GetImportContentContexts|GetImportContentContexts]]
|-
| 0x00240102
| [[1.0.0-0]]
| [[AMPXI:DeleteImportContentContexts|DeleteImportContentContexts]]
|-
| 0x00250000
| [[1.0.0-0]]
| [[AMPXI:GetNumCurrentImportContentContexts|GetNumCurrentImportContentContexts]]
|-
| 0x00260042
| [[1.0.0-0]]
| [[AMPXI:GetCurrentImportContentContextList|GetCurrentImportContentContextList]]
|-
| 0x00270044
| [[1.0.0-0]]
| [[AMPXI:GetCurrentImportContentContexts|GetCurrentImportContentContexts]]
|-
| 0x00280000
| [[1.0.0-0]]
| [[AMPXI:InstallTitleAbort|InstallTitleAbort]]
|-
| 0x00290000
| [[1.0.0-0]]
| [[AMPXI:InstallTitleFinish|InstallTitleFinish]]
|-
| 0x002A00C2
| [[1.0.0-0]]
| [[AMPXI:InstallTitlesFinish|InstallTitlesFinish]]
|-
| 0x002B....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x002C....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x002D....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x002E....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x002F....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0030....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0031....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0032....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0033....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0034....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0035....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0036....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0037....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0038....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x00390146
| [[1.0.0-0]]
| [[AMPXI:Sign|Sign]]
|-
| 0x003A0146
| [[1.0.0-0]]
| Stubbed.
|-
| 0x003B0042
| [[1.0.0-0]]
| [[AMPXI:GetCTCert|GetCTCert]]
|-
| 0x003C0000
| [[1.0.0-0]]
| [[AMPXI:GetDeviceID|GetDeviceID]]
|-
| 0x003D0108
| [[1.0.0-0]]
| [[AMPXI:SetCertificates|SetCertificates]]
|-
| 0x003E0042
| [[1.0.0-0]]
| [[AMPXI:SetCertificate|SetCertificate]]
|-
| 0x003F0040
| [[1.0.0-0]]
| [[AMPXI:IsImportDatabaseInitialized|IsImportDatabaseInitialized]]
|-
| 0x00400040
| [[1.0.0-0]]
| [[AMPXI:DoCleanup|DoCleanup]]
|-
| 0x00410000
| [[1.0.0-0]]
| [[AMPXI:DeleteAllTemporaryPrograms|DeleteAllTemporaryPrograms]]
|-
| 0x00420142
| [[1.0.0-0]]
| [[AMPXI:InstallTitlesFinishFIRM|InstallTitlesFinishFIRM]]
|-
| 0x004301C8
| [[2.0.0-2]]
| [[AMPXI:VerifyDSiWareFooter|VerifyDSiWareFooter]]
|-
| 0x004400C4
| [[2.0.0-2]]
| This does basically nothing: after checking the two buffers' mem-ranges successfully(on failure it executes svcBreak like all other Process9 code for that), this just returns 0x0.
|-
| 0x00450108
| [[2.0.0-2]]
| [[AMPXI:DecryptDSiWareData|DecryptDSiWareData]]
|-
| 0x00460182
| [[2.0.0-2]]
| [[AMPXI:WriteTWLSavedata|WriteTWLSavedata]]
|-
| 0x00470080
| [[2.0.0-2]]
| [[AMPXI:InitializeTitleDatabase|InitializeTitleDatabase]]
|-
| 0x00480040
| [[2.0.0-2]]
| [[AMPXI:ReloadDBS|ReloadDBS]]
|-
| 0x00490080
| [[2.0.0-2]]
| [[AMPXI:GetNumTicketIds|GetNumTicketIds]]
|-
| 0x004A0102
| [[2.0.0-2]]
| [[AMPXI:GetTicketIdList|GetTicketIdList]]
|-
| 0x004B0100
| [[2.0.0-2]]
| [[AMPXI:DeleteTicketId|DeleteTicketId]]
|-
| 0x004C0042
| [[2.0.0-2]]
| [[AMPXI:GetPersonalizedTicketInfoList|GetPersonalizedTicketInfoList]]
|-
| 0x004D0144
| [[2.0.0-2]]
| [[AMPXI:ExportDSiWare|ExportDSiWare]]
|-
| 0x004E00C0
| [[2.0.0-2]]
| InstallTitleBeginDSi (?) (unknown_u64, u8_optype) The optype must be 5 or 11, but it's not used after validating it. Disabling using this in AM-sysmodule breaks DSiWare-importing. This is used right before [[AMPXI:InstallTmdBegin|InstallTmdBegin]] in AM-sysmodule.
|-
| 0x004F00C0
| [[2.0.0-2]]
| [[AMPXI:GetDSiWareExportSize|GetDSiWareExportSize]]
|-
| 0x00500044
| [[2.0.0-2]]
| [[AMPXI:GetTwlProgramListForReboot|GetTwlProgramListForReboot]]
|-
| 0x00510000
| [[2.0.0-2]]
| [[AMPXI:DeleteAllTwlUserPrograms|DeleteAllTwlUserPrograms]]
|-
| 0x00520040
| [[2.0.0-2]]
| [[AMPXI:DeleteAllExpiredUserPrograms|DeleteAllExpiredUserPrograms]]
|-
| 0x00530084
| [[2.0.0-2]]
| [[AMPXI:ValidateDSiWareMovableSedHash|ValidateDSiWareMovableSedHash]]
|-
| 0x00540000
| [[2.0.0-2]]
| [[AMPXI:GetTWLPartitionInfo|GetTWLPartitionInfo]]
|-
| 0x005500C4
| [[2.0.0-2]]
| [[AMPXI:ValidateDSiWareSectionMAC|ValidateDSiWareSectionMAC]]
|-
| 0x005600C0
| [[2.0.0-2]]
| [[AMPXI:CheckContentRights|CheckContentRights]]
|-
| 0x00570042
| [[4.0.0-7]]
| [[AMPXI:InstallTitleSetContentIndices|InstallTitleSetContentIndices]]
|-
| 0x005800C0
| [[4.0.0-7]]
| [[AMPXI:GetNumContentInfos|GetNumContentInfos]]
|-
| 0x00590104
| [[4.0.0-7]]
| [[AMPXI:FindContentInfos|FindContentInfos]]
|-
| 0x005A0142
| [[4.0.0-7]]
| [[AMPXI:ListContentInfos|ListContentInfos]]
|-
| 0x005B0000
| [[4.0.0-7]]
| [[AMPXI:GetNumCurrentContentInfos|GetNumCurrentContentInfos]]
|-
| 0x005C0044
| [[4.0.0-7]]
| ?
|-
| 0x005D0082
| [[4.0.0-7]]
| [[AMPXI:ListCurrentContentInfos|ListCurrentContentInfos]]
|-
| 0x005E0102
| [[4.0.0-7]]
| [[AMPXI:DeleteContents|DeleteContents]]
|-
| 0x005F0080
| [[4.0.0-7]]
| ?
|-
| 0x00600102
| [[4.0.0-7]]
| [[AMPXI:ListDataTitleTicketInfos|ListDataTitleTicketInfos]]
|-
| 0x00610142
| [[4.0.0-7]]
| [[AMPXI:ExportLicenseTicket|ExportLicenseTicket]]
|-
| 0x00620044
| [[4.0.0-7]]
| [[AMPXI:GetTicketLimitInfos|GetTicketLimitInfos]]
|-
| 0x00630042
| [[4.0.0-7]]
| [[AMPXI:UpdateImportContentContexts|UpdateImportContentContexts]]
|-
| 0x006400C0
| [[4.0.0-7]]
| [[AMPXI:GetInternalTitleLocationInfo|GetInternalTitleLocationInfo]]
|-
| 0x006500C0
| [[4.0.0-7]]
| [[AMPXI:MigrateAGBtoSAV|MigrateAGBtoSAV]]
|-
| 0x0066....
| [[4.0.0-7]]
| Stubbed starting with [[4.0.0-7]].
|-
| 0x00670082
| [[4.0.0-7]]
| [[AMPXI:DeleteProgramsAtomically|DeleteProgramsAtomically]]
|-
| 0x006801C2
| [[4.0.0-7]]
| [[AMPXI:GetItemRights|GetItemRights]]
|-
| 0x006900C0
| [[4.0.0-7]]
| [[AMPXI:IsDataTitleInUse|IsDataTitleInUse]]
|-
| 0x006A00C0
| [[4.0.0-7]]
| [[AMPXI:GetNumExistingContentInfos|GetNumExistingContentInfos]]
|-
| 0x006B0142
| [[4.0.0-7]]
| ?
|-
| 0x006C00C0
| [[5.0.0-11]]
| (u8 [[Mediatypes|Mediatype]], u64 programID)
|-
| 0x006D0184
| [[11.8.0-41]]
| [[AMPXI:ExportTicketWrapped|ExportTicketWrapped]]
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xC8A0802B
| This indicates the the [[Title_Database|dbs]] image(.db) does not exist, or opening the .db file failed.
|-
| 0xC8E083FC
| This error indicates that the title is already installed, with the same title-version as the title being installed?
|-
| 0xD8E08027
| Invalid title-version, or the title-version of the title being installed is older than the currently installed title-version.
|-
| 0xD8A08004
| Wrong installation state.
|-
| 0xD8E08020
| CIA file is empty.
|-
| 0xD8E08025
| Invalid NCCH. returned from InstallContentFinish
|-
| 0xD8A08029
| Error-type 1
|-
| 0xD8E08065
| Error-type -1
|-
| 0xD8E08065+1 / 0xD8E08066
| Error-type -2
|-
| 0xD8E08065+2 / 0xD8E08067
| Error-type -3. Returned when a CIA header is invalid.
|-
| 0xD8E08065+3 / 0xD8E08068
| Error-type -4
|-
| 0xD8E08065+4 / 0xD8E08069
| Error-type -5
|-
| 0xD8E08065+5 / 0xD8E0806A
| Error-type -6. Returned when a function returns error -2011: signature or hash check for cert(TMD/TIK/cert-chain, ...) failed.
|-
| 0xD8E08065+6 / 0xD8E0806B
| Error-type -7
|-
| 0xD8E08065+7 / 0xD8E0806C
| Error-type -8
|-
| 0xD8E08065+8 / 0xD8E0806D
| Error-type -9
|-
| 0xD8E08065+9 / 0xD8E0806E
| Error-type -10
|-
| 0xD8E08065+10 / 0xD8E0806F
| Error-type -11
|-
| 0xD8E08065+11 / 0xD8E08070
| Error-type -12
|-
| 0xD8E08065+12 / 0xD8E08071
| Error-type -13
|-
| 0xD8E08065+13 / 0xD8E08072
| Error-type -14
|-
| 0xD8A083FA
| Invalid titleID(?) / the specified title(s) don't exist.
|-
| 0xE0E0802C
| AM module returns this error when the system-title bit is set for the input CTR/TWL titleID-high, for [[AM:DeleteApplicationTitle]].
|}

AMPXI:InstallTitleStop

2022-04-15T09:56:27Z

Luigoalma: Small typographical error

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00110000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00110040]
|-
| 1
| Result code
|}

=Description=
Stops active title import initialized by [[AMPXI:InstallTitleBegin|AMPXI:InstallTitleBegin]] or resumed by [[AMPXI:InstallTitleResume|AMPXI:InstallTitleResume]].

The import is not cancelled and can later be resumed with [[AMPXI:InstallTitleResume|AMPXI:InstallTitleResume]].

AMPXI:InstallTitleAbort

2022-04-15T09:52:29Z

Luigoalma: Add actual title abort ampxi

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00280000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00280040]
|-
| 1
| Result code
|}

=Description=
Aborts active title import initialized by [[AMPXI:InstallTitleBegin|AMPXI:InstallTitleBegin]] or resumed by [[AMPXI:InstallTitleResume|AMPXI:InstallTitleResume]].

Cannot be resumed with [[AMPXI:InstallTitleResume|AMPXI:InstallTitleResume]] later.

AMPXI:InstallTitleStop

2022-04-15T09:49:01Z

Luigoalma: Description given about this command based on AM & PS9 behavior and binary reversal.

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00110000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00110040]
|-
| 1
| Result code
|}

=Description=
Stops active content import initialized by [[AMPXI:InstallTitleBegin|AMPXI:InstallTitleBegin]] or resumed by [[AMPXI:InstallTitleResume|AMPXI:InstallTitleResume]].

The import is not cancelled and can later be resumed with [[AMPXI:InstallTitleResume|AMPXI:InstallTitleResume]].

AMPXI:InstallTitleAbort

2022-04-15T09:43:42Z

Luigoalma: Luigoalma moved page AMPXI:InstallTitleAbort to AMPXI:InstallTitleStop: 0x00110000 is not Abort, stops for later resume

#REDIRECT [[AMPXI:InstallTitleStop]]

AMPXI:InstallTitleStop

2022-04-15T09:43:42Z

Luigoalma: Luigoalma moved page AMPXI:InstallTitleAbort to AMPXI:InstallTitleStop: 0x00110000 is not Abort, stops for later resume

Application Manager Services PXI

2022-04-15T09:41:04Z

Luigoalma: Update links to actual and new commands

=Application Manager Services PXI "pxi:am9"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010040
| [[1.0.0-0]]
| [[AMPXI:GetTitleCount|GetTitleCount]]
|-
| 0x00020082
| [[1.0.0-0]]
| [[AMPXI:GetTitleList|GetTitleList]]
|-
| 0x00030084
| [[1.0.0-0]]
| [[AMPXI:GetTitleInfo|GetTitleInfo]]
|-
| 0x000400C0
| [[1.0.0-0]]
| [[AMPXI:DeleteTitle|DeleteTitle]]
|-
| 0x000500C0
| [[1.0.0-0]]
| [[AMPXI:GetTitleProductCode|GetTitleProductCode]]
|-
| 0x000600C0
| [[1.0.0-0]]
| [[AMPXI:GetTitleExtDataId|GetTitleExtDataId]]
|-
| 0x00070080
| [[1.0.0-0]]
| [[AMPXI:DeletePendingTitles|DeletePendingTitles]]
|-
| 0x00080080
| [[1.0.0-0]]
| [[AMPXI:InstallFIRM|InstallFIRM]]
|-
| 0x00090000
| [[1.0.0-0]]
| [[AMPXI:InstallTikBegin|InstallTikBegin]]
|-
| 0x000A0042
| [[1.0.0-0]]
| [[AMPXI:InstallTikWrite|InstallTikWrite]]
|-
| 0x000B0000
| [[1.0.0-0]]
| [[AMPXI:InstallTikAbort|InstallTikAbort]]
|-
| 0x000C0000
| [[1.0.0-0]]
| [[AMPXI:InstallTikFinish|InstallTikFinish]]
|-
| 0x000D0080
| [[1.0.0-0]]
| [[AMPXI:DeleteTicket|DeleteTicket]]
|-
| 0x000E0000
| [[1.0.0-0]]
| [[AMPXI:GetTicketCount|GetTicketCount]]
|-
| 0x000F0082
| [[1.0.0-0]]
| [[AMPXI:GetTicketList|GetTicketList]]
|-
| 0x00100100
| [[1.0.0-0]]
| [[AMPXI:InstallTitleBegin|InstallTitleBegin]]
|-
| 0x00110000
| [[1.0.0-0]]
| [[AMPXI:InstallTitleAbort|InstallTitleAbort]]
|-
| 0x001200C0
| [[1.0.0-0]]
| [[AMPXI:InstallTitleResume|InstallTitleResume]]
|-
| 0x00130000
| [[1.0.0-0]]
| [[AMPXI:InstallTmdBegin|InstallTmdBegin]]
|-
| 0x00140042
| [[1.0.0-0]]
| [[AMPXI:InstallTmdWrite|InstallTmdWrite]]
|-
| 0x00150000
| [[1.0.0-0]]
| [[AMPXI:InstallTmdAbort|InstallTmdAbort]]
|-
| 0x00160040
| [[1.0.0-0]]
| [[AMPXI:InstallTmdFinish|InstallTmdFinish]]
|-
| 0x00170040
| [[1.0.0-0]]
| [[AMPXI:InstallContentBegin|InstallContentBegin]]
|-
| 0x00180042
| [[1.0.0-0]]
| [[AMPXI:InstallContentWrite|InstallContentWrite]]
|-
| 0x00190000
| [[1.0.0-0]]
| [[AMPXI:InstallContentStop|InstallContentStop]]
|-
| 0x001A0000
| [[1.0.0-0]]
| [[AMPXI:InstallContentAbort|InstallContentAbort]]
|-
| 0x001B0040
| [[1.0.0-0]]
| [[AMPXI:InstallContentResume|InstallContentResume]]
|-
| 0x001C0000
| [[1.0.0-0]]
| [[AMPXI:InstallContentFinish|InstallContentFinish]]
|-
| 0x001D0080
| [[1.0.0-0]]
| [[AMPXI:GetPendingTitleCount|GetPendingTitleCount]]
|-
| 0x001E00C2
| [[1.0.0-0]]
| [[AMPXI:GetPendingTitleList|GetPendingTitleList]]
|-
| 0x001F0084
| [[1.0.0-0]]
| [[AMPXI:GetPendingTitleInfo|GetPendingTitleInfo]]
|-
| 0x002000C0
| [[1.0.0-0]]
| [[AMPXI:DeletePendingTitle|DeletePendingTitle]]
|-
| 0x002100C0
| [[1.0.0-0]]
| [[AMPXI:GetNumImportContentContexts|GetNumImportContentContexts]]
|-
| 0x00220102
| [[1.0.0-0]]
| [[AMPXI:GetImportContentContextList|GetImportContentContextList]]
|-
| 0x00230104
| [[1.0.0-0]]
| [[AMPXI:GetImportContentContexts|GetImportContentContexts]]
|-
| 0x00240102
| [[1.0.0-0]]
| [[AMPXI:DeleteImportContentContexts|DeleteImportContentContexts]]
|-
| 0x00250000
| [[1.0.0-0]]
| [[AMPXI:GetNumCurrentImportContentContexts|GetNumCurrentImportContentContexts]]
|-
| 0x00260042
| [[1.0.0-0]]
| [[AMPXI:GetCurrentImportContentContextList|GetCurrentImportContentContextList]]
|-
| 0x00270044
| [[1.0.0-0]]
| [[AMPXI:GetCurrentImportContentContexts|GetCurrentImportContentContexts]]
|-
| 0x00280000
| [[1.0.0-0]]
| InstallTitleAbortDSi (?)
|-
| 0x00290000
| [[1.0.0-0]]
| [[AMPXI:InstallTitleFinish|InstallTitleFinish]]
|-
| 0x002A00C2
| [[1.0.0-0]]
| [[AMPXI:InstallTitlesFinish|InstallTitlesFinish]]
|-
| 0x002B....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x002C....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x002D....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x002E....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x002F....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0030....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0031....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0032....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0033....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0034....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0035....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0036....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0037....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x0038....
| [[1.0.0-0]]
| Stubbed.
|-
| 0x00390146
| [[1.0.0-0]]
| [[AMPXI:Sign|Sign]]
|-
| 0x003A0146
| [[1.0.0-0]]
| Stubbed.
|-
| 0x003B0042
| [[1.0.0-0]]
| [[AMPXI:GetCTCert|GetCTCert]]
|-
| 0x003C0000
| [[1.0.0-0]]
| [[AMPXI:GetDeviceID|GetDeviceID]]
|-
| 0x003D0108
| [[1.0.0-0]]
| [[AMPXI:SetCertificates|SetCertificates]]
|-
| 0x003E0042
| [[1.0.0-0]]
| [[AMPXI:SetCertificate|SetCertificate]]
|-
| 0x003F0040
| [[1.0.0-0]]
| [[AMPXI:IsImportDatabaseInitialized|IsImportDatabaseInitialized]]
|-
| 0x00400040
| [[1.0.0-0]]
| [[AMPXI:DoCleanup|DoCleanup]]
|-
| 0x00410000
| [[1.0.0-0]]
| [[AMPXI:DeleteAllTemporaryPrograms|DeleteAllTemporaryPrograms]]
|-
| 0x00420142
| [[1.0.0-0]]
| [[AMPXI:InstallTitlesFinishFIRM|InstallTitlesFinishFIRM]]
|-
| 0x004301C8
| [[2.0.0-2]]
| [[AMPXI:VerifyDSiWareFooter|VerifyDSiWareFooter]]
|-
| 0x004400C4
| [[2.0.0-2]]
| This does basically nothing: after checking the two buffers' mem-ranges successfully(on failure it executes svcBreak like all other Process9 code for that), this just returns 0x0.
|-
| 0x00450108
| [[2.0.0-2]]
| [[AMPXI:DecryptDSiWareData|DecryptDSiWareData]]
|-
| 0x00460182
| [[2.0.0-2]]
| [[AMPXI:WriteTWLSavedata|WriteTWLSavedata]]
|-
| 0x00470080
| [[2.0.0-2]]
| [[AMPXI:InitializeTitleDatabase|InitializeTitleDatabase]]
|-
| 0x00480040
| [[2.0.0-2]]
| [[AMPXI:ReloadDBS|ReloadDBS]]
|-
| 0x00490080
| [[2.0.0-2]]
| [[AMPXI:GetNumTicketIds|GetNumTicketIds]]
|-
| 0x004A0102
| [[2.0.0-2]]
| [[AMPXI:GetTicketIdList|GetTicketIdList]]
|-
| 0x004B0100
| [[2.0.0-2]]
| [[AMPXI:DeleteTicketId|DeleteTicketId]]
|-
| 0x004C0042
| [[2.0.0-2]]
| [[AMPXI:GetPersonalizedTicketInfoList|GetPersonalizedTicketInfoList]]
|-
| 0x004D0144
| [[2.0.0-2]]
| [[AMPXI:ExportDSiWare|ExportDSiWare]]
|-
| 0x004E00C0
| [[2.0.0-2]]
| InstallTitleBeginDSi (?) (unknown_u64, u8_optype) The optype must be 5 or 11, but it's not used after validating it. Disabling using this in AM-sysmodule breaks DSiWare-importing. This is used right before [[AMPXI:InstallTmdBegin|InstallTmdBegin]] in AM-sysmodule.
|-
| 0x004F00C0
| [[2.0.0-2]]
| [[AMPXI:GetDSiWareExportSize|GetDSiWareExportSize]]
|-
| 0x00500044
| [[2.0.0-2]]
| [[AMPXI:GetTwlProgramListForReboot|GetTwlProgramListForReboot]]
|-
| 0x00510000
| [[2.0.0-2]]
| [[AMPXI:DeleteAllTwlUserPrograms|DeleteAllTwlUserPrograms]]
|-
| 0x00520040
| [[2.0.0-2]]
| [[AMPXI:DeleteAllExpiredUserPrograms|DeleteAllExpiredUserPrograms]]
|-
| 0x00530084
| [[2.0.0-2]]
| [[AMPXI:ValidateDSiWareMovableSedHash|ValidateDSiWareMovableSedHash]]
|-
| 0x00540000
| [[2.0.0-2]]
| [[AMPXI:GetTWLPartitionInfo|GetTWLPartitionInfo]]
|-
| 0x005500C4
| [[2.0.0-2]]
| [[AMPXI:ValidateDSiWareSectionMAC|ValidateDSiWareSectionMAC]]
|-
| 0x005600C0
| [[2.0.0-2]]
| [[AMPXI:CheckContentRights|CheckContentRights]]
|-
| 0x00570042
| [[4.0.0-7]]
| [[AMPXI:InstallTitleSetContentIndices|InstallTitleSetContentIndices]]
|-
| 0x005800C0
| [[4.0.0-7]]
| [[AMPXI:GetNumContentInfos|GetNumContentInfos]]
|-
| 0x00590104
| [[4.0.0-7]]
| [[AMPXI:FindContentInfos|FindContentInfos]]
|-
| 0x005A0142
| [[4.0.0-7]]
| [[AMPXI:ListContentInfos|ListContentInfos]]
|-
| 0x005B0000
| [[4.0.0-7]]
| [[AMPXI:GetNumCurrentContentInfos|GetNumCurrentContentInfos]]
|-
| 0x005C0044
| [[4.0.0-7]]
| ?
|-
| 0x005D0082
| [[4.0.0-7]]
| [[AMPXI:ListCurrentContentInfos|ListCurrentContentInfos]]
|-
| 0x005E0102
| [[4.0.0-7]]
| [[AMPXI:DeleteContents|DeleteContents]]
|-
| 0x005F0080
| [[4.0.0-7]]
| ?
|-
| 0x00600102
| [[4.0.0-7]]
| [[AMPXI:ListDataTitleTicketInfos|ListDataTitleTicketInfos]]
|-
| 0x00610142
| [[4.0.0-7]]
| [[AMPXI:ExportLicenseTicket|ExportLicenseTicket]]
|-
| 0x00620044
| [[4.0.0-7]]
| [[AMPXI:GetTicketLimitInfos|GetTicketLimitInfos]]
|-
| 0x00630042
| [[4.0.0-7]]
| [[AMPXI:UpdateImportContentContexts|UpdateImportContentContexts]]
|-
| 0x006400C0
| [[4.0.0-7]]
| [[AMPXI:GetInternalTitleLocationInfo|GetInternalTitleLocationInfo]]
|-
| 0x006500C0
| [[4.0.0-7]]
| [[AMPXI:MigrateAGBtoSAV|MigrateAGBtoSAV]]
|-
| 0x0066....
| [[4.0.0-7]]
| Stubbed starting with [[4.0.0-7]].
|-
| 0x00670082
| [[4.0.0-7]]
| [[AMPXI:DeleteProgramsAtomically|DeleteProgramsAtomically]]
|-
| 0x006801C2
| [[4.0.0-7]]
| [[AMPXI:GetItemRights|GetItemRights]]
|-
| 0x006900C0
| [[4.0.0-7]]
| [[AMPXI:IsDataTitleInUse|IsDataTitleInUse]]
|-
| 0x006A00C0
| [[4.0.0-7]]
| [[AMPXI:GetNumExistingContentInfos|GetNumExistingContentInfos]]
|-
| 0x006B0142
| [[4.0.0-7]]
| ?
|-
| 0x006C00C0
| [[5.0.0-11]]
| (u8 [[Mediatypes|Mediatype]], u64 programID)
|-
| 0x006D0184
| [[11.8.0-41]]
| [[AMPXI:ExportTicketWrapped|ExportTicketWrapped]]
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xC8A0802B
| This indicates the the [[Title_Database|dbs]] image(.db) does not exist, or opening the .db file failed.
|-
| 0xC8E083FC
| This error indicates that the title is already installed, with the same title-version as the title being installed?
|-
| 0xD8E08027
| Invalid title-version, or the title-version of the title being installed is older than the currently installed title-version.
|-
| 0xD8A08004
| Wrong installation state.
|-
| 0xD8E08020
| CIA file is empty.
|-
| 0xD8E08025
| Invalid NCCH. returned from InstallContentFinish
|-
| 0xD8A08029
| Error-type 1
|-
| 0xD8E08065
| Error-type -1
|-
| 0xD8E08065+1 / 0xD8E08066
| Error-type -2
|-
| 0xD8E08065+2 / 0xD8E08067
| Error-type -3. Returned when a CIA header is invalid.
|-
| 0xD8E08065+3 / 0xD8E08068
| Error-type -4
|-
| 0xD8E08065+4 / 0xD8E08069
| Error-type -5
|-
| 0xD8E08065+5 / 0xD8E0806A
| Error-type -6. Returned when a function returns error -2011: signature or hash check for cert(TMD/TIK/cert-chain, ...) failed.
|-
| 0xD8E08065+6 / 0xD8E0806B
| Error-type -7
|-
| 0xD8E08065+7 / 0xD8E0806C
| Error-type -8
|-
| 0xD8E08065+8 / 0xD8E0806D
| Error-type -9
|-
| 0xD8E08065+9 / 0xD8E0806E
| Error-type -10
|-
| 0xD8E08065+10 / 0xD8E0806F
| Error-type -11
|-
| 0xD8E08065+11 / 0xD8E08070
| Error-type -12
|-
| 0xD8E08065+12 / 0xD8E08071
| Error-type -13
|-
| 0xD8E08065+13 / 0xD8E08072
| Error-type -14
|-
| 0xD8A083FA
| Invalid titleID(?) / the specified title(s) don't exist.
|-
| 0xE0E0802C
| AM module returns this error when the system-title bit is set for the input CTR/TWL titleID-high, for [[AM:DeleteApplicationTitle]].
|}

AMPXI:InstallContentAbort

2022-04-15T09:39:21Z

Luigoalma: Add actual content abort command

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001A0000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001A0040]
|-
| 1
| Result code
|}

=Description=
Aborts active content import initialized by [[AMPXI:InstallContentBegin|AMPXI:InstallContentBegin]] or resumed by [[AMPXI:InstallContentResume|AMPXI:InstallContentResume]].

Cannot be resumed with [[AMPXI:InstallContentResume|AMPXI:InstallContentResume]] later.

AMPXI:InstallContentStop

2022-04-15T09:35:16Z

Luigoalma: Description given about this command based on AM & PS9 behavior and binary reversal.

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00190000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00190040]
|-
| 1
| Result code
|}

=Description=
Stops active content import initialized by [[AMPXI:InstallContentBegin|AMPXI:InstallContentBegin]] or resumed by [[AMPXI:InstallContentResume|AMPXI:InstallContentResume]].

The import is not cancelled and can later be resumed with [[AMPXI:InstallContentResume|AMPXI:InstallContentResume]].

AMPXI:InstallContentAbort

2022-04-15T09:22:54Z

Luigoalma: Luigoalma moved page AMPXI:InstallContentAbort to AMPXI:InstallContentStop: 0x00190000 is not abort, its stopping content import for later resume

#REDIRECT [[AMPXI:InstallContentStop]]

AMPXI:InstallContentStop

2022-04-15T09:22:54Z

Luigoalma: Luigoalma moved page AMPXI:InstallContentAbort to AMPXI:InstallContentStop: 0x00190000 is not abort, its stopping content import for later resume

Process Services PXI

2022-02-01T01:02:53Z

Luigoalma: Found information from reversing all PS versions and some P9 binaries and given named based on what used for

=Process Services PXI "pxi:ps9"=
{| class="wikitable" border="1"
|-
! Command Header (Pre 2.0)
! Command Header (Post 2.0)
! Available since system version
! Description
|-
| 0x000100C6
| 0x000100C6
| [[1.0.0-0]]
| This crypts a raw message with RSA.
|-
| 0x00020284
| 0x00020284
| [[1.0.0-0]]
| SignRsaSha256
|-
| 0x00030284
| 0x00030284
| [[1.0.0-0]]
| VerifyRsaSha256
|-
| 0x00040140
| Removed
| [[1.0.0-0]], removed with [[2.0.0-2]]
| SetAesKey
|-
| 0x000501C4
| 0x000401C4
| [[1.0.0-0]]
| [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]
|-
| 0x00060284
| 0x00050284
| [[1.0.0-0]]
| [[PSPXI:EncryptSignDecryptVerifyAesCcm|EncryptSignDecryptVerifyAesCcm]]
|-
| 0x00070000
| 0x00060000
| [[1.0.0-0]]
| GetRomId. This reads 0x40-bytes from [[Gamecards|gamecard]] command 0xC6 (gamecard-uniqueID), and returns the first 0x10-bytes from that since the rest of the command reply is all 0xFF-bytes.
|-
| 0x00080000
| 0x00070000
| [[1.0.0-0]]
| GetRomId2. The first u8 this returns is from GetRomMakerCode, the following 0x10-bytes are from [[AES|encrypting]] the 0x10-bytes which GetRomId also returns. This is encrypted with AES-CBC, the regular normal-key and IV set by [[FIRM|Process9]] for this are loaded from the Process9 .rodata section.
|-
| 0x00090000
| 0x00080000
| [[1.0.0-0]]
| [[PSPXI:GetCTRCardAutoStartupBit|GetCTRCardAutoStartupBit]]
|-
| 0x000A0000
| 0x00090000
| [[1.0.0-0]]
| GetRomMakerCode
|-
| 0x000B0000
| 0x000A0000
| [[1.0.0-0]]
| [[PSPXI:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x000C0000
| 0x000B0000
| [[1.0.0-0]]
| [[PSPXI:GetDeviceId|GetDeviceId]]
|-
| 0x000D0042
| 0x000C0042
| [[1.0.0-0]]
| SeedRNG
|-
| 0x000E0042
| 0x000D0042
| [[1.0.0-0]]
| [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x04010084
| 0x04010084
| [[8.1.0-0_New3DS]]
| GenerateAmiiboHMAC. [[New_3DS]]-only. cmd[1] = insize, cmd[2] = outsize, cmd[3] = (insize<<8) <nowiki>|</nowiki> 0x4, cmd[4] = inbufptr, cmd[5] = (outsize<<8) <nowiki>|</nowiki> 0x14, and cmd[6] = outbufptr.
|-
| 0x04020082
| 0x04020082
| [[8.1.0-0_New3DS]]
| GenerateAmiiboKeyData. [[New_3DS]]-only. cmd[1] = insize, cmd[2] = u8 flag, cmd[3] = (insize<<8) <nowiki>|</nowiki> 0x4, cmd[4] = inbufptr.
|-
| 0x04030044
| 0x04030044
| [[8.1.0-0_New3DS]]
| AmiiboEncryptDecrypt. [[New_3DS]]-only.
|-
| 0x04040044
| 0x04040044
| [[8.1.0-0_New3DS]]
| AmiiboEncryptDecryptDev. [[New_3DS]]-only.
|}

These RSA commands are an interface for using the [[RSA]] engine. The system will hang when it attempts to use a >RSA-2048 RSA bit-size with the RSA engine, since the [[RSA]] engine does not support >RSA-2048. These RSA commands have an input field specifying what RSA bit-size to use, but the RSA padding code is hard-coded to use RSA-2048.

The New3DS 0x040X commands(used for [[Amiibo]] crypto) were removed with [[9.3.0-21]], the code for that was moved into [[NFC_Services|NFC]]-module.

=Command 0x04010084=
The input buffer size must be <=0x1E0-bytes, and the out buffer size must be >0 and <=0x20-bytes. This calculates a SHA256-HMAC over the input buffer using the current already-generated [[Amiibo]] HMAC key(generated_amiibodata+0x20), the output hash is then written to the out buffer.

=Command 0x04020082=
This is used for [[Amiibo]] key generation. 0x30-bytes are generated. The input buffer size must be 0x40-bytes.

The input u8 must be either zero or non-zero, the used value varies depending on what crypto(AES/HMAC) operation is done after the crypto init.

Structure of the input buffer:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| This is the raw [[Amiibo]]-write counter u16 from page[4] byte1.
|-
| 0x2
| 0xE
| All-zero.
|-
| 0x10
| 0x8
| This is the first 8-bytes of the NFC tag serial-number(page0-1).
|-
| 0x18
| 0x8
| Same 8-bytes as above.
|-
| 0x20
| 0x20
| This is the plaintext hash from NFC tag page[0x18], which is the hash listed under the page 0x15 section [[Amiibo|here]].
|}

=Command 0x04030044=
This is used for the actual [[Amiibo]] AES crypto, max input buffer size is same as command 0x04010084. AES-CTR is used here. Normal-key = generated_amiibodata+0x0, CTR = generated_amiibodata+0x10(see command 0x04010084 regarding generated_amiibodata).

=Command 0x04040044=
Similar to 0x04030044, except this is devunit-only with dev-only keys.

=RSA Context=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Modulo
|-
| 0x100
| 0x100
| Exponent
|-
| 0x200
| 0x4
| RSA bit-size.
|-
| 0x204
| 0x1
| 0 = Public Exponent, 1 = Private Exponent
|-
| 0x205
| 0x3
| Padding
|}

This context structure is fixed to 0x208-bytes.

Homebrew Exploits

2020-09-10T00:46:40Z

Luigoalma:

==Payload==
{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Description
! Supported firmwares
|-
| style="background: lightgreen" | Yes
| [https://smealum.github.io/3ds/ *hax payload]
| Booted by all of the below non-sysmodule exploits. '''No longer needed as of [https://github.com/AuroraWright/Luma3DS/releases/tag/v8.0 Luma 8.0]'''
| From '''9.0.0-7''' up to '''11.9.0-42'''.
|}

For the rest of this page, "Supported firmwares" refers to the exploit ''itself'', not whether *hax payload supports it.

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system. ''Please'' see the above Payload section regarding what "Supported firmwares" indicates ''exactly''.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: lightgreen" | Yes
| [[ninjhax|Ninjhax 2.x]]
| From '''9.0.0-7''' up to and including '''11.9.X'''.
| A cartridge or eShop version (JPN-only, not available anymore for purchase) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [http://plutooo.github.io/freakyhax/ freakyhax]
| From '''9.0.0-7''' up to and including '''11.9.X'''.
| A cartridge or eShop version (USA/EUR/JPN, not available anymore for purchase) of "Freakyform Deluxe".
| plutoo
| [http://plutooo.github.io/freakyhax/ Install]
|-
| style="background: salmon" | No
| [http://plutooo.github.io/smilehax/ smilehax]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (JPN all versions up to 3.32 excluded, USA 3.31 only)
| plutoo
| [http://plutooo.github.io/smilehax/ Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/zoogie/smilehax-IIe smilehax IIe]
| From '''9.0.0-7''' up to and including '''11.13.0-45'''
| SmileBASIC (JPN version 3.3.2 via app downgrade, USA/EUR 3.6.0, aka latest app version)
| zoogie
| [https://github.com/zoogie/smilehax-IIe/releases/latest Install]
|-
| style="background: salmon" | No
| [http://mrnbayoh.github.io/basicsploit/ BASICSploit]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (USA all versions)
| MrNbaYoh
| [http://mrnbayoh.github.io/basicsploit/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''11.9.0-37'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo (prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| From '''9.0.0-2''' to '''11.0.0-33'''
Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| A USA, EUR, JPN, or KOR system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|-
| style="background: salmon" | No
| [https://github.com/svanheulen/genhax genhax]
| (New 3DS only) From '''9.9.0-X''' up to and including '''11.2.0-X'''.
| A gamecard or eShop-install of Monster Hunter X (JPN only), and the DLC encryption key (see installer instructions). '''Note: the secondary exploit still works, see bellow'''
| svanheulen
| [https://github.com/svanheulen/genhax_installer Install]
|-
| style="background: salmon" | No
| [https://github.com/nedwill/soundhax soundhax]
| From '''9.0.0-13''' up to and including '''11.3.0-36'''.
| A USA, EUR, JPN or KOR system.
| nedwill
| [http://soundhax.com Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/MrNbaYoh/doodlebomb doodlebomb]
| From '''9.0.0-X'''(?) up to and including '''11.6.0-X'''.
| An eShop-install of Swapdoodle (version 1.1.1 or lower). As of 2017-4-26, version 1.1.2 was released, blocking outdated app version from sending or receiving messages.
| MrNbaYoh
| [https://mrnbayoh.github.io/doodlebomb/ Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/MrNbaYoh/rpwng2 RPwnG 2]
| From '''1.1.7-X'''(?) up to and including '''11.9.0-X'''.
| A digital copy of RPG Maker Player (free) ver. 1.1.4 on EUR, ver. 1.1.2 on USA. A 3DS on firmware 11.7.
| MrNbaYoh
| [https://mrnbayoh.github.io/rpwng2/ Install]
|-
| style="background: darkorange" | Only if installed before August 28, 2017
| [https://twitter.com/MrNbaYoh/status/899394739543437313 RPwnG]
| From '''9.0.0-X'''(?) up to and including '''11.9.0-X'''.
| An digital copy of RPG Maker Player (free) ver. 1.1.4 on EUR, ver. 1.1.2 on USA/JPN is required. As of August 28, 2017 the code is instantly removed after publishing.
| MrNbaYoh
| [https://mrnbayoh.github.io/rpwng/ Install]
|-
| style="background: salmon" | No
| [https://github.com/MrNbaYoh/notehax notehax]
| From '''9.9.0-X''' up to and including '''11.5.0-X'''.
| A digital copy of Flipnote Studio 3D on ver 1.3.1 (JPN) and ver 1.0.0 for EUR/USA (not the latest)
| MrNbaYoh
| [https://mrnbayoh.github.io/notehax/ Install]
|-
| style="background: darkorange" | Only if you already purchased Blockfactory before it was removed from the eShop
| [https://github.com/Stary2001/haxfactory haxfactory]
| From '''9.0.0-X'''(?) up to and including '''11.9.0-X'''.
| A digital copy of "Blockfactory" (USA/EUR)
| Stary2001
| [https://github.com/Stary2001/haxfactory Install]
|}

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own. ''Please'' see the above Payload section regarding what "Supported firmwares" indicates ''exactly''.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: lightgreen" | Yes
| [http://vegaroxas.github.io/ steelhax]
| From '''9.0.0-X''' up to and including '''11.9.0-X'''
| A copy of Steel Diver: Sub Wars
| Vegaroxas
| [https://github.com/VegaRoXas/vegaroxas.github.io/raw/master/files/steelhax-installer.zip Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''11.9.0-X''', for '''X''' up to and including 39.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Before compression was introduced in the 2016-7-18 release, the size of the *hax payload meant the exploit can't co-exist with regular saves on a physical version of the game.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| JPN/USA/EUR: From '''9.0.0-X''' up to and including '''11.2.0-X'''.
KOR: From '''9.6.0-X''' up to and including '''11.2.0-X'''.
| JPN/USA/EUR: Having created [[Home_Menu#Home_Menu_Theme_SD_ExtData|theme extdata]] through opening the official theme selector at least once.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to '''11.9.0-X'''.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: salmon" | No
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1). v1.1 patches out the overflow vulnerability used by (v*)hax.
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''11.9.0-X'''.
| An eShop-install of Citizens of Earth (either v1 or v2), featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|-
| style="background: salmon" | No
| [http://mrnbayoh.github.io/basehaxx/ basehaxx]
| From '''9.0.0-X''' up to and including '''11.9.0-X'''.
| A gamecard or eShop-install of Pokémon Omega Ruby / Alpha Sapphire.
| MrNbaYoh
| [http://mrnbayoh.github.io/basehaxx/ install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/stickerhax stickerhax]
| From '''9.0.0-X''' up to and including '''11.6.0-X'''.
| A gamecard or eShop-install of Paper Mario: Sticker Star.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/stickerhax Here]
|-
| style="background: lightgreen" | Yes
| [https://github.com/svanheulen/genhax genhax]
| (New 3DS only) From '''9.9.0-X'''(JPN) or '''10.3.0-X'''(EUR/USA) up to and including '''11.3.0-X'''.
| A gamecard or eShop-install of Monster Hunter Generations or Monster Hunter X (without the game updates installed), and an internet connection during installation.
| svanheulen
| [https://github.com/svanheulen/genhax_installer Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/MrNbaYoh/painthax painthax]
| From '''9.0.0-X''' up to and including '''11.6.0-X'''.
| An eShop-install of Pixel Paint.
| MrNbaYoh
| [https://github.com/MrNbaYoh/painthax/releases/latest install]
|-
| style="background: salmon" | No
| [https://github.com/yellows8/ctpkpwn ctpkpwn_tfh]
| From '''9.9.0-X''' up to and including '''11.3.0-X'''.
| A gamecard or eShop-install of "The Legend of Zelda: Tri Force Heroes", and an Internet connection during installation. Unless you have "CFW", ctr-httpwn >=v1.2 with the included bosshaxx on a compatible system-version is also required. If installing via ctr-httpwn, you can't do so on >=v11.4. Note that the exploit itself was not fixed.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/ctpkpwn/releases Install]
|-
| style="background: salmon" | No
| [https://github.com/MrNbaYoh/doodlebomb doodlebomb]
| From '''9.0.0-X'''(?) up to and including '''11.4.0-X'''.
| An eShop-install of Swapdoodle.
| MrNbaYoh
| [https://mrnbayoh.github.io/doodlebomb/ Install]
|-
| style="background: darkorange" | Only if installed before August 28, 2017
| [https://github.com/ChampionLeake/RPwnG3 RPwnG3]
| From '''9.0.0-X'''(?) up to and including '''11.12.0-X'''.
| A Digital/Physical copy of "RPGMaker Fes Player/RPGMaker Fes" (USA/JPN 1.1.2 or lower ; EUR 1.1.4 or lower).
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/RPwnG3/releases Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/luigoalma/nitpic3d nitpic3d]
| From '''9.6.0-X'''(?) up to and including '''11.13.0-X'''.
| A digital or physical of Picross 3D: Round 2
| Luigoalma and Kartik
| [https://github.com/luigoalma/nitpic3d Install]
|}

==Exploits without Homebrew Launcher==

<u>'''Warning:'''</u> The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format, but could still prove useful by chaining to exploits with higher privileges.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: lime" | Yes
| [[bannerbomb3]] (System Settings)
| (Old3DS (2DS) (XL) / New3DS (XL)) '''11.5.0''' to '''11.13.0'''

(New2DS XL) '''(11.4.0)''' '''11.5.0''' to '''11.13.0'''

An exploit that uses a buffer overflow in a TWL export banner's title strings to gain rop execution.
|A USA, EUR, KOR, or JPN system with its movable.sed keyY extracted.
|[[User:zoogie|zoogie]]
|[[bannerbomb3|Install]]
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''5.0.0-2''' to '''11.0.0-33''' (Pre-v5.0 is supported for some versions if you manually modify the source)

(New3DS) From '''9.0.0-20''' to '''11.0.0-33'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|-
| style="background: salmon" | No
| Ninjhax (with specialized payloads)
| Up to '''9.2.0-20'''?
|
| smea + independent developers
| N/A
|}

==Previous Exploits==
<u>'''Warning:'''</u> These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced (see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

[https://github.com/AuroraWright/Luma3DS Luma3DS], apart from providing signature patches for the installation and use of custom titles, includes the "Rosalina" system module, which among its features allows cleanly loading 3dsx applications as a native process with full ARM11 system permissions, by replacing an installed title's ExeFS and ExHeader during load time. It is currently the only option for running 3dsx applications on 11.4+ O3DSes; additionally, the *hax 2.x payload is incompatible with Rosalina and therefore so are homebrew applications requiring its target title system.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| style="background: salmon" | No, still usable pre-v11.4.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''11.3.0-X'''. This includes bosshaxx.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

3DS Userland Flaws

2020-09-10T00:31:11Z

Luigoalma:

This page lists vulnerabilities / exploits for 3DS applications and applets. Exploiting these initially results in ROP, from that ROP one can then for example try exploiting [[3DS_System_Flaws|system]] flaw(s).

=Non-system applications=
{| class="wikitable" border="1"
|-
! Application name
! Summary
! Description
! Fixed in app/system version
! Last app/system version this flaw was checked for
! Timeframe info related to this was added to wiki
! Timeframe this vuln was discovered
! Vuln discovered by
|-
| Cubic Ninja
| Map-data stack smash
| See [[Ninjhax|here]] regarding Ninjhax.
| None
| App: Initial version. System: [[10.4.0-29]].
| Ninjhax release
| July 2014
| [[User:smea|smea]]
|-
| The Legend of Zelda: Ocarina of Time 3D
| UTF-16 name string buffer overflow via unchecked u8 length field
| The u8 at offset 0x2C in the savefile is the character-length of the UTF-16 string at offset 0x1C. When copying this string, it's essentially a memory-copy with lenval*2, not a string-copy. This can be used to trigger buffer overflows at various locations depending on the string length.
* When value is >=0x6E it crashes when saving the saveslot, this causes a stack-smash however it normally crashes before it returns from the function which had the stack-frame overwritten.
* With value >=0x9A, it crashes via stack-smash in-game once any dialogs are opened(touching buttons on the touch-screen can trigger it too).
* Length value>=0xCD causes a crash while loading the saveslot, via a heap buffer overflow. This buf-overflow overwrites a heap memchunk following the allocated buffer. When the first 16-bits overwriting that heap memchunk is not the memchunk magic-number(0x7373), the mem-alloc code will just return a NULL ptr which later results in a crash. When the magic-number is valid, the mem-alloc code will continue to attempt to parse the memchunk, which may crash depending on the data which overwrote the memchunk. This heap code is separate from the CTRSDK heap code. Exploiting this doesn't seem to be possible: since the heap code actually verifies that the magic-number for the next/prev memchunk ptrs are correct(unlike CTRSDK), it's not possible to change those ptrs to useful arbitrary addresses outside of savedata(like with triggering a write to a c++ object ptr which later is used with a vtable func-call, this is what one would do with CTRSDK heap here).

On March 11, 2015, an exploit using this vuln was released, that one was intended for warez/etc. The following exploit wasn't released before then mainly because doing so would (presumably) result in the vuln being fixed. The following old exploit was released on March 14, 2015: [https://github.com/yellows8/oot3dhax].
| None
| App: Initial version. System: [[10.6.0-31]].
| March 11, 2015
| Around October 22, 2012
| [[User:Yellows8|Yellows8]]
|-
| Super Smash Bros 3DS
| Buffer overflow in local-multiplayer beacon handling.
| See [[smashbroshax|here]].
| App: v1.1.3
| See [[smashbroshax|here]]. System: [[10.3.0-28]].
| Time of exploit release.
| See [[smashbroshax|here]].
| [[User:Yellows8|Yellows8]]
|-
| Pokemon Super Mystery Dungeon
| Heap overflow within linear memory via unchecked save file length
| Pokemon Super Mystery Dungeon uses zlib compression for most of its save files, possibly due to the save files being larger than its predecessor, Gates to Infinity. When a save file is being prepared to be loaded and read from, only a 0x32000 large buffer is allocated for file reading, and a 0x3e800-large buffer for decompression is also allocated before the file is read. However, the game does not limit the size of the file read to this allocation bound, allowing for the file to overflow into the linear memory heap and into the next allocation. Since Pokemon Super Mystery Dungeon stores allocation memchunks directly before the allocation, overwriting the next memchunk with a corrupted one allows for arbitrary writes of linear heap pointers when the next buffer is allocated or arbitrary writes of any pointer within writable memory when the corrupted buffer is freed.
| None
| O3DS: [[11.3.0-36]]. N3DS: [[11.4.0-37]].
| Time of exploit release.
| April 14, 2016
| [[User:Shinyquagsire23|Shiny Quagsire]]
|-
| VVVVVV
| Buffer overflow in XML save file array parsing
| VVVVVV utilizes several XML files (renamed with a .vvv extension) to store level save data, stats and settings. Within these XML files are several tags containing an array of data which, when parsed, is not properly checked to be of proper length for the tag being parsed from. This allows for an overflow of 16-bit array values from the location where the array is parsed. With unlock.vvv, XML data is parsed to the stack, and with level saves the heap. This allows for the pointer where the level save worldmap tag array should be parsed into to be overwritten with a stack address, allowing for ROP from within the XML array parsing function on the next level load.
| App: v1.1
| [[10.7.0-32]].
| Time of exploit release.
| April 25, 2016
| [[User:Shinyquagsire23|Shiny Quagsire]]
|-
| Citizens of Earth
| Save file read stack smash
| Citizens of Earth also uses "XML" files for saves, which are actually entirely binary data (not XML at all) with no checksums. These files are read from the filesystem on to a fixed size stack buffer which leads to an incredibly trivial stack smash. When using the autosave slot for this, the save is parsed when the user selects "continue". When using one of the dedicated save slots (1-3), the save is parsed shortly after the company splash screens fade. Note that the save is read quite high (descending) on the stack - when exploiting this, one would likely need to move SP due to almost instantly overflowing the physical stack.
| None
| [[10.7.0-32]].
| Time of exploit release.
| May 5, 2016
| [[User:Dazzozo|Dazzozo]]
|-
| SmileBASIC 3.x
| Poor parameter validation on "BGSCREEN" command
| The SmileBASIC "BGSCREEN" command's second parameter is not properly validated as being within range. As a result, one can set the screen size to an absurdly large value. This means that the "BGGET" and "BGPUT" commands can then be used on out-of-range values to read and write a significant chunk of the interpreter's address space.
With a series of carefully-designed BGPUT commands, one can build a ROP chain and cause it to be executed.
| App: 3.3.2.
| System: [[11.0.0-33]].
| July 20, 2016
| Around June 26, 2016
| slackerSnail, 12Me12, incvoid
Exploited by MrNbaYoh and [[User:Plutooo|plutoo]].
|-
| SmileBASIC 3.x
| Subscripted TIME$/DATE$ allow write access to DATA/BSS
| Utf-16 characters can be assigned to subscripted TIME$/DATE$ interpreter sysvars which results in write-only access to all of DATA and some BSS in userland.
TIME$[0]/DATE$[0] actually point to somewhere in rodata, and an overly large subscript can be used to write well past it and into the aforementioned areas. Demo [https://github.com/zoogie/smilehax-IIe here.]
| App: 3.6.2 (3.6.0 latest for US/EU, JP appvers. can be downgraded)
| System: [[11.13.0-45]].
| April 2020
| February 2020
| bug publicly documented [https://translate.google.com/translate?sl=auto&tl=en&u=http%3A%2F%2Fsmilebasic.com%2Fdebug%2Farchive%2F here.]
Exploited by Zoogie
|-
| The Legend of Zelda: Tri Force Heroes
| [[3DS_System_Flaws#General.2FCTRSDK|CTRSDK]] CTPK buffer overflow combined with game's usage of SpotPass
| During the very first screen displayed by the game during boot("Loading..."), just seconds after title launch, the game loads CTPK from the [[BOSS_Services|stored]] SpotPass content. Hence, this game could be exploited via the vulnerable CTRSDK CTPK code ''if'' one could get custom SpotPass data into extdata somehow(ctr-httpwn >=v1.2 with bosshaxx allows this).

The code for this runs from a thread separate from the main-thread, with the stack in linearmem heap. This SpotPass handling triggers before the game ever opens the regular savedata archive. The extdata is opened at some point before this: it opens a file for checking if it exists, then immediately closes it.

The two SpotPass URLs for this have always(?) returned HTTP 404 as of November 2016. It appears these were intended for use as textures for additional costumes(and never got used publicly), but this wasn't tested.

This is used by [https://github.com/yellows8/ctpkpwn ctpkpwn_tfh].
| None
| App: v2.1.0
| November 18, 2016
| November 14, 2016
| [[User:Yellows8|Yellows8]]
|-
| Pixel Paint
| Buffer overflow via unchecked extdata file length
| Pixel Paint loads pictures saved by the user from extdatas. The file is read to a fixed size buffer but the file length remains unchecked, so with a large enough file, one can overwrite pointers in memory and gain control of the execution flow.
| None
| App: Initial version. System: [[11.2.0-35]].
| December 27, 2016
| November 5, 2016
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| Steel Diver : Sub Wars
| Heap overflow / arbitrary memcpy
| Savefile datas are stored as key/value pairs, a large enough string key makes the game overwrite a memcpy source/destination addresses and size arguments. So one can actually memcpy a rop on the stack and gain control of the execution flow.
| None
| System: [[11.2.0-35]].
| December 27, 2016
| Around July 15, 2016
| [[User:Nba_Yoh|MrNbaYoh]], Vegaroxas
|-
| 1001 Spikes
| Buffer overflow via unchecked array-indexes in XML savefile parsing
| The savefiles are stored as renamed .xml files, which contain several tags with attributes like 'array-index="array-value"', where both of these are converted from ASCII strings to integers as signed-int32, and the array-value given blindly written to an array inside a structure using the (unchecked) index given. With several of these attributes, one can overwrite the stack starting from the stored lr of the function that does this parsing, and write a ROP chain there. Testing used the "LevelAttempts" tag which is the last such tag parsed in that function.
| None
| App: v1.2.0 (TMD v2096)
| December 27, 2016
| Around November 2, 2016
| [[User:Riley|Riley]]
|-
| Pokemon Omega Ruby/Alpha Sapphire
| Secret base team name heap overflow
| When the player wants to edit the team name, it is copied over the heap, however its length is not verified. So with a large enough team name one can overwrite some pointers and get two arbitrary jumps and then get control of the execution flow.
| None
| App: 1.4. System: [[11.2.0-35]].
| December 30, 2016
| June, 2016
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| Swapdoodle
| Heap buffer overflow via unchecked size
| The letter file format used by doodlebomb is composed of multiple chunks. Each chunks is described in the header of the file where the name, size and CRC of each chunk are stored. Some chunks are meant to be headers, every header's size should be 0x80, however the length of the STAHED1 chunk remains unchecked and the game memcpy the chunk to a 0x80 byte buffer with the length provided in the file. This way one is able to overwrite some pointers and get control of the execution flow.
| App: > v1.1.1
| App: v1.1.1
| April 24, 2017
| February, 2017
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| Pokemon Picross
| Arbitrary memcpy via unchecked size
| When reading the savefile, the game handles some lists of buffers that are copied to memory. These buffers should always be 0x14-bytes long but the game uses the size provided in the savefile to copy them. These buffers are copied in some structs and thus with a big enough length value, one can overwrite the next struct which contains a size and a destination address for a memcpy.
| None?
| App: ?
| May 29, 2017
| June, 2016
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| RPG Maker Fes/Player
| Buffer overflow on .bss section
| When loading a project, the game copies multiple chunks over the BSS section. However the number of chunks to copy is not checked, thus a large amount of chunk result in a buffer overflow. There's multiple way to exploit this flaw to gain an arbitrary memcpy or an arbitrary jump.
| None?
| App: ?
| August 28, 2017
| August, 2017
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| RPG Maker Fes/Player
| Buffer overflow via unchecked file size
| When loading a project, the game loads the file to a 0x200000 bytes long buffer. However the size remains unchecked, so with a big enough file one can overflow the buffer and overwrite a thread stack and then achieve ROP.
| None?
| App: ?
| August 29, 2017
| August, 2017
| [[User:Nba_Yoh|MrNbaYoh]], [[User: ChampionLeake|ChampionLeake]]
|-
| Pokemon Omega Ruby/Alpha Sapphire
| PSS data heap/stack overflow
| When launching the game, multiple chunks from the save file are parsed and copied to a large heap buffer. When parsing PSS data (acquaintances, passerby) the game copies each entry to the heap buffer, the number of entries to copy is read from the end of the multiple pss data chunks and is not checked, leading to an overflow. The "PSS data - friends" chunk is vulnerable too, but the overflow occurs on the stack and unfortunately this isn't exploitable because of a 4 bytes uncontrolled value (in each entry) that gets written on sensitive data.
| None
| App: 1.4. System: [[11.6.0]].
| October 1, 2017
| June, 2016
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| RPG Maker Fes/Player
| OOB write
| When handling events in a map, the indices of "buttons" are not checked. This results in an out of bound bit write, one can thus write a rop directly on the stack (bit by bit).
| None?
| App: ?
| August 5, 2018
|
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| Unholy Heights
| Buffer overflow via unchecked string size
| The game stores some utf-16 messages in the savefile. Right before the message is the length(u32) for the string, the game uses this size to memcpy the message from the savefile to the stack without checking the length. This allows one to overwrite some function addresses on the stack and form a rop chain.
| None
| App: Initial Version
| September 13, 2018
| August, 2018
| Kartik
|-
| Mononoke Forest
| String Buffer Overflow via unchecked string length
| The game stores plaintext profile names in the savefile. The profile names are strcpy/memcpy to different areas of the game's functions in the stack. Using a large extensive profile name, a user can overwrite some stack-registers and point to stack buffer addresses to eventually gain control of the stack to lead and form a rop-chain.
| None
| App: v1.0.0
| August 14, 2019
| February 8, 2019
| [[User: ChampionLeake|ChampionLeake]] and [[User: Kartik|Kartik]]
|-
| Picross 3D: Round 2
| Out of bounds array access allowing to point to fabricated objects and vtable
| Game only checks save header. With the last interacted save slot index at +0xb270 in the save data unchecked we can achieve a predictable out of bounds access, as well inserting ROP data without detecting save corruption. Game references an object from an array of 3 elements and passes it to a function that will read object pointers and hit a vtable call. With a copy save data left in memory and a properly calculated index, we can point to a fake object position in the save, vtable jump to a stack pivot and start the ROP chain.
| None
| App: Initial version
| September 10, 2020
| August 24, 2020
| [[User: Luigoalma|Luigoalma]] and [[User: Kartik|Kartik]]
|}

==Flipnote Studio 3D==

{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in app/system version
! Timeframe info related to this was added to wiki
! Flaw discovered by
|-
| KFH frame count overflow
| The KFH frame count field should not be >= 0x3E8, but it wasn't checked and so uncontrolled data were written over pointers, causing an unexploitable crash.
| System: 11.6
| September 20, 2017
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| KMI paper color overflow
| Paper color field (and similar color fields) in KMI chunks was not checked, a too high value caused a jump to an uncontrolled location.
| System: 11.6
| September 20, 2017
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| KSN BGM data size overflow
| The size of the BGM data in the KSN chunk was not checked, it was used in a memcpy so with a big enough size one could overwrite a thread stack on linear mem and achieve ROP (notehax v1).
| System: 11.6
| September 20, 2017
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| KMC chunk unchecked
| The KMC chunk was not verified at all, the CRC32 and the size were not checked. A big enough size caused an integer overflow and made the game read the file backward.
| System: 11.6
| September 20, 2017
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| KMI layer size unchecked
| The 3 layer size fields in KMI chunks were not checked, leading to some crashes in the editor.
| System: 11.6
| September 20, 2017
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| Bad "queue" implementation
| When a KWZ was parsed, frames were copied in a kind of queue, bounds were not checked obviously, so with the KMI layer size flaw one was able to fill completely the queue, then write past the buffer and overwrite a heap chunk header (notehax v2). This is not possible anymore, the queue cannot be filled because layer sizes are checked. Moreover each time an element is removed from the queue, the whole content is memmoved *facepalm*.
| System: 11.6
| September 20, 2017
| [[User:Nba_Yoh|MrNbaYoh]]
|}

==Useless crashes / applications which were fuzzed==
* Pushmo (3DSWare), QR codes: level name is properly limited to 16 characters, game doesn't crash with a longer name. The only possible crashes are triggered by out-of-bounds array index values, these crashes are not exploitable due to the index value being 8bit.

* [[Pyramids (3DSWare)]], QR codes: no strings. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.

* [[Pyramids 2 (3DSWare)]], QR codes: no strings. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.

* [https://github.com/yellows8/mm3d_re The Legend of Zelda: Majora's Mask 3D]

* "The Legend of Zelda: A Link Between Worlds" and "The Legend of Zelda: Tri Force Heroes": these games don't crash at all when the entire save-file(minus constant header data) is overwritten with /dev/random output / 0xFF-bytes. All of the CRC32s were updated for this of course. Note that this refers to the regular save file: Tri Force Heroes can be exploited via BOSS extdata - see above.

* Pokemon Mystery Dungeon: Gates to Infinity has the same unchecked file bounds as Pokemon Super Mystery Dungeon, however since save compression was introduced in Pokemon Super Mystery Dungeon, it only allocates one buffer within the application heap instead of several within the linear heap, resulting in nothing to corrupt or overwrite even if the file's length is extended past its allocation.

* "Kid Icarus: Uprising": Overwriting the entire savedata results in various crashes, nothing useful.

* Savedata/extdata for "Super Smash Bros 3DS": Overwriting the various files stored under savedata/extdata results in useless crashes.

* "StarFox 64 3D": Doesn't crash at all with the entire savedata overwritten.

* "Frogger 3D": Overwriting a savefile with random-data results in *nothing* crashing.

* "Mutant Mudds": Overwriting the savefile with random data results in a crash

* "Worcle Worlds": Overwriting the savefile with 0xFF results in a crash due to an out of bound read

* "Animal Crossing: New Leaf": Creating a QR code from random data results in a valid QR code and a random design. In some very rare cases(which aren't always reproducible?) a crash/etc may occur, but this isn't known to be useful.

* "Angry Birds Star Wars": Strings in the savefile are preceded by their lengths. These strings are never stored on the stack and are memcpy'd into heap memory. If the size is invalid the alloc will fail and thus the memcpy will operate on a nullptr resulting in a useless data abort.

* "Gem Smashers": Overwriting the savefile with random bytes results in useless crashes.

* "Luxor:" Strings/plaintext in the savefile are present and these's no checks. Overwriting the whole save (excluding the header), with /dev/random cause a useless crash.

* "Luv Me Buddies Wonderland:" Doesn't crash at all with the entire savedata overwritten. Overwriting some areas, points to useless nulls

==Crashes needing investigation==
* Disney Infinity crashes when all savedata overwritten with /dev/urandom. No checksums. 0xFF bytes don't cause a crash.

* Football Up Online / Soccer Up Online and Football Up 3D / Soccer Up 3D crash when teamname(UTF-16) length = 0x48 AND 0x20 null bytes are removed after just the name or if teamname length is way longer than 0x48.

=System applications=
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in version
! Last version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| 3DS [[System Settings]] DS profile string stack-smash
| Too long or corrupted strings (01Ah 2 Nickname length in characters 050h 2 Message length in characters) in the NVRAM DS user settings (System Settings->Other Settings->Profile->Nintendo DS Profile) cause it to crash in 3DS-mode due to a stack-smash. The DSi is not vulnerable to this, DSi launcher(menu) and DSi System Settings will reset the NVRAM user-settings if the length field values are too long(same result as when the CRCs are invalid). TWL_FIRM also resets the NVRAM user-settings when the string-length(s) are too long.
| [[7.0.0-13]]
| [[7.0.0-13]]
| 2012
| [[User:Ichfly|Ichfly]]
|-
| 3DS [[System Settings]] stack smash via title strings in [[DSiWare_Exports]]
| DSiWare export banners contain 16 consecutive 0x100 byte, utf-16 game title strings for different languages. Nintendo correctly limits the string's max length by placing a NULL at str[127] before it's copied to the stack. However, they didn't allocate enough space for all 128 wchars (char/wchar type confusion?), so an attacker can craft a valid full-length string that will crash the stack at about str+0xEC. ROP execution can then be obtained from this crash in DSiWare Data Management as demonstrated [https://github.com/zoogie/Bannerbomb3 here].

Interesting note: A line feed wchar (00 0A) at any point in the string before the crash offset will prevent the crash from occurring.
| None
| [[11.13.0-45]]
| Dec. 2018
| Zoogie
|-
| 3DS SAFE_MODE [https://www.3dbrew.org/wiki/System_Settings#System_Updater System Updater] stack smash from proxy-url string
| During [[Recovery Mode]] and after all 3 wifi slots fail to find an access point for sysupdate, a user is permitted to access the wifi settings mode to make changes. Here, if the proxy-url field string's NULL terminator had been altered beforehand, a stack smash can occur when the user selects Proxy Settings -> Detailed Setup and the corrupted url string is displayed.

This is a difficult crash to control because the url string is converted from ascii to utf-16 between the slot and stack, effectively reducing the available gadgets to 0.4% of the normal amount. It's possible to improvise an "escape" using an eoreq pc w/shift gadget to combine registers and form a jump that can access 1/2 of all available gadgets.

Because this exploit runs *under* SAFE_MODE, it's possible to run safehax with one's choice of k11 and arm9 hax. Prerequisite: a userland exploit with cfg:s/i access to modify the wifi slot. A demonstration can be viewed [https://github.com/zoogie/unSAFE_MODE here].
| None
| [[11.13.0-45]]
| Jan. 2020
| Zoogie
|-
| [[Nintendo 3DS Sound]]
| When a .m4a is loaded, the song name is copied to a 256 byte buffer. When the song name begins with a Unicode BOM marker, it memcpy's the tag using the user-provided length. This gives an arbitrary write which can be used to achieve ROP.
| [[11.4.0-37]]
| [[11.4.0-37]]
| June/July 2016
| [[User:nedwill|nedwill]]
|}

=System applets=
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in version
! Last version this flaw was checked for
! Introduced with version
! Timeframe info related to this was added to wiki
! Timeframe this was discovered
! Discovered by
|-
| Webkit/web-browser bugs
| spider has had at least three different code-execution exploits. Majority of them are use-after-free issues. See also [[browserhax|here]].
|
|
|
| 2013?
|
| A lot of people.
|-
| Old3DS/New3DS [[Internet_Browser|Browser-version-check]] bypass
| When the browser-version-check code runs where the savedata for it was never initialized(such as when the user used the "Initialize savedata" option), it will use base_timestamp=0 instead of the timestamp loaded from savedata. This is then used with "if(cur_timestamp - base_timestamp >= <24h timestamp>){Run browser-version-check HTTPS request code}".
Hence, if the savedata was just initialized, and if the system datetime is set to before January 2, 2000, the browser-version-check will be skipped. This includes January 1, 2000, 00:00, because that's the epoch(timestamp value 0x0) used with this timestamp.

See [http://yls8.mtheall.com/3dsbrowserhax.php here] for bypass usage instructions.

This was fixed with [[10.7.0-32|10.7.0-32]], see [[Internet_Browser|here]] for details.
| [[10.7.0-32|10.7.0-32]]
|
| [[9.9.0-26|9.9.0-26]]
| February 25, 2016
| November 2, 2015 (Exactly one week after the browser version pages were initially updated server-side)
| [[User:Yellows8|Yellows8]]
|-
| Skater - Bookmark OOB write
| Each bookmark has an id that should not exceed 0x63 (99), however ids are not checked, this results in an OOB write on the stack, but only the value 0x01 can be written.
|
| [[11.6.0-39|11.6.0-39]]
|
| May 21, 2018
| May 20, 2018
| [[User:Nba_Yoh|MrNbaYoh]]
|-
| MicroSD Management - malformed security blob causes stack buffer overflow (mhax)
| The MicroSD Management application's parsing of Windows NTLM security blobs in the SMB/CIFS protocol doesn't verify that the client's specified NT domain name is less than 32 UTF-16 characters. When it's longer, a stack buffer overrun occurs, leading to a ROP chain and complete control of the mcopy application.

The malformed security blob can be sent by an attacker within the SMB_COM_SESSION_SETUP_ANDX (0x73) packet.
| [[11.8.0-41|11.8.0-41]]
| [[11.8.0-41|11.8.0-41]]
| [[9.0.0-20|9.0.0-20]]
| August 12, 2018
| 2018
| smea
|}

==Home Menu==
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in version
! Last version this flaw was checked for
! Introduced with version
! Timeframe info related to this was added to wiki
! Timeframe this was discovered
! Discovered by
|-
| bossbannerhax
| After successfully loading [[Extended_Banner|extended-banner]] data(done when selecting an icon), Home Menu attempts to load "[[CBMD]]" data into a 0x100000-byte heap buffer from the [[BOSS_Services|stored]] SpotPass content. When successful and the magic-number is CBMD, Home Menu then decompresses the exbanner sections into another fixed-size heap buffer, without checking the outsize at all. The main CBMD CGFX code with ExeFS checks the size, but this code doesn't(however this is exbanner "CBMD", not a "normal" CBMD).

Used with menuhax as of v3.2.
| [[11.3.0-36|11.3.0-X]]
|
| [[1.0.0-0|1.0.0-0]]
| November 18, 2016
| December 23, 2014
| [[User:Yellows8|Yellows8]]
|-
| sdiconhax
| This is basically the same as nandiconhax, the vulnerable SD/NAND functions are ''identical'' minus the file-buffer offsets. Exploitation is different due to different heap-buffer location though. Unlike nandiconhax, the icon buffer for SD is located in linearmem(with recent Home Menu versions at least). This is used by [[menuhax]].
| [[11.1.0-34|11.1.0-X]]
|
| [[4.0.0-7|4.0.0-X]]
| July 27, 2016
| October 23, 2015
| [[User:Yellows8|Yellows8]]
|-
| [[System_SaveData|NAND-savedata]] Launcher.dat icons (nandiconhax)
| The homemenu code processing the titleid list @ launcherdat+8 copies those titleIDs to another buffer, where the offset relative to that buffer is calculated using the corresponding s8/s16 entries. Those two values are not range checked at all. Hence, one can use this to write u64(s) with arbitrary values to before/after this allocated output buffer. See [[Home_Menu|here]] regarding Launcher.dat structure.

This can be exploited(with Launcher.dat loading at startup at least) by using a s16 for the icon entry with value 0xFFEC(-20)(and perhaps more icons with similar s16 values to write multiple u64s). The result is that the u64 value is written to outbuf-0xA0, which overwrites object+0(vtable) and object+4(doesn't matter here) for an object that gets used a bit after the vulnerable function triggers. The low 32bits of the u64 can then be set to the address of controlled memory(either outbuf in regular heap or the entire launcherdat buffer in linearmem), for use as a fake vtable in order to get control of PC. From there one can begin ROP via vtable funcptrs to do a stack-pivot(r4=objectaddr at the time the above object gets used).

Originally this vuln could only be triggered via Launcher.dat at Home Menu startup, right after Launcher.dat gets loaded + memory gets allocated, once the file-format version code is finished running. Starting with v9.6 this can be triggered when loading layouts from SD extdata as well. The vuln itself triggers before the layout data is written to Launcher.dat, but it doesn't seem to be possible to overwrite anything which actually gets used before the function which writes Launcher.dat into the layout gets called.

Home Menu has some sort of fail-safe system(or at least on v9.7) when Home Menu crashes due to Launcher.dat(this also applies for other things with Home Menu): after crashing once, Home Menu resets Launcher.dat to a state where it no longer crashes anymore. However, note that any exploits using this which hang/etc without crashing will still brick the system. '''Hence, attempting anything with this on physnand without hw-nand-access isn't really recommended.'''
| [[11.1.0-34|11.1.0-X]]
|
| [[4.0.0-7|4.0.0-X]]
|
| May 14, 2015
| [[User:Yellows8|Yellows8]]
|-
| Theme-data decompression buffer overflow ([[menuhax|themehax]])
| The only func-call size parameter used by the theme decompression function is one for the compressed size, none for the decompressed size. The decompressed-size value from the LZ header is used by this function to check when to stop decompressing, but this function itself has nothing to verify the decompressed_size with. The code calling this function does not check or even use the decompressed size from the header either.

This function is separate from the rest of the Home Menu code: the function used for decompressing themes is *only* used for decompressing themes, nothing else. There's a separate decompression function in Home Menu used for decompressing everything else.

That other decompression function in Home Menu handles decompression size properly(decompressed size check for max buffer size is done by code calling the other function, not in the function itself). Unlike the other function, the theme function supports multiple LZ algorithms, but the one which actually gets used in official themes is the same one supported by the other function anyway.

See also [[menuhax|here]].

With [[10.2.0-28|10.2.0-X]] Home Menu, the only code change was that the following was added right after theme-load and before actual decompression: "if(<get_lzheader_decompressed_size>(compressed_buf) > 0x150000)<exit>;". This fixed the vuln.
| [[10.2.0-28|10.2.0-X]]
| [[10.2.0-28|10.2.0-X]]
| <Old3DS/New3DS version which added initial theme support>
|
| December 22, 2014
| [[User:Yellows8|Yellows8]], [[User:Myria|Myria]] independently (~spring 2015)
|-
| Shuffle body-data buffer overflow ([[menuhax|shufflehax]])
| See [[menuhax|here]].
| [[10.6.0-31|10.6.0-X]]
| [[10.6.0-31|10.6.0-X]]
| [[9.3.0-21|9.3.0-X]]
|
| January 3, 2015
| [[User:Yellows8|Yellows8]]
|-
| Extdata file-data loading buffer overflow
| The extdata file-reading code allocates a fixed-size heap buffer for the expected filesize, then reads the filedata into this buffer using the actual FS filesize. Before v5.0 the filesize used here wasn't validated, hence if the filesize is larger than alloc_size a buffer overflow would occur. ''After'' doing the file-read it does validate that the actual_readsize matches the alloc_size, but at this point the buffer overflow has already occurred.

This affected at least the following: SaveData.dat and Cache.dat.

This can be triggered with SaveData.dat by installing a <v4.0 Home Menu version, with Home Menu extdata from >=v4.0 still on SD. When this is done with v2.0 Home Menu, a kernelpanic occurs when processing an AM command(it appears a buffer ptr which is then passed to a command was overwritten with 0x0 - of course other SaveData.dat filesizes may result in different behaviour).
| [[5.0.0-11|5.0.0-X]]
|
| [[2.0.0-2|2.0.0-X]]
| June 9, 2016
| June 9, 2016
| [[User:Yellows8|Yellows8]]
|}

The icon data arrays used with {sd/nand}iconhax were added to SaveData.dat/Launcher.dat with [[4.0.0-7|4.0.0-X]], hence the vulnerable functions were added with that same version.

With <=v4.0 the SaveData.dat buffer is located in the regular heap. It's unknown when exactly it was moved to linearmem, which is where it's located with recent versions. It's located in linearmem for KOR >=v9.6 for example.

The SaveData.dat/Launcher.dat icon vulns were fixed by doing various unsigned >=60/>=360 checks on the loaded values. When these checks fail, it just skips over handling this icon entry. Hence, the original value can't be negative / out-of-bounds any more.

==Useless crashes==
Old3DS system web-browser:
* 2^32 characters long string(''finally'' fixed with v10.6): this is similar to the vulnerability fixed [http://git.chromium.org/gitweb/?p=external/Webkit.git;a=commitdiff;h=ec471f16fbd1f879cb631f9b022fd16acd75f4d4 here], concat-large-strings-crash2.html triggers a crash which is about the same as the one triggered by a 2^32 string. Most of the time this vulnerability will cause a memory page permissions fault, since the WebKit code attempts to copy the string text data to the output buffer located in read-only [[CRO0|CRO]] heap memory. The only difference between a crash triggered by a 2^32 string and the concat-large-strings-crash2.html crash is at the former copies the string data using the original string length(like 1 text character for "x", 4 for "xxxx") while the latter attempts to copy >12MB. In some ''very'' rare cases a thread separate from the string data-copy thread will crash, this might be exploitable. However, this is mostly useless since it rarely crashes this way.

* Trying to directly load a page via the browser "URL" option with [https://github.com/yellows8/3ds_browserhax_common webkitdebug] setup, causes a crash to trigger in oss.cro due to an use-after-free being caught with webkitdebug. This is presumably some sort of realloc() issue in the libcurl version used by the <={v10.2-v10.3} browser. This happens with *every* *single* *page* one tries to load via the "URL" option, but not when loading links on the current page, hence this is probably useless. A different use-after-free with realloc triggers with loading any page at all regardless of method too(libcurl probably).

* This WebKit build has ''a lot'' of crash-trigger bugs that only happen with [https://github.com/yellows8/3ds_browserhax_common webkitdebug] completely setup(addr accesses near 0x0), with ''just'' trying to load any page at all.

Certificates

2020-08-06T16:34:47Z

Luigoalma: Unknown parameter has use on CTCert Certificates

== Overview ==
Certificates contain cryptography information for verifying Signatures. These certificates are also signed. The parent/child relationship between certificates, makes all the certificates effectively signed by 'Root', the public key for which is stored in NATIVE_FIRM.

== Format ==

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Signature Type
|-
| 0x4
| X
| Signature with Padding (aligning next data to 0x40 bytes)
|-
| 0x4 + X
| 0x40
| Issuer
|-
| 0x44 + X
| 0x4
| Key Type
|-
| 0x48 + X
| 0x40
| Name
|-
| 0x88 + X
| 0x4
| Expiration time as UNIX Timestamp, used at least for [[CTCert]]
|-
| 0x8C + X
| *
| Public Key
|}

== Signature ==

The signature method used to sign the certificate can be determined by checking the Signature Type:
{{Signature Types}}

The hash for the signature is calculated over the actual certificate data(from the start of the "Issuer", to the end of the "Public Key", aligned to 0x40 bytes).

== Public Key ==

Determining the type of public key stored, is done by checking the key type:

{| class="wikitable"
|-
! Value
! Key Type
|-
| 0x0
| RSA_4096
|-
| 0x1
| RSA_2048
|-
| 0x2
| Elliptic Curve
|}
=== RSA ===
This contains the Public Key(i.e. Modulus & Public Exponent)

==== 4096 Bit ====
{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x200
| Modulus
|-
| 0x200
| 0x4
| Public Exponent
|-
| 0x204
| 0x34
| Padding
|}

==== 2048 Bit ====
{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Modulus
|-
| 0x100
| 0x4
| Public Exponent
|-
| 0x104
| 0x34
| Padding
|}

=== ECC ===
This contains the ECC public key, and is as follows:

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3C
| Public Key
|-
| 0x3C
| 0x3C
| Padding
|}

CTCert

2020-08-06T16:33:48Z

Luigoalma: Found while digging the Process9 binary executable, function generating a CTCert can be found using OTP registers.

=Summary=
The console-unique CTCert is used for signing [[Title Data Structure|CTX]] files, the DeviceCert used by [[eShop]], and for [[DSiWare_Exports|DSiWare]] exports. This ECDSA signature, the ECDSA private key for this cert, and the IssuerID is loaded from memory initialized by bootrom instead of NAND. This is the 3DS equivalent of the DSi TWCert.

The CTCert is signed with ECDSA by Nintendo. CTCerts can be verified via a DER stored in NATIVE_FIRM, separate DERs are used for retail and dev/debug.

=Structure=
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[Certificates|Signature]] Type, 0x010005.
|-
| 0x04
| 0x3C
| ECDSA Signature
|-
| 0x40
| 0x40
| Padding
|-
| 0x80
| 0x40
| Cert Issuer ID, for retail this is "Nintendo CA - G3_NintendoCTR2prod", for dev "Nintendo CA - G3_NintendoCTR2dev"
|-
| 0xC0
| 0x04
| Key Type
|-
| 0xC4
| 0x40
| Key ID: "CT<DeviceId>-<ConsoleType>", where DeviceId is the hex [[PSPXI:GetDeviceId|DeviceId]], and ConsoleType is 00 for retail, 01 for dev
|-
| 0x104
| 0x04
| Expiration time as UNIX Timestamp in big endian.
|-
| 0x108
| 0x3C
| ECDSA Public Key. This is two consecutive u8 arrays (each one of length 0x1E), where the first one corresponds to the ECDSA R coordinate, and the second to ECDSA S coordinate. These are in '''big''' endian.
|-
| 0x144
| 0x3C
| Padding
|}

The ECDSA public key for this cert is converted from the ECDSA private key initialized by bootrom.
The curve used for ECDSA is sect233r1.

AMNet:Sign

2020-08-04T15:14:13Z

Luigoalma: Added information about the IPC, based on the behavior found in the NIM's binary executable.

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x08160146]
|-
| 1
|0x3C (Signature output size)
|-
| 2
|0x180 (Certificate output size)
|-
| 3-4
| u64, Title id
|-
| 5
|Data input size
|-
| 6
| (Input size << 4) <nowiki>|</nowiki> 0xA
|-
| 7
|Data input pointer
|-
| 8
| (0x3C << 4) <nowiki>|</nowiki> 0xC
|-
| 9
|Signature output pointer
|-
| 10
| (0x180 << 4) <nowiki>|</nowiki> 0xC
|-
| 11
|Certificate output pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
|AM internal error value (? Treated like an error value by NIM)
|}

=Description=
Signs given data with ECC, returning generated signature and [[Certificates|certificate]].

Certificate is signed with ECDSA with SHA256 and holds an ECC public key.
Signed with the [[AMNet:GetDeviceCert|device certificate]].
ECC public key on certificate appears to be randomly generated on call(?).

Used by NIM to sign a message that's not sent over SOAP, however the device certificate, output signature and output certificate of the message are.

Config Savegame

2020-04-27T13:09:07Z

Luigoalma:

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Flags
|}

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD)
|-
| 0x00030002
| 0x8
| 0xC
| ?
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]]
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
| 0x000A0000
| 0x1C
| 0xE
| Username in UTF16
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| ? Contains the email address set during Parental Restriction setup.
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to.
|-
| 0x000E0000
| 0x1
| 0xE
| ?
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| ?
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| ?
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info
|-
| 0x00100002
| 0x1
| 0xC
| ?
|-
| 0x00100003
| 0x10
| 0xC
| ?
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| ?
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental control Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x20
| Secret answer in UTF-16
|}

===Parental Control setting block 0xC0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control restriction bitmask|Parental Control restriction bitmask]]
|-
| 0x0C
| 0x04
| Parental Controls PIN code
|}

====Parental Control restriction bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls enable
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Internet Browser
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 8
| eShop
|-
| 10
| Miiverse (view)
|-
| 11
| Miiverse (post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

Ticket

2019-10-13T22:42:49Z

Luigoalma: Content Index doesn't have a fixed size.

[[Category:File formats]]
Tickets are a format used to store an encrypted titlekey (using 128-Bit AES-CBC). With 3DS, the Ticket format was updated (now v1) from Wii/DSi format (v0).

== Structure ==

All of the data in the file is represented in Big Endian.

{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x000||Y||Signature Data
|-
| Y||0x210||Ticket Data
|}

Y denotes the total size of the "Signature Data" section and depends on the signature type.

=== Signature Data ===
The signature is of the ticket header.
{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x0||0x4||Signature Type
|-
| 0x4 ||X||Signature
|-
| 0x4 + X|| ||Padding to align the signature data to 0x40 bytes
|}

==== Signature Type ====
{{Signature Types}}

The hash for the signature is calculated over the Ticket Data.

=== Ticket Data ===
{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x0||0x40||Issuer
|-
| 0x40||0x3C||ECC PublicKey
|-
| 0x7C||0x1||Version (For 3DS this is always 1)
|-
| 0x7D||0x1||CaCrlVersion
|-
| 0x7E||0x1||SignerCrlVersion
|-
| 0x7F||0x10||TitleKey (normal-key encrypted using one of the common keyYs; see below)
|-
| 0x8F||0x1||Reserved
|-
| 0x90||0x8||TicketID
|-
| 0x98||0x4||ConsoleID
|-
| 0x9C||0x8||TitleID
|-
| 0xA4||0x2||Reserved
|-
| 0xA6||0x2||Ticket title version
|-
| 0xA8||0x8||Reserved
|-
| 0xB0||0x1||License Type
|-
| 0xB1||0x1||Index to the common [[AES|keyY]] used for this ticket, usually 0x1 for retail system titles; see below.
|-
| 0xB2||0x2A||Reserved
|-
| 0xDC||0x4||eShop Account ID?
|-
| 0xE0||0x1||Reserved
|-
| 0xE1||0x1||Audit
|-
| 0xE2||0x42||Reserved
|-
| 0x124||0x40||Limits
|-
| 0x164||X||Content Index
|}

* For v0 of the format, see [[Talk:Ticket#Ticket_Format_0|here]]

* The Ticket Title Version is generally the same as the title version stored in the [[TMD|Title Metadata]]. Although it doesn't have to match the TMD version to be valid.

* The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot. The keyY is selected through an index (ticket offset 0xB1) into a plaintext array of 6 keys ("common keyYs") stored in the data section of Process9. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key. (On retail for these keyYs, the hardware key-scrambler is used)

* The titlekey is used to decrypt content downloaded from the CDN using 128-bit AES-CBC with the content index (as big endian u16, padded with trailing zeroes) as the IV.

* In demos, the first u32 in the "Limits" section is 0x4, then the second u32 is the max-playcount.

* The Content Index of a ticket has its own size defined within itself, with seemingly a minimal of 20 bytes, the second u32 in big endian defines the full value of X.

== Certificate Chain ==
Tickets retrieved from CDN/SOAP have a [[Certificates|certificate]] chain appended at the end of the file. There are two certificates in this chain:

{| class="wikitable" border="1"
|-
! CERTIFICATE
! SIGNATURE TYPE
! RETAIL CERT NAME
! DEBUG CERT NAME
! DESCRIPTION
|-
| Ticket
| RSA-2048
| XS0000000c
| XS00000009
| Used to verify the Ticket signature
|-
| CA
| RSA-4096
| CA00000003
| CA00000004
| Used to verify the Ticket Certificate
|}

The CA certificate is issued by 'Root', the public key for which is stored in NATIVE_FIRM.

== Some facts==
* '''CommonETicket''' (for short, '''cetk''') is the name given to tickets for titles which are not available on the [[EShop|eShop]], like [[Title list#CTR System Titles|system titles]]. As the name suggests, they are not unique tickets, the same ticket is common to each 3ds which has installed that title. This is in contrast to tickets for eShop content, which are generated prior to initial download, and are unique to 3ds it was generated for.

* '''CETK''' can be fetched through HTTP using the link to default update server, using the title's [[TMD]] URL where "cetk" is used instead of "tmd" for the URL. The 3DS NIM module retrieves system tickets via SOAP request ''GetSystemCommonETicket'' instead of directly downloading the cetks with HTTPS. The cetks are also accessible via HTTP (even though the 3DS never accesses them like that).